fix issue of Heap Use-After-Free in CXFA_LayoutItem::AddChild

xfa/fxfa/parser/xfa_layout_itemlayout.cpp

Index: xfa/fxfa/parser/xfa_layout_itemlayout.cpp
diff --git a/xfa/fxfa/parser/xfa_layout_itemlayout.cpp b/xfa/fxfa/parser/xfa_layout_itemlayout.cpp
index 17f97da7792eb89c10349e4d285569c5b7aef8db..4ddadf0e0ad7471d197d96423322ee5240985b21 100644
--- a/xfa/fxfa/parser/xfa_layout_itemlayout.cpp
+++ b/xfa/fxfa/parser/xfa_layout_itemlayout.cpp
@@ -546,27 +546,29 @@ void CXFA_LayoutItem::RemoveChild(CXFA_LayoutItem* pChildItem) {
 CXFA_ContentLayoutItem* CXFA_ItemLayoutProcessor::ExtractLayoutItem() {
   CXFA_ContentLayoutItem* pLayoutItem = m_pLayoutItem;
   if (pLayoutItem) {
-    m_pLayoutItem = (CXFA_ContentLayoutItem*)pLayoutItem->m_pNextSibling;
-    pLayoutItem->m_pNextSibling = NULL;
-  }
-  if (m_nCurChildNodeStage == XFA_ItemLayoutProcessorStages_Done &&
-      ToContentLayoutItem(m_pOldLayoutItem)) {
-    if (m_pOldLayoutItem->m_pPrev) {
-      m_pOldLayoutItem->m_pPrev->m_pNext = NULL;
-    }
-    CXFA_FFNotify* pNotify =
-        m_pOldLayoutItem->m_pFormNode->GetDocument()->GetParser()->GetNotify();
-    CXFA_LayoutProcessor* pDocLayout =
-        m_pOldLayoutItem->m_pFormNode->GetDocument()->GetDocLayout();
-    CXFA_ContentLayoutItem* pOldLayoutItem = m_pOldLayoutItem;
-    while (pOldLayoutItem) {
-      CXFA_ContentLayoutItem* pNextOldLayoutItem = pOldLayoutItem->m_pNext;
-      pNotify->OnLayoutItemRemoving(pDocLayout, pOldLayoutItem);
-      delete pOldLayoutItem;
-      pOldLayoutItem = pNextOldLayoutItem;
-    }
-    m_pOldLayoutItem = NULL;
+    m_pLayoutItem =
+        static_cast<CXFA_ContentLayoutItem*>(pLayoutItem->m_pNextSibling);
+    pLayoutItem->m_pNextSibling = nullptr;
   }
+  if (m_nCurChildNodeStage != XFA_ItemLayoutProcessorStages_Done ||
+      !ToContentLayoutItem(m_pOldLayoutItem))
+    return pLayoutItem;
+  if (m_pOldLayoutItem->m_pPrev)
+    m_pOldLayoutItem->m_pPrev->m_pNext = nullptr;
+  CXFA_FFNotify* pNotify =
+      m_pOldLayoutItem->m_pFormNode->GetDocument()->GetParser()->GetNotify();
+  CXFA_LayoutProcessor* pDocLayout =
+      m_pOldLayoutItem->m_pFormNode->GetDocument()->GetDocLayout();
+  CXFA_ContentLayoutItem* pOldLayoutItem = m_pOldLayoutItem;
+  while (pOldLayoutItem) {
+    CXFA_ContentLayoutItem* pNextOldLayoutItem = pOldLayoutItem->m_pNext;
+    pNotify->OnLayoutItemRemoving(pDocLayout, pOldLayoutItem);
+    if (pOldLayoutItem->m_pParent)
+      pOldLayoutItem->m_pParent->RemoveChild(pOldLayoutItem);
+    delete pOldLayoutItem;
+    pOldLayoutItem = pNextOldLayoutItem;
+  }
+  m_pOldLayoutItem = nullptr;
   return pLayoutItem;
 }
 static FX_BOOL XFA_ItemLayoutProcessor_FindBreakNode(