Fix binding of null pointer dereference to reference type

core/fxcrt/include/fx_basic.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_FXCRT_INCLUDE_FX_BASIC_H_
 #define CORE_FXCRT_INCLUDE_FX_BASIC_H_
 
 #include <algorithm>
@@ skipping 259 matching lines @@
   int GetSize() const { return m_nSize; }
 
   int GetUpperBound() const { return m_nSize - 1; }
 
   FX_BOOL SetSize(int nNewSize) { return CFX_BasicArray::SetSize(nNewSize); }
 
   void RemoveAll() { SetSize(0); }
 
   const TYPE GetAt(int nIndex) const {
     if (nIndex < 0 || nIndex >= m_nSize) {
-      return (const TYPE&)(*(volatile const TYPE*)NULL);
+      IMMEDIATE_CRASH();
     }
     return ((const TYPE*)m_pData)[nIndex];
   }
 
   FX_BOOL SetAt(int nIndex, TYPE newElement) {
     if (nIndex < 0 || nIndex >= m_nSize) {
       return FALSE;
     }
     ((TYPE*)m_pData)[nIndex] = newElement;
     return TRUE;
   }
 
   TYPE& ElementAt(int nIndex) {
     if (nIndex < 0 || nIndex >= m_nSize) {
-      return *(TYPE*)NULL;
+      IMMEDIATE_CRASH();
     }
     return ((TYPE*)m_pData)[nIndex];
   }
 
   const TYPE* GetData() const { return (const TYPE*)m_pData; }
 
   TYPE* GetData() { return (TYPE*)m_pData; }
 
   FX_BOOL SetAtGrow(int nIndex, TYPE newElement) {
     if (nIndex < 0)
@@ skipping 756 matching lines @@
   FX_FLOAT c;
   FX_FLOAT d;
   FX_FLOAT e;
   FX_FLOAT f;
   FX_FLOAT g;
   FX_FLOAT h;
   FX_FLOAT i;
 };
 
 #endif  // CORE_FXCRT_INCLUDE_FX_BASIC_H_