Fix the problem that memory is accessed after released due to invalid type-cast

core/src/fpdfdoc/doc_tagged.cpp

Index: core/src/fpdfdoc/doc_tagged.cpp
diff --git a/core/src/fpdfdoc/doc_tagged.cpp b/core/src/fpdfdoc/doc_tagged.cpp
index 551042037bef6b4d82598d443f8ce69127eef7e5..698157356c228fda50755f84945d36dbe4e038ab 100644
--- a/core/src/fpdfdoc/doc_tagged.cpp
+++ b/core/src/fpdfdoc/doc_tagged.cpp
@@ -192,8 +192,11 @@ FX_BOOL CPDF_StructTreeImpl::AddTopLevelNode(CPDF_Dictionary* pDict, CPDF_Struct
         FX_DWORD i;
         FX_BOOL bSave = FALSE;
         for (i = 0; i < pTopKids->GetCount(); i ++) {
-            CPDF_Reference* pKidRef = (CPDF_Reference*)pTopKids->GetElement(i);
-            if (pKidRef->GetType() != PDFOBJ_REFERENCE || pKidRef->GetRefObjNum() != pDict->GetObjNum()) {
+            CPDF_Object* pKidRef = pTopKids->GetElement(i);
+            if (pKidRef == NULL || pKidRef->GetType() != PDFOBJ_REFERENCE) {
+                continue;
+            }
+            if (((CPDF_Reference*) pKidRef)->GetRefObjNum() != pDict->GetObjNum()) {
                 continue;
             }
             if (m_Kids[i]) {