Revert "Change CFX_XML Save to take a write stream"

This reverts commit 9a3a7709103a872037dcea1f3cf0b7785a3da191.

Reason for revert: Gerrit did not do what I expected....

Original change's description:
> Change CFX_XML Save to take a write stream
> 
> This CL changes CFX_XML to use an IFX_SeekableWriteStream instead of the more
> generic IFX_SeekableStream.
> 
> Change-Id: I6e4def380c43eca755d91ad5cb6146c2dfdaee10
> Reviewed-on: https://pdfium-review.googlesource.com/30877
> Commit-Queue: dsinclair <dsinclair@chromium.org>
> Reviewed-by: Tom Sepez <tsepez@chromium.org>

TBR=tsepez@chromium.org,dsinclair@chromium.org,hnakashima@chromium.org

Change-Id: I137e53bf93285b88ade6832dedefca66e3b61e13
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://pdfium-review.googlesource.com/31211
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

19 files changed, 186 insertions, 143 deletions

diff --git a/core/fpdfdoc/cpdf_metadata.cpp b/core/fpdfdoc/cpdf_metadata.cpp
index c928952dca..161fc93edd 100644
--- a/core/fpdfdoc/cpdf_metadata.cpp
+++ b/core/fpdfdoc/cpdf_metadata.cpp
@@ -19,11 +19,12 @@ void CheckForSharedFormInternal(CFX_XMLElement* element,
                                 std::vector<UnsupportedFeature>* unsupported) {
   WideString attr = element->GetAttribute(L"xmlns:adhocwf");
   if (attr == L"http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/") {
-    for (const auto& child : *element) {
+    for (const auto* child = element->GetFirstChild(); child;
+         child = child->GetNextSibling()) {
       if (child->GetType() != FX_XMLNODE_Element)
         continue;
 
-      const auto* child_elem = static_cast<const CFX_XMLElement*>(child.get());
+      const auto* child_elem = static_cast<const CFX_XMLElement*>(child);
       if (child_elem->GetName() != L"adhocwf:workflowType")
         continue;
 
@@ -45,11 +46,12 @@ void CheckForSharedFormInternal(CFX_XMLElement* element,
     }
   }
 
-  for (const auto& child : *element) {
+  for (auto* child = element->GetFirstChild(); child;
+       child = child->GetNextSibling()) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CheckForSharedFormInternal(static_cast<CFX_XMLElement*>(child.get()),
+    CheckForSharedFormInternal(static_cast<CFX_XMLElement*>(child),
                                unsupported);
   }
 }
diff --git a/core/fxcrt/xml/cfx_xmlchardata.cpp b/core/fxcrt/xml/cfx_xmlchardata.cpp
index e62a43ac53..dec2e4618f 100644
--- a/core/fxcrt/xml/cfx_xmlchardata.cpp
+++ b/core/fxcrt/xml/cfx_xmlchardata.cpp
@@ -21,8 +21,7 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLCharData::Clone() {
   return pdfium::MakeUnique<CFX_XMLCharData>(GetText());
 }
 
-void CFX_XMLCharData::Save(
-    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
+void CFX_XMLCharData::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
   pXMLStream->WriteString("<![CDATA[");
   pXMLStream->WriteString(GetText().UTF8Encode().AsStringView());
   pXMLStream->WriteString("]]>");
diff --git a/core/fxcrt/xml/cfx_xmlchardata.h b/core/fxcrt/xml/cfx_xmlchardata.h
index 0cdc348f26..5b00597955 100644
--- a/core/fxcrt/xml/cfx_xmlchardata.h
+++ b/core/fxcrt/xml/cfx_xmlchardata.h
@@ -20,7 +20,7 @@ class CFX_XMLCharData : public CFX_XMLText {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
 };
 
 #endif  // CORE_FXCRT_XML_CFX_XMLCHARDATA_H_
diff --git a/core/fxcrt/xml/cfx_xmlelement.cpp b/core/fxcrt/xml/cfx_xmlelement.cpp
index 8c8922e0c6..5e79da63cf 100644
--- a/core/fxcrt/xml/cfx_xmlelement.cpp
+++ b/core/fxcrt/xml/cfx_xmlelement.cpp
@@ -33,9 +33,10 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLElement::Clone() {
   // TODO(dsinclair): This clone is wrong. It doesn't clone child nodes just
   // copies text nodes?
   WideString wsText;
-  for (const auto& pChild : *this) {
+  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
+       pChild = pChild->GetNextSibling()) {
     if (pChild->GetType() == FX_XMLNODE_Text)
-      wsText += static_cast<CFX_XMLText*>(pChild.get())->GetText();
+      wsText += static_cast<CFX_XMLText*>(pChild)->GetText();
   }
   pClone->SetTextData(wsText);
   return std::move(pClone);
@@ -78,10 +79,11 @@ WideString CFX_XMLElement::GetNamespaceURI() const {
 WideString CFX_XMLElement::GetTextData() const {
   CFX_WideTextBuf buffer;
 
-  for (const auto& pChild : *this) {
+  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
+       pChild = pChild->GetNextSibling()) {
     if (pChild->GetType() == FX_XMLNODE_Text ||
         pChild->GetType() == FX_XMLNODE_CharData) {
-      buffer << static_cast<CFX_XMLText*>(pChild.get())->GetText();
+      buffer << static_cast<CFX_XMLText*>(pChild)->GetText();
     }
   }
   return buffer.MakeString();
@@ -94,8 +96,7 @@ void CFX_XMLElement::SetTextData(const WideString& wsText) {
   AppendChild(pdfium::MakeUnique<CFX_XMLText>(wsText));
 }
 
-void CFX_XMLElement::Save(
-    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
+void CFX_XMLElement::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
   ByteString bsNameEncoded = name_.UTF8Encode();
 
   pXMLStream->WriteString("<");
@@ -108,16 +109,17 @@ void CFX_XMLElement::Save(
         AttributeToString(it.first, it.second).UTF8Encode().AsStringView());
   }
 
-  if (HasChildren()) {
+  if (!GetFirstChild()) {
     pXMLStream->WriteString(" />\n");
     return;
   }
 
   pXMLStream->WriteString(">\n");
 
-  for (const auto& pChild : *this)
+  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
+       pChild = pChild->GetNextSibling()) {
     pChild->Save(pXMLStream);
-
+  }
   pXMLStream->WriteString("</");
   pXMLStream->WriteString(bsNameEncoded.AsStringView());
   pXMLStream->WriteString(">\n");
@@ -130,11 +132,11 @@ CFX_XMLElement* CFX_XMLElement::GetFirstChildNamed(
 
 CFX_XMLElement* CFX_XMLElement::GetNthChildNamed(const WideStringView& name,
                                                  size_t idx) const {
-  for (const auto& child : *this) {
+  for (auto* child = GetFirstChild(); child; child = child->GetNextSibling()) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child.get());
+    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child);
     if (elem->name_ != name)
       continue;
     if (idx == 0)
diff --git a/core/fxcrt/xml/cfx_xmlelement.h b/core/fxcrt/xml/cfx_xmlelement.h
index 678ba6d996..c1d9fea3f0 100644
--- a/core/fxcrt/xml/cfx_xmlelement.h
+++ b/core/fxcrt/xml/cfx_xmlelement.h
@@ -22,7 +22,7 @@ class CFX_XMLElement : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
 
   WideString GetName() const { return name_; }
 
diff --git a/core/fxcrt/xml/cfx_xmlinstruction.cpp b/core/fxcrt/xml/cfx_xmlinstruction.cpp
index d0f5cbb68b..7b844e6808 100644
--- a/core/fxcrt/xml/cfx_xmlinstruction.cpp
+++ b/core/fxcrt/xml/cfx_xmlinstruction.cpp
@@ -40,8 +40,7 @@ bool CFX_XMLInstruction::IsAcrobat() const {
   return name_ == L"acrobat";
 }
 
-void CFX_XMLInstruction::Save(
-    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
+void CFX_XMLInstruction::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
   if (name_.CompareNoCase(L"xml") == 0) {
     pXMLStream->WriteString("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
     return;
diff --git a/core/fxcrt/xml/cfx_xmlinstruction.h b/core/fxcrt/xml/cfx_xmlinstruction.h
index 3be9d48573..045610bd8a 100644
--- a/core/fxcrt/xml/cfx_xmlinstruction.h
+++ b/core/fxcrt/xml/cfx_xmlinstruction.h
@@ -21,7 +21,7 @@ class CFX_XMLInstruction : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
 
   bool IsOriginalXFAVersion() const;
   bool IsAcrobat() const;
diff --git a/core/fxcrt/xml/cfx_xmlnode.cpp b/core/fxcrt/xml/cfx_xmlnode.cpp
index de0a4acd2f..4f811e608e 100644
--- a/core/fxcrt/xml/cfx_xmlnode.cpp
+++ b/core/fxcrt/xml/cfx_xmlnode.cpp
@@ -6,8 +6,8 @@
 
 #include "core/fxcrt/xml/cfx_xmlnode.h"
 
-#include <algorithm>
 #include <utility>
+#include <vector>
 
 #include "core/fxcrt/xml/cfx_xmlchardata.h"
 #include "core/fxcrt/xml/cfx_xmlelement.h"
@@ -22,7 +22,15 @@ CFX_XMLNode::~CFX_XMLNode() {
 }
 
 void CFX_XMLNode::DeleteChildren() {
-  children_.clear();
+  CFX_XMLNode* child = last_child_.Get();
+  // Clear last child early as it will have been deleted already.
+  last_child_ = nullptr;
+  while (child) {
+    child = child->prev_sibling_.Get();
+    if (child)
+      child->next_sibling_ = nullptr;
+  }
+  first_child_ = nullptr;
 }
 
 void CFX_XMLNode::AppendChild(std::unique_ptr<CFX_XMLNode> pNode) {
@@ -34,38 +42,63 @@ void CFX_XMLNode::InsertChildNode(std::unique_ptr<CFX_XMLNode> pNode,
   ASSERT(!pNode->parent_);
 
   pNode->parent_ = this;
-  if (static_cast<size_t>(index) >= children_.size()) {
-    if (!children_.empty())
-      children_.back()->next_sibling_ = pNode.get();
-    children_.push_back(std::move(pNode));
+  // No existing children, add node as first child.
+  if (!first_child_) {
+    ASSERT(!last_child_);
+
+    first_child_ = std::move(pNode);
+    last_child_ = first_child_.get();
+    first_child_->prev_sibling_ = nullptr;
+    first_child_->next_sibling_ = nullptr;
+    return;
+  }
+
+  if (index == 0) {
+    first_child_->prev_sibling_ = pNode.get();
+    pNode->next_sibling_ = std::move(first_child_);
+    pNode->prev_sibling_ = nullptr;
+    first_child_ = std::move(pNode);
     return;
   }
-  index = std::max(index, 0);
 
-  pNode->next_sibling_ = children_[index].get();
-  children_.insert(children_.begin() + index, std::move(pNode));
-  if (index > 0)
-    children_[index - 1]->next_sibling_ = children_[index].get();
+  int32_t iCount = 0;
+  CFX_XMLNode* pFind = first_child_.get();
+  // Note, negative indexes, and indexes after the end of the list will result
+  // in appending to the list.
+  while (++iCount != index && pFind->next_sibling_)
+    pFind = pFind->next_sibling_.get();
+
+  pNode->prev_sibling_ = pFind;
+  if (pFind->next_sibling_)
+    pFind->next_sibling_->prev_sibling_ = pNode.get();
+  pNode->next_sibling_ = std::move(pFind->next_sibling_);
+
+  pFind->next_sibling_ = std::move(pNode);
+  if (pFind == last_child_.Get())
+    last_child_ = pFind->next_sibling_.get();
 }
 
 void CFX_XMLNode::RemoveChildNode(CFX_XMLNode* pNode) {
+  ASSERT(first_child_);
   ASSERT(pNode);
 
-  auto it = std::find(children_.begin(), children_.end(),
-                      pdfium::FakeUniquePtr<CFX_XMLNode>(pNode));
-  if (it != children_.end()) {
-    if (it != children_.begin()) {
-      CFX_XMLNode* prev = (*(it - 1)).get();
-      prev->next_sibling_ = (*it)->next_sibling_;
-    }
-
-    children_.erase(it);
+  if (first_child_.get() == pNode) {
+    first_child_.release();
+    first_child_ = std::move(pNode->next_sibling_);
+  } else {
+    CFX_XMLNode* prev = pNode->prev_sibling_.Get();
+    prev->next_sibling_.release();  // Release pNode
+    prev->next_sibling_ = std::move(pNode->next_sibling_);
   }
-}
 
-void CFX_XMLNode::MoveChildrenTo(CFX_XMLNode* root) {
-  ASSERT(root->children_.empty());
-  std::swap(root->children_, children_);
+  if (last_child_.Get() == pNode)
+    last_child_ = pNode->prev_sibling_.Get();
+
+  if (pNode->next_sibling_)
+    pNode->next_sibling_->prev_sibling_ = pNode->prev_sibling_;
+
+  pNode->parent_ = nullptr;
+  pNode->prev_sibling_ = nullptr;
 }
 
 CFX_XMLNode* CFX_XMLNode::GetRoot() {
diff --git a/core/fxcrt/xml/cfx_xmlnode.h b/core/fxcrt/xml/cfx_xmlnode.h
index cbf89adb5e..288095403c 100644
--- a/core/fxcrt/xml/cfx_xmlnode.h
+++ b/core/fxcrt/xml/cfx_xmlnode.h
@@ -8,7 +8,6 @@
 #define CORE_FXCRT_XML_CFX_XMLNODE_H_
 
 #include <memory>
-#include <vector>
 
 #include "core/fxcrt/fx_stream.h"
 #include "core/fxcrt/retain_ptr.h"
@@ -23,39 +22,34 @@ enum FX_XMLNODETYPE {
 
 class CFX_XMLNode {
  public:
-  using const_iterator =
-      std::vector<std::unique_ptr<CFX_XMLNode>>::const_iterator;
-
   CFX_XMLNode();
   virtual ~CFX_XMLNode();
 
   virtual FX_XMLNODETYPE GetType() const = 0;
   virtual std::unique_ptr<CFX_XMLNode> Clone() = 0;
-  virtual void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) = 0;
+  virtual void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) = 0;
 
   CFX_XMLNode* GetRoot();
   CFX_XMLNode* GetParent() const { return parent_.Get(); }
-  CFX_XMLNode* GetNextSibling() const { return next_sibling_; }
-  bool HasChildren() const { return !children_.empty(); }
-  const_iterator begin() const { return children_.begin(); }
-  const_iterator end() const { return children_.end(); }
+  CFX_XMLNode* GetFirstChild() const { return first_child_.get(); }
+  CFX_XMLNode* GetNextSibling() const { return next_sibling_.get(); }
 
   void AppendChild(std::unique_ptr<CFX_XMLNode> pNode);
   void InsertChildNode(std::unique_ptr<CFX_XMLNode> pNode, int32_t index);
   void RemoveChildNode(CFX_XMLNode* pNode);
   void DeleteChildren();
-  // Note |root| must not have any children.
-  void MoveChildrenTo(CFX_XMLNode* root);
 
  protected:
   WideString EncodeEntities(const WideString& value);
 
  private:
+  // A node owns its first child and it owns its next sibling. The rest
+  // are unowned pointers.
   UnownedPtr<CFX_XMLNode> parent_;
-  // The next_sibling is owned by the vector. We don't use an UnownedPtr
-  // because we don't know the destruction order of the vector.
-  CFX_XMLNode* next_sibling_;
-  std::vector<std::unique_ptr<CFX_XMLNode>> children_;
+  UnownedPtr<CFX_XMLNode> last_child_;
+  UnownedPtr<CFX_XMLNode> prev_sibling_;
+  std::unique_ptr<CFX_XMLNode> first_child_;
+  std::unique_ptr<CFX_XMLNode> next_sibling_;
 };
 
 #endif  // CORE_FXCRT_XML_CFX_XMLNODE_H_
diff --git a/core/fxcrt/xml/cfx_xmltext.cpp b/core/fxcrt/xml/cfx_xmltext.cpp
index 2c324be1c9..9bed941dd4 100644
--- a/core/fxcrt/xml/cfx_xmltext.cpp
+++ b/core/fxcrt/xml/cfx_xmltext.cpp
@@ -21,7 +21,7 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLText::Clone() {
   return pdfium::MakeUnique<CFX_XMLText>(m_wsText);
 }
 
-void CFX_XMLText::Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
+void CFX_XMLText::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
   pXMLStream->WriteString(
       EncodeEntities(GetText()).UTF8Encode().AsStringView());
 }
diff --git a/core/fxcrt/xml/cfx_xmltext.h b/core/fxcrt/xml/cfx_xmltext.h
index cc9c71d01c..bbf14be257 100644
--- a/core/fxcrt/xml/cfx_xmltext.h
+++ b/core/fxcrt/xml/cfx_xmltext.h
@@ -20,7 +20,7 @@ class CFX_XMLText : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
 
   WideString GetText() const { return m_wsText; }
   void SetText(const WideString& wsText) { m_wsText = wsText; }
diff --git a/fxjs/xfa/cjx_node.cpp b/fxjs/xfa/cjx_node.cpp
index 06a812e2eb..a8a88c9627 100644
--- a/fxjs/xfa/cjx_node.cpp
+++ b/fxjs/xfa/cjx_node.cpp
@@ -247,7 +247,13 @@ CJS_Return CJX_Node::loadXML(CFX_V8* runtime,
   }
 
   if (bIgnoreRoot) {
-    pXMLNode->MoveChildrenTo(pFakeXMLRoot.get());
+    CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild();
+    while (pXMLChild) {
+      CFX_XMLNode* pXMLSibling = pXMLChild->GetNextSibling();
+      pXMLNode->RemoveChildNode(pXMLChild);
+      pFakeXMLRoot->AppendChild(pdfium::WrapUnique<CFX_XMLNode>(pXMLChild));
+      pXMLChild = pXMLSibling;
+    }
   } else {
     CFX_XMLNode* pXMLParent = pXMLNode->GetParent();
     if (pXMLParent)
diff --git a/testing/libfuzzer/pdf_xml_fuzzer.cc b/testing/libfuzzer/pdf_xml_fuzzer.cc
index fdd0f6f5c5..97b9d3c7cf 100644
--- a/testing/libfuzzer/pdf_xml_fuzzer.cc
+++ b/testing/libfuzzer/pdf_xml_fuzzer.cc
@@ -25,7 +25,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (!parser.Parse())
     return 0;
 
-  for (const auto& pXMLNode : *root) {
+  for (CFX_XMLNode* pXMLNode = root->GetFirstChild(); pXMLNode;
+       pXMLNode = pXMLNode->GetNextSibling()) {
     if (pXMLNode->GetType() == FX_XMLNODE_Element)
       break;
   }
diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index ac0eba70fa..67b9ca4cb1 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -78,13 +78,13 @@ CFX_XMLNode* CXFA_TextLayout::GetXMLContainerNode() {
     return nullptr;
 
   CFX_XMLNode* pXMLContainer = nullptr;
-  for (const auto& pXMLChild : *pXMLRoot) {
+  for (CFX_XMLNode* pXMLChild = pXMLRoot->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     if (pXMLChild->GetType() == FX_XMLNODE_Element) {
-      CFX_XMLElement* pXMLElement =
-          static_cast<CFX_XMLElement*>(pXMLChild.get());
+      CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
       WideString wsTag = pXMLElement->GetLocalTagName();
       if (wsTag == L"body" || wsTag == L"html") {
-        pXMLContainer = pXMLChild.get();
+        pXMLContainer = pXMLChild;
         break;
       }
     }
@@ -820,15 +820,15 @@ bool CXFA_TextLayout::LoadRichText(
       }
     }
 
-    for (const auto& pChildNode : *pXMLNode) {
+    for (CFX_XMLNode* pChildNode = pXMLNode->GetFirstChild(); pChildNode;
+         pChildNode = pChildNode->GetNextSibling()) {
       if (bCurOl)
         iLiCount++;
 
-      if (!LoadRichText(pChildNode.get(), textWidth, fLinePos,
+      if (!LoadRichText(pChildNode, textWidth, fLinePos,
                         pContext ? pStyle : pParentStyle, bSavePieces,
-                        pLinkData, true, bIsOl, iLiCount)) {
+                        pLinkData, true, bIsOl, iLiCount))
         return false;
-      }
     }
 
     if (m_pLoader) {
diff --git a/xfa/fxfa/cxfa_textparser.cpp b/xfa/fxfa/cxfa_textparser.cpp
index 5ceacf79c2..f0a6dd2af1 100644
--- a/xfa/fxfa/cxfa_textparser.cpp
+++ b/xfa/fxfa/cxfa_textparser.cpp
@@ -245,8 +245,10 @@ void CXFA_TextParser::ParseRichText(CFX_XMLNode* pXMLNode,
     m_mapXMLNodeToParseContext[pXMLNode] = std::move(pTextContext);
   }
 
-  for (const auto& pXMLChild : *pXMLNode)
-    ParseRichText(pXMLChild.get(), pNewStyle.Get());
+  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
+    ParseRichText(pXMLChild, pNewStyle.Get());
+  }
 }
 
 bool CXFA_TextParser::TagValidate(const WideString& wsName) const {
diff --git a/xfa/fxfa/cxfa_textprovider.cpp b/xfa/fxfa/cxfa_textprovider.cpp
index 39c8c90680..60c52942ed 100644
--- a/xfa/fxfa/cxfa_textprovider.cpp
+++ b/xfa/fxfa/cxfa_textprovider.cpp
@@ -62,10 +62,10 @@ CXFA_Node* CXFA_TextProvider::GetTextNode(bool& bRichText) {
     CXFA_Node* pBind = m_pNode->GetBindData();
     CFX_XMLNode* pXMLNode = pBind->GetXMLMappingNode();
     ASSERT(pXMLNode);
-    for (const auto& pXMLChild : *pXMLNode) {
+    for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+         pXMLChild = pXMLChild->GetNextSibling()) {
       if (pXMLChild->GetType() == FX_XMLNODE_Element) {
-        CFX_XMLElement* pElement =
-            static_cast<CFX_XMLElement*>(pXMLChild.get());
+        CFX_XMLElement* pElement = static_cast<CFX_XMLElement*>(pXMLChild);
         if (XFA_RecognizeRichText(pElement))
           bRichText = true;
       }
diff --git a/xfa/fxfa/parser/cxfa_document_parser.cpp b/xfa/fxfa/parser/cxfa_document_parser.cpp
index 21d531d9f9..e4f85f2bac 100644
--- a/xfa/fxfa/parser/cxfa_document_parser.cpp
+++ b/xfa/fxfa/parser/cxfa_document_parser.cpp
@@ -100,10 +100,12 @@ const PacketInfo* GetPacketByName(const WideStringView& wsName) {
 }
 
 CFX_XMLNode* GetDocumentNode(CFX_XMLNode* pRootNode) {
-  for (const auto& pXMLNode : *pRootNode) {
+  for (CFX_XMLNode* pXMLNode = pRootNode->GetFirstChild(); pXMLNode;
+       pXMLNode = pXMLNode->GetNextSibling()) {
     if (pXMLNode->GetType() != FX_XMLNODE_Element)
       continue;
-    return pXMLNode.get();
+
+    return pXMLNode;
   }
   return nullptr;
 }
@@ -230,10 +232,11 @@ CFX_XMLNode* GetDataSetsFromXDP(CFX_XMLNode* pXMLDocumentNode) {
     return nullptr;
   }
 
-  for (const auto& pDatasetsNode : *pXMLDocumentNode) {
-    if (MatchNodeName(pDatasetsNode.get(), datasets_packet->name,
+  for (CFX_XMLNode* pDatasetsNode = pXMLDocumentNode->GetFirstChild();
+       pDatasetsNode; pDatasetsNode = pDatasetsNode->GetNextSibling()) {
+    if (MatchNodeName(pDatasetsNode, datasets_packet->name,
                       datasets_packet->uri, datasets_packet->flags)) {
-      return pDatasetsNode.get();
+      return pDatasetsNode;
     }
   }
   return nullptr;
@@ -245,19 +248,19 @@ bool IsStringAllWhitespace(WideString wsText) {
 }
 
 void ConvertXMLToPlainText(CFX_XMLElement* pRootXMLNode, WideString& wsOutput) {
-  for (const auto& pXMLChild : *pRootXMLNode) {
+  for (CFX_XMLNode* pXMLChild = pRootXMLNode->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
         WideString wsTextData =
-            static_cast<CFX_XMLElement*>(pXMLChild.get())->GetTextData();
+            static_cast<CFX_XMLElement*>(pXMLChild)->GetTextData();
         wsTextData += L"\n";
         wsOutput += wsTextData;
         break;
       }
       case FX_XMLNODE_Text:
       case FX_XMLNODE_CharData: {
-        WideString wsText =
-            static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
+        WideString wsText = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
         if (IsStringAllWhitespace(wsText))
           continue;
 
@@ -304,9 +307,10 @@ WideString GetPlainTextFromRichText(CFX_XMLNode* pXMLNode) {
     default:
       break;
   }
-
-  for (const auto& pChildXML : *pXMLNode)
-    wsPlainText += GetPlainTextFromRichText(pChildXML.get());
+  for (CFX_XMLNode* pChildXML = pXMLNode->GetFirstChild(); pChildXML;
+       pChildXML = pChildXML->GetNextSibling()) {
+    wsPlainText += GetPlainTextFromRichText(pChildXML);
+  }
 
   return wsPlainText;
 }
@@ -356,7 +360,8 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
   XFA_PacketType ePacketID = pXFANode->GetPacketType();
   if (ePacketID == XFA_PacketType::Datasets) {
     if (pXFANode->GetElementType() == XFA_Element::DataValue) {
-      for (const auto& pXMLChild : *pXMLNode) {
+      for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+           pXMLChild = pXMLChild->GetNextSibling()) {
         FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
         if (eNodeType == FX_XMLNODE_Instruction)
           continue;
@@ -367,7 +372,7 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
           if (!pXFAChild)
             return;
 
-          CFX_XMLElement* child = static_cast<CFX_XMLElement*>(pXMLChild.get());
+          CFX_XMLElement* child = static_cast<CFX_XMLElement*>(pXMLChild);
           WideString wsNodeStr = child->GetLocalTagName();
           pXFAChild->JSObject()->SetCData(XFA_Attribute::Name, wsNodeStr, false,
                                           false);
@@ -377,7 +382,7 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
                                             false, false);
 
           pXFANode->InsertChild(pXFAChild, nullptr);
-          pXFAChild->SetXMLMappingNode(pXMLChild.get());
+          pXFAChild->SetXMLMappingNode(pXMLChild);
           pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
           break;
         }
@@ -456,16 +461,17 @@ CXFA_Node* CXFA_DocumentParser::ParseAsXDPPacket_XDP(
 
   CFX_XMLNode* pXMLConfigDOMRoot = nullptr;
   CXFA_Node* pXFAConfigDOMRoot = nullptr;
-  for (const auto& pChildItem : *pXMLDocumentNode) {
+  for (CFX_XMLNode* pChildItem = pXMLDocumentNode->GetFirstChild(); pChildItem;
+       pChildItem = pChildItem->GetNextSibling()) {
     const PacketInfo* pPacketInfo = GetPacketByIndex(XFA_PacketType::Config);
-    if (!MatchNodeName(pChildItem.get(), pPacketInfo->name, pPacketInfo->uri,
+    if (!MatchNodeName(pChildItem, pPacketInfo->name, pPacketInfo->uri,
                        pPacketInfo->flags)) {
       continue;
     }
     if (pXFARootNode->GetFirstChildByName(pPacketInfo->hash))
       return nullptr;
 
-    pXMLConfigDOMRoot = pChildItem.get();
+    pXMLConfigDOMRoot = pChildItem;
     pXFAConfigDOMRoot = ParseAsXDPPacket_Config(pXMLConfigDOMRoot);
     if (pXFAConfigDOMRoot)
       pXFARootNode->InsertChild(pXFAConfigDOMRoot, nullptr);
@@ -474,14 +480,14 @@ CXFA_Node* CXFA_DocumentParser::ParseAsXDPPacket_XDP(
   CFX_XMLNode* pXMLDatasetsDOMRoot = nullptr;
   CFX_XMLNode* pXMLFormDOMRoot = nullptr;
   CFX_XMLNode* pXMLTemplateDOMRoot = nullptr;
-  for (const auto& pChildItem : *pXMLDocumentNode) {
-    if (pChildItem->GetType() != FX_XMLNODE_Element)
+  for (CFX_XMLNode* pChildItem = pXMLDocumentNode->GetFirstChild(); pChildItem;
+       pChildItem = pChildItem->GetNextSibling()) {
+    if (!pChildItem || pChildItem->GetType() != FX_XMLNODE_Element)
       continue;
-    if (pChildItem.get() == pXMLConfigDOMRoot)
+    if (pChildItem == pXMLConfigDOMRoot)
       continue;
 
-    CFX_XMLElement* pElement =
-        reinterpret_cast<CFX_XMLElement*>(pChildItem.get());
+    CFX_XMLElement* pElement = reinterpret_cast<CFX_XMLElement*>(pChildItem);
     WideString wsPacketName = pElement->GetLocalTagName();
     const PacketInfo* pPacketInfo =
         GetPacketByName(wsPacketName.AsStringView());
@@ -765,11 +771,11 @@ CXFA_Node* CXFA_DocumentParser::NormalLoader(CXFA_Node* pXFANode,
                                              XFA_PacketType ePacketID,
                                              bool bUseAttribute) {
   bool bOneOfPropertyFound = false;
-  for (const auto& pXMLChild : *pXMLDoc) {
+  for (CFX_XMLNode* pXMLChild = pXMLDoc->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
-        CFX_XMLElement* pXMLElement =
-            static_cast<CFX_XMLElement*>(pXMLChild.get());
+        CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
         WideString wsTagName = pXMLElement->GetLocalTagName();
         XFA_Element eType = CXFA_Node::NameToElement(wsTagName);
         if (eType == XFA_Element::Unknown)
@@ -831,11 +837,9 @@ CXFA_Node* CXFA_DocumentParser::NormalLoader(CXFA_Node* pXFANode,
             NormalLoader(pXFAChild, pXMLElement, ePacketID, bUseAttribute);
             break;
         }
-        break;
-      }
+      } break;
       case FX_XMLNODE_Instruction:
-        ParseInstruction(pXFANode,
-                         static_cast<CFX_XMLInstruction*>(pXMLChild.get()),
+        ParseInstruction(pXFANode, static_cast<CFX_XMLInstruction*>(pXMLChild),
                          ePacketID);
         break;
       default:
@@ -861,7 +865,8 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
     pXFANode->SetXMLMappingNode(pXMLNode);
 
   WideString wsValue;
-  for (const auto& pXMLChild : *pXMLNode) {
+  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
     if (eNodeType == FX_XMLNODE_Instruction)
       continue;
@@ -870,20 +875,19 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
       if (eNodeType != FX_XMLNODE_Element)
         break;
 
-      if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild.get())))
-        wsValue += GetPlainTextFromRichText(
-            static_cast<CFX_XMLElement*>(pXMLChild.get()));
+      if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild)))
+        wsValue +=
+            GetPlainTextFromRichText(static_cast<CFX_XMLElement*>(pXMLChild));
     } else if (element == XFA_Element::Sharpxml) {
       if (eNodeType != FX_XMLNODE_Element)
         break;
 
-      ConvertXMLToPlainText(static_cast<CFX_XMLElement*>(pXMLChild.get()),
-                            wsValue);
+      ConvertXMLToPlainText(static_cast<CFX_XMLElement*>(pXMLChild), wsValue);
     } else {
       if (eNodeType == FX_XMLNODE_Element)
         break;
       if (eNodeType == FX_XMLNODE_Text || eNodeType == FX_XMLNODE_CharData)
-        wsValue = static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
+        wsValue = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
     }
     break;
   }
@@ -905,11 +909,11 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
 void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
                                          CFX_XMLNode* pXMLNode,
                                          XFA_PacketType ePacketID) {
-  for (const auto& pXMLChild : *pXMLNode) {
+  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
-        CFX_XMLElement* pXMLElement =
-            static_cast<CFX_XMLElement*>(pXMLChild.get());
+        CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
         {
           WideString wsNamespaceURI = GetElementTagNamespaceURI(pXMLElement);
           if (wsNamespaceURI == L"http://www.xfa.com/schema/xfa-package/" ||
@@ -941,10 +945,11 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
           }
         }
         if (eNodeType == XFA_Element::DataModel) {
-          for (const auto& pXMLDataChild : *pXMLElement) {
+          for (CFX_XMLNode* pXMLDataChild = pXMLElement->GetFirstChild();
+               pXMLDataChild; pXMLDataChild = pXMLDataChild->GetNextSibling()) {
             if (pXMLDataChild->GetType() == FX_XMLNODE_Element) {
               if (!XFA_RecognizeRichText(
-                      static_cast<CFX_XMLElement*>(pXMLDataChild.get()))) {
+                      static_cast<CFX_XMLElement*>(pXMLDataChild))) {
                 eNodeType = XFA_Element::DataGroup;
                 break;
               }
@@ -1005,7 +1010,7 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
         if (eNodeType == XFA_Element::DataGroup)
           ParseDataGroup(pXFAChild, pXMLElement, ePacketID);
         else if (bNeedValue)
-          ParseDataValue(pXFAChild, pXMLChild.get(), XFA_PacketType::Datasets);
+          ParseDataValue(pXFAChild, pXMLChild, XFA_PacketType::Datasets);
 
         pXFAChild->SetXMLMappingNode(pXMLElement);
         pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
@@ -1013,7 +1018,7 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
       }
       case FX_XMLNODE_CharData:
       case FX_XMLNODE_Text: {
-        CFX_XMLText* pXMLText = static_cast<CFX_XMLText*>(pXMLChild.get());
+        CFX_XMLText* pXMLText = static_cast<CFX_XMLText*>(pXMLChild);
         WideString wsText = pXMLText->GetText();
         if (IsStringAllWhitespace(wsText))
           continue;
@@ -1043,23 +1048,23 @@ void CXFA_DocumentParser::ParseDataValue(CXFA_Node* pXFANode,
   CFX_WideTextBuf wsCurValueTextBuf;
   bool bMarkAsCompound = false;
   CFX_XMLNode* pXMLCurValueNode = nullptr;
-  for (const auto& pXMLChild : *pXMLNode) {
+  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
+       pXMLChild = pXMLChild->GetNextSibling()) {
     FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
     if (eNodeType == FX_XMLNODE_Instruction)
       continue;
 
     if (eNodeType == FX_XMLNODE_Text || eNodeType == FX_XMLNODE_CharData) {
-      WideString wsText = static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
+      WideString wsText = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
       if (!pXMLCurValueNode)
-        pXMLCurValueNode = pXMLChild.get();
+        pXMLCurValueNode = pXMLChild;
 
       wsCurValueTextBuf << wsText;
-    } else if (XFA_RecognizeRichText(
-                   static_cast<CFX_XMLElement*>(pXMLChild.get()))) {
-      WideString wsText = GetPlainTextFromRichText(
-          static_cast<CFX_XMLElement*>(pXMLChild.get()));
+    } else if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild))) {
+      WideString wsText =
+          GetPlainTextFromRichText(static_cast<CFX_XMLElement*>(pXMLChild));
       if (!pXMLCurValueNode)
-        pXMLCurValueNode = pXMLChild.get();
+        pXMLCurValueNode = pXMLChild;
 
       wsCurValueTextBuf << wsText;
     } else {
@@ -1090,12 +1095,12 @@ void CXFA_DocumentParser::ParseDataValue(CXFA_Node* pXFANode,
         return;
 
       WideString wsNodeStr =
-          static_cast<CFX_XMLElement*>(pXMLChild.get())->GetLocalTagName();
+          static_cast<CFX_XMLElement*>(pXMLChild)->GetLocalTagName();
       pXFAChild->JSObject()->SetCData(XFA_Attribute::Name, wsNodeStr, false,
                                       false);
-      ParseDataValue(pXFAChild, pXMLChild.get(), ePacketID);
+      ParseDataValue(pXFAChild, pXMLChild, ePacketID);
       pXFANode->InsertChild(pXFAChild, nullptr);
-      pXFAChild->SetXMLMappingNode(pXMLChild.get());
+      pXFAChild->SetXMLMappingNode(pXMLChild);
       pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
       WideString wsCurValue =
           pXFAChild->JSObject()->GetCData(XFA_Attribute::Value);
diff --git a/xfa/fxfa/parser/cxfa_xmllocale.cpp b/xfa/fxfa/parser/cxfa_xmllocale.cpp
index cbee75725a..ffb4cd9dde 100644
--- a/xfa/fxfa/parser/cxfa_xmllocale.cpp
+++ b/xfa/fxfa/parser/cxfa_xmllocale.cpp
@@ -38,10 +38,11 @@ std::unique_ptr<CXFA_XMLLocale> CXFA_XMLLocale::Create(
     return nullptr;
 
   CFX_XMLElement* locale = nullptr;
-  for (const auto& child : *(root.get())) {
+  for (auto* child = root->GetFirstChild(); child;
+       child = child->GetNextSibling()) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
-    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child.get());
+    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child);
     if (elem->GetName() == L"locale") {
       locale = elem;
       break;
@@ -125,11 +126,12 @@ WideString CXFA_XMLLocale::GetCalendarSymbol(const WideStringView& symbol,
 
   WideString pstrSymbolNames = symbol + L"Names";
   CFX_XMLElement* name_child = nullptr;
-  for (const auto& name : *child) {
+  for (auto* name = child->GetFirstChild(); name;
+       name = name->GetNextSibling()) {
     if (name->GetType() != FX_XMLNODE_Element)
       continue;
 
-    auto* elem = static_cast<CFX_XMLElement*>(name.get());
+    auto* elem = static_cast<CFX_XMLElement*>(name);
     if (elem->GetName() != pstrSymbolNames)
       continue;
 
@@ -208,11 +210,12 @@ WideString CXFA_XMLLocale::GetNumPattern(FX_LOCALENUMSUBCATEGORY eType) const {
 WideString CXFA_XMLLocale::GetPattern(CFX_XMLElement* patterns,
                                       const WideStringView& bsTag,
                                       const WideStringView& wsName) const {
-  for (const auto& child : *patterns) {
+  for (auto* child = patterns->GetFirstChild(); child;
+       child = child->GetNextSibling()) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CFX_XMLElement* pattern = static_cast<CFX_XMLElement*>(child.get());
+    CFX_XMLElement* pattern = static_cast<CFX_XMLElement*>(child);
     if (pattern->GetName() != bsTag)
       continue;
     if (pattern->GetAttribute(L"name") != wsName)
diff --git a/xfa/fxfa/parser/xfa_utils.cpp b/xfa/fxfa/parser/xfa_utils.cpp
index 876cdf0c75..de0f76b6b4 100644
--- a/xfa/fxfa/parser/xfa_utils.cpp
+++ b/xfa/fxfa/parser/xfa_utils.cpp
@@ -211,10 +211,7 @@ void RegenerateFormFile_Changed(CXFA_Node* pNode,
         if (!pExDataXML)
           break;
 
-        if (pExDataXML->begin() == pExDataXML->end())
-          return;
-
-        CFX_XMLNode* pRichTextXML = pExDataXML->begin()->get();
+        CFX_XMLNode* pRichTextXML = pExDataXML->GetFirstChild();
         if (!pRichTextXML)
           break;