Change CFX_XML Save to take a write stream

This CL changes CFX_XML to use an IFX_SeekableWriteStream instead of the more
generic IFX_SeekableStream.

Change-Id: I6e4def380c43eca755d91ad5cb6146c2dfdaee10
Reviewed-on: https://pdfium-review.googlesource.com/30877
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

19 files changed, 143 insertions, 186 deletions

diff --git a/core/fpdfdoc/cpdf_metadata.cpp b/core/fpdfdoc/cpdf_metadata.cpp
index 161fc93edd..c928952dca 100644
--- a/core/fpdfdoc/cpdf_metadata.cpp
+++ b/core/fpdfdoc/cpdf_metadata.cpp
@@ -19,12 +19,11 @@ void CheckForSharedFormInternal(CFX_XMLElement* element,
                                 std::vector<UnsupportedFeature>* unsupported) {
   WideString attr = element->GetAttribute(L"xmlns:adhocwf");
   if (attr == L"http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/") {
-    for (const auto* child = element->GetFirstChild(); child;
-         child = child->GetNextSibling()) {
+    for (const auto& child : *element) {
       if (child->GetType() != FX_XMLNODE_Element)
         continue;
 
-      const auto* child_elem = static_cast<const CFX_XMLElement*>(child);
+      const auto* child_elem = static_cast<const CFX_XMLElement*>(child.get());
       if (child_elem->GetName() != L"adhocwf:workflowType")
         continue;
 
@@ -46,12 +45,11 @@ void CheckForSharedFormInternal(CFX_XMLElement* element,
     }
   }
 
-  for (auto* child = element->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
+  for (const auto& child : *element) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CheckForSharedFormInternal(static_cast<CFX_XMLElement*>(child),
+    CheckForSharedFormInternal(static_cast<CFX_XMLElement*>(child.get()),
                                unsupported);
   }
 }
diff --git a/core/fxcrt/xml/cfx_xmlchardata.cpp b/core/fxcrt/xml/cfx_xmlchardata.cpp
index dec2e4618f..e62a43ac53 100644
--- a/core/fxcrt/xml/cfx_xmlchardata.cpp
+++ b/core/fxcrt/xml/cfx_xmlchardata.cpp
@@ -21,7 +21,8 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLCharData::Clone() {
   return pdfium::MakeUnique<CFX_XMLCharData>(GetText());
 }
 
-void CFX_XMLCharData::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
+void CFX_XMLCharData::Save(
+    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
   pXMLStream->WriteString("<![CDATA[");
   pXMLStream->WriteString(GetText().UTF8Encode().AsStringView());
   pXMLStream->WriteString("]]>");
diff --git a/core/fxcrt/xml/cfx_xmlchardata.h b/core/fxcrt/xml/cfx_xmlchardata.h
index 5b00597955..0cdc348f26 100644
--- a/core/fxcrt/xml/cfx_xmlchardata.h
+++ b/core/fxcrt/xml/cfx_xmlchardata.h
@@ -20,7 +20,7 @@ class CFX_XMLCharData : public CFX_XMLText {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
 };
 
 #endif  // CORE_FXCRT_XML_CFX_XMLCHARDATA_H_
diff --git a/core/fxcrt/xml/cfx_xmlelement.cpp b/core/fxcrt/xml/cfx_xmlelement.cpp
index 5e79da63cf..8c8922e0c6 100644
--- a/core/fxcrt/xml/cfx_xmlelement.cpp
+++ b/core/fxcrt/xml/cfx_xmlelement.cpp
@@ -33,10 +33,9 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLElement::Clone() {
   // TODO(dsinclair): This clone is wrong. It doesn't clone child nodes just
   // copies text nodes?
   WideString wsText;
-  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
-       pChild = pChild->GetNextSibling()) {
+  for (const auto& pChild : *this) {
     if (pChild->GetType() == FX_XMLNODE_Text)
-      wsText += static_cast<CFX_XMLText*>(pChild)->GetText();
+      wsText += static_cast<CFX_XMLText*>(pChild.get())->GetText();
   }
   pClone->SetTextData(wsText);
   return std::move(pClone);
@@ -79,11 +78,10 @@ WideString CFX_XMLElement::GetNamespaceURI() const {
 WideString CFX_XMLElement::GetTextData() const {
   CFX_WideTextBuf buffer;
 
-  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
-       pChild = pChild->GetNextSibling()) {
+  for (const auto& pChild : *this) {
     if (pChild->GetType() == FX_XMLNODE_Text ||
         pChild->GetType() == FX_XMLNODE_CharData) {
-      buffer << static_cast<CFX_XMLText*>(pChild)->GetText();
+      buffer << static_cast<CFX_XMLText*>(pChild.get())->GetText();
     }
   }
   return buffer.MakeString();
@@ -96,7 +94,8 @@ void CFX_XMLElement::SetTextData(const WideString& wsText) {
   AppendChild(pdfium::MakeUnique<CFX_XMLText>(wsText));
 }
 
-void CFX_XMLElement::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
+void CFX_XMLElement::Save(
+    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
   ByteString bsNameEncoded = name_.UTF8Encode();
 
   pXMLStream->WriteString("<");
@@ -109,17 +108,16 @@ void CFX_XMLElement::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
         AttributeToString(it.first, it.second).UTF8Encode().AsStringView());
   }
 
-  if (!GetFirstChild()) {
+  if (HasChildren()) {
     pXMLStream->WriteString(" />\n");
     return;
   }
 
   pXMLStream->WriteString(">\n");
 
-  for (CFX_XMLNode* pChild = GetFirstChild(); pChild;
-       pChild = pChild->GetNextSibling()) {
+  for (const auto& pChild : *this)
     pChild->Save(pXMLStream);
-  }
+
   pXMLStream->WriteString("</");
   pXMLStream->WriteString(bsNameEncoded.AsStringView());
   pXMLStream->WriteString(">\n");
@@ -132,11 +130,11 @@ CFX_XMLElement* CFX_XMLElement::GetFirstChildNamed(
 
 CFX_XMLElement* CFX_XMLElement::GetNthChildNamed(const WideStringView& name,
                                                  size_t idx) const {
-  for (auto* child = GetFirstChild(); child; child = child->GetNextSibling()) {
+  for (const auto& child : *this) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child);
+    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child.get());
     if (elem->name_ != name)
       continue;
     if (idx == 0)
diff --git a/core/fxcrt/xml/cfx_xmlelement.h b/core/fxcrt/xml/cfx_xmlelement.h
index c1d9fea3f0..678ba6d996 100644
--- a/core/fxcrt/xml/cfx_xmlelement.h
+++ b/core/fxcrt/xml/cfx_xmlelement.h
@@ -22,7 +22,7 @@ class CFX_XMLElement : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
 
   WideString GetName() const { return name_; }
 
diff --git a/core/fxcrt/xml/cfx_xmlinstruction.cpp b/core/fxcrt/xml/cfx_xmlinstruction.cpp
index 7b844e6808..d0f5cbb68b 100644
--- a/core/fxcrt/xml/cfx_xmlinstruction.cpp
+++ b/core/fxcrt/xml/cfx_xmlinstruction.cpp
@@ -40,7 +40,8 @@ bool CFX_XMLInstruction::IsAcrobat() const {
   return name_ == L"acrobat";
 }
 
-void CFX_XMLInstruction::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
+void CFX_XMLInstruction::Save(
+    const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
   if (name_.CompareNoCase(L"xml") == 0) {
     pXMLStream->WriteString("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
     return;
diff --git a/core/fxcrt/xml/cfx_xmlinstruction.h b/core/fxcrt/xml/cfx_xmlinstruction.h
index 045610bd8a..3be9d48573 100644
--- a/core/fxcrt/xml/cfx_xmlinstruction.h
+++ b/core/fxcrt/xml/cfx_xmlinstruction.h
@@ -21,7 +21,7 @@ class CFX_XMLInstruction : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
 
   bool IsOriginalXFAVersion() const;
   bool IsAcrobat() const;
diff --git a/core/fxcrt/xml/cfx_xmlnode.cpp b/core/fxcrt/xml/cfx_xmlnode.cpp
index 4f811e608e..de0a4acd2f 100644
--- a/core/fxcrt/xml/cfx_xmlnode.cpp
+++ b/core/fxcrt/xml/cfx_xmlnode.cpp
@@ -6,8 +6,8 @@
 
 #include "core/fxcrt/xml/cfx_xmlnode.h"
 
+#include <algorithm>
 #include <utility>
-#include <vector>
 
 #include "core/fxcrt/xml/cfx_xmlchardata.h"
 #include "core/fxcrt/xml/cfx_xmlelement.h"
@@ -22,15 +22,7 @@ CFX_XMLNode::~CFX_XMLNode() {
 }
 
 void CFX_XMLNode::DeleteChildren() {
-  CFX_XMLNode* child = last_child_.Get();
-  // Clear last child early as it will have been deleted already.
-  last_child_ = nullptr;
-  while (child) {
-    child = child->prev_sibling_.Get();
-    if (child)
-      child->next_sibling_ = nullptr;
-  }
-  first_child_ = nullptr;
+  children_.clear();
 }
 
 void CFX_XMLNode::AppendChild(std::unique_ptr<CFX_XMLNode> pNode) {
@@ -42,63 +34,38 @@ void CFX_XMLNode::InsertChildNode(std::unique_ptr<CFX_XMLNode> pNode,
   ASSERT(!pNode->parent_);
 
   pNode->parent_ = this;
-  // No existing children, add node as first child.
-  if (!first_child_) {
-    ASSERT(!last_child_);
-
-    first_child_ = std::move(pNode);
-    last_child_ = first_child_.get();
-    first_child_->prev_sibling_ = nullptr;
-    first_child_->next_sibling_ = nullptr;
-    return;
-  }
-
-  if (index == 0) {
-    first_child_->prev_sibling_ = pNode.get();
-    pNode->next_sibling_ = std::move(first_child_);
-    pNode->prev_sibling_ = nullptr;
-    first_child_ = std::move(pNode);
+  if (static_cast<size_t>(index) >= children_.size()) {
+    if (!children_.empty())
+      children_.back()->next_sibling_ = pNode.get();
+    children_.push_back(std::move(pNode));
     return;
   }
+  index = std::max(index, 0);
 
-  int32_t iCount = 0;
-  CFX_XMLNode* pFind = first_child_.get();
-  // Note, negative indexes, and indexes after the end of the list will result
-  // in appending to the list.
-  while (++iCount != index && pFind->next_sibling_)
-    pFind = pFind->next_sibling_.get();
-
-  pNode->prev_sibling_ = pFind;
-  if (pFind->next_sibling_)
-    pFind->next_sibling_->prev_sibling_ = pNode.get();
-  pNode->next_sibling_ = std::move(pFind->next_sibling_);
-
-  pFind->next_sibling_ = std::move(pNode);
-  if (pFind == last_child_.Get())
-    last_child_ = pFind->next_sibling_.get();
+  pNode->next_sibling_ = children_[index].get();
+  children_.insert(children_.begin() + index, std::move(pNode));
+  if (index > 0)
+    children_[index - 1]->next_sibling_ = children_[index].get();
 }
 
 void CFX_XMLNode::RemoveChildNode(CFX_XMLNode* pNode) {
-  ASSERT(first_child_);
   ASSERT(pNode);
 
-  if (first_child_.get() == pNode) {
-    first_child_.release();
-    first_child_ = std::move(pNode->next_sibling_);
-  } else {
-    CFX_XMLNode* prev = pNode->prev_sibling_.Get();
-    prev->next_sibling_.release();  // Release pNode
-    prev->next_sibling_ = std::move(pNode->next_sibling_);
-  }
-
-  if (last_child_.Get() == pNode)
-    last_child_ = pNode->prev_sibling_.Get();
+  auto it = std::find(children_.begin(), children_.end(),
+                      pdfium::FakeUniquePtr<CFX_XMLNode>(pNode));
+  if (it != children_.end()) {
+    if (it != children_.begin()) {
+      CFX_XMLNode* prev = (*(it - 1)).get();
+      prev->next_sibling_ = (*it)->next_sibling_;
+    }
 
-  if (pNode->next_sibling_)
-    pNode->next_sibling_->prev_sibling_ = pNode->prev_sibling_;
+    children_.erase(it);
+  }
+}
 
-  pNode->parent_ = nullptr;
-  pNode->prev_sibling_ = nullptr;
+void CFX_XMLNode::MoveChildrenTo(CFX_XMLNode* root) {
+  ASSERT(root->children_.empty());
+  std::swap(root->children_, children_);
 }
 
 CFX_XMLNode* CFX_XMLNode::GetRoot() {
diff --git a/core/fxcrt/xml/cfx_xmlnode.h b/core/fxcrt/xml/cfx_xmlnode.h
index 288095403c..cbf89adb5e 100644
--- a/core/fxcrt/xml/cfx_xmlnode.h
+++ b/core/fxcrt/xml/cfx_xmlnode.h
@@ -8,6 +8,7 @@
 #define CORE_FXCRT_XML_CFX_XMLNODE_H_
 
 #include <memory>
+#include <vector>
 
 #include "core/fxcrt/fx_stream.h"
 #include "core/fxcrt/retain_ptr.h"
@@ -22,34 +23,39 @@ enum FX_XMLNODETYPE {
 
 class CFX_XMLNode {
  public:
+  using const_iterator =
+      std::vector<std::unique_ptr<CFX_XMLNode>>::const_iterator;
+
   CFX_XMLNode();
   virtual ~CFX_XMLNode();
 
   virtual FX_XMLNODETYPE GetType() const = 0;
   virtual std::unique_ptr<CFX_XMLNode> Clone() = 0;
-  virtual void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) = 0;
+  virtual void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) = 0;
 
   CFX_XMLNode* GetRoot();
   CFX_XMLNode* GetParent() const { return parent_.Get(); }
-  CFX_XMLNode* GetFirstChild() const { return first_child_.get(); }
-  CFX_XMLNode* GetNextSibling() const { return next_sibling_.get(); }
+  CFX_XMLNode* GetNextSibling() const { return next_sibling_; }
+  bool HasChildren() const { return !children_.empty(); }
+  const_iterator begin() const { return children_.begin(); }
+  const_iterator end() const { return children_.end(); }
 
   void AppendChild(std::unique_ptr<CFX_XMLNode> pNode);
   void InsertChildNode(std::unique_ptr<CFX_XMLNode> pNode, int32_t index);
   void RemoveChildNode(CFX_XMLNode* pNode);
   void DeleteChildren();
+  // Note |root| must not have any children.
+  void MoveChildrenTo(CFX_XMLNode* root);
 
  protected:
   WideString EncodeEntities(const WideString& value);
 
  private:
-  // A node owns its first child and it owns its next sibling. The rest
-  // are unowned pointers.
   UnownedPtr<CFX_XMLNode> parent_;
-  UnownedPtr<CFX_XMLNode> last_child_;
-  UnownedPtr<CFX_XMLNode> prev_sibling_;
-  std::unique_ptr<CFX_XMLNode> first_child_;
-  std::unique_ptr<CFX_XMLNode> next_sibling_;
+  // The next_sibling is owned by the vector. We don't use an UnownedPtr
+  // because we don't know the destruction order of the vector.
+  CFX_XMLNode* next_sibling_;
+  std::vector<std::unique_ptr<CFX_XMLNode>> children_;
 };
 
 #endif  // CORE_FXCRT_XML_CFX_XMLNODE_H_
diff --git a/core/fxcrt/xml/cfx_xmltext.cpp b/core/fxcrt/xml/cfx_xmltext.cpp
index 9bed941dd4..2c324be1c9 100644
--- a/core/fxcrt/xml/cfx_xmltext.cpp
+++ b/core/fxcrt/xml/cfx_xmltext.cpp
@@ -21,7 +21,7 @@ std::unique_ptr<CFX_XMLNode> CFX_XMLText::Clone() {
   return pdfium::MakeUnique<CFX_XMLText>(m_wsText);
 }
 
-void CFX_XMLText::Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) {
+void CFX_XMLText::Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) {
   pXMLStream->WriteString(
       EncodeEntities(GetText()).UTF8Encode().AsStringView());
 }
diff --git a/core/fxcrt/xml/cfx_xmltext.h b/core/fxcrt/xml/cfx_xmltext.h
index bbf14be257..cc9c71d01c 100644
--- a/core/fxcrt/xml/cfx_xmltext.h
+++ b/core/fxcrt/xml/cfx_xmltext.h
@@ -20,7 +20,7 @@ class CFX_XMLText : public CFX_XMLNode {
   // CFX_XMLNode
   FX_XMLNODETYPE GetType() const override;
   std::unique_ptr<CFX_XMLNode> Clone() override;
-  void Save(const RetainPtr<IFX_SeekableStream>& pXMLStream) override;
+  void Save(const RetainPtr<IFX_SeekableWriteStream>& pXMLStream) override;
 
   WideString GetText() const { return m_wsText; }
   void SetText(const WideString& wsText) { m_wsText = wsText; }
diff --git a/fxjs/xfa/cjx_node.cpp b/fxjs/xfa/cjx_node.cpp
index a8a88c9627..06a812e2eb 100644
--- a/fxjs/xfa/cjx_node.cpp
+++ b/fxjs/xfa/cjx_node.cpp
@@ -247,13 +247,7 @@ CJS_Return CJX_Node::loadXML(CFX_V8* runtime,
   }
 
   if (bIgnoreRoot) {
-    CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild();
-    while (pXMLChild) {
-      CFX_XMLNode* pXMLSibling = pXMLChild->GetNextSibling();
-      pXMLNode->RemoveChildNode(pXMLChild);
-      pFakeXMLRoot->AppendChild(pdfium::WrapUnique<CFX_XMLNode>(pXMLChild));
-      pXMLChild = pXMLSibling;
-    }
+    pXMLNode->MoveChildrenTo(pFakeXMLRoot.get());
   } else {
     CFX_XMLNode* pXMLParent = pXMLNode->GetParent();
     if (pXMLParent)
diff --git a/testing/libfuzzer/pdf_xml_fuzzer.cc b/testing/libfuzzer/pdf_xml_fuzzer.cc
index 97b9d3c7cf..fdd0f6f5c5 100644
--- a/testing/libfuzzer/pdf_xml_fuzzer.cc
+++ b/testing/libfuzzer/pdf_xml_fuzzer.cc
@@ -25,8 +25,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   if (!parser.Parse())
     return 0;
 
-  for (CFX_XMLNode* pXMLNode = root->GetFirstChild(); pXMLNode;
-       pXMLNode = pXMLNode->GetNextSibling()) {
+  for (const auto& pXMLNode : *root) {
     if (pXMLNode->GetType() == FX_XMLNODE_Element)
       break;
   }
diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index 67b9ca4cb1..ac0eba70fa 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -78,13 +78,13 @@ CFX_XMLNode* CXFA_TextLayout::GetXMLContainerNode() {
     return nullptr;
 
   CFX_XMLNode* pXMLContainer = nullptr;
-  for (CFX_XMLNode* pXMLChild = pXMLRoot->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pXMLRoot) {
     if (pXMLChild->GetType() == FX_XMLNODE_Element) {
-      CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
+      CFX_XMLElement* pXMLElement =
+          static_cast<CFX_XMLElement*>(pXMLChild.get());
       WideString wsTag = pXMLElement->GetLocalTagName();
       if (wsTag == L"body" || wsTag == L"html") {
-        pXMLContainer = pXMLChild;
+        pXMLContainer = pXMLChild.get();
         break;
       }
     }
@@ -820,15 +820,15 @@ bool CXFA_TextLayout::LoadRichText(
       }
     }
 
-    for (CFX_XMLNode* pChildNode = pXMLNode->GetFirstChild(); pChildNode;
-         pChildNode = pChildNode->GetNextSibling()) {
+    for (const auto& pChildNode : *pXMLNode) {
       if (bCurOl)
         iLiCount++;
 
-      if (!LoadRichText(pChildNode, textWidth, fLinePos,
+      if (!LoadRichText(pChildNode.get(), textWidth, fLinePos,
                         pContext ? pStyle : pParentStyle, bSavePieces,
-                        pLinkData, true, bIsOl, iLiCount))
+                        pLinkData, true, bIsOl, iLiCount)) {
         return false;
+      }
     }
 
     if (m_pLoader) {
diff --git a/xfa/fxfa/cxfa_textparser.cpp b/xfa/fxfa/cxfa_textparser.cpp
index f0a6dd2af1..5ceacf79c2 100644
--- a/xfa/fxfa/cxfa_textparser.cpp
+++ b/xfa/fxfa/cxfa_textparser.cpp
@@ -245,10 +245,8 @@ void CXFA_TextParser::ParseRichText(CFX_XMLNode* pXMLNode,
     m_mapXMLNodeToParseContext[pXMLNode] = std::move(pTextContext);
   }
 
-  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
-    ParseRichText(pXMLChild, pNewStyle.Get());
-  }
+  for (const auto& pXMLChild : *pXMLNode)
+    ParseRichText(pXMLChild.get(), pNewStyle.Get());
 }
 
 bool CXFA_TextParser::TagValidate(const WideString& wsName) const {
diff --git a/xfa/fxfa/cxfa_textprovider.cpp b/xfa/fxfa/cxfa_textprovider.cpp
index 60c52942ed..39c8c90680 100644
--- a/xfa/fxfa/cxfa_textprovider.cpp
+++ b/xfa/fxfa/cxfa_textprovider.cpp
@@ -62,10 +62,10 @@ CXFA_Node* CXFA_TextProvider::GetTextNode(bool& bRichText) {
     CXFA_Node* pBind = m_pNode->GetBindData();
     CFX_XMLNode* pXMLNode = pBind->GetXMLMappingNode();
     ASSERT(pXMLNode);
-    for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-         pXMLChild = pXMLChild->GetNextSibling()) {
+    for (const auto& pXMLChild : *pXMLNode) {
       if (pXMLChild->GetType() == FX_XMLNODE_Element) {
-        CFX_XMLElement* pElement = static_cast<CFX_XMLElement*>(pXMLChild);
+        CFX_XMLElement* pElement =
+            static_cast<CFX_XMLElement*>(pXMLChild.get());
         if (XFA_RecognizeRichText(pElement))
           bRichText = true;
       }
diff --git a/xfa/fxfa/parser/cxfa_document_parser.cpp b/xfa/fxfa/parser/cxfa_document_parser.cpp
index e4f85f2bac..21d531d9f9 100644
--- a/xfa/fxfa/parser/cxfa_document_parser.cpp
+++ b/xfa/fxfa/parser/cxfa_document_parser.cpp
@@ -100,12 +100,10 @@ const PacketInfo* GetPacketByName(const WideStringView& wsName) {
 }
 
 CFX_XMLNode* GetDocumentNode(CFX_XMLNode* pRootNode) {
-  for (CFX_XMLNode* pXMLNode = pRootNode->GetFirstChild(); pXMLNode;
-       pXMLNode = pXMLNode->GetNextSibling()) {
+  for (const auto& pXMLNode : *pRootNode) {
     if (pXMLNode->GetType() != FX_XMLNODE_Element)
       continue;
-
-    return pXMLNode;
+    return pXMLNode.get();
   }
   return nullptr;
 }
@@ -232,11 +230,10 @@ CFX_XMLNode* GetDataSetsFromXDP(CFX_XMLNode* pXMLDocumentNode) {
     return nullptr;
   }
 
-  for (CFX_XMLNode* pDatasetsNode = pXMLDocumentNode->GetFirstChild();
-       pDatasetsNode; pDatasetsNode = pDatasetsNode->GetNextSibling()) {
-    if (MatchNodeName(pDatasetsNode, datasets_packet->name,
+  for (const auto& pDatasetsNode : *pXMLDocumentNode) {
+    if (MatchNodeName(pDatasetsNode.get(), datasets_packet->name,
                       datasets_packet->uri, datasets_packet->flags)) {
-      return pDatasetsNode;
+      return pDatasetsNode.get();
     }
   }
   return nullptr;
@@ -248,19 +245,19 @@ bool IsStringAllWhitespace(WideString wsText) {
 }
 
 void ConvertXMLToPlainText(CFX_XMLElement* pRootXMLNode, WideString& wsOutput) {
-  for (CFX_XMLNode* pXMLChild = pRootXMLNode->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pRootXMLNode) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
         WideString wsTextData =
-            static_cast<CFX_XMLElement*>(pXMLChild)->GetTextData();
+            static_cast<CFX_XMLElement*>(pXMLChild.get())->GetTextData();
         wsTextData += L"\n";
         wsOutput += wsTextData;
         break;
       }
       case FX_XMLNODE_Text:
       case FX_XMLNODE_CharData: {
-        WideString wsText = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
+        WideString wsText =
+            static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
         if (IsStringAllWhitespace(wsText))
           continue;
 
@@ -307,10 +304,9 @@ WideString GetPlainTextFromRichText(CFX_XMLNode* pXMLNode) {
     default:
       break;
   }
-  for (CFX_XMLNode* pChildXML = pXMLNode->GetFirstChild(); pChildXML;
-       pChildXML = pChildXML->GetNextSibling()) {
-    wsPlainText += GetPlainTextFromRichText(pChildXML);
-  }
+
+  for (const auto& pChildXML : *pXMLNode)
+    wsPlainText += GetPlainTextFromRichText(pChildXML.get());
 
   return wsPlainText;
 }
@@ -360,8 +356,7 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
   XFA_PacketType ePacketID = pXFANode->GetPacketType();
   if (ePacketID == XFA_PacketType::Datasets) {
     if (pXFANode->GetElementType() == XFA_Element::DataValue) {
-      for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-           pXMLChild = pXMLChild->GetNextSibling()) {
+      for (const auto& pXMLChild : *pXMLNode) {
         FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
         if (eNodeType == FX_XMLNODE_Instruction)
           continue;
@@ -372,7 +367,7 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
           if (!pXFAChild)
             return;
 
-          CFX_XMLElement* child = static_cast<CFX_XMLElement*>(pXMLChild);
+          CFX_XMLElement* child = static_cast<CFX_XMLElement*>(pXMLChild.get());
           WideString wsNodeStr = child->GetLocalTagName();
           pXFAChild->JSObject()->SetCData(XFA_Attribute::Name, wsNodeStr, false,
                                           false);
@@ -382,7 +377,7 @@ void CXFA_DocumentParser::ConstructXFANode(CXFA_Node* pXFANode,
                                             false, false);
 
           pXFANode->InsertChild(pXFAChild, nullptr);
-          pXFAChild->SetXMLMappingNode(pXMLChild);
+          pXFAChild->SetXMLMappingNode(pXMLChild.get());
           pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
           break;
         }
@@ -461,17 +456,16 @@ CXFA_Node* CXFA_DocumentParser::ParseAsXDPPacket_XDP(
 
   CFX_XMLNode* pXMLConfigDOMRoot = nullptr;
   CXFA_Node* pXFAConfigDOMRoot = nullptr;
-  for (CFX_XMLNode* pChildItem = pXMLDocumentNode->GetFirstChild(); pChildItem;
-       pChildItem = pChildItem->GetNextSibling()) {
+  for (const auto& pChildItem : *pXMLDocumentNode) {
     const PacketInfo* pPacketInfo = GetPacketByIndex(XFA_PacketType::Config);
-    if (!MatchNodeName(pChildItem, pPacketInfo->name, pPacketInfo->uri,
+    if (!MatchNodeName(pChildItem.get(), pPacketInfo->name, pPacketInfo->uri,
                        pPacketInfo->flags)) {
       continue;
     }
     if (pXFARootNode->GetFirstChildByName(pPacketInfo->hash))
       return nullptr;
 
-    pXMLConfigDOMRoot = pChildItem;
+    pXMLConfigDOMRoot = pChildItem.get();
     pXFAConfigDOMRoot = ParseAsXDPPacket_Config(pXMLConfigDOMRoot);
     if (pXFAConfigDOMRoot)
       pXFARootNode->InsertChild(pXFAConfigDOMRoot, nullptr);
@@ -480,14 +474,14 @@ CXFA_Node* CXFA_DocumentParser::ParseAsXDPPacket_XDP(
   CFX_XMLNode* pXMLDatasetsDOMRoot = nullptr;
   CFX_XMLNode* pXMLFormDOMRoot = nullptr;
   CFX_XMLNode* pXMLTemplateDOMRoot = nullptr;
-  for (CFX_XMLNode* pChildItem = pXMLDocumentNode->GetFirstChild(); pChildItem;
-       pChildItem = pChildItem->GetNextSibling()) {
-    if (!pChildItem || pChildItem->GetType() != FX_XMLNODE_Element)
+  for (const auto& pChildItem : *pXMLDocumentNode) {
+    if (pChildItem->GetType() != FX_XMLNODE_Element)
       continue;
-    if (pChildItem == pXMLConfigDOMRoot)
+    if (pChildItem.get() == pXMLConfigDOMRoot)
       continue;
 
-    CFX_XMLElement* pElement = reinterpret_cast<CFX_XMLElement*>(pChildItem);
+    CFX_XMLElement* pElement =
+        reinterpret_cast<CFX_XMLElement*>(pChildItem.get());
     WideString wsPacketName = pElement->GetLocalTagName();
     const PacketInfo* pPacketInfo =
         GetPacketByName(wsPacketName.AsStringView());
@@ -771,11 +765,11 @@ CXFA_Node* CXFA_DocumentParser::NormalLoader(CXFA_Node* pXFANode,
                                              XFA_PacketType ePacketID,
                                              bool bUseAttribute) {
   bool bOneOfPropertyFound = false;
-  for (CFX_XMLNode* pXMLChild = pXMLDoc->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pXMLDoc) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
-        CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
+        CFX_XMLElement* pXMLElement =
+            static_cast<CFX_XMLElement*>(pXMLChild.get());
         WideString wsTagName = pXMLElement->GetLocalTagName();
         XFA_Element eType = CXFA_Node::NameToElement(wsTagName);
         if (eType == XFA_Element::Unknown)
@@ -837,9 +831,11 @@ CXFA_Node* CXFA_DocumentParser::NormalLoader(CXFA_Node* pXFANode,
             NormalLoader(pXFAChild, pXMLElement, ePacketID, bUseAttribute);
             break;
         }
-      } break;
+        break;
+      }
       case FX_XMLNODE_Instruction:
-        ParseInstruction(pXFANode, static_cast<CFX_XMLInstruction*>(pXMLChild),
+        ParseInstruction(pXFANode,
+                         static_cast<CFX_XMLInstruction*>(pXMLChild.get()),
                          ePacketID);
         break;
       default:
@@ -865,8 +861,7 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
     pXFANode->SetXMLMappingNode(pXMLNode);
 
   WideString wsValue;
-  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pXMLNode) {
     FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
     if (eNodeType == FX_XMLNODE_Instruction)
       continue;
@@ -875,19 +870,20 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
       if (eNodeType != FX_XMLNODE_Element)
         break;
 
-      if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild)))
-        wsValue +=
-            GetPlainTextFromRichText(static_cast<CFX_XMLElement*>(pXMLChild));
+      if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild.get())))
+        wsValue += GetPlainTextFromRichText(
+            static_cast<CFX_XMLElement*>(pXMLChild.get()));
     } else if (element == XFA_Element::Sharpxml) {
       if (eNodeType != FX_XMLNODE_Element)
         break;
 
-      ConvertXMLToPlainText(static_cast<CFX_XMLElement*>(pXMLChild), wsValue);
+      ConvertXMLToPlainText(static_cast<CFX_XMLElement*>(pXMLChild.get()),
+                            wsValue);
     } else {
       if (eNodeType == FX_XMLNODE_Element)
         break;
       if (eNodeType == FX_XMLNODE_Text || eNodeType == FX_XMLNODE_CharData)
-        wsValue = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
+        wsValue = static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
     }
     break;
   }
@@ -909,11 +905,11 @@ void CXFA_DocumentParser::ParseContentNode(CXFA_Node* pXFANode,
 void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
                                          CFX_XMLNode* pXMLNode,
                                          XFA_PacketType ePacketID) {
-  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pXMLNode) {
     switch (pXMLChild->GetType()) {
       case FX_XMLNODE_Element: {
-        CFX_XMLElement* pXMLElement = static_cast<CFX_XMLElement*>(pXMLChild);
+        CFX_XMLElement* pXMLElement =
+            static_cast<CFX_XMLElement*>(pXMLChild.get());
         {
           WideString wsNamespaceURI = GetElementTagNamespaceURI(pXMLElement);
           if (wsNamespaceURI == L"http://www.xfa.com/schema/xfa-package/" ||
@@ -945,11 +941,10 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
           }
         }
         if (eNodeType == XFA_Element::DataModel) {
-          for (CFX_XMLNode* pXMLDataChild = pXMLElement->GetFirstChild();
-               pXMLDataChild; pXMLDataChild = pXMLDataChild->GetNextSibling()) {
+          for (const auto& pXMLDataChild : *pXMLElement) {
             if (pXMLDataChild->GetType() == FX_XMLNODE_Element) {
               if (!XFA_RecognizeRichText(
-                      static_cast<CFX_XMLElement*>(pXMLDataChild))) {
+                      static_cast<CFX_XMLElement*>(pXMLDataChild.get()))) {
                 eNodeType = XFA_Element::DataGroup;
                 break;
               }
@@ -1010,7 +1005,7 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
         if (eNodeType == XFA_Element::DataGroup)
           ParseDataGroup(pXFAChild, pXMLElement, ePacketID);
         else if (bNeedValue)
-          ParseDataValue(pXFAChild, pXMLChild, XFA_PacketType::Datasets);
+          ParseDataValue(pXFAChild, pXMLChild.get(), XFA_PacketType::Datasets);
 
         pXFAChild->SetXMLMappingNode(pXMLElement);
         pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
@@ -1018,7 +1013,7 @@ void CXFA_DocumentParser::ParseDataGroup(CXFA_Node* pXFANode,
       }
       case FX_XMLNODE_CharData:
       case FX_XMLNODE_Text: {
-        CFX_XMLText* pXMLText = static_cast<CFX_XMLText*>(pXMLChild);
+        CFX_XMLText* pXMLText = static_cast<CFX_XMLText*>(pXMLChild.get());
         WideString wsText = pXMLText->GetText();
         if (IsStringAllWhitespace(wsText))
           continue;
@@ -1048,23 +1043,23 @@ void CXFA_DocumentParser::ParseDataValue(CXFA_Node* pXFANode,
   CFX_WideTextBuf wsCurValueTextBuf;
   bool bMarkAsCompound = false;
   CFX_XMLNode* pXMLCurValueNode = nullptr;
-  for (CFX_XMLNode* pXMLChild = pXMLNode->GetFirstChild(); pXMLChild;
-       pXMLChild = pXMLChild->GetNextSibling()) {
+  for (const auto& pXMLChild : *pXMLNode) {
     FX_XMLNODETYPE eNodeType = pXMLChild->GetType();
     if (eNodeType == FX_XMLNODE_Instruction)
       continue;
 
     if (eNodeType == FX_XMLNODE_Text || eNodeType == FX_XMLNODE_CharData) {
-      WideString wsText = static_cast<CFX_XMLText*>(pXMLChild)->GetText();
+      WideString wsText = static_cast<CFX_XMLText*>(pXMLChild.get())->GetText();
       if (!pXMLCurValueNode)
-        pXMLCurValueNode = pXMLChild;
+        pXMLCurValueNode = pXMLChild.get();
 
       wsCurValueTextBuf << wsText;
-    } else if (XFA_RecognizeRichText(static_cast<CFX_XMLElement*>(pXMLChild))) {
-      WideString wsText =
-          GetPlainTextFromRichText(static_cast<CFX_XMLElement*>(pXMLChild));
+    } else if (XFA_RecognizeRichText(
+                   static_cast<CFX_XMLElement*>(pXMLChild.get()))) {
+      WideString wsText = GetPlainTextFromRichText(
+          static_cast<CFX_XMLElement*>(pXMLChild.get()));
       if (!pXMLCurValueNode)
-        pXMLCurValueNode = pXMLChild;
+        pXMLCurValueNode = pXMLChild.get();
 
       wsCurValueTextBuf << wsText;
     } else {
@@ -1095,12 +1090,12 @@ void CXFA_DocumentParser::ParseDataValue(CXFA_Node* pXFANode,
         return;
 
       WideString wsNodeStr =
-          static_cast<CFX_XMLElement*>(pXMLChild)->GetLocalTagName();
+          static_cast<CFX_XMLElement*>(pXMLChild.get())->GetLocalTagName();
       pXFAChild->JSObject()->SetCData(XFA_Attribute::Name, wsNodeStr, false,
                                       false);
-      ParseDataValue(pXFAChild, pXMLChild, ePacketID);
+      ParseDataValue(pXFAChild, pXMLChild.get(), ePacketID);
       pXFANode->InsertChild(pXFAChild, nullptr);
-      pXFAChild->SetXMLMappingNode(pXMLChild);
+      pXFAChild->SetXMLMappingNode(pXMLChild.get());
       pXFAChild->SetFlag(XFA_NodeFlag_Initialized);
       WideString wsCurValue =
           pXFAChild->JSObject()->GetCData(XFA_Attribute::Value);
diff --git a/xfa/fxfa/parser/cxfa_xmllocale.cpp b/xfa/fxfa/parser/cxfa_xmllocale.cpp
index ffb4cd9dde..cbee75725a 100644
--- a/xfa/fxfa/parser/cxfa_xmllocale.cpp
+++ b/xfa/fxfa/parser/cxfa_xmllocale.cpp
@@ -38,11 +38,10 @@ std::unique_ptr<CXFA_XMLLocale> CXFA_XMLLocale::Create(
     return nullptr;
 
   CFX_XMLElement* locale = nullptr;
-  for (auto* child = root->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
+  for (const auto& child : *(root.get())) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
-    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child);
+    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child.get());
     if (elem->GetName() == L"locale") {
       locale = elem;
       break;
@@ -126,12 +125,11 @@ WideString CXFA_XMLLocale::GetCalendarSymbol(const WideStringView& symbol,
 
   WideString pstrSymbolNames = symbol + L"Names";
   CFX_XMLElement* name_child = nullptr;
-  for (auto* name = child->GetFirstChild(); name;
-       name = name->GetNextSibling()) {
+  for (const auto& name : *child) {
     if (name->GetType() != FX_XMLNODE_Element)
       continue;
 
-    auto* elem = static_cast<CFX_XMLElement*>(name);
+    auto* elem = static_cast<CFX_XMLElement*>(name.get());
     if (elem->GetName() != pstrSymbolNames)
       continue;
 
@@ -210,12 +208,11 @@ WideString CXFA_XMLLocale::GetNumPattern(FX_LOCALENUMSUBCATEGORY eType) const {
 WideString CXFA_XMLLocale::GetPattern(CFX_XMLElement* patterns,
                                       const WideStringView& bsTag,
                                       const WideStringView& wsName) const {
-  for (auto* child = patterns->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
+  for (const auto& child : *patterns) {
     if (child->GetType() != FX_XMLNODE_Element)
       continue;
 
-    CFX_XMLElement* pattern = static_cast<CFX_XMLElement*>(child);
+    CFX_XMLElement* pattern = static_cast<CFX_XMLElement*>(child.get());
     if (pattern->GetName() != bsTag)
       continue;
     if (pattern->GetAttribute(L"name") != wsName)
diff --git a/xfa/fxfa/parser/xfa_utils.cpp b/xfa/fxfa/parser/xfa_utils.cpp
index de0f76b6b4..876cdf0c75 100644
--- a/xfa/fxfa/parser/xfa_utils.cpp
+++ b/xfa/fxfa/parser/xfa_utils.cpp
@@ -211,7 +211,10 @@ void RegenerateFormFile_Changed(CXFA_Node* pNode,
         if (!pExDataXML)
           break;
 
-        CFX_XMLNode* pRichTextXML = pExDataXML->GetFirstChild();
+        if (pExDataXML->begin() == pExDataXML->end())
+          return;
+
+        CFX_XMLNode* pRichTextXML = pExDataXML->begin()->get();
         if (!pRichTextXML)
           break;