5 files changed, 14 insertions, 22 deletions
diff --git a/core/fpdfdoc/cpdf_metadata.cpp b/core/fpdfdoc/cpdf_metadata.cpp
index 323de4ffcf..5ef7312752 100644
--- a/core/fpdfdoc/cpdf_metadata.cpp
+++ b/core/fpdfdoc/cpdf_metadata.cpp
@@ -49,11 +49,9 @@ void CheckForSharedFormInternal(CFX_XMLElement* element,
 
   for (auto* child = element->GetFirstChild(); child;
        child = child->GetNextSibling()) {
-    if (child->GetType() != FX_XMLNODE_Element)
-      continue;
-
-    CheckForSharedFormInternal(static_cast<CFX_XMLElement*>(child),
-                               unsupported);
+    CFX_XMLElement* pElement = ToXMLElement(child);
+    if (pElement)
+      CheckForSharedFormInternal(pElement, unsupported);
   }
 }
 
diff --git a/core/fxcrt/xml/cfx_xmlelement.cpp b/core/fxcrt/xml/cfx_xmlelement.cpp
index 74351b8c58..4bb4eae1bd 100644
--- a/core/fxcrt/xml/cfx_xmlelement.cpp
+++ b/core/fxcrt/xml/cfx_xmlelement.cpp
@@ -125,11 +125,8 @@ CFX_XMLElement* CFX_XMLElement::GetFirstChildNamed(
 CFX_XMLElement* CFX_XMLElement::GetNthChildNamed(const WideStringView& name,
                                                  size_t idx) const {
   for (auto* child = GetFirstChild(); child; child = child->GetNextSibling()) {
-    if (child->GetType() != FX_XMLNODE_Element)
-      continue;
-
-    CFX_XMLElement* elem = static_cast<CFX_XMLElement*>(child);
-    if (elem->name_ != name)
+    CFX_XMLElement* elem = ToXMLElement(child);
+    if (!elem || elem->name_ != name)
       continue;
     if (idx == 0)
       return elem;
diff --git a/core/fxcrt/xml/cfx_xmlelement_unittest.cpp b/core/fxcrt/xml/cfx_xmlelement_unittest.cpp
index 1e53ef3dd7..dfc60a10c3 100644
--- a/core/fxcrt/xml/cfx_xmlelement_unittest.cpp
+++ b/core/fxcrt/xml/cfx_xmlelement_unittest.cpp
@@ -73,7 +73,6 @@ TEST(CFX_XMLElementTest, Attributes) {
 
 TEST(CFX_XMLElementTest, Clone) {
   CFX_XMLDocument doc;
-
   CFX_XMLElement node(L"test:node");
   node.SetAttribute(L"first", L"one");
   node.SetAttribute(L"second", L"two");
@@ -87,10 +86,9 @@ TEST(CFX_XMLElementTest, Clone) {
 
   CFX_XMLNode* clone = node.Clone(&doc);
   EXPECT_TRUE(clone != nullptr);
-
   ASSERT_EQ(FX_XMLNODE_Element, clone->GetType());
-  CFX_XMLElement* inst = static_cast<CFX_XMLElement*>(clone);
 
+  CFX_XMLElement* inst = ToXMLElement(clone);
   EXPECT_EQ(L"test:node", inst->GetName());
   EXPECT_EQ(L"node", inst->GetLocalTagName());
   EXPECT_EQ(L"test", inst->GetNamespacePrefix());
diff --git a/core/fxcrt/xml/cfx_xmlinstruction_unittest.cpp b/core/fxcrt/xml/cfx_xmlinstruction_unittest.cpp
index 74ef87e344..b25a18be9c 100644
--- a/core/fxcrt/xml/cfx_xmlinstruction_unittest.cpp
+++ b/core/fxcrt/xml/cfx_xmlinstruction_unittest.cpp
@@ -132,7 +132,7 @@ TEST(CFX_XMLInstructionTest, ParseAndReSaveInnerInstruction) {
   ASSERT_TRUE(root->GetFirstChild() != nullptr);
   ASSERT_TRUE(root->GetFirstChild()->GetType() == FX_XMLNODE_Element);
 
-  CFX_XMLElement* node = static_cast<CFX_XMLElement*>(root->GetFirstChild());
+  CFX_XMLElement* node = ToXMLElement(root->GetFirstChild());
   EXPECT_EQ(L"node", node->GetName());
 
   CFX_XMLInstruction* instruction = nullptr;
diff --git a/core/fxcrt/xml/cfx_xmlparser.cpp b/core/fxcrt/xml/cfx_xmlparser.cpp
index 268774a10f..dd28cf8adc 100644
--- a/core/fxcrt/xml/cfx_xmlparser.cpp
+++ b/core/fxcrt/xml/cfx_xmlparser.cpp
@@ -262,11 +262,10 @@ bool CFX_XMLParser::DoSyntaxParse(CFX_XMLDocument* doc) {
             current_buffer_idx++;
             current_parser_state = FDE_XmlSyntaxState::AttriName;
 
-            if (current_node_ &&
-                current_node_->GetType() == FX_XMLNODE_Element) {
-              static_cast<CFX_XMLElement*>(current_node_)
-                  ->SetAttribute(current_attribute_name, GetTextData());
-            }
+            CFX_XMLElement* elem = ToXMLElement(current_node_);
+            if (elem)
+              elem->SetAttribute(current_attribute_name, GetTextData());
+
             current_attribute_name.clear();
           } else {
             ProcessTextChar(ch);
@@ -311,13 +310,13 @@ bool CFX_XMLParser::DoSyntaxParse(CFX_XMLDocument* doc) {
               node_type_stack.pop();
               current_parser_state = FDE_XmlSyntaxState::Text;
 
-              if (current_node_->GetType() != FX_XMLNODE_Element)
+              CFX_XMLElement* element = ToXMLElement(current_node_);
+              if (!element)
                 return false;
 
               WideString element_name = GetTextData();
               if (element_name.GetLength() > 0 &&
-                  element_name !=
-                      static_cast<CFX_XMLElement*>(current_node_)->GetName()) {
+                  element_name != element->GetName()) {
                 return false;
               }