3 files changed, 9 insertions, 11 deletions
diff --git a/xfa/fxfa/parser/cxfa_document.cpp b/xfa/fxfa/parser/cxfa_document.cpp
index 713e15c4fa..c3e73e2f19 100644
--- a/xfa/fxfa/parser/cxfa_document.cpp
+++ b/xfa/fxfa/parser/cxfa_document.cpp
@@ -7,6 +7,7 @@
 #include "xfa/fxfa/parser/cxfa_document.h"
 
 #include <set>
+#include <utility>
 
 #include "core/fxcrt/fx_extension.h"
 #include "core/fxcrt/fx_fallthrough.h"
@@ -1633,7 +1634,7 @@ void CXFA_Document::DoDataMerge() {
                                         false);
 
     CFX_XMLElement* ref = pDatasetsXMLNode.get();
-    m_pRootNode->GetXMLMappingNode()->AppendChild(pDatasetsXMLNode.release());
+    m_pRootNode->GetXMLMappingNode()->AppendChild(std::move(pDatasetsXMLNode));
     m_pRootNode->InsertChild(pDatasetsRoot, nullptr);
     pDatasetsRoot->SetXMLMappingNode(ref);
   }
diff --git a/xfa/fxfa/parser/cxfa_document_parser.cpp b/xfa/fxfa/parser/cxfa_document_parser.cpp
index 62828d71a7..4770d849b1 100644
--- a/xfa/fxfa/parser/cxfa_document_parser.cpp
+++ b/xfa/fxfa/parser/cxfa_document_parser.cpp
@@ -349,7 +349,7 @@ std::unique_ptr<CFX_XMLNode> CXFA_DocumentParser::LoadXML(
   ASSERT(pStream);
 
   auto root = pdfium::MakeUnique<CFX_XMLNode>();
-  root->AppendChild(new CFX_XMLInstruction(L"xml"));
+  root->AppendChild(pdfium::MakeUnique<CFX_XMLInstruction>(L"xml"));
 
   CFX_XMLParser parser(root.get(), pStream);
   return parser.Parse() ? std::move(root) : nullptr;
@@ -674,7 +674,10 @@ CXFA_Node* CXFA_DocumentParser::ParseAsXDPPacket_Data(
       static_cast<CFX_XMLElement*>(pXMLDocumentNode)
           ->RemoveAttribute(L"xmlns:xfa");
     }
-    pDataElement->AppendChild(pXMLDocumentNode);
+    // The node was either removed from the parent above, or already has no
+    // parent so we can take ownership.
+    pDataElement->AppendChild(
+        pdfium::WrapUnique<CFX_XMLNode>(pXMLDocumentNode));
     pDataXMLNode.Reset(std::move(pDataElement));
   }
   if (!pDataXMLNode)
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index 7da4ed551d..3399023037 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -1158,14 +1158,8 @@ void CXFA_Node::InsertChild(int32_t index, CXFA_Node* pNode) {
     return;
 
   ASSERT(!pNode->xml_node_->GetParent());
-
-  xml_node_->InsertChildNode(pNode->xml_node_.Get(), index);
-  if (pNode->xml_node_.IsOwned()) {
-    // We remove ownership of the XML node from pNode and transfer the ownership
-    // into the XML tree, the pNode still has an unowned pointer to the XML
-    // node.
-    pNode->xml_node_.Release().release();
-  }
+  ASSERT(pNode->xml_node_.IsOwned());
+  xml_node_->InsertChildNode(pNode->xml_node_.Release(), index);
 }
 
 void CXFA_Node::InsertChild(CXFA_Node* pNode, CXFA_Node* pBeforeNode) {