diff --git a/core/fpdfapi/page/cpdf_contentmark.cpp b/core/fpdfapi/page/cpdf_contentmark.cpp
index 7d411b2..cf8e37e 100644
--- a/core/fpdfapi/page/cpdf_contentmark.cpp
+++ b/core/fpdfapi/page/cpdf_contentmark.cpp
@@ -61,7 +61,7 @@
 }
 
 bool CPDF_ContentMark::LookupMark(const ByteStringView& mark,
-                                  CPDF_Dictionary*& pDict) const {
+                                  CPDF_Dictionary** pDict) const {
   const MarkData* pData = m_Ref.GetObject();
   if (!pData)
     return false;
@@ -69,7 +69,7 @@
   for (int i = 0; i < pData->CountItems(); i++) {
     const CPDF_ContentMarkItem& item = pData->GetItem(i);
     if (item.GetName() == mark) {
-      pDict = item.GetParam();
+      *pDict = item.GetParam();
       return true;
     }
   }
diff --git a/core/fpdfapi/page/cpdf_contentmark.h b/core/fpdfapi/page/cpdf_contentmark.h
index f702859..9619b12 100644
--- a/core/fpdfapi/page/cpdf_contentmark.h
+++ b/core/fpdfapi/page/cpdf_contentmark.h
@@ -28,7 +28,7 @@
   const CPDF_ContentMarkItem& GetItem(int i) const;
 
   bool HasMark(const ByteStringView& mark) const;
-  bool LookupMark(const ByteStringView& mark, CPDF_Dictionary*& pDict) const;
+  bool LookupMark(const ByteStringView& mark, CPDF_Dictionary** pDict) const;
   void AddMark(const ByteString& name, CPDF_Dictionary* pDict, bool bDirect);
   void DeleteLastMark();
 
diff --git a/core/fpdfapi/parser/cpdf_simple_parser.cpp b/core/fpdfapi/parser/cpdf_simple_parser.cpp
index 5358b18..b49f842 100644
--- a/core/fpdfapi/parser/cpdf_simple_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_simple_parser.cpp
@@ -14,17 +14,17 @@
 CPDF_SimpleParser::CPDF_SimpleParser(const ByteStringView& str)
     : m_pData(str.raw_str()), m_dwSize(str.GetLength()), m_dwCurPos(0) {}
 
-void CPDF_SimpleParser::ParseWord(const uint8_t*& pStart, uint32_t& dwSize) {
-  pStart = nullptr;
-  dwSize = 0;
+std::pair<const uint8_t*, uint32_t> CPDF_SimpleParser::ParseWord() {
+  const uint8_t* pStart = nullptr;
+  uint8_t dwSize = 0;
   uint8_t ch;
   while (1) {
     if (m_dwSize <= m_dwCurPos)
-      return;
+      return std::make_pair(pStart, dwSize);
     ch = m_pData[m_dwCurPos++];
     while (PDFCharIsWhitespace(ch)) {
       if (m_dwSize <= m_dwCurPos)
-        return;
+        return std::make_pair(pStart, dwSize);
       ch = m_pData[m_dwCurPos++];
     }
 
@@ -33,7 +33,7 @@
 
     while (1) {
       if (m_dwSize <= m_dwCurPos)
-        return;
+        return std::make_pair(pStart, dwSize);
       ch = m_pData[m_dwCurPos++];
       if (PDFCharIsLineEnding(ch))
         break;
@@ -46,19 +46,19 @@
     if (ch == '/') {
       while (1) {
         if (m_dwSize <= m_dwCurPos)
-          return;
+          return std::make_pair(pStart, dwSize);
         ch = m_pData[m_dwCurPos++];
         if (!PDFCharIsOther(ch) && !PDFCharIsNumeric(ch)) {
           m_dwCurPos--;
           dwSize = m_dwCurPos - start_pos;
-          return;
+          return std::make_pair(pStart, dwSize);
         }
       }
     } else {
       dwSize = 1;
       if (ch == '<') {
         if (m_dwSize <= m_dwCurPos)
-          return;
+          return std::make_pair(pStart, dwSize);
         ch = m_pData[m_dwCurPos++];
         if (ch == '<')
           dwSize = 2;
@@ -66,7 +66,7 @@
           m_dwCurPos--;
       } else if (ch == '>') {
         if (m_dwSize <= m_dwCurPos)
-          return;
+          return std::make_pair(pStart, dwSize);
         ch = m_pData[m_dwCurPos++];
         if (ch == '>')
           dwSize = 2;
@@ -74,13 +74,13 @@
           m_dwCurPos--;
       }
     }
-    return;
+    return std::make_pair(pStart, dwSize);
   }
 
   dwSize = 1;
   while (1) {
     if (m_dwSize <= m_dwCurPos)
-      return;
+      return std::make_pair(pStart, dwSize);
     ch = m_pData[m_dwCurPos++];
 
     if (PDFCharIsDelimiter(ch) || PDFCharIsWhitespace(ch)) {
@@ -89,12 +89,13 @@
     }
     dwSize++;
   }
+  return std::make_pair(pStart, dwSize);
 }
 
 ByteStringView CPDF_SimpleParser::GetWord() {
   const uint8_t* pStart;
   uint32_t dwSize;
-  ParseWord(pStart, dwSize);
+  std::tie(pStart, dwSize) = ParseWord();
   if (dwSize == 1 && pStart[0] == '<') {
     while (m_dwCurPos < m_dwSize && m_pData[m_dwCurPos] != '>') {
       m_dwCurPos++;
diff --git a/core/fpdfapi/parser/cpdf_simple_parser.h b/core/fpdfapi/parser/cpdf_simple_parser.h
index 72cf700..659039e 100644
--- a/core/fpdfapi/parser/cpdf_simple_parser.h
+++ b/core/fpdfapi/parser/cpdf_simple_parser.h
@@ -7,6 +7,8 @@
 #ifndef CORE_FPDFAPI_PARSER_CPDF_SIMPLE_PARSER_H_
 #define CORE_FPDFAPI_PARSER_CPDF_SIMPLE_PARSER_H_
 
+#include <utility>
+
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
 
@@ -25,7 +27,7 @@
   uint32_t GetCurPos() const { return m_dwCurPos; }
 
  private:
-  void ParseWord(const uint8_t*& pStart, uint32_t& dwSize);
+  std::pair<const uint8_t*, uint32_t> ParseWord();
 
   const uint8_t* m_pData;
   uint32_t m_dwSize;
diff --git a/core/fxcodec/codec/ccodec_pngmodule.cpp b/core/fxcodec/codec/ccodec_pngmodule.cpp
index 0531ff1..40bdfba 100644
--- a/core/fxcodec/codec/ccodec_pngmodule.cpp
+++ b/core/fxcodec/codec/ccodec_pngmodule.cpp
@@ -183,8 +183,8 @@
   if (!pContext)
     return;
 
-  uint8_t* src_buf = nullptr;
-  if (!pContext->m_pDelegate->PngAskScanlineBuf(row_num, src_buf))
+  uint8_t* src_buf;
+  if (!pContext->m_pDelegate->PngAskScanlineBuf(row_num, &src_buf))
     png_error(png_ptr, "Ask Scanline buffer Callback Error");
 
   if (src_buf)
diff --git a/core/fxcodec/codec/ccodec_pngmodule.h b/core/fxcodec/codec/ccodec_pngmodule.h
index 121e646..847f67e 100644
--- a/core/fxcodec/codec/ccodec_pngmodule.h
+++ b/core/fxcodec/codec/ccodec_pngmodule.h
@@ -28,7 +28,11 @@
                                int pass,
                                int* color_type,
                                double* gamma) = 0;
-    virtual bool PngAskScanlineBuf(int line, uint8_t*& src_buf) = 0;
+
+    // Returns true on success. |pSrcBuf| will be set if this succeeds.
+    // |pSrcBuf| does not take ownership of the buffer.
+    virtual bool PngAskScanlineBuf(int line, uint8_t** pSrcBuf) = 0;
+
     virtual void PngFillScanlineBufCompleted(int pass, int line) = 0;
   };
 
diff --git a/core/fxcodec/codec/ccodec_progressivedecoder.h b/core/fxcodec/codec/ccodec_progressivedecoder.h
index 05b7c92..ea51429 100644
--- a/core/fxcodec/codec/ccodec_progressivedecoder.h
+++ b/core/fxcodec/codec/ccodec_progressivedecoder.h
@@ -131,7 +131,7 @@
                      int pass,
                      int* color_type,
                      double* gamma) override;
-  bool PngAskScanlineBuf(int line, uint8_t*& src_buf) override;
+  bool PngAskScanlineBuf(int line, uint8_t** pSrcBuf) override;
   void PngFillScanlineBufCompleted(int pass, int line) override;
 
   // CCodec_GifModule::Delegate
diff --git a/core/fxcodec/codec/fx_codec_progress.cpp b/core/fxcodec/codec/fx_codec_progress.cpp
index 746a574..f20e18c 100644
--- a/core/fxcodec/codec/fx_codec_progress.cpp
+++ b/core/fxcodec/codec/fx_codec_progress.cpp
@@ -395,7 +395,7 @@
   return true;
 }
 
-bool CCodec_ProgressiveDecoder::PngAskScanlineBuf(int line, uint8_t*& src_buf) {
+bool CCodec_ProgressiveDecoder::PngAskScanlineBuf(int line, uint8_t** pSrcBuf) {
   RetainPtr<CFX_DIBitmap> pDIBitmap = m_pDeviceBitmap;
   if (!pDIBitmap) {
     NOTREACHED();
@@ -406,7 +406,7 @@
     int32_t row = (int32_t)((line - m_clipBox.top) * scale_y) + m_startY;
     uint8_t* src_scan = (uint8_t*)pDIBitmap->GetScanline(row);
     uint8_t* des_scan = m_pDecodeBuf;
-    src_buf = m_pDecodeBuf;
+    *pSrcBuf = m_pDecodeBuf;
     int32_t src_Bpp = pDIBitmap->GetBPP() >> 3;
     int32_t des_Bpp = (m_SrcFormat & 0xff) >> 3;
     int32_t src_left = m_startX;
diff --git a/core/fxcrt/css/cfx_cssdeclaration.cpp b/core/fxcrt/css/cfx_cssdeclaration.cpp
index c44c878..90bdf4e 100644
--- a/core/fxcrt/css/cfx_cssdeclaration.cpp
+++ b/core/fxcrt/css/cfx_cssdeclaration.cpp
@@ -256,7 +256,7 @@
     CFX_CSSPrimitiveType eType;
     CFX_CSSValueListParser list(pszValue + 4, iValueLen - 5, ',');
     for (int32_t i = 0; i < 3; ++i) {
-      if (!list.NextValue(eType, pszValue, iValueLen))
+      if (!list.NextValue(&eType, &pszValue, &iValueLen))
         return false;
       if (eType != CFX_CSSPrimitiveType::Number)
         return false;
@@ -477,7 +477,7 @@
   const uint32_t dwType = pTable->dwType;
   CFX_CSSPrimitiveType eType;
   std::vector<RetainPtr<CFX_CSSValue>> list;
-  while (parser.NextValue(eType, pszValue, iValueLen)) {
+  while (parser.NextValue(&eType, &pszValue, &iValueLen)) {
     switch (eType) {
       case CFX_CSSPrimitiveType::Number:
         if (dwType & CFX_CSSVALUETYPE_MaybeNumber) {
@@ -596,7 +596,7 @@
 
   CFX_CSSValueListParser parser(pszValue, iValueLen, ' ');
   CFX_CSSPrimitiveType eType;
-  while (parser.NextValue(eType, pszValue, iValueLen)) {
+  while (parser.NextValue(&eType, &pszValue, &iValueLen)) {
     switch (eType) {
       case CFX_CSSPrimitiveType::Number: {
         if (pWidth)
@@ -653,7 +653,7 @@
   RetainPtr<CFX_CSSValue> pLineHeight;
   std::vector<RetainPtr<CFX_CSSValue>> familyList;
   CFX_CSSPrimitiveType eType;
-  while (parser.NextValue(eType, pszValue, iValueLen)) {
+  while (parser.NextValue(&eType, &pszValue, &iValueLen)) {
     switch (eType) {
       case CFX_CSSPrimitiveType::String: {
         const CFX_CSSPropertyValueTable* pValue =
@@ -708,7 +708,7 @@
           familyList.push_back(pdfium::MakeRetain<CFX_CSSStringValue>(
               WideString(pszValue, iValueLen)));
         }
-        parser.m_Separator = ',';
+        parser.UseCommaSeparator();
         break;
       }
       case CFX_CSSPrimitiveType::Number: {
diff --git a/core/fxcrt/css/cfx_cssvaluelistparser.cpp b/core/fxcrt/css/cfx_cssvaluelistparser.cpp
index 05204e5..2339dec 100644
--- a/core/fxcrt/css/cfx_cssvaluelistparser.cpp
+++ b/core/fxcrt/css/cfx_cssvaluelistparser.cpp
@@ -15,46 +15,46 @@
   ASSERT(psz && iLen > 0);
 }
 
-bool CFX_CSSValueListParser::NextValue(CFX_CSSPrimitiveType& eType,
-                                       const wchar_t*& pStart,
-                                       int32_t& iLength) {
+bool CFX_CSSValueListParser::NextValue(CFX_CSSPrimitiveType* eType,
+                                       const wchar_t** pStart,
+                                       int32_t* iLength) {
   while (m_pCur < m_pEnd && (*m_pCur <= ' ' || *m_pCur == m_Separator))
     ++m_pCur;
 
   if (m_pCur >= m_pEnd)
     return false;
 
-  eType = CFX_CSSPrimitiveType::Unknown;
-  pStart = m_pCur;
-  iLength = 0;
+  *eType = CFX_CSSPrimitiveType::Unknown;
+  *pStart = m_pCur;
+  *iLength = 0;
   wchar_t wch = *m_pCur;
   if (wch == '#') {
-    iLength = SkipTo(' ', false, false);
-    if (iLength == 4 || iLength == 7)
-      eType = CFX_CSSPrimitiveType::RGB;
+    *iLength = SkipTo(' ', false, false);
+    if (*iLength == 4 || *iLength == 7)
+      *eType = CFX_CSSPrimitiveType::RGB;
   } else if (std::iswdigit(wch) || wch == '.' || wch == '-' || wch == '+') {
     while (m_pCur < m_pEnd && (*m_pCur > ' ' && *m_pCur != m_Separator))
       ++m_pCur;
 
-    iLength = m_pCur - pStart;
-    eType = CFX_CSSPrimitiveType::Number;
+    *iLength = m_pCur - *pStart;
+    *eType = CFX_CSSPrimitiveType::Number;
   } else if (wch == '\"' || wch == '\'') {
-    pStart++;
+    ++(*pStart);
     m_pCur++;
-    iLength = SkipTo(wch, false, false);
+    *iLength = SkipTo(wch, false, false);
     m_pCur++;
-    eType = CFX_CSSPrimitiveType::String;
+    *eType = CFX_CSSPrimitiveType::String;
   } else if (m_pEnd - m_pCur > 5 && m_pCur[3] == '(') {
     if (FXSYS_wcsnicmp(L"rgb", m_pCur, 3) == 0) {
-      iLength = SkipTo(')', false, false) + 1;
+      *iLength = SkipTo(')', false, false) + 1;
       m_pCur++;
-      eType = CFX_CSSPrimitiveType::RGB;
+      *eType = CFX_CSSPrimitiveType::RGB;
     }
   } else {
-    iLength = SkipTo(m_Separator, true, true);
-    eType = CFX_CSSPrimitiveType::String;
+    *iLength = SkipTo(m_Separator, true, true);
+    *eType = CFX_CSSPrimitiveType::String;
   }
-  return m_pCur <= m_pEnd && iLength > 0;
+  return m_pCur <= m_pEnd && *iLength > 0;
 }
 
 int32_t CFX_CSSValueListParser::SkipTo(wchar_t wch,
diff --git a/core/fxcrt/css/cfx_cssvaluelistparser.h b/core/fxcrt/css/cfx_cssvaluelistparser.h
index 514db9e..6872ee2 100644
--- a/core/fxcrt/css/cfx_cssvaluelistparser.h
+++ b/core/fxcrt/css/cfx_cssvaluelistparser.h
@@ -14,15 +14,15 @@
  public:
   CFX_CSSValueListParser(const wchar_t* psz, int32_t iLen, wchar_t separator);
 
-  bool NextValue(CFX_CSSPrimitiveType& eType,
-                 const wchar_t*& pStart,
-                 int32_t& iLength);
-
-  wchar_t m_Separator;
+  bool NextValue(CFX_CSSPrimitiveType* eType,
+                 const wchar_t** pStart,
+                 int32_t* iLength);
+  void UseCommaSeparator() { m_Separator = ','; }
 
  private:
   int32_t SkipTo(wchar_t wch, bool breakOnSpace, bool matchBrackets);
 
+  wchar_t m_Separator;
   const wchar_t* m_pCur;
   const wchar_t* m_pEnd;
 };
diff --git a/core/fxcrt/css/cfx_cssvaluelistparser_unittest.cpp b/core/fxcrt/css/cfx_cssvaluelistparser_unittest.cpp
index 62a542b..e232a2d 100644
--- a/core/fxcrt/css/cfx_cssvaluelistparser_unittest.cpp
+++ b/core/fxcrt/css/cfx_cssvaluelistparser_unittest.cpp
@@ -16,28 +16,28 @@
   int32_t len;
 
   auto parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"#abc", 4, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::RGB, type);
   EXPECT_EQ(L"#abc", WideString(start, len));
-  EXPECT_FALSE(parser->NextValue(type, start, len));
+  EXPECT_FALSE(parser->NextValue(&type, &start, &len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"#abcdef", 7, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::RGB, type);
   EXPECT_EQ(L"#abcdef", WideString(start, len));
-  EXPECT_FALSE(parser->NextValue(type, start, len));
+  EXPECT_FALSE(parser->NextValue(&type, &start, &len));
 
   parser =
       pdfium::MakeUnique<CFX_CSSValueListParser>(L"rgb(1, 255, 4)", 14, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::RGB, type);
   EXPECT_EQ(L"rgb(1, 255, 4)", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"#abcdefghij", 11, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Unknown, type);
   EXPECT_EQ(L"#abcdefghij", WideString(start, len));
-  EXPECT_FALSE(parser->NextValue(type, start, len));
+  EXPECT_FALSE(parser->NextValue(&type, &start, &len));
 }
 
 TEST(CFX_CSSValueListParserTest, number_parsing) {
@@ -46,38 +46,38 @@
   int32_t len;
 
   auto parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"1234", 4, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"1234", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"-1234", 5, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"-1234", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"+1234", 5, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"+1234", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L".1234", 5, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L".1234", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"4321.1234", 9, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"4321.1234", WideString(start, len));
 
   // TODO(dsinclair): These should probably fail but currently don't.
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"4321.12.34", 10, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"4321.12.34", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"43a1.12.34", 10, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"43a1.12.34", WideString(start, len));
 }
@@ -89,18 +89,18 @@
 
   auto parser =
       pdfium::MakeUnique<CFX_CSSValueListParser>(L"'string'", 8, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::String, type);
   EXPECT_EQ(L"string", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"\"another string\"", 16,
                                                       L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::String, type);
   EXPECT_EQ(L"another string", WideString(start, len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"standalone", 10, L' ');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::String, type);
   EXPECT_EQ(L"standalone", WideString(start, len));
 }
@@ -111,31 +111,31 @@
   int32_t len;
 
   auto parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"1, 2, 3", 7, L',');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"1", WideString(start, len));
 
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"2", WideString(start, len));
 
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"3", WideString(start, len));
 
-  EXPECT_FALSE(parser->NextValue(type, start, len));
+  EXPECT_FALSE(parser->NextValue(&type, &start, &len));
 
   parser = pdfium::MakeUnique<CFX_CSSValueListParser>(L"'str', rgb(1, 2, 3), 4",
                                                       22, L',');
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::String, type);
   EXPECT_EQ(L"str", WideString(start, len));
 
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::RGB, type);
   EXPECT_EQ(L"rgb(1, 2, 3)", WideString(start, len));
 
-  EXPECT_TRUE(parser->NextValue(type, start, len));
+  EXPECT_TRUE(parser->NextValue(&type, &start, &len));
   EXPECT_EQ(CFX_CSSPrimitiveType::Number, type);
   EXPECT_EQ(L"4", WideString(start, len));
 }
diff --git a/core/fxge/cfx_fontmapper.cpp b/core/fxge/cfx_fontmapper.cpp
index 0511b0a..bb80c27 100644
--- a/core/fxge/cfx_fontmapper.cpp
+++ b/core/fxge/cfx_fontmapper.cpp
@@ -763,7 +763,6 @@
                                            const uint32_t tableTTCF,
                                            uint32_t ttc_size,
                                            uint32_t font_size) {
-  FXFT_Face face;
   uint8_t buffer[1024];
   m_pFontInfo->GetFontData(hFont, tableTTCF, buffer, FX_ArraySize(buffer));
   uint32_t* pBuffer = reinterpret_cast<uint32_t*>(buffer);
@@ -771,8 +770,8 @@
   for (int i = 0; i < 256; i++)
     checksum += pBuffer[i];
   uint8_t* pFontData;
-  face = m_pFontMgr->GetCachedTTCFace(ttc_size, checksum, ttc_size - font_size,
-                                      pFontData);
+  FXFT_Face face = m_pFontMgr->GetCachedTTCFace(
+      ttc_size, checksum, ttc_size - font_size, &pFontData);
   if (!face) {
     pFontData = FX_Alloc(uint8_t, ttc_size);
     m_pFontInfo->GetFontData(hFont, tableTTCF, pFontData, ttc_size);
@@ -787,9 +786,9 @@
                                         int weight,
                                         bool bItalic,
                                         uint32_t font_size) {
-  FXFT_Face face;
   uint8_t* pFontData;
-  face = m_pFontMgr->GetCachedFace(SubstName, weight, bItalic, pFontData);
+  FXFT_Face face =
+      m_pFontMgr->GetCachedFace(SubstName, weight, bItalic, &pFontData);
   if (!face) {
     pFontData = FX_Alloc(uint8_t, font_size);
     m_pFontInfo->GetFontData(hFont, 0, pFontData, font_size);
diff --git a/core/fxge/cfx_fontmgr.cpp b/core/fxge/cfx_fontmgr.cpp
index e12f341..d9b0354 100644
--- a/core/fxge/cfx_fontmgr.cpp
+++ b/core/fxge/cfx_fontmgr.cpp
@@ -123,13 +123,13 @@
 FXFT_Face CFX_FontMgr::GetCachedFace(const ByteString& face_name,
                                      int weight,
                                      bool bItalic,
-                                     uint8_t*& pFontData) {
+                                     uint8_t** pFontData) {
   auto it = m_FaceMap.find(KeyNameFromFace(face_name, weight, bItalic));
   if (it == m_FaceMap.end())
     return nullptr;
 
   CTTFontDesc* pFontDesc = it->second.get();
-  pFontData = pFontDesc->m_pFontData;
+  *pFontData = pFontDesc->m_pFontData;
   pFontDesc->m_RefCount++;
   return pFontDesc->m_SingleFace;
 }
@@ -165,13 +165,13 @@
 FXFT_Face CFX_FontMgr::GetCachedTTCFace(int ttc_size,
                                         uint32_t checksum,
                                         int font_offset,
-                                        uint8_t*& pFontData) {
+                                        uint8_t** pFontData) {
   auto it = m_FaceMap.find(KeyNameFromSize(ttc_size, checksum));
   if (it == m_FaceMap.end())
     return nullptr;
 
   CTTFontDesc* pFontDesc = it->second.get();
-  pFontData = pFontDesc->m_pFontData;
+  *pFontData = pFontDesc->m_pFontData;
   pFontDesc->m_RefCount++;
   int face_index = GetTTCIndex(pFontDesc->m_pFontData, ttc_size, font_offset);
   if (!pFontDesc->m_TTCFaces[face_index]) {
diff --git a/core/fxge/cfx_fontmgr.h b/core/fxge/cfx_fontmgr.h
index eddb1ef..62ecd84 100644
--- a/core/fxge/cfx_fontmgr.h
+++ b/core/fxge/cfx_fontmgr.h
@@ -27,7 +27,7 @@
   FXFT_Face GetCachedFace(const ByteString& face_name,
                           int weight,
                           bool bItalic,
-                          uint8_t*& pFontData);
+                          uint8_t** pFontData);
   FXFT_Face AddCachedFace(const ByteString& face_name,
                           int weight,
                           bool bItalic,
@@ -37,7 +37,7 @@
   FXFT_Face GetCachedTTCFace(int ttc_size,
                              uint32_t checksum,
                              int font_offset,
-                             uint8_t*& pFontData);
+                             uint8_t** pFontData);
   FXFT_Face AddCachedTTCFace(int ttc_size,
                              uint32_t checksum,
                              uint8_t* pData,