Merge to M44: Fix heap use after free in Document::DoFieldDelay and Document::delay
This fix removes CJS_DelayData object from m_DelayData array and copies them to
a new array, before processing them. So contents of m_DelayData array cannot be
used after they get freed.
BUG=487928
R=tsepez@chromium.org
TEST= Chrome pdf plugin should not crash when poc_stable,testuafdocument1.pdf
and testuafdocument2.pdf are viewed.
see crbug.com/487928 and crbug.com/487928#c18 for more details.
Review URL: https://codereview.chromium.org/1163823002
(cherry picked from commit 4ff7a4246c81a71b4f878e959b3ca304cd76ec8a)
Review URL: https://codereview.chromium.org/1223163004 .
1 file changed
