Stop storing `CFX_Font::m_pSubData`

This memory allocation is only used by CPDF_CIDFont, so move it into
CPDF_CIDFont. There, it can become a local variable, as it is only used
in CPDF_CIDFont::GetGlyphIndex() when loading the GSUB table. Also
change the variable type from a unique_ptr to a FixedUninitDataVector.

Change-Id: I3e5b07f7eb0fde872befb315d6cd5fcd811bd57b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/107392
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/font/cpdf_cidfont.cpp b/core/fpdfapi/font/cpdf_cidfont.cpp
index d7634df..0d02494 100644
--- a/core/fpdfapi/font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/font/cpdf_cidfont.cpp
@@ -23,6 +23,7 @@
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/cpdf_stream_acc.h"
+#include "core/fxcrt/fixed_uninit_data_vector.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxcrt/fx_safe_types.h"
@@ -660,22 +661,22 @@
 
   static constexpr uint32_t kGsubTag =
       CFX_FontMapper::MakeTag('G', 'S', 'U', 'B');
-  if (!m_Font.GetSubData()) {
-    unsigned long length = 0;
-    int error = FT_Load_Sfnt_Table(face, kGsubTag, 0, nullptr, &length);
-    if (error || !length) {
-      return index;
-    }
-
-    m_Font.AllocSubData(length);
+  unsigned long length = 0;
+  int error = FT_Load_Sfnt_Table(face, kGsubTag, 0, nullptr, &length);
+  if (error || !length) {
+    return index;
   }
-  int error =
-      FT_Load_Sfnt_Table(face, kGsubTag, 0, m_Font.GetSubData(), nullptr);
+
+  FixedUninitDataVector<uint8_t> sub_data(length);
+  error = FT_Load_Sfnt_Table(face, kGsubTag, 0, sub_data.writable_span().data(),
+                             nullptr);
   if (error) {
     return index;
   }
 
-  m_pTTGSUBTable = std::make_unique<CFX_CTTGSUBTable>(m_Font.GetSubData());
+  // CFX_CTTGSUBTable parses the data and stores all the values in its structs.
+  // It does not store pointers into `sub_data`.
+  m_pTTGSUBTable = std::make_unique<CFX_CTTGSUBTable>(sub_data.span().data());
   return GetVerticalGlyph(index, pVertGlyph);
 }
 
diff --git a/core/fxge/cfx_font.cpp b/core/fxge/cfx_font.cpp
index e9ca56b..a2a44df 100644
--- a/core/fxge/cfx_font.cpp
+++ b/core/fxge/cfx_font.cpp
@@ -637,10 +637,6 @@
   return result;
 }
 
-void CFX_Font::AllocSubData(size_t size) {
-  m_pSubData.reset(FX_Alloc(uint8_t, size));
-}
-
 RetainPtr<CFX_GlyphCache> CFX_Font::GetOrCreateGlyphCache() const {
   if (!m_GlyphCache)
     m_GlyphCache = CFX_GEModule::Get()->GetFontCache()->GetGlyphCache(this);
diff --git a/core/fxge/cfx_font.h b/core/fxge/cfx_font.h
index 9197b22..7a8973b 100644
--- a/core/fxge/cfx_font.h
+++ b/core/fxge/cfx_font.h
@@ -16,7 +16,6 @@
 #include "core/fxcrt/data_vector.h"
 #include "core/fxcrt/fx_codepage_forward.h"
 #include "core/fxcrt/fx_coordinates.h"
-#include "core/fxcrt/fx_memory_wrappers.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr_exclusion.h"
 #include "core/fxge/cfx_face.h"
@@ -129,8 +128,6 @@
   absl::optional<FX_RECT> GetBBox() const;
 
   bool IsEmbedded() const { return m_bEmbedded; }
-  void AllocSubData(size_t size);
-  uint8_t* GetSubData() const { return m_pSubData.get(); }
   FontType GetFontType() const { return m_FontType; }
   void SetFontType(FontType type) { m_FontType = type; }
   uint64_t GetObjectTag() const { return m_ObjectTag; }
@@ -167,7 +164,6 @@
   mutable RetainPtr<CFX_Face> m_Face;
   mutable RetainPtr<CFX_GlyphCache> m_GlyphCache;
   std::unique_ptr<CFX_SubstFont> m_pSubstFont;
-  std::unique_ptr<uint8_t, FxFreeDeleter> m_pSubData;
   DataVector<uint8_t> m_FontDataAllocation;
   pdfium::span<uint8_t> m_FontData;
   FontType m_FontType = FontType::kUnknown;