commit 7f7405ec47e9ca045d6bf391a05a423e5f1338e9
author Lei Zhang <thestig@chromium.org> Mon Apr 08 18:21:21 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Mon Apr 08 18:21:21 2019 +0000
tree 8fef7a9760ee507674bea8a5a604579782404fa9
parent 5bf8c7fe3fa0bd4d09e69e9a7e026ee789f416d0

Move |CXFA_FFDocView::m_ValidateNodes| before iterating over it.

Similar issue to the one fixed in commit 12eacc8a.

BUG=chromium:933163

Change-Id: I7e79dd27a5ebbaceaa0db0604c28520b24a8d7f6
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/52832
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

xfa/fxfa/cxfa_ffdocview.cpp

diff --git a/xfa/fxfa/cxfa_ffdocview.cpp b/xfa/fxfa/cxfa_ffdocview.cpp
index a346abe..49edda3 100644
--- a/xfa/fxfa/cxfa_ffdocview.cpp
+++ b/xfa/fxfa/cxfa_ffdocview.cpp
@@ -576,11 +576,15 @@
   if (!m_pDoc->GetDocEnvironment()->IsValidationsEnabled(m_pDoc.Get()))
     return false;
 
-  for (CXFA_Node* node : m_ValidateNodes) {
-    if (!node->HasRemovedChildren())
-      node->ProcessValidate(this, 0);
+  while (!m_ValidateNodes.empty()) {
+    std::vector<CXFA_Node*> nodes = std::move(m_ValidateNodes);
+    m_ValidateNodes.clear();
+    for (CXFA_Node* node : nodes) {
+      if (!node->HasRemovedChildren())
+        node->ProcessValidate(this, 0);
+    }
+    // May have created more nodes to validate, try again.
   }
-  m_ValidateNodes.clear();
   return true;
 }