Convert to std::array<> in CXFA_ContentLayoutProcessor.

This helps to resolve unsafe buffer usage in the future, and avoids
the confusing syntax of T (&arg)[3] required  for passing a reference
to an array rather than an array of references (which is prohibited).
With the std::array<> syntax, confusion is avoided.

In the process, fix an instance where we were declaring an argument
as an array[3] but then invoking a -> operator against it. This worked
in the past due to the way array[3] degrades to array*.

Pass a reference in one place rather than a pointer to keep things
even simpler.

Change-Id: Iabce74ebc1589df30b6efa05391d98309acf8160
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/119831
Reviewed-by: Thomas Sepez <tsepez@google.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp b/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
index 0e1268e..b568b96 100644
--- a/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
+++ b/xfa/fxfa/layout/cxfa_contentlayoutprocessor.cpp
@@ -1419,7 +1419,7 @@
 bool CXFA_ContentLayoutProcessor::ProcessKeepForSplit(
     CXFA_ContentLayoutProcessor* pChildProcessor,
     Result eRetValue,
-    std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>>* rgCurLineLayoutItem,
+    ContentLayoutItemVector& rgCurLineLayoutItem,
     float* fContentCurRowAvailWidth,
     float* fContentCurRowHeight,
     float* fContentCurRowY,
@@ -1452,7 +1452,7 @@
     return true;
   }
 
-  rgCurLineLayoutItem->push_back(pChildProcessor->ExtractLayoutItem());
+  rgCurLineLayoutItem.push_back(pChildProcessor->ExtractLayoutItem());
   *bAddedItemInRow = true;
   *fContentCurRowAvailWidth -= childSize.width;
   *fContentCurRowHeight = std::max(*fContentCurRowHeight, childSize.height);
@@ -1587,8 +1587,7 @@
     float fContentCurRowHeight = 0;
     float fContentCurRowAvailWidth = fContentWidthLimit;
     m_fWidthLimit = fContentCurRowAvailWidth;
-    std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>>
-        rgCurLineLayoutItems[3];
+    std::array<ContentLayoutItemVector, 3> rgCurLineLayoutItems;
     uint8_t uCurHAlignState =
         (eFlowStrategy != XFA_AttributeValue::Rl_tb ? 0 : 2);
     if (pLastChild) {
@@ -1724,7 +1723,7 @@
                   bContainerWidthAutoSize, &calculated_size.width,
                   &calculated_size.height, &fContentCurRowY,
                   fContentCurRowHeight, fContentWidthLimit, false);
-              rgCurLineLayoutItems->clear();
+              rgCurLineLayoutItems.front().clear();
               auto* pTempProcessor =
                   cppgc::MakeGarbageCollected<CXFA_ContentLayoutProcessor>(
                       GetHeap()->GetAllocationHandle(), GetHeap(), pLeaderNode,
@@ -1914,8 +1913,7 @@
 }
 
 bool CXFA_ContentLayoutProcessor::CalculateRowChildPosition(
-    std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>> (
-        &rgCurLineLayoutItems)[3],
+    std::array<ContentLayoutItemVector, 3>& rgCurLineLayoutItems,
     XFA_AttributeValue eFlowStrategy,
     bool bContainerHeightAutoSize,
     bool bContainerWidthAutoSize,
@@ -2342,8 +2340,7 @@
     float fContainerHeight,
     XFA_AttributeValue eFlowStrategy,
     uint8_t* uCurHAlignState,
-    std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>> (
-        &rgCurLineLayoutItems)[3],
+    std::array<ContentLayoutItemVector, 3>& rgCurLineLayoutItems,
     bool bUseBreakControl,
     float fAvailHeight,
     float fRealHeight,
@@ -2534,7 +2531,7 @@
   }
 
   Result eResult;
-  if (ProcessKeepForSplit(pProcessor, eRetValue, &rgCurLineLayoutItems[uHAlign],
+  if (ProcessKeepForSplit(pProcessor, eRetValue, rgCurLineLayoutItems[uHAlign],
                           fContentCurRowAvailWidth, fContentCurRowHeight,
                           fContentCurRowY, bAddedItemInRow, bForceEndPage,
                           &eResult)) {
diff --git a/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h b/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
index 173e39d..f11e3c5 100644
--- a/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
+++ b/xfa/fxfa/layout/cxfa_contentlayoutprocessor.h
@@ -9,6 +9,7 @@
 
 #include <float.h>
 
+#include <array>
 #include <list>
 #include <map>
 #include <optional>
@@ -78,6 +79,9 @@
     UnownedPtr<CXFA_Node> m_pOverflowNode;                         // Ok, stack
   };
 
+  using ContentLayoutItemVector =
+      std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>>;
+
   CXFA_ContentLayoutProcessor(cppgc::Heap* pHeap,
                               CXFA_Node* pNode,
                               CXFA_ViewLayoutProcessor* pViewLayoutProcessor);
@@ -91,17 +95,15 @@
   bool HasLayoutItem() const { return !!m_pLayoutItem; }
   void SplitLayoutItem(float fSplitPos);
   float FindSplitPos(float fProposedSplitPos);
-  bool ProcessKeepForSplit(
-      CXFA_ContentLayoutProcessor* pChildProcessor,
-      Result eRetValue,
-      std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>>*
-          rgCurLineLayoutItem,
-      float* fContentCurRowAvailWidth,
-      float* fContentCurRowHeight,
-      float* fContentCurRowY,
-      bool* bAddedItemInRow,
-      bool* bForceEndPage,
-      Result* result);
+  bool ProcessKeepForSplit(CXFA_ContentLayoutProcessor* pChildProcessor,
+                           Result eRetValue,
+                           ContentLayoutItemVector& rgCurLineLayoutItem,
+                           float* fContentCurRowAvailWidth,
+                           float* fContentCurRowHeight,
+                           float* fContentCurRowY,
+                           bool* bAddedItemInRow,
+                           bool* bForceEndPage,
+                           Result* result);
   void ProcessUnUseOverFlow(CXFA_Node* pLeaderNode,
                             CXFA_Node* pTrailerNode,
                             CXFA_ContentLayoutItem* pTrailerItem,
@@ -120,8 +122,7 @@
                        float fSplitPos);
   float InsertKeepLayoutItems();
   bool CalculateRowChildPosition(
-      std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>> (
-          &rgCurLineLayoutItems)[3],
+      std::array<ContentLayoutItemVector, 3>& rgCurLineLayoutItems,
       XFA_AttributeValue eFlowStrategy,
       bool bContainerHeightAutoSize,
       bool bContainerWidthAutoSize,
@@ -178,8 +179,7 @@
       float fContainerHeight,
       XFA_AttributeValue eFlowStrategy,
       uint8_t* uCurHAlignState,
-      std::vector<cppgc::Persistent<CXFA_ContentLayoutItem>> (
-          &rgCurLineLayoutItems)[3],
+      std::array<ContentLayoutItemVector, 3>& rgCurLineLayoutItems,
       bool bUseBreakControl,
       float fAvailHeight,
       float fRealHeight,