Avoid some comparisons against data.size() - 1.

These rely on earlier checks that data is not empty, otherwise
underflow would occur in these cases.

-- invert one test in Windows while at it.

Change-Id: Ic3f99f31e6cfedfcee59dfafe3b0974266e0a098
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/114058
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_stitchfunc.cpp b/core/fpdfapi/page/cpdf_stitchfunc.cpp
index 0c3ebd6..21d7340 100644
--- a/core/fpdfapi/page/cpdf_stitchfunc.cpp
+++ b/core/fpdfapi/page/cpdf_stitchfunc.cpp
@@ -110,7 +110,7 @@
                              pdfium::span<float> results) const {
   float input = inputs[0];
   size_t i;
-  for (i = 0; i < m_pSubFunctions.size() - 1; i++) {
+  for (i = 0; i + 1 < m_pSubFunctions.size(); i++) {
     if (input < m_bounds[i + 1])
       break;
   }
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.cpp b/core/fpdfapi/parser/fpdf_parser_decode.cpp
index 3f7d08c..79fcb1f 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode.cpp
@@ -276,7 +276,7 @@
       dest_count += src_span[i] + 1;
       i += src_span[i] + 2;
     } else {
-      const uint8_t fill = i < src_span.size() - 1 ? src_span[i + 1] : 0;
+      const uint8_t fill = i + 1 < src_span.size() ? src_span[i + 1] : 0;
       const size_t fill_size = 257 - src_span[i];
       fxcrt::spanset(dest_span.subspan(dest_count, fill_size), fill);
       dest_count += fill_size;
diff --git a/core/fxcodec/basic/basicmodule.cpp b/core/fxcodec/basic/basicmodule.cpp
index 452e464..07fc896 100644
--- a/core/fxcodec/basic/basicmodule.cpp
+++ b/core/fxcodec/basic/basicmodule.cpp
@@ -152,7 +152,7 @@
       UpdateOperator((uint8_t)copy_len);
     } else if (m_Operator > 128) {
       int fill = 0;
-      if (m_SrcOffset - 1 < m_SrcBuf.size() - 1) {
+      if (m_SrcOffset < m_SrcBuf.size()) {
         fill = m_SrcBuf[m_SrcOffset];
       }
       uint32_t duplicate_len = 257 - m_Operator;
diff --git a/core/fxcodec/flate/flatemodule.cpp b/core/fxcodec/flate/flatemodule.cpp
index a3e28cc..a023bb1 100644
--- a/core/fxcodec/flate/flatemodule.cpp
+++ b/core/fxcodec/flate/flatemodule.cpp
@@ -605,9 +605,9 @@
     std::unique_ptr<uint8_t, FxFreeDeleter> tmp_buf =
         std::move(result_tmp_bufs[i]);
     uint32_t tmp_buf_size = buf_size;
-    if (i == result_tmp_bufs.size() - 1)
+    if (i + 1 == result_tmp_bufs.size()) {
       tmp_buf_size = last_buf_size;
-
+    }
     uint32_t cp_size = std::min(tmp_buf_size, remaining);
     memcpy(result_buf.get() + result_pos, tmp_buf.get(), cp_size);
     result_pos += cp_size;
diff --git a/core/fxcodec/jpeg/jpegmodule.cpp b/core/fxcodec/jpeg/jpegmodule.cpp
index ad80c7e..83f3e0b 100644
--- a/core/fxcodec/jpeg/jpegmodule.cpp
+++ b/core/fxcodec/jpeg/jpegmodule.cpp
@@ -29,7 +29,7 @@
     pdfium::span<const uint8_t> src_span) {
   DCHECK(!src_span.empty());
 
-  for (size_t offset = 0; offset < src_span.size() - 1; ++offset) {
+  for (size_t offset = 0; offset + 1 < src_span.size(); ++offset) {
     if (src_span[offset] == 0xff && src_span[offset + 1] == 0xd8)
       return src_span.subspan(offset);
   }
diff --git a/core/fxcrt/widestring.cpp b/core/fxcrt/widestring.cpp
index aa01fc3..db20c48 100644
--- a/core/fxcrt/widestring.cpp
+++ b/core/fxcrt/widestring.cpp
@@ -1064,7 +1064,7 @@
   {
     // Span's lifetime must end before ReleaseBuffer() below.
     pdfium::span<wchar_t> buf = result.GetBuffer(data.size() / 2);
-    for (size_t i = 0; i < data.size() - 1; i += 2) {
+    for (size_t i = 0; i + 1 < data.size(); i += 2) {
       buf[length++] = data[i] | data[i + 1] << 8;
     }
 
@@ -1086,7 +1086,7 @@
   {
     // Span's lifetime must end before ReleaseBuffer() below.
     pdfium::span<wchar_t> buf = result.GetBuffer(data.size() / 2);
-    for (size_t i = 0; i < data.size() - 1; i += 2) {
+    for (size_t i = 0; i + 1 < data.size(); i += 2) {
       buf[length++] = data[i] << 8 | data[i + 1];
     }
 
diff --git a/core/fxge/agg/fx_agg_driver.cpp b/core/fxge/agg/fx_agg_driver.cpp
index d197932..fd3c75e 100644
--- a/core/fxge/agg/fx_agg_driver.cpp
+++ b/core/fxge/agg/fx_agg_driver.cpp
@@ -930,7 +930,7 @@
       agg_path.move_to(pos.x, pos.y);
     } else if (point_type == CFX_Path::Point::Type::kLine) {
       if (i > 0 && points[i - 1].IsTypeAndOpen(CFX_Path::Point::Type::kMove) &&
-          (i == points.size() - 1 ||
+          (i + 1 == points.size() ||
            points[i + 1].IsTypeAndOpen(CFX_Path::Point::Type::kMove)) &&
           points[i].m_Point == points[i - 1].m_Point) {
         pos.x += 1;
diff --git a/core/fxge/cfx_path.cpp b/core/fxge/cfx_path.cpp
index 53e99dc..525409e 100644
--- a/core/fxge/cfx_path.cpp
+++ b/core/fxge/cfx_path.cpp
@@ -361,7 +361,7 @@
         rect.UpdateRect(m_Points[iPoint + 1].m_Point);
         iPoint += 2;
       }
-      if (iPoint == m_Points.size() - 1 ||
+      if (iPoint + 1 == m_Points.size() ||
           m_Points[iPoint + 1].m_Type == CFX_Path::Point::Type::kMove) {
         iStartPoint = iPoint - 1;
         iEndPoint = iPoint;
diff --git a/core/fxge/win32/cgdi_plus_ext.cpp b/core/fxge/win32/cgdi_plus_ext.cpp
index d001391..c491350 100644
--- a/core/fxge/win32/cgdi_plus_ext.cpp
+++ b/core/fxge/win32/cgdi_plus_ext.cpp
@@ -344,10 +344,11 @@
     for (size_t i = 0; i < pGraphState->m_DashArray.size(); i += 2) {
       float on_phase = pGraphState->m_DashArray[i];
       float off_phase;
-      if (i == pGraphState->m_DashArray.size() - 1)
-        off_phase = on_phase;
-      else
+      if (i + 1 < pGraphState->m_DashArray.size()) {
         off_phase = pGraphState->m_DashArray[i + 1];
+      } else {
+        off_phase = on_phase;
+      }
       on_phase /= width;
       off_phase /= width;
       if (on_phase + off_phase <= 0.00002f) {
@@ -673,7 +674,7 @@
     } else if (point_type == CFX_Path::Point::Type::kLine) {
       gp_types[i] = Gdiplus::PathPointTypeLine;
       if (points[i - 1].IsTypeAndOpen(CFX_Path::Point::Type::kMove) &&
-          (i == points.size() - 1 ||
+          (i + 1 == points.size() ||
            points[i + 1].IsTypeAndOpen(CFX_Path::Point::Type::kMove)) &&
           gp_points[i].Y == gp_points[i - 1].Y &&
           gp_points[i].X == gp_points[i - 1].X) {
@@ -759,7 +760,7 @@
     } else {
       size_t iStart = 0;
       for (size_t i = 0; i < points.size(); ++i) {
-        if (i == points.size() - 1 ||
+        if (i + 1 == points.size() ||
             gp_types[i + 1] == Gdiplus::PathPointTypeStart) {
           Gdiplus::GpPath* pSubPath;
           CallFunc(GdipCreatePath2)(
diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index 8228a5c..0bcd594 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -1228,8 +1228,8 @@
       return;
 
     bHasCount = false;
-    while (szPieceNext < pPieceLine->m_textPieces.size() - 1) {
-      szPieceNext++;
+    while (szPieceNext + 1 < pPieceLine->m_textPieces.size()) {
+      ++szPieceNext;
       if (pPieceLine->m_charCounts[szPieceNext] > 0) {
         bHasCount = true;
         break;