Make WideString::{Format|FormatV} static

This CL moves the Format and FormatV methods from WideString to be
static.

Bug: pdfium:934
Change-Id: I9941d6a2a5bbf0a82087cd0ea5d0f8fc42eecd3e
Reviewed-on: https://pdfium-review.googlesource.com/18630
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

27 files changed, 234 insertions, 323 deletions

diff --git a/core/fpdfdoc/cpdf_pagelabel.cpp b/core/fpdfdoc/cpdf_pagelabel.cpp
index 5efb18ef3d..d0693086ab 100644
--- a/core/fpdfdoc/cpdf_pagelabel.cpp
+++ b/core/fpdfdoc/cpdf_pagelabel.cpp
@@ -50,23 +50,25 @@ WideString MakeLetters(int num) {
 }
 
 WideString GetLabelNumPortion(int num, const ByteString& bsStyle) {
-  WideString wsNumPortion;
   if (bsStyle.IsEmpty())
-    return wsNumPortion;
-  if (bsStyle == "D") {
-    wsNumPortion.Format(L"%d", num);
-  } else if (bsStyle == "R") {
-    wsNumPortion = MakeRoman(num);
+    return L"";
+  if (bsStyle == "D")
+    return WideString::Format(L"%d", num);
+  if (bsStyle == "R") {
+    WideString wsNumPortion = MakeRoman(num);
     wsNumPortion.MakeUpper();
-  } else if (bsStyle == "r") {
-    wsNumPortion = MakeRoman(num);
-  } else if (bsStyle == "A") {
-    wsNumPortion = MakeLetters(num);
+    return wsNumPortion;
+  }
+  if (bsStyle == "r")
+    return MakeRoman(num);
+  if (bsStyle == "A") {
+    WideString wsNumPortion = MakeLetters(num);
     wsNumPortion.MakeUpper();
-  } else if (bsStyle == "a") {
-    wsNumPortion = MakeLetters(num);
+    return wsNumPortion;
   }
-  return wsNumPortion;
+  if (bsStyle == "a")
+    return MakeLetters(num);
+  return L"";
 }
 
 }  // namespace
@@ -114,7 +116,7 @@ bool CPDF_PageLabel::GetLabel(int nPage, WideString* wsLabel) const {
       return true;
     }
   }
-  wsLabel->Format(L"%d", nPage + 1);
+  *wsLabel = WideString::Format(L"%d", nPage + 1);
   return true;
 }
 
diff --git a/core/fxcrt/widestring.cpp b/core/fxcrt/widestring.cpp
index bd504e0cac..d33ed1ad6c 100644
--- a/core/fxcrt/widestring.cpp
+++ b/core/fxcrt/widestring.cpp
@@ -246,6 +246,30 @@ pdfium::Optional<size_t> GuessSizeForVSWPrintf(const wchar_t* pFormat,
   return pdfium::Optional<size_t>(nMaxLen);
 }
 
+// Returns string unless we ran out of space.
+pdfium::Optional<WideString> TryVSWPrintf(size_t size,
+                                          const wchar_t* pFormat,
+                                          va_list argList) {
+  WideString str;
+  wchar_t* buffer = str.GetBuffer(size);
+
+  // In the following two calls, there's always space in the buffer for
+  // a terminating NUL that's not included in nMaxLen.
+  // For vswprintf(), MSAN won't untaint the buffer on a truncated write's
+  // -1 return code even though the buffer is written. Probably just as well
+  // not to trust the vendor's implementation to write anything anyways.
+  // See https://crbug.com/705912.
+  memset(buffer, 0, (size + 1) * sizeof(wchar_t));
+  int ret = vswprintf(buffer, size + 1, pFormat, argList);
+
+  bool bSufficientBuffer = ret >= 0 || buffer[size - 1] == 0;
+  if (!bSufficientBuffer)
+    return {};
+
+  str.ReleaseBuffer(str.GetStringLength());
+  return {str};
+}
+
 #ifndef NDEBUG
 bool IsValidCodePage(uint16_t codepage) {
   switch (codepage) {
@@ -285,6 +309,45 @@ namespace fxcrt {
 static_assert(sizeof(WideString) <= sizeof(wchar_t*),
               "Strings must not require more space than pointers");
 
+// static
+WideString WideString::FormatV(const wchar_t* format, va_list argList) {
+  va_list argListCopy;
+  va_copy(argListCopy, argList);
+  int maxLen = vswprintf(nullptr, 0, format, argListCopy);
+  va_end(argListCopy);
+
+  if (maxLen <= 0) {
+    va_copy(argListCopy, argList);
+    auto guess = GuessSizeForVSWPrintf(format, argListCopy);
+    va_end(argListCopy);
+
+    if (!guess.has_value())
+      return L"";
+    maxLen = pdfium::base::checked_cast<int>(guess.value());
+  }
+
+  while (maxLen < 32 * 1024) {
+    va_copy(argListCopy, argList);
+    pdfium::Optional<WideString> ret =
+        TryVSWPrintf(static_cast<size_t>(maxLen), format, argListCopy);
+    va_end(argListCopy);
+
+    if (ret)
+      return *ret;
+    maxLen *= 2;
+  }
+  return L"";
+}
+
+// static
+WideString WideString::Format(const wchar_t* pFormat, ...) {
+  va_list argList;
+  va_start(argList, pFormat);
+  WideString ret = FormatV(pFormat, argList);
+  va_end(argList);
+  return ret;
+}
+
 WideString::WideString() {}
 
 WideString::WideString(const WideString& other) : m_pData(other.m_pData) {}
@@ -666,57 +729,6 @@ void WideString::AllocCopy(WideString& dest,
   dest.m_pData.Swap(pNewData);
 }
 
-bool WideString::TryVSWPrintf(size_t size,
-                              const wchar_t* pFormat,
-                              va_list argList) {
-  GetBuffer(size);
-  if (!m_pData)
-    return true;
-
-  // In the following two calls, there's always space in the buffer for
-  // a terminating NUL that's not included in nMaxLen.
-  // For vswprintf(), MSAN won't untaint the buffer on a truncated write's
-  // -1 return code even though the buffer is written. Probably just as well
-  // not to trust the vendor's implementation to write anything anyways.
-  // See https://crbug.com/705912.
-  memset(m_pData->m_String, 0, (size + 1) * sizeof(wchar_t));
-  int ret = vswprintf(m_pData->m_String, size + 1, pFormat, argList);
-  bool bSufficientBuffer = ret >= 0 || m_pData->m_String[size - 1] == 0;
-  ReleaseBuffer(GetStringLength());
-  return bSufficientBuffer;
-}
-
-void WideString::FormatV(const wchar_t* format, va_list argList) {
-  va_list argListCopy;
-  va_copy(argListCopy, argList);
-  int maxLen = vswprintf(nullptr, 0, format, argListCopy);
-  va_end(argListCopy);
-  if (maxLen <= 0) {
-    va_copy(argListCopy, argList);
-    auto guess = GuessSizeForVSWPrintf(format, argListCopy);
-    va_end(argListCopy);
-    if (!guess.has_value())
-      return;
-    maxLen = pdfium::base::checked_cast<int>(guess.value());
-  }
-  while (maxLen < 32 * 1024) {
-    va_copy(argListCopy, argList);
-    bool bSufficientBuffer =
-        TryVSWPrintf(static_cast<size_t>(maxLen), format, argListCopy);
-    va_end(argListCopy);
-    if (bSufficientBuffer)
-      break;
-    maxLen *= 2;
-  }
-}
-
-void WideString::Format(const wchar_t* pFormat, ...) {
-  va_list argList;
-  va_start(argList, pFormat);
-  FormatV(pFormat, argList);
-  va_end(argList);
-}
-
 size_t WideString::Insert(size_t location, wchar_t ch) {
   const size_t cur_length = m_pData ? m_pData->m_nDataLength : 0;
   if (!IsValidLength(location))
diff --git a/core/fxcrt/widestring.h b/core/fxcrt/widestring.h
index 01c4eedaf1..9d856c72c9 100644
--- a/core/fxcrt/widestring.h
+++ b/core/fxcrt/widestring.h
@@ -33,6 +33,9 @@ class WideString {
   using const_iterator = const CharType*;
   using const_reverse_iterator = std::reverse_iterator<const_iterator>;
 
+  static WideString Format(const wchar_t* lpszFormat, ...);
+  static WideString FormatV(const wchar_t* lpszFormat, va_list argList);
+
   WideString();
   WideString(const WideString& other);
   WideString(WideString&& other) noexcept;
@@ -141,9 +144,6 @@ class WideString {
   size_t InsertAtBack(wchar_t ch) { return Insert(GetLength(), ch); }
   size_t Delete(size_t index, size_t count = 1);
 
-  void Format(const wchar_t* lpszFormat, ...);
-  void FormatV(const wchar_t* lpszFormat, va_list argList);
-
   void MakeLower();
   void MakeUpper();
 
@@ -189,9 +189,6 @@ class WideString {
   void AssignCopy(const wchar_t* pSrcData, size_t nSrcLen);
   void Concat(const wchar_t* lpszSrcData, size_t nSrcLen);
 
-  // Returns true unless we ran out of space.
-  bool TryVSWPrintf(size_t size, const wchar_t* format, va_list argList);
-
   RetainPtr<StringData> m_pData;
 
   friend WideString_ConcatInPlace_Test;
diff --git a/core/fxcrt/widestring_unittest.cpp b/core/fxcrt/widestring_unittest.cpp
index 42819b3349..aaa6d9cae7 100644
--- a/core/fxcrt/widestring_unittest.cpp
+++ b/core/fxcrt/widestring_unittest.cpp
@@ -1278,84 +1278,25 @@ TEST(WideStringView, TrimmedRight) {
 }
 
 TEST(WideString, FormatWidth) {
-  {
-    WideString str;
-    str.Format(L"%5d", 1);
-    EXPECT_EQ(L"    1", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%d", 1);
-    EXPECT_EQ(L"1", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%*d", 5, 1);
-    EXPECT_EQ(L"    1", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%-1d", 1);
-    EXPECT_EQ(L"1", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%0d", 1);
-    EXPECT_EQ(L"1", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%1048576d", 1);
-    EXPECT_EQ(L"", str);
-  }
+  EXPECT_EQ(L"    1", WideString::Format(L"%5d", 1));
+  EXPECT_EQ(L"1", WideString::Format(L"%d", 1));
+  EXPECT_EQ(L"    1", WideString::Format(L"%*d", 5, 1));
+  EXPECT_EQ(L"1", WideString::Format(L"%-1d", 1));
+  EXPECT_EQ(L"1", WideString::Format(L"%0d", 1));
+  EXPECT_EQ(L"", WideString::Format(L"%1048576d", 1));
 }
 
 TEST(WideString, FormatPrecision) {
-  {
-    WideString str;
-    str.Format(L"%.2f", 1.12345);
-    EXPECT_EQ(L"1.12", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%.*f", 3, 1.12345);
-    EXPECT_EQ(L"1.123", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%f", 1.12345);
-    EXPECT_EQ(L"1.123450", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%-1f", 1.12345);
-    EXPECT_EQ(L"1.123450", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%0f", 1.12345);
-    EXPECT_EQ(L"1.123450", str);
-  }
-
-  {
-    WideString str;
-    str.Format(L"%.1048576f", 1.2);
-    EXPECT_EQ(L"", str);
-  }
+  EXPECT_EQ(L"1.12", WideString::Format(L"%.2f", 1.12345));
+  EXPECT_EQ(L"1.123", WideString::Format(L"%.*f", 3, 1.12345));
+  EXPECT_EQ(L"1.123450", WideString::Format(L"%f", 1.12345));
+  EXPECT_EQ(L"1.123450", WideString::Format(L"%-1f", 1.12345));
+  EXPECT_EQ(L"1.123450", WideString::Format(L"%0f", 1.12345));
+  EXPECT_EQ(L"", WideString::Format(L"%.1048576f", 1.2));
 }
 
 TEST(WideString, FormatOutOfRangeChar) {
-  WideString str;
-  str.Format(L"unsupported char '%c'", 0x00FF00FF);
+  WideString::Format(L"unsupported char '%c'", 0x00FF00FF);
 }
 
 TEST(WideString, Empty) {
diff --git a/core/fxcrt/xml/cfx_xmldoc.cpp b/core/fxcrt/xml/cfx_xmldoc.cpp
index 30e4a47e72..e29c09a08e 100644
--- a/core/fxcrt/xml/cfx_xmldoc.cpp
+++ b/core/fxcrt/xml/cfx_xmldoc.cpp
@@ -53,10 +53,9 @@ void CFX_XMLDoc::SaveXMLNode(
   CFX_XMLNode* pNode = (CFX_XMLNode*)pINode;
   switch (pNode->GetType()) {
     case FX_XMLNODE_Instruction: {
-      WideString ws;
       CFX_XMLInstruction* pInstruction = (CFX_XMLInstruction*)pNode;
       if (pInstruction->GetName().CompareNoCase(L"xml") == 0) {
-        ws = L"<?xml version=\"1.0\" encoding=\"";
+        WideString ws = L"<?xml version=\"1.0\" encoding=\"";
         uint16_t wCodePage = pXMLStream->GetCodePage();
         if (wCodePage == FX_CODEPAGE_UTF16LE) {
           ws += L"UTF-16";
@@ -68,7 +67,8 @@ void CFX_XMLDoc::SaveXMLNode(
         ws += L"\"?>";
         pXMLStream->WriteString(ws.AsStringView());
       } else {
-        ws.Format(L"<?%s", pInstruction->GetName().c_str());
+        WideString ws =
+            WideString::Format(L"<?%s", pInstruction->GetName().c_str());
         pXMLStream->WriteString(ws.AsStringView());
 
         for (auto it : pInstruction->GetAttributes()) {
diff --git a/core/fxcrt/xml/cfx_xmlnode.cpp b/core/fxcrt/xml/cfx_xmlnode.cpp
index 4550d5b4ae..f2b9006ebf 100644
--- a/core/fxcrt/xml/cfx_xmlnode.cpp
+++ b/core/fxcrt/xml/cfx_xmlnode.cpp
@@ -349,7 +349,7 @@ void CFX_XMLNode::SaveXMLNode(
         ws += L"\"?>";
         pXMLStream->WriteString(ws.AsStringView());
       } else {
-        ws.Format(L"<?%s", pInstruction->GetName().c_str());
+        ws = WideString::Format(L"<?%s", pInstruction->GetName().c_str());
         pXMLStream->WriteString(ws.AsStringView());
 
         for (auto it : pInstruction->GetAttributes()) {
diff --git a/fxjs/cfxjse_formcalc_context.cpp b/fxjs/cfxjse_formcalc_context.cpp
index e7e0e48871..dfd381625c 100644
--- a/fxjs/cfxjse_formcalc_context.cpp
+++ b/fxjs/cfxjse_formcalc_context.cpp
@@ -6260,11 +6260,11 @@ void CFXJSE_FormCalcContext::ThrowArgumentMismatchException() const {
 }
 
 void CFXJSE_FormCalcContext::ThrowException(const wchar_t* str, ...) const {
-  WideString wsMessage;
   va_list arg_ptr;
   va_start(arg_ptr, str);
-  wsMessage.FormatV(str, arg_ptr);
+  WideString wsMessage = WideString::FormatV(str, arg_ptr);
   va_end(arg_ptr);
+
   ASSERT(!wsMessage.IsEmpty());
   FXJSE_ThrowMessage(wsMessage.UTF8Encode().AsStringView());
 }
diff --git a/fxjs/cjs_publicmethods.cpp b/fxjs/cjs_publicmethods.cpp
index 8bcfd3c39b..856fa11732 100644
--- a/fxjs/cjs_publicmethods.cpp
+++ b/fxjs/cjs_publicmethods.cpp
@@ -399,9 +399,8 @@ double CJS_PublicMethods::ParseNormalDate(const WideString& value,
     return dt;
   }
 
-  WideString swTemp;
-  swTemp.Format(L"%d/%d/%d %d:%d:%d", nMonth, nDay, nYear, nHour, nMin, nSec);
-  return JS_DateParse(swTemp);
+  return JS_DateParse(WideString::Format(L"%d/%d/%d %d:%d:%d", nMonth, nDay,
+                                         nYear, nHour, nMin, nSec));
 }
 
 double CJS_PublicMethods::MakeRegularDate(const WideString& value,
@@ -707,22 +706,23 @@ WideString CJS_PublicMethods::MakeFormatDate(double dDate,
               sPart += c;
               break;
             case 'm':
-              sPart.Format(L"%d", nMonth);
+              sPart = WideString::Format(L"%d", nMonth);
               break;
             case 'd':
-              sPart.Format(L"%d", nDay);
+              sPart = WideString::Format(L"%d", nDay);
               break;
             case 'H':
-              sPart.Format(L"%d", nHour);
+              sPart = WideString::Format(L"%d", nHour);
               break;
             case 'h':
-              sPart.Format(L"%d", nHour > 12 ? nHour - 12 : nHour);
+              sPart =
+                  WideString::Format(L"%d", nHour > 12 ? nHour - 12 : nHour);
               break;
             case 'M':
-              sPart.Format(L"%d", nMin);
+              sPart = WideString::Format(L"%d", nMin);
               break;
             case 's':
-              sPart.Format(L"%d", nSec);
+              sPart = WideString::Format(L"%d", nSec);
               break;
             case 't':
               sPart += nHour > 12 ? 'p' : 'a';
@@ -732,25 +732,26 @@ WideString CJS_PublicMethods::MakeFormatDate(double dDate,
         } else if (remaining == 1 || format[i + 2] != c) {
           switch (c) {
             case 'y':
-              sPart.Format(L"%02d", nYear - (nYear / 100) * 100);
+              sPart = WideString::Format(L"%02d", nYear - (nYear / 100) * 100);
               break;
             case 'm':
-              sPart.Format(L"%02d", nMonth);
+              sPart = WideString::Format(L"%02d", nMonth);
               break;
             case 'd':
-              sPart.Format(L"%02d", nDay);
+              sPart = WideString::Format(L"%02d", nDay);
               break;
             case 'H':
-              sPart.Format(L"%02d", nHour);
+              sPart = WideString::Format(L"%02d", nHour);
               break;
             case 'h':
-              sPart.Format(L"%02d", nHour > 12 ? nHour - 12 : nHour);
+              sPart =
+                  WideString::Format(L"%02d", nHour > 12 ? nHour - 12 : nHour);
               break;
             case 'M':
-              sPart.Format(L"%02d", nMin);
+              sPart = WideString::Format(L"%02d", nMin);
               break;
             case 's':
-              sPart.Format(L"%02d", nSec);
+              sPart = WideString::Format(L"%02d", nSec);
               break;
             case 't':
               sPart = nHour > 12 ? L"pm" : L"am";
@@ -774,7 +775,7 @@ WideString CJS_PublicMethods::MakeFormatDate(double dDate,
         } else if (remaining == 3 || format[i + 4] != c) {
           switch (c) {
             case 'y':
-              sPart.Format(L"%04d", nYear);
+              sPart = WideString::Format(L"%04d", nYear);
               i += 4;
               break;
             case 'm':
@@ -1148,9 +1149,8 @@ CJS_Return CJS_PublicMethods::AFDate_FormatEx(
   }
 
   if (std::isnan(dDate)) {
-    WideString swMsg;
-    swMsg.Format(JSGetStringFromID(JSMessage::kParseDateError).c_str(),
-                 sFormat.c_str());
+    WideString swMsg = WideString::Format(
+        JSGetStringFromID(JSMessage::kParseDateError).c_str(), sFormat.c_str());
     AlertIfPossible(pContext, swMsg.c_str());
     return CJS_Return(false);
   }
@@ -1236,9 +1236,9 @@ CJS_Return CJS_PublicMethods::AFDate_KeystrokeEx(
     bool bWrongFormat = false;
     double dRet = MakeRegularDate(strValue, sFormat, &bWrongFormat);
     if (bWrongFormat || std::isnan(dRet)) {
-      WideString swMsg;
-      swMsg.Format(JSGetStringFromID(JSMessage::kParseDateError).c_str(),
-                   sFormat.c_str());
+      WideString swMsg = WideString::Format(
+          JSGetStringFromID(JSMessage::kParseDateError).c_str(),
+          sFormat.c_str());
       AlertIfPossible(pContext, swMsg.c_str());
       pEvent->Rc() = false;
       return CJS_Return(true);
@@ -1552,9 +1552,8 @@ CJS_Return CJS_PublicMethods::AFParseDateEx(
   WideString sFormat = pRuntime->ToWideString(params[1]);
   double dDate = MakeRegularDate(sValue, sFormat, nullptr);
   if (std::isnan(dDate)) {
-    WideString swMsg;
-    swMsg.Format(JSGetStringFromID(JSMessage::kParseDateError).c_str(),
-                 sFormat.c_str());
+    WideString swMsg = WideString::Format(
+        JSGetStringFromID(JSMessage::kParseDateError).c_str(), sFormat.c_str());
     AlertIfPossible(pRuntime->GetCurrentEventContext(), swMsg.c_str());
     return CJS_Return(false);
   }
@@ -1706,17 +1705,20 @@ CJS_Return CJS_PublicMethods::AFRange_Validate(
 
   if (bGreaterThan && bLessThan) {
     if (dEentValue < dGreaterThan || dEentValue > dLessThan)
-      swMsg.Format(JSGetStringFromID(JSMessage::kRangeBetweenError).c_str(),
-                   pRuntime->ToWideString(params[1]).c_str(),
-                   pRuntime->ToWideString(params[3]).c_str());
+      swMsg = WideString::Format(
+          JSGetStringFromID(JSMessage::kRangeBetweenError).c_str(),
+          pRuntime->ToWideString(params[1]).c_str(),
+          pRuntime->ToWideString(params[3]).c_str());
   } else if (bGreaterThan) {
     if (dEentValue < dGreaterThan)
-      swMsg.Format(JSGetStringFromID(JSMessage::kRangeGreaterError).c_str(),
-                   pRuntime->ToWideString(params[1]).c_str());
+      swMsg = WideString::Format(
+          JSGetStringFromID(JSMessage::kRangeGreaterError).c_str(),
+          pRuntime->ToWideString(params[1]).c_str());
   } else if (bLessThan) {
     if (dEentValue > dLessThan)
-      swMsg.Format(JSGetStringFromID(JSMessage::kRangeLessError).c_str(),
-                   pRuntime->ToWideString(params[3]).c_str());
+      swMsg = WideString::Format(
+          JSGetStringFromID(JSMessage::kRangeLessError).c_str(),
+          pRuntime->ToWideString(params[3]).c_str());
   }
 
   if (!swMsg.IsEmpty()) {
diff --git a/fxjs/cjs_runtime.cpp b/fxjs/cjs_runtime.cpp
index 8a3b166cbd..87224af8e2 100644
--- a/fxjs/cjs_runtime.cpp
+++ b/fxjs/cjs_runtime.cpp
@@ -208,8 +208,8 @@ int CJS_Runtime::ExecuteScript(const WideString& script, WideString* info) {
   FXJSErr error = {};
   int nRet = Execute(script, &error);
   if (nRet < 0) {
-    info->Format(L"[ Line: %05d { %s } ] : %s", error.linnum - 1, error.srcline,
-                 error.message);
+    *info = WideString::Format(L"[ Line: %05d { %s } ] : %s", error.linnum - 1,
+                               error.srcline, error.message);
   }
   return nRet;
 }
diff --git a/fxjs/cjs_util.cpp b/fxjs/cjs_util.cpp
index 9fc1093158..c7bf027695 100644
--- a/fxjs/cjs_util.cpp
+++ b/fxjs/cjs_util.cpp
@@ -115,19 +115,20 @@ CJS_Return util::printf(CJS_Runtime* pRuntime,
     WideString strSegment;
     switch (ParseDataType(&c_strFormat)) {
       case UTIL_INT:
-        strSegment.Format(c_strFormat.c_str(),
-                          pRuntime->ToInt32(params[iIndex]));
+        strSegment = WideString::Format(c_strFormat.c_str(),
+                                        pRuntime->ToInt32(params[iIndex]));
         break;
       case UTIL_DOUBLE:
-        strSegment.Format(c_strFormat.c_str(),
-                          pRuntime->ToDouble(params[iIndex]));
+        strSegment = WideString::Format(c_strFormat.c_str(),
+                                        pRuntime->ToDouble(params[iIndex]));
         break;
       case UTIL_STRING:
-        strSegment.Format(c_strFormat.c_str(),
-                          pRuntime->ToWideString(params[iIndex]).c_str());
+        strSegment =
+            WideString::Format(c_strFormat.c_str(),
+                               pRuntime->ToWideString(params[iIndex]).c_str());
         break;
       default:
-        strSegment.Format(L"%ls", c_strFormat.c_str());
+        strSegment = WideString::Format(L"%ls", c_strFormat.c_str());
         break;
     }
     c_strResult += strSegment.c_str();
@@ -164,16 +165,16 @@ CJS_Return util::printd(CJS_Runtime* pRuntime,
     WideString swResult;
     switch (pRuntime->ToInt32(params[0])) {
       case 0:
-        swResult.Format(L"D:%04d%02d%02d%02d%02d%02d", year, month, day, hour,
-                        min, sec);
+        swResult = WideString::Format(L"D:%04d%02d%02d%02d%02d%02d", year,
+                                      month, day, hour, min, sec);
         break;
       case 1:
-        swResult.Format(L"%04d.%02d.%02d %02d:%02d:%02d", year, month, day,
-                        hour, min, sec);
+        swResult = WideString::Format(L"%04d.%02d.%02d %02d:%02d:%02d", year,
+                                      month, day, hour, min, sec);
         break;
       case 2:
-        swResult.Format(L"%04d/%02d/%02d %02d:%02d:%02d", year, month, day,
-                        hour, min, sec);
+        swResult = WideString::Format(L"%04d/%02d/%02d %02d:%02d:%02d", year,
+                                      month, day, hour, min, sec);
         break;
       default:
         return CJS_Return(JSGetStringFromID(JSMessage::kValueError));
@@ -215,9 +216,6 @@ CJS_Return util::printd(CJS_Runtime* pRuntime,
     };
 
     for (size_t i = 0; i < FX_ArraySize(cTableAd); ++i) {
-      WideString sValue;
-      sValue.Format(L"%d", cTableAd[i].iValue);
-
       int iStart = 0;
       int iEnd;
       while ((iEnd = cFormat.find(cTableAd[i].lpszJSMark, iStart)) != -1) {
@@ -227,7 +225,8 @@ CJS_Return util::printd(CJS_Runtime* pRuntime,
             continue;
           }
         }
-        cFormat.replace(iEnd, wcslen(cTableAd[i].lpszJSMark), sValue.c_str());
+        cFormat.replace(iEnd, wcslen(cTableAd[i].lpszJSMark),
+                        WideString::Format(L"%d", cTableAd[i].iValue).c_str());
         iStart = iEnd;
       }
     }
diff --git a/fxjs/cjx_node.cpp b/fxjs/cjx_node.cpp
index 17662dada6..b89101ce17 100644
--- a/fxjs/cjx_node.cpp
+++ b/fxjs/cjx_node.cpp
@@ -297,10 +297,7 @@ pdfium::Optional<WideString> CJX_Node::TryAttribute(XFA_Attribute eAttr,
       pdfium::Optional<int32_t> iValue = TryInteger(pAttr->eName, bUseDefault);
       if (!iValue)
         return {};
-
-      WideString wsValue;
-      wsValue.Format(L"%d", *iValue);
-      return {wsValue};
+      return {WideString::Format(L"%d", *iValue)};
     }
     case XFA_AttributeType::Measure: {
       pdfium::Optional<CXFA_Measurement> value =
@@ -1555,9 +1552,8 @@ void CJX_Node::Script_Som_BorderColor(CFXJSE_Value* pValue,
   int32_t g;
   int32_t b;
   std::tie(a, r, g, b) = ArgbDecode(color);
-  WideString strColor;
-  strColor.Format(L"%d,%d,%d", r, g, b);
-  pValue->SetString(strColor.UTF8Encode().AsStringView());
+  pValue->SetString(
+      WideString::Format(L"%d,%d,%d", r, g, b).UTF8Encode().AsStringView());
 }
 
 void CJX_Node::Script_Som_BorderWidth(CFXJSE_Value* pValue,
@@ -1610,9 +1606,8 @@ void CJX_Node::Script_Som_FillColor(CFXJSE_Value* pValue,
   int32_t g;
   int32_t b;
   std::tie(a, r, g, b) = ArgbDecode(color);
-  WideString wsColor;
-  wsColor.Format(L"%d,%d,%d", r, g, b);
-  pValue->SetString(wsColor.UTF8Encode().AsStringView());
+  pValue->SetString(
+      WideString::Format(L"%d,%d,%d", r, g, b).UTF8Encode().AsStringView());
 }
 
 void CJX_Node::Script_Som_DataNode(CFXJSE_Value* pValue,
@@ -3285,10 +3280,10 @@ bool CJX_Node::SetValue(XFA_Attribute eAttr,
       elem->SetString(pInfo->pName, pValue ? L"1" : L"0");
       break;
     case XFA_AttributeType::Integer: {
-      WideString wsValue;
-      wsValue.Format(L"%d",
-                     static_cast<int32_t>(reinterpret_cast<uintptr_t>(pValue)));
-      elem->SetString(pInfo->pName, wsValue);
+      elem->SetString(
+          pInfo->pName,
+          WideString::Format(L"%d", static_cast<int32_t>(
+                                        reinterpret_cast<uintptr_t>(pValue))));
       break;
     }
     default:
diff --git a/fxjs/cjx_object.cpp b/fxjs/cjx_object.cpp
index 80a54fc8a0..49c147ba95 100644
--- a/fxjs/cjx_object.cpp
+++ b/fxjs/cjx_object.cpp
@@ -48,11 +48,9 @@ void CJX_Object::ThrowArgumentMismatchException() const {
 }
 
 void CJX_Object::ThrowException(const wchar_t* str, ...) const {
-  WideString wsMessage;
   va_list arg_ptr;
-
   va_start(arg_ptr, str);
-  wsMessage.FormatV(str, arg_ptr);
+  WideString wsMessage = WideString::FormatV(str, arg_ptr);
   va_end(arg_ptr);
 
   ASSERT(!wsMessage.IsEmpty());
diff --git a/xfa/fgas/crt/cfgas_formatstring.cpp b/xfa/fgas/crt/cfgas_formatstring.cpp
index 87b07691a4..eaac969fd8 100644
--- a/xfa/fgas/crt/cfgas_formatstring.cpp
+++ b/xfa/fgas/crt/cfgas_formatstring.cpp
@@ -554,9 +554,8 @@ uint16_t GetWeekOfYear(uint16_t year, uint16_t month, uint16_t day) {
 }
 
 WideString NumToString(size_t fmt_size, int32_t value) {
-  WideString str;
-  str.Format(fmt_size == 1 ? L"%d" : fmt_size == 2 ? L"%02d" : L"%03d", value);
-  return str;
+  return WideString::Format(
+      fmt_size == 1 ? L"%d" : fmt_size == 2 ? L"%02d" : L"%03d", value);
 }
 
 WideString DateFormat(const WideString& wsDatePattern,
@@ -684,10 +683,8 @@ WideString TimeFormat(const WideString& wsTimePattern,
       FX_TIMEZONE tz = pLocale->GetTimeZone();
       if (tz.tzHour != 0 || tz.tzMinute != 0) {
         wsResult += tz.tzHour < 0 ? L"-" : L"+";
-
-        WideString wsTimezone;
-        wsTimezone.Format(L"%02d:%02d", abs(tz.tzHour), tz.tzMinute);
-        wsResult += wsTimezone;
+        wsResult +=
+            WideString::Format(L"%02d:%02d", abs(tz.tzHour), tz.tzMinute);
       }
     }
   }
@@ -2006,9 +2003,7 @@ bool CFGAS_FormatString::FormatStrNum(const WideStringView& wsInputNum,
         ccf--;
         break;
       case 'E': {
-        WideString wsExp;
-        wsExp.Format(L"E%+d", exponent);
-        *wsOutput = wsExp + *wsOutput;
+        *wsOutput = WideString::Format(L"E%+d", exponent) + *wsOutput;
         ccf--;
         break;
       }
@@ -2164,9 +2159,7 @@ bool CFGAS_FormatString::FormatStrNum(const WideStringView& wsInputNum,
         ccf++;
         break;
       case 'E': {
-        WideString wsExp;
-        wsExp.Format(L"E%+d", exponent);
-        *wsOutput += wsExp;
+        *wsOutput += WideString::Format(L"E%+d", exponent);
         ccf++;
         break;
       }
diff --git a/xfa/fwl/cfwl_datetimepicker.cpp b/xfa/fwl/cfwl_datetimepicker.cpp
index cd58dc7f92..8dcdf887f7 100644
--- a/xfa/fwl/cfwl_datetimepicker.cpp
+++ b/xfa/fwl/cfwl_datetimepicker.cpp
@@ -214,10 +214,11 @@ void CFWL_DateTimePicker::FormatDateString(int32_t iYear,
                                            WideString& wsText) {
   if ((m_pProperties->m_dwStyleExes & FWL_STYLEEXT_DTP_ShortDateFormat) ==
       FWL_STYLEEXT_DTP_ShortDateFormat) {
-    wsText.Format(L"%d-%d-%d", iYear, iMonth, iDay);
+    wsText = WideString::Format(L"%d-%d-%d", iYear, iMonth, iDay);
   } else if ((m_pProperties->m_dwStyleExes & FWL_STYLEEXT_DTP_LongDateFormat) ==
              FWL_STYLEEXT_DTP_LongDateFormat) {
-    wsText.Format(L"%d Year %d Month %d Day", iYear, iMonth, iDay);
+    wsText =
+        WideString::Format(L"%d Year %d Month %d Day", iYear, iMonth, iDay);
   }
 }
 
diff --git a/xfa/fwl/cfwl_monthcalendar.cpp b/xfa/fwl/cfwl_monthcalendar.cpp
index 82cef65c3c..5f23a1e8e9 100644
--- a/xfa/fwl/cfwl_monthcalendar.cpp
+++ b/xfa/fwl/cfwl_monthcalendar.cpp
@@ -430,9 +430,8 @@ CFX_SizeF CFWL_MonthCalendar::CalcSize() {
   float fDayMaxW = 0.0f;
   float fDayMaxH = 0.0f;
   for (int day = 10; day <= 31; day++) {
-    WideString wsDay;
-    wsDay.Format(L"%d", day);
-    CFX_SizeF sz = CalcTextSize(wsDay, m_pProperties->m_pThemeProvider, false);
+    CFX_SizeF sz = CalcTextSize(WideString::Format(L"%d", day),
+                                m_pProperties->m_pThemeProvider, false);
     fDayMaxW = (fDayMaxW >= sz.width) ? fDayMaxW : sz.width;
     fDayMaxH = (fDayMaxH >= sz.height) ? fDayMaxH : sz.height;
   }
@@ -579,8 +578,6 @@ void CFWL_MonthCalendar::ResetDateItem() {
     if (iDayOfWeek >= 7)
       iDayOfWeek = 0;
 
-    WideString wsDay;
-    wsDay.Format(L"%d", i + 1);
     uint32_t dwStates = 0;
     if (m_iYear == m_iCurYear && m_iMonth == m_iCurMonth && m_iDay == (i + 1))
       dwStates |= FWL_ITEMSTATE_MCD_Flag;
@@ -588,8 +585,8 @@ void CFWL_MonthCalendar::ResetDateItem() {
       dwStates |= FWL_ITEMSTATE_MCD_Selected;
 
     CFX_RectF rtDate;
-    m_arrDates.push_back(pdfium::MakeUnique<DATEINFO>(i + 1, iDayOfWeek,
-                                                      dwStates, rtDate, wsDay));
+    m_arrDates.push_back(pdfium::MakeUnique<DATEINFO>(
+        i + 1, iDayOfWeek, dwStates, rtDate, WideString::Format(L"%d", i + 1)));
     iDayOfWeek++;
   }
 }
@@ -680,17 +677,13 @@ WideString CFWL_MonthCalendar::GetHeadText(int32_t iYear, int32_t iMonth) {
                                           L"April",   L"May",      L"June",
                                           L"July",    L"August",   L"September",
                                           L"October", L"November", L"December"};
-  WideString wsHead;
-  wsHead.Format(L"%s, %d", pMonth[iMonth - 1], iYear);
-  return wsHead;
+  return WideString::Format(L"%s, %d", pMonth[iMonth - 1], iYear);
 }
 
 WideString CFWL_MonthCalendar::GetTodayText(int32_t iYear,
                                             int32_t iMonth,
                                             int32_t iDay) {
-  WideString wsToday;
-  wsToday.Format(L", %d/%d/%d", iDay, iMonth, iYear);
-  return wsToday;
+  return WideString::Format(L", %d/%d/%d", iDay, iMonth, iYear);
 }
 
 int32_t CFWL_MonthCalendar::GetDayAtPoint(const CFX_PointF& point) const {
@@ -893,7 +886,7 @@ CFWL_MonthCalendar::DATEINFO::DATEINFO(int32_t day,
                                        int32_t dayofweek,
                                        uint32_t dwSt,
                                        CFX_RectF rc,
-                                       WideString& wsday)
+                                       const WideString& wsday)
     : iDay(day),
       iDayOfWeek(dayofweek),
       dwStates(dwSt),
diff --git a/xfa/fwl/cfwl_monthcalendar.h b/xfa/fwl/cfwl_monthcalendar.h
index 325fa96158..7b68600bbc 100644
--- a/xfa/fwl/cfwl_monthcalendar.h
+++ b/xfa/fwl/cfwl_monthcalendar.h
@@ -79,7 +79,7 @@ class CFWL_MonthCalendar : public CFWL_Widget {
              int32_t dayofweek,
              uint32_t dwSt,
              CFX_RectF rc,
-             WideString& wsday);
+             const WideString& wsday);
     ~DATEINFO();
 
     int32_t iDay;
diff --git a/xfa/fxfa/cxfa_ffdocview.cpp b/xfa/fxfa/cxfa_ffdocview.cpp
index d076fdeddb..3895d54569 100644
--- a/xfa/fxfa/cxfa_ffdocview.cpp
+++ b/xfa/fxfa/cxfa_ffdocview.cpp
@@ -163,12 +163,10 @@ void CXFA_FFDocView::ShowNullTestMsg() {
       wsMsg += m_arrNullTestMsg[i] + L"\n";
 
     if (iRemain > 0) {
-      WideString wsTemp;
-      wsTemp.Format(
-          L"Message limit exceeded. Remaining %d "
-          L"validation errors not reported.",
-          iRemain);
-      wsMsg += L"\n" + wsTemp;
+      wsMsg += L"\n" + WideString::Format(
+                           L"Message limit exceeded. Remaining %d "
+                           L"validation errors not reported.",
+                           iRemain);
     }
     pAppProvider->MsgBox(wsMsg, pAppProvider->GetAppTitle(), XFA_MBICON_Status,
                          XFA_MB_OK);
diff --git a/xfa/fxfa/cxfa_ffnotify.cpp b/xfa/fxfa/cxfa_ffnotify.cpp
index 6e3cdd9411..fb63556da9 100644
--- a/xfa/fxfa/cxfa_ffnotify.cpp
+++ b/xfa/fxfa/cxfa_ffnotify.cpp
@@ -286,12 +286,10 @@ void CXFA_FFNotify::OpenDropDownList(CXFA_FFWidget* hWidget) {
 WideString CXFA_FFNotify::GetCurrentDateTime() {
   CFX_DateTime dataTime;
   dataTime.Now();
-
-  WideString wsDateTime;
-  wsDateTime.Format(L"%d%02d%02dT%02d%02d%02d", dataTime.GetYear(),
-                    dataTime.GetMonth(), dataTime.GetDay(), dataTime.GetHour(),
-                    dataTime.GetMinute(), dataTime.GetSecond());
-  return wsDateTime;
+  return WideString::Format(L"%d%02d%02dT%02d%02d%02d", dataTime.GetYear(),
+                            dataTime.GetMonth(), dataTime.GetDay(),
+                            dataTime.GetHour(), dataTime.GetMinute(),
+                            dataTime.GetSecond());
 }
 
 void CXFA_FFNotify::ResetData(CXFA_WidgetData* pWidgetData) {
diff --git a/xfa/fxfa/cxfa_fftextedit.cpp b/xfa/fxfa/cxfa_fftextedit.cpp
index 61f48d7f54..848eab875f 100644
--- a/xfa/fxfa/cxfa_fftextedit.cpp
+++ b/xfa/fxfa/cxfa_fftextedit.cpp
@@ -203,10 +203,9 @@ void CXFA_FFTextEdit::ValidateNumberField(const WideString& wsText) {
   WideString wsSomField;
   pAcc->GetNode()->GetSOMExpression(wsSomField);
 
-  WideString wsMessage;
-  wsMessage.Format(L"%s can not contain %s", wsText.c_str(),
-                   wsSomField.c_str());
-  pAppProvider->MsgBox(wsMessage, pAppProvider->GetAppTitle(), XFA_MBICON_Error,
+  pAppProvider->MsgBox(WideString::Format(L"%s can not contain %s",
+                                          wsText.c_str(), wsSomField.c_str()),
+                       pAppProvider->GetAppTitle(), XFA_MBICON_Error,
                        XFA_MB_OK);
 }
 
diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index 532079e4a7..bec116c65e 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -756,7 +756,7 @@ bool CXFA_TextLayout::LoadRichText(
         } else if (wsName == L"li") {
           bCurLi = true;
           if (bIsOl)
-            wsText.Format(L"%d.  ", iLiCount);
+            wsText = WideString::Format(L"%d.  ", iLiCount);
           else
             wsText = 0x00B7 + WideStringView(L"  ", 1);
         } else if (!bContentNode) {
diff --git a/xfa/fxfa/cxfa_widgetacc.cpp b/xfa/fxfa/cxfa_widgetacc.cpp
index a579646fd9..b019bf636c 100644
--- a/xfa/fxfa/cxfa_widgetacc.cpp
+++ b/xfa/fxfa/cxfa_widgetacc.cpp
@@ -472,7 +472,8 @@ int32_t CXFA_WidgetAcc::ProcessNullTestValidate(CXFA_ValidateData validateData,
     case XFA_ATTRIBUTEENUM_Error: {
       if (wsNullMsg.IsEmpty()) {
         wsCaptionName = GetValidateCaptionName(bVersionFlag);
-        wsNullMsg.Format(L"%s cannot be blank.", wsCaptionName.c_str());
+        wsNullMsg =
+            WideString::Format(L"%s cannot be blank.", wsCaptionName.c_str());
       }
       pAppProvider->MsgBox(wsNullMsg, wsTitle, XFA_MBICON_Status, XFA_MB_OK);
       return XFA_EVENTERROR_Error;
@@ -483,7 +484,7 @@ int32_t CXFA_WidgetAcc::ProcessNullTestValidate(CXFA_ValidateData validateData,
 
       if (wsNullMsg.IsEmpty()) {
         wsCaptionName = GetValidateCaptionName(bVersionFlag);
-        wsNullMsg.Format(
+        wsNullMsg = WideString::Format(
             L"%s cannot be blank. To ignore validations for %s, click Ignore.",
             wsCaptionName.c_str(), wsCaptionName.c_str());
       }
@@ -518,21 +519,16 @@ WideString CXFA_WidgetAcc::GetValidateCaptionName(bool bVersionFlag) {
 
 WideString CXFA_WidgetAcc::GetValidateMessage(bool bError, bool bVersionFlag) {
   WideString wsCaptionName = GetValidateCaptionName(bVersionFlag);
-  WideString wsMessage;
-  if (bVersionFlag) {
-    wsMessage.Format(L"%s validation failed", wsCaptionName.c_str());
-    return wsMessage;
-  }
+  if (bVersionFlag)
+    return WideString::Format(L"%s validation failed", wsCaptionName.c_str());
   if (bError) {
-    wsMessage.Format(L"The value you entered for %s is invalid.",
-                     wsCaptionName.c_str());
-    return wsMessage;
+    return WideString::Format(L"The value you entered for %s is invalid.",
+                              wsCaptionName.c_str());
   }
-  wsMessage.Format(
+  return WideString::Format(
       L"The value you entered for %s is invalid. To ignore "
       L"validations for %s, click Ignore.",
       wsCaptionName.c_str(), wsCaptionName.c_str());
-  return wsMessage;
 }
 
 int32_t CXFA_WidgetAcc::ProcessValidate(int32_t iFlags) {
diff --git a/xfa/fxfa/parser/cxfa_dataexporter.cpp b/xfa/fxfa/parser/cxfa_dataexporter.cpp
index c86a7f7d51..e8a37719fe 100644
--- a/xfa/fxfa/parser/cxfa_dataexporter.cpp
+++ b/xfa/fxfa/parser/cxfa_dataexporter.cpp
@@ -162,7 +162,8 @@ void RecognizeXFAVersionNumber(CXFA_Node* pTemplateRoot,
   if (eVersion == XFA_VERSION_UNKNOWN)
     eVersion = XFA_VERSION_DEFAULT;
 
-  wsVersionNumber.Format(L"%i.%i", eVersion / 100, eVersion % 100);
+  wsVersionNumber =
+      WideString::Format(L"%i.%i", eVersion / 100, eVersion % 100);
 }
 
 void RegenerateFormFile_Changed(CXFA_Node* pNode,
diff --git a/xfa/fxfa/parser/cxfa_filldata.cpp b/xfa/fxfa/parser/cxfa_filldata.cpp
index da249548f9..9f57b8de7d 100644
--- a/xfa/fxfa/parser/cxfa_filldata.cpp
+++ b/xfa/fxfa/parser/cxfa_filldata.cpp
@@ -19,14 +19,14 @@ int32_t CXFA_FillData::GetPresence() {
 void CXFA_FillData::SetColor(FX_ARGB color) {
   CXFA_Node* pNode =
       m_pNode->JSNode()->GetProperty(0, XFA_Element::Color, true);
-  WideString wsColor;
   int a;
   int r;
   int g;
   int b;
   std::tie(a, r, g, b) = ArgbDecode(color);
-  wsColor.Format(L"%d,%d,%d", r, g, b);
-  pNode->JSNode()->SetCData(XFA_Attribute::Value, wsColor, false, false);
+  pNode->JSNode()->SetCData(XFA_Attribute::Value,
+                            WideString::Format(L"%d,%d,%d", r, g, b), false,
+                            false);
 }
 
 FX_ARGB CXFA_FillData::GetColor(bool bText) {
diff --git a/xfa/fxfa/parser/cxfa_localevalue.cpp b/xfa/fxfa/parser/cxfa_localevalue.cpp
index 109254fe2c..09e3577887 100644
--- a/xfa/fxfa/parser/cxfa_localevalue.cpp
+++ b/xfa/fxfa/parser/cxfa_localevalue.cpp
@@ -292,32 +292,27 @@ CFX_DateTime CXFA_LocaleValue::GetTime() const {
 
 bool CXFA_LocaleValue::SetDate(const CFX_DateTime& d) {
   m_dwType = XFA_VT_DATE;
-  m_wsValue.Format(L"%04d-%02d-%02d", d.GetYear(), d.GetMonth(), d.GetDay());
+  m_wsValue = WideString::Format(L"%04d-%02d-%02d", d.GetYear(), d.GetMonth(),
+                                 d.GetDay());
   return true;
 }
 
 bool CXFA_LocaleValue::SetTime(const CFX_DateTime& t) {
   m_dwType = XFA_VT_TIME;
-  m_wsValue.Format(L"%02d:%02d:%02d", t.GetHour(), t.GetMinute(),
-                   t.GetSecond());
-  if (t.GetMillisecond() > 0) {
-    WideString wsTemp;
-    wsTemp.Format(L"%:03d", t.GetMillisecond());
-    m_wsValue += wsTemp;
-  }
+  m_wsValue = WideString::Format(L"%02d:%02d:%02d", t.GetHour(), t.GetMinute(),
+                                 t.GetSecond());
+  if (t.GetMillisecond() > 0)
+    m_wsValue += WideString::Format(L"%:03d", t.GetMillisecond());
   return true;
 }
 
 bool CXFA_LocaleValue::SetDateTime(const CFX_DateTime& dt) {
   m_dwType = XFA_VT_DATETIME;
-  m_wsValue.Format(L"%04d-%02d-%02dT%02d:%02d:%02d", dt.GetYear(),
-                   dt.GetMonth(), dt.GetDay(), dt.GetHour(), dt.GetMinute(),
-                   dt.GetSecond());
-  if (dt.GetMillisecond() > 0) {
-    WideString wsTemp;
-    wsTemp.Format(L"%:03d", dt.GetMillisecond());
-    m_wsValue += wsTemp;
-  }
+  m_wsValue = WideString::Format(L"%04d-%02d-%02dT%02d:%02d:%02d", dt.GetYear(),
+                                 dt.GetMonth(), dt.GetDay(), dt.GetHour(),
+                                 dt.GetMinute(), dt.GetSecond());
+  if (dt.GetMillisecond() > 0)
+    m_wsValue += WideString::Format(L"%:03d", dt.GetMillisecond());
   return true;
 }
 
diff --git a/xfa/fxfa/parser/cxfa_measurement.cpp b/xfa/fxfa/parser/cxfa_measurement.cpp
index 91e39af969..288ed0cd31 100644
--- a/xfa/fxfa/parser/cxfa_measurement.cpp
+++ b/xfa/fxfa/parser/cxfa_measurement.cpp
@@ -46,37 +46,27 @@ void CXFA_Measurement::SetString(const WideStringView& wsMeasure) {
 }
 
 WideString CXFA_Measurement::ToString() const {
-  WideString wsMeasure;
   switch (GetUnit()) {
     case XFA_Unit::Mm:
-      wsMeasure.Format(L"%.8gmm", GetValue());
-      break;
+      return WideString::Format(L"%.8gmm", GetValue());
     case XFA_Unit::Pt:
-      wsMeasure.Format(L"%.8gpt", GetValue());
-      break;
+      return WideString::Format(L"%.8gpt", GetValue());
     case XFA_Unit::In:
-      wsMeasure.Format(L"%.8gin", GetValue());
-      break;
+      return WideString::Format(L"%.8gin", GetValue());
     case XFA_Unit::Cm:
-      wsMeasure.Format(L"%.8gcm", GetValue());
-      break;
+      return WideString::Format(L"%.8gcm", GetValue());
     case XFA_Unit::Mp:
-      wsMeasure.Format(L"%.8gmp", GetValue());
-      break;
+      return WideString::Format(L"%.8gmp", GetValue());
     case XFA_Unit::Pc:
-      wsMeasure.Format(L"%.8gpc", GetValue());
-      break;
+      return WideString::Format(L"%.8gpc", GetValue());
     case XFA_Unit::Em:
-      wsMeasure.Format(L"%.8gem", GetValue());
-      break;
+      return WideString::Format(L"%.8gem", GetValue());
     case XFA_Unit::Percent:
-      wsMeasure.Format(L"%.8g%%", GetValue());
-      break;
+      return WideString::Format(L"%.8g%%", GetValue());
     default:
-      wsMeasure.Format(L"%.8g", GetValue());
       break;
   }
-  return wsMeasure;
+  return WideString::Format(L"%.8g", GetValue());
 }
 
 float CXFA_Measurement::ToUnit(XFA_Unit eUnit) const {
diff --git a/xfa/fxfa/parser/cxfa_nodehelper.cpp b/xfa/fxfa/parser/cxfa_nodehelper.cpp
index bc1d5c2031..e8e88d2fc1 100644
--- a/xfa/fxfa/parser/cxfa_nodehelper.cpp
+++ b/xfa/fxfa/parser/cxfa_nodehelper.cpp
@@ -256,14 +256,15 @@ void CXFA_NodeHelper::GetNameExpression(CXFA_Node* refNode,
   if (refNode->IsUnnamed() ||
       (bIsProperty && refNode->GetElementType() != XFA_Element::PageSet)) {
     ws = refNode->GetClassName();
-    wsName.Format(L"#%s[%d]", ws.c_str(),
-                  GetIndex(refNode, eLogicType, bIsProperty, true));
+    wsName =
+        WideString::Format(L"#%s[%d]", ws.c_str(),
+                           GetIndex(refNode, eLogicType, bIsProperty, true));
     return;
   }
   ws = refNode->JSNode()->GetCData(XFA_Attribute::Name);
   ws.Replace(L".", L"\\.");
-  wsName.Format(L"%s[%d]", ws.c_str(),
-                GetIndex(refNode, eLogicType, bIsProperty, false));
+  wsName = WideString::Format(
+      L"%s[%d]", ws.c_str(), GetIndex(refNode, eLogicType, bIsProperty, false));
 }
 
 bool CXFA_NodeHelper::NodeIsTransparent(CXFA_Node* refNode) {
diff --git a/xfa/fxfa/parser/cxfa_strokedata.cpp b/xfa/fxfa/parser/cxfa_strokedata.cpp
index 43354a38a4..edbac24237 100644
--- a/xfa/fxfa/parser/cxfa_strokedata.cpp
+++ b/xfa/fxfa/parser/cxfa_strokedata.cpp
@@ -60,14 +60,14 @@ void CXFA_StrokeData::SetColor(FX_ARGB argb) {
 
   CXFA_Node* pNode =
       m_pNode->JSNode()->GetProperty(0, XFA_Element::Color, true);
-  WideString wsColor;
   int a;
   int r;
   int g;
   int b;
   std::tie(a, r, g, b) = ArgbDecode(argb);
-  wsColor.Format(L"%d,%d,%d", r, g, b);
-  pNode->JSNode()->SetCData(XFA_Attribute::Value, wsColor, false, false);
+  pNode->JSNode()->SetCData(XFA_Attribute::Value,
+                            WideString::Format(L"%d,%d,%d", r, g, b), false,
+                            false);
 }
 
 int32_t CXFA_StrokeData::GetJoinType() const {