Speculative fix for segv destroying CPDF_PageObjectHolder::m_GraphicsMap

We speculate that the bug that makes the comparison operator irreflexive
might be the cause of the segv on windows production code, should a
NaN sneak into the GraphicsData struct. In any event, should this
happen, the tree won't be correct with some nodes erroneously replaced.

Add a test which fails prior to the patch, but alas does not elicit
the segv.

Also move operator<() methods to .cpp file corresponding to .h file
in which they are delcared.

Bug: 852273
Change-Id: Ib7929881e7ffbed8b09f6e2c9fb7898cbde58946
Reviewed-on: https://pdfium-review.googlesource.com/35171
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

1 files changed, 30 insertions, 0 deletions

diff --git a/core/fxcrt/fx_extension_unittest.cpp b/core/fxcrt/fx_extension_unittest.cpp
index 39f26b534b..d84071b83a 100644
--- a/core/fxcrt/fx_extension_unittest.cpp
+++ b/core/fxcrt/fx_extension_unittest.cpp
@@ -3,6 +3,9 @@
 // found in the LICENSE file.
 
 #include "core/fxcrt/fx_extension.h"
+
+#include <limits>
+
 #include "testing/gtest/include/gtest/gtest.h"
 
 TEST(fxcrt, FXSYS_HexCharToInt) {
@@ -134,3 +137,30 @@ TEST(fxcrt, FXSYS_wcstof) {
                   FXSYS_wcstof(L"99999999999999999", 17, &used_len));
   EXPECT_EQ(17, used_len);
 }
+
+TEST(fxcrt, FXSYS_SafeOps) {
+  const float fMin = std::numeric_limits<float>::min();
+  const float fMax = std::numeric_limits<float>::max();
+  const float fInf = std::numeric_limits<float>::infinity();
+  const float fNan = std::numeric_limits<float>::quiet_NaN();
+  const float ascending[] = {fMin, 1.0f, 2.0f, fMax, fInf, fNan};
+
+  for (size_t i = 0; i < FX_ArraySize(ascending); ++i) {
+    for (size_t j = 0; j < FX_ArraySize(ascending); ++j) {
+      if (i == j) {
+        EXPECT_TRUE(FXSYS_SafeEQ(ascending[i], ascending[j]))
+            << " at " << i << " " << j;
+      } else {
+        EXPECT_FALSE(FXSYS_SafeEQ(ascending[i], ascending[j]))
+            << " at " << i << " " << j;
+      }
+      if (i < j) {
+        EXPECT_TRUE(FXSYS_SafeLT(ascending[i], ascending[j]))
+            << " at " << i << " " << j;
+      } else {
+        EXPECT_FALSE(FXSYS_SafeLT(ascending[i], ascending[j]))
+            << " at " << i << " " << j;
+      }
+    }
+  }
+}