Add in depth check for ToJavascript and related methods

There exists a similar check for the parser, but it doesn't catch all
cases of excessive memory usage, since a single parse step can
generate multiple expressions that need to be converted or other cases
where the parse depth doesn't match the emission depth later.

Due to the expressions appearing in two different inheritence
hierachies the depth information needs to be stored outside of the
classes, thus the new depth class.

Another way to handle this would be to change the method calls to take
in a visitor object that tracks depth. This would require significant
reworking of some of the code, so I am going to file a bug about doing
that conversion as a cleanup.

BUG=chromium:752495

Change-Id: Ica7c9b60ecf1e17530ea88b7bfb01582c63043be
Reviewed-on: https://pdfium-review.googlesource.com/16752
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/xfa/fxfa/fm2js/cxfa_fmsimpleexpression_unittest.cpp b/xfa/fxfa/fm2js/cxfa_fmsimpleexpression_unittest.cpp
index 5f4d83c327..96ccb71ca9 100644
--- a/xfa/fxfa/fm2js/cxfa_fmsimpleexpression_unittest.cpp
+++ b/xfa/fxfa/fm2js/cxfa_fmsimpleexpression_unittest.cpp
@@ -13,6 +13,7 @@
 #include "testing/test_support.h"
 #include "third_party/base/ptr_util.h"
 #include "xfa/fxfa/fm2js/cxfa_fmlexer.h"
+#include "xfa/fxfa/fm2js/cxfa_fmtojavascriptdepth.h"
 
 TEST(FMCallExpressionTest, more_than_32_arguments) {
   // Use sign as it has 3 object parameters at positions 0, 5, and 6.
@@ -22,6 +23,7 @@ TEST(FMCallExpressionTest, more_than_32_arguments) {
   for (size_t i = 0; i < 50; i++)
     args.push_back(pdfium::MakeUnique<CXFA_FMSimpleExpression>(0, TOKnan));
 
+  CXFA_FMToJavaScriptDepth::Reset();
   CXFA_FMCallExpression callExp(0, std::move(exp), std::move(args), true);
   CFX_WideTextBuf js;
   callExp.ToJavaScript(js);
@@ -45,24 +47,28 @@ TEST(FMCallExpressionTest, more_than_32_arguments) {
 }
 
 TEST(FMStringExpressionTest, Empty) {
+  CXFA_FMToJavaScriptDepth::Reset();
   CFX_WideTextBuf accumulator;
   CXFA_FMStringExpression(1, WideStringView()).ToJavaScript(accumulator);
   EXPECT_EQ(L"", accumulator.AsStringView());
 }
 
 TEST(FMStringExpressionTest, Short) {
+  CXFA_FMToJavaScriptDepth::Reset();
   CFX_WideTextBuf accumulator;
   CXFA_FMStringExpression(1, L"a").ToJavaScript(accumulator);
   EXPECT_EQ(L"a", accumulator.AsStringView());
 }
 
 TEST(FMStringExpressionTest, Medium) {
+  CXFA_FMToJavaScriptDepth::Reset();
   CFX_WideTextBuf accumulator;
   CXFA_FMStringExpression(1, L".abcd.").ToJavaScript(accumulator);
   EXPECT_EQ(L"\"abcd\"", accumulator.AsStringView());
 }
 
 TEST(FMStringExpressionTest, Long) {
+  CXFA_FMToJavaScriptDepth::Reset();
   CFX_WideTextBuf accumulator;
   std::vector<WideStringView::UnsignedType> vec(140000, L'A');
   CXFA_FMStringExpression(1, WideStringView(vec)).ToJavaScript(accumulator);
@@ -70,6 +76,7 @@ TEST(FMStringExpressionTest, Long) {
 }
 
 TEST(FMStringExpressionTest, Quoted) {
+  CXFA_FMToJavaScriptDepth::Reset();
   CFX_WideTextBuf accumulator;
   CXFA_FMStringExpression(1, L".Simon says \"\"run\"\".")
       .ToJavaScript(accumulator);