2 files changed, 34 insertions, 38 deletions

diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index 5359a340e5..e360c16dde 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -911,23 +911,21 @@ void CXFA_TextLayout::ProcessText(WideString& wsText) {
   if (iLen == 0)
     return;
 
+  wchar_t* psz = wsText.GetBuffer(iLen);
   int32_t iTrimLeft = 0;
-  {
-    // Span's lifetime must end before ReleaseBuffer() below.
-    pdfium::span<wchar_t> psz = wsText.GetBuffer(iLen);
-    wchar_t wPrev = 0;
-    for (int32_t i = 0; i < iLen; i++) {
-      wchar_t wch = psz[i];
-      if (wch < 0x20)
-        wch = 0x20;
-      if (wch == 0x20 && wPrev == 0x20)
-        continue;
-
-      wPrev = wch;
-      psz[iTrimLeft++] = wch;
-    }
+  wchar_t wch = 0, wPrev = 0;
+  for (int32_t i = 0; i < iLen; i++) {
+    wch = psz[i];
+    if (wch < 0x20)
+      wch = 0x20;
+    if (wch == 0x20 && wPrev == 0x20)
+      continue;
+
+    wPrev = wch;
+    psz[iTrimLeft++] = wch;
   }
-  wsText.ReleaseBuffer(iTrimLeft);
+  wsText.ReleaseBuffer(iLen);
+  wsText = wsText.Left(iTrimLeft);
 }
 
 void CXFA_TextLayout::EndBreak(CFX_BreakType dwStatus,
diff --git a/xfa/fxfa/parser/cxfa_localevalue.cpp b/xfa/fxfa/parser/cxfa_localevalue.cpp
index 057eaeba2c..cec59de37f 100644
--- a/xfa/fxfa/parser/cxfa_localevalue.cpp
+++ b/xfa/fxfa/parser/cxfa_localevalue.cpp
@@ -682,34 +682,32 @@ void CXFA_LocaleValue::GetNumericFormat(WideString& wsFormat,
                                         int32_t nDecLen) {
   ASSERT(wsFormat.IsEmpty());
   ASSERT(nIntLen >= -1 && nDecLen >= -1);
+
   int32_t nTotalLen = (nIntLen >= 0 ? nIntLen : 2) + 1 +
                       (nDecLen >= 0 ? nDecLen : 2) + (nDecLen == 0 ? 0 : 1);
-  {
-    // Span's lifetime must end before ReleaseBuffer() below.
-    pdfium::span<wchar_t> lpBuf = wsFormat.GetBuffer(nTotalLen);
-    int32_t nPos = 0;
-    lpBuf[nPos++] = L's';
-
-    if (nIntLen == -1) {
+  wchar_t* lpBuf = wsFormat.GetBuffer(nTotalLen);
+  int32_t nPos = 0;
+  lpBuf[nPos++] = L's';
+
+  if (nIntLen == -1) {
+    lpBuf[nPos++] = L'z';
+    lpBuf[nPos++] = L'*';
+  } else {
+    while (nIntLen) {
       lpBuf[nPos++] = L'z';
-      lpBuf[nPos++] = L'*';
-    } else {
-      while (nIntLen) {
-        lpBuf[nPos++] = L'z';
-        nIntLen--;
-      }
-    }
-    if (nDecLen != 0) {
-      lpBuf[nPos++] = L'.';
+      nIntLen--;
     }
-    if (nDecLen == -1) {
+  }
+  if (nDecLen != 0) {
+    lpBuf[nPos++] = L'.';
+  }
+  if (nDecLen == -1) {
+    lpBuf[nPos++] = L'z';
+    lpBuf[nPos++] = L'*';
+  } else {
+    while (nDecLen) {
       lpBuf[nPos++] = L'z';
-      lpBuf[nPos++] = L'*';
-    } else {
-      while (nDecLen) {
-        lpBuf[nPos++] = L'z';
-        nDecLen--;
-      }
+      nDecLen--;
     }
   }
   wsFormat.ReleaseBuffer(nTotalLen);