From 9e41d0461d175410f6ea7573e729dc1ae14e846d Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Mon, 13 Feb 2017 12:01:40 -0800
Subject: Use container with stable iterator for m_Icons.

The container may grow while it is being traversed in JS.

BUG=691371

Change-Id: I73ee536458697267c69e6c3ada96e28546d11a4e
Reviewed-on: https://pdfium-review.googlesource.com/2690
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
---
 fpdfsdk/javascript/Document.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fpdfsdk/javascript/Document.h b/fpdfsdk/javascript/Document.h
index 227c4284bb..7786c77881 100644
--- a/fpdfsdk/javascript/Document.h
+++ b/fpdfsdk/javascript/Document.h
@@ -288,7 +288,7 @@ class Document : public CJS_EmbedObj {
   CPDFSDK_FormFillEnvironment::ObservedPtr m_pFormFillEnv;
   CFX_WideString m_cwBaseURL;
   std::list<std::unique_ptr<CJS_DelayData>> m_DelayData;
-  std::vector<std::unique_ptr<IconElement>> m_Icons;
+  std::list<std::unique_ptr<IconElement>> m_Icons;  // For iterator stability.
   bool m_bDelay;
 };
 
-- 
cgit v1.2.3