PDF: Fix uninit memory access in PDFiumEngine.

This regressed in r294564.

BUG=413850

Review URL: https://codereview.chromium.org/568803004

Cr-Commit-Position: refs/heads/master@{#294854}

2 files changed, 59 insertions, 20 deletions

diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
index 6457478..42f69e7 100644
--- a/pdf/pdfium/pdfium_engine.cc
+++ b/pdf/pdfium/pdfium_engine.cc
@@ -561,6 +561,8 @@ PDFiumEngine::PDFiumEngine(PDFEngine::Client* client)
       form_(NULL),
       defer_page_unload_(false),
       selecting_(false),
+      mouse_down_state_(PDFiumPage::NONSELECTABLE_AREA,
+                        PDFiumPage::LinkTarget()),
       next_page_to_search_(-1),
       last_page_to_search_(-1),
       last_character_index_to_search_(-1),
@@ -1322,7 +1324,7 @@ bool PDFiumEngine::OnMouseDown(const pp::MouseInputEvent& event) {
   PDFiumPage::LinkTarget target;
   PDFiumPage::Area area = GetCharIndex(event, &page_index,
                                        &char_index, &target);
-  mouse_down_state_ = MouseDownState(area, target);
+  mouse_down_state_.Set(area, target);
 
   // Decide whether to open link or not based on user action in mouse up and
   // mouse move events.
@@ -1410,7 +1412,7 @@ bool PDFiumEngine::OnMouseUp(const pp::MouseInputEvent& event) {
       GetCharIndex(event, &page_index, &char_index, &target);
 
   // Open link on mouse up for same link for which mouse down happened earlier.
-  if (mouse_down_state_ == MouseDownState(area, target)) {
+  if (mouse_down_state_.Matches(area, target)) {
     if (area == PDFiumPage::WEBLINK_AREA) {
       bool open_in_new_tab = !!(event.GetModifiers() & kDefaultKeyModifier);
       client_->NavigateTo(target.url, open_in_new_tab);
@@ -1443,8 +1445,8 @@ bool PDFiumEngine::OnMouseMove(const pp::MouseInputEvent& event) {
 
   // Clear |mouse_down_state_| if mouse moves away from where the mouse down
   // happened.
-  if (mouse_down_state_ != MouseDownState(area, target))
-    mouse_down_state_ = MouseDownState();
+  if (!mouse_down_state_.Matches(area, target))
+    mouse_down_state_.Reset();
 
   if (!selecting_) {
     PP_CursorType_Dev cursor;
@@ -2756,6 +2758,39 @@ PDFiumEngine::SelectionChangeInvalidator::GetVisibleSelectionsScreenRects(
   }
 }
 
+PDFiumEngine::MouseDownState::MouseDownState(
+    const PDFiumPage::Area& area,
+    const PDFiumPage::LinkTarget& target)
+    : area_(area), target_(target) {
+}
+
+PDFiumEngine::MouseDownState::~MouseDownState() {
+}
+
+void PDFiumEngine::MouseDownState::Set(const PDFiumPage::Area& area,
+                                       const PDFiumPage::LinkTarget& target) {
+  area_ = area;
+  target_ = target;
+}
+
+void PDFiumEngine::MouseDownState::Reset() {
+  area_ = PDFiumPage::NONSELECTABLE_AREA;
+  target_ = PDFiumPage::LinkTarget();
+}
+
+bool PDFiumEngine::MouseDownState::Matches(
+    const PDFiumPage::Area& area,
+    const PDFiumPage::LinkTarget& target) const {
+  if (area_ == area) {
+    if (area == PDFiumPage::WEBLINK_AREA)
+      return target_.url == target.url;
+    if (area == PDFiumPage::DOCLINK_AREA)
+      return target_.page == target.page;
+    return true;
+  }
+  return false;
+}
+
 void PDFiumEngine::DeviceToPage(int page_index,
                                 float device_x,
                                 float device_y,
diff --git a/pdf/pdfium/pdfium_engine.h b/pdf/pdfium/pdfium_engine.h
index 6c8368a..5999e41 100644
--- a/pdf/pdfium/pdfium_engine.h
+++ b/pdf/pdfium/pdfium_engine.h
@@ -131,6 +131,26 @@ class PDFiumEngine : public PDFEngine,
     pp::Point previous_origin_;
   };
 
+  // Used to store mouse down state to handle it in other mouse event handlers.
+  class MouseDownState {
+   public:
+    MouseDownState(const PDFiumPage::Area& area,
+                   const PDFiumPage::LinkTarget& target);
+    ~MouseDownState();
+
+    void Set(const PDFiumPage::Area& area,
+             const PDFiumPage::LinkTarget& target);
+    void Reset();
+    bool Matches(const PDFiumPage::Area& area,
+                 const PDFiumPage::LinkTarget& target) const;
+
+   private:
+    PDFiumPage::Area area_;
+    PDFiumPage::LinkTarget target_;
+
+    DISALLOW_COPY_AND_ASSIGN(MouseDownState);
+  };
+
   friend class SelectionChangeInvalidator;
 
   struct FileAvail : public FX_FILEAVAIL {
@@ -509,22 +529,6 @@ class PDFiumEngine : public PDFEngine,
   // True if we're in the middle of selection.
   bool selecting_;
 
-  // Used to store mouse down state to handle it in other mouse event handlers.
-  struct MouseDownState {
-    MouseDownState() {};
-    MouseDownState(PDFiumPage::Area area, PDFiumPage::LinkTarget target)
-        : area_(area), target_(target) {};
-    PDFiumPage::Area area_;
-    PDFiumPage::LinkTarget target_;
-
-    bool operator==(const MouseDownState& rhs) const {
-      return (area_ == rhs.area_) && (target_.url == rhs.target_.url);
-    }
-
-    bool operator!=(const MouseDownState rhs) const {
-      return (area_ != rhs.area_) || (target_.url != rhs.target_.url);
-    }
-  };
   MouseDownState mouse_down_state_;
 
   // Used for searching.