CFX_ByteString::Reserve(), ReleaseBuffer() fixes.

core/fxcrt/fx_basic_wstring.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <cctype>
@@ skipping 206 matching lines @@
   m_pData.Reset(StringData::Create(nNewLength));
 }
 
 void CFX_WideString::ReleaseBuffer(FX_STRSIZE nNewLength) {
   if (!m_pData)
     return;
 
   if (nNewLength == -1)
     nNewLength = FXSYS_wcslen(m_pData->m_String);
 
+  nNewLength = std::min(nNewLength, m_pData->m_nAllocLength);
   if (nNewLength == 0) {
     clear();
     return;
   }
 
-  FXSYS_assert(nNewLength <= m_pData->m_nAllocLength);
-  ReallocBeforeWrite(nNewLength);
+  FXSYS_assert(m_pData->m_nRefs == 1);
   m_pData->m_nDataLength = nNewLength;
   m_pData->m_String[nNewLength] = 0;
+  if (m_pData->m_nAllocLength - nNewLength >= 32) {
+    // Over arbitrary threshold, so pay the price to relocate.  Force copy to
+    // always occur by holding a second reference to the string.
+    CFX_WideString preserve(*this);
+    ReallocBeforeWrite(nNewLength);
+  }
 }
 
 void CFX_WideString::Reserve(FX_STRSIZE len) {
   GetBuffer(len);
-  ReleaseBuffer(GetLength());
 }
 
 FX_WCHAR* CFX_WideString::GetBuffer(FX_STRSIZE nMinBufLength) {
   if (!m_pData) {
     if (nMinBufLength == 0)
       return nullptr;
 
     m_pData.Reset(StringData::Create(nMinBufLength));
     m_pData->m_nDataLength = 0;
     m_pData->m_String[0] = 0;
@@ skipping 735 matching lines @@
       FXSYS_MultiByteToWideChar(codepage, 0, bstr.c_str(), src_len, nullptr, 0);
   CFX_WideString wstr;
   if (dest_len) {
     FX_WCHAR* dest_buf = wstr.GetBuffer(dest_len);
     FXSYS_MultiByteToWideChar(codepage, 0, bstr.c_str(), src_len, dest_buf,
                               dest_len);
     wstr.ReleaseBuffer(dest_len);
   }
   return wstr;
 }