Convert CFXJSE_Value::ToString to return.

xfa/fxjse/value.h

Index: xfa/fxjse/value.h
diff --git a/xfa/fxjse/value.h b/xfa/fxjse/value.h
index da4976b53cb146f7d2fd6f7ac8a2c3c241acbc85..264fde66a578ad50f43a6921bc839ba35efb7364 100644
--- a/xfa/fxjse/value.h
+++ b/xfa/fxjse/value.h
@@ -172,14 +172,18 @@ class CFXJSE_Value {
         v8::Local<v8::Value>::New(m_pIsolate, m_hValue);
     return static_cast<int32_t>(hValue->NumberValue());
   }
-  V8_INLINE void ToString(CFX_ByteString& szStrOutput) const {
+  V8_INLINE CFX_ByteString ToString() const {
     ASSERT(!m_hValue.IsEmpty());
     CFXJSE_ScopeUtil_IsolateHandleRootContext scope(m_pIsolate);
     v8::Local<v8::Value> hValue =
         v8::Local<v8::Value>::New(m_pIsolate, m_hValue);
     v8::Local<v8::String> hString = hValue->ToString();
     v8::String::Utf8Value hStringVal(hString);
-    szStrOutput = *hStringVal;
+    return CFX_ByteString(*hStringVal);
+  }
+  V8_INLINE CFX_ByteStringC ToStringC() const { return ToString().AsStringC(); }

[Tom Sepez, 2016/06/09 16:43:56]

Nope. The call to ToString() creates a temporary bytestring that lives up until
the semicolon at the end of this statement.  AsStringC doesn't do any copying,
returning pointers into the temporary's buffers.  So we're returing pointers
into something on the stack that gets destructed and popped.

We'll have to put the calls to ToString().AsStringC() into the callers so that
the temporary result of ToString() lives for the duration of what the caller
intends to do with it.

[dsinclair, 2016/06/09 17:26:54]

Done.

+  V8_INLINE CFX_WideString ToWideString() const {
+    return CFX_WideString::FromUTF8(ToStringC());

[Tom Sepez, 2016/06/09 16:47:55]

Note that ToWideString() will be fine (once we fix its ToStringC usage) because
CFX_WideString() allocs and copies.

   }
   CFXJSE_HostObject* ToHostObject(CFXJSE_Class* lpClass) const;