Fix FMCallExpression undefined shift behaviour.

xfa/fxfa/fm2js/xfa_simpleexpression.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fxfa/fm2js/xfa_simpleexpression.h"
 
 #include "core/fxcrt/include/fx_ext.h"
 
@@ skipping 522 matching lines @@
 
 void CXFA_FMCallExpression::ToJavaScript(CFX_WideTextBuf& javascript) {
   CFX_WideTextBuf funcName;
   m_pExp->ToJavaScript(funcName);
   if (m_bIsSomMethod) {
     javascript << funcName;
     javascript << FX_WSTRC(L"(");
     if (m_pArguments) {
       uint32_t methodPara = IsMethodWithObjParam(funcName.AsStringC());
       if (methodPara > 0) {
         for (int i = 0; i < m_pArguments->GetSize(); ++i) {

[Lei Zhang, 2016/08/03 16:43:23]

So is it the case that m_pArguments->GetSize() can be over 32 normally?

[dsinclair, 2016/08/03 16:55:36]

The spec for formcalc doesn't mention a limit on the number of arguments just
that there are required and optional arguments. I left the ability to have more
then 32 in because I wasn't sure if there were methods were you could pass n
optional arguments and have it use them.

-          if ((methodPara & (0x01 << i)) > 0) {
+          // Currently none of our expressions use objects for a parameter over
+          // the 6th. Make sure we don't overflow the shift when doing this
+          // check. If we ever need more the 32 object params we can revisit.
+          if (i < 32 && (methodPara & (0x01 << i)) > 0) {
             javascript << gs_lpStrExpFuncName[GETFMJSOBJ];
           } else {
             javascript << gs_lpStrExpFuncName[GETFMVALUE];
           }
           javascript << FX_WSTRC(L"(");
           CXFA_FMSimpleExpression* e = m_pArguments->GetAt(i);
           e->ToJavaScript(javascript);
           javascript << FX_WSTRC(L")");
           if (i + 1 < m_pArguments->GetSize()) {
             javascript << FX_WSTRC(L", ");
@@ skipping 188 matching lines @@
       L"for(var index = accessor_object.length - 1; index > 1; index--)\n{\n");
   javascript << FX_WSTRC(L"method_return_value = accessor_object[index].");
   m_pExp2->ToJavaScript(javascript);
   javascript << FX_WSTRC(L";\n}\n}\n");
   javascript << FX_WSTRC(L"else\n{\nmethod_return_value = accessor_object.");
   m_pExp2->ToJavaScript(javascript);
   javascript << FX_WSTRC(L";\n}\n");
   javascript << FX_WSTRC(L"return method_return_value;\n");
   javascript << FX_WSTRC(L"}\n).call(this)");
 }