PDF: Fix uninit memory access in PDFiumEngine.

pdf/pdfium/pdfium_engine.h

Index: pdf/pdfium/pdfium_engine.h
diff --git a/pdf/pdfium/pdfium_engine.h b/pdf/pdfium/pdfium_engine.h
index 6c8368ae749caff67dc57510de83d2a9df3138db..5999e4175eb306d3ca14afee00ceb10e99ba2f1e 100644
--- a/pdf/pdfium/pdfium_engine.h
+++ b/pdf/pdfium/pdfium_engine.h
@@ -131,6 +131,26 @@ class PDFiumEngine : public PDFEngine,
     pp::Point previous_origin_;
   };
 
+  // Used to store mouse down state to handle it in other mouse event handlers.
+  class MouseDownState {
+   public:
+    MouseDownState(const PDFiumPage::Area& area,
+                   const PDFiumPage::LinkTarget& target);
+    ~MouseDownState();
+
+    void Set(const PDFiumPage::Area& area,
+             const PDFiumPage::LinkTarget& target);
+    void Reset();
+    bool Matches(const PDFiumPage::Area& area,
+                 const PDFiumPage::LinkTarget& target) const;
+
+   private:
+    PDFiumPage::Area area_;
+    PDFiumPage::LinkTarget target_;
+
+    DISALLOW_COPY_AND_ASSIGN(MouseDownState);
+  };
+
   friend class SelectionChangeInvalidator;
 
   struct FileAvail : public FX_FILEAVAIL {
@@ -509,22 +529,6 @@ class PDFiumEngine : public PDFEngine,
   // True if we're in the middle of selection.
   bool selecting_;
 
-  // Used to store mouse down state to handle it in other mouse event handlers.
-  struct MouseDownState {

[Lei Zhang, 2014/09/12 22:49:04]

non-trivial struct/class -> class

-    MouseDownState() {};

[Lei Zhang, 2014/09/12 22:49:04]

didn't initialize |area_| or |target_| -> :(

-    MouseDownState(PDFiumPage::Area area, PDFiumPage::LinkTarget target)
-        : area_(area), target_(target) {};
-    PDFiumPage::Area area_;
-    PDFiumPage::LinkTarget target_;
-
-    bool operator==(const MouseDownState& rhs) const {
-      return (area_ == rhs.area_) && (target_.url == rhs.target_.url);

[Lei Zhang, 2014/09/12 22:49:04]

what about target_.page ??

-    }
-
-    bool operator!=(const MouseDownState rhs) const {

[Lei Zhang, 2014/09/12 22:49:04]

const ref

-      return (area_ != rhs.area_) || (target_.url != rhs.target_.url);

[Lei Zhang, 2014/09/12 22:49:04]

As written, this could have just been: return !(*this == rhs)

-    }
-  };
   MouseDownState mouse_down_state_;
 
   // Used for searching.