VULNERABILITY DETAILS
The attached pdf file could crash PDFium when XFA and ASAN was enabled on Windows.

```
is_asan = true
pdf_enable_xfa = true
pdf_enable_v8 = true
```

The following error log was produced by AddressSanitizer.
```
=================================================================
==7932==ERROR: AddressSanitizer: heap-use-after-free on address 0x0c11b58c at pc 0x03a8242d bp 0x0040dd5c sp 0x0040dd50
READ of size 1 at 0x0c11b58c thread T0
==7932==*** WARNING: Failed to initialize DbgHelp!              ***
==7932==*** Most likely this means that the app is already      ***
==7932==*** using DbgHelp, possibly with incompatible flags.    ***
==7932==*** Due to technical reasons, symbolization might crash ***
==7932==*** or produce wrong results.                           ***
    #0 0x3a8242c in CXFA_Document::DoProtoMerge C:\pdfium\xfa\fxfa\parser\cxfa_document.cpp:368
    #1 0x39dba35 in CXFA_FFDocView::StartLayout C:\pdfium\xfa\fxfa\cxfa_ffdocview.cpp:70
    #2 0x3987815 in CPDFXFA_Context::LoadXFADoc C:\pdfium\fpdfsdk\fpdfxfa\cpdfxfa_context.cpp:115
    #3 0x2f5464e in FPDF_LoadXFA C:\pdfium\fpdfsdk\fpdfview.cpp:599
    #4 0x13c475e in main C:\pdfium\samples\pdfium_test.cc:1630
    #5 0x3fa87aa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #6 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #7 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #8 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

0x0c11b58c is located 12 bytes inside of 104-byte region [0x0c11b580,0x0c11b5e8)
freed by thread T0 here:
    #0 0x3f953c8 in free c:\b\rr\tmp8oruyi\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:44
    #1 0x2fcea60 in fxcrt::ByteString::~ByteString C:\pdfium\core\fxcrt\bytestring.cpp:221
    #2 0x3a8172d in CXFA_Document::DoProtoMerge C:\pdfium\xfa\fxfa\parser\cxfa_document.cpp:426
    #3 0x39dba35 in CXFA_FFDocView::StartLayout C:\pdfium\xfa\fxfa\cxfa_ffdocview.cpp:70
    #4 0x3987815 in CPDFXFA_Context::LoadXFADoc C:\pdfium\fpdfsdk\fpdfxfa\cpdfxfa_context.cpp:115
    #5 0x2f5464e in FPDF_LoadXFA C:\pdfium\fpdfsdk\fpdfview.cpp:599
    #6 0x13c475e in main C:\pdfium\samples\pdfium_test.cc:1630
    #7 0x3fa87aa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #8 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #9 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #10 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

previously allocated by thread T0 here:
    #0 0x3f954ac in malloc c:\b\rr\tmp8oruyi\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:60
    #1 0x2fc80e8 in fxcrt::StringDataTemplate<wchar_t>::Create C:\pdfium\core\fxcrt\string_data_template.h:19
    #2 0x2fc8216 in fxcrt::WideString::WideString C:\pdfium\core\fxcrt\widestring.cpp:377
    #3 0x3db970e in CJX_Object::TryCData C:\pdfium\fxjs\xfa\cjx_object.cpp:588
    #4 0x3dbbb94 in CJX_Object::GetCData C:\pdfium\fxjs\xfa\cjx_object.cpp:446
    #5 0x3a80cb3 in CXFA_Document::DoProtoMerge C:\pdfium\xfa\fxfa\parser\cxfa_document.cpp:394
    #6 0x39dba35 in CXFA_FFDocView::StartLayout C:\pdfium\xfa\fxfa\cxfa_ffdocview.cpp:70
    #7 0x3987815 in CPDFXFA_Context::LoadXFADoc C:\pdfium\fpdfsdk\fpdfxfa\cpdfxfa_context.cpp:115
    #8 0x2f5464e in FPDF_LoadXFA C:\pdfium\fpdfsdk\fpdfview.cpp:599
    #9 0x13c475e in main C:\pdfium\samples\pdfium_test.cc:1630
    #10 0x3fa87aa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #11 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #12 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #13 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

SUMMARY: AddressSanitizer: heap-use-after-free C:\pdfium\xfa\fxfa\parser\cxfa_document.cpp:368 in CXFA_Document::DoProtoMerge
Shadow bytes around the buggy address:
  0x31823660: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fd fd
  0x31823670: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x31823680: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x31823690: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x318236a0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
=>0x318236b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x318236c0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x318236d0: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
  0x318236e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x318236f0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x31823700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7932==ABORTING
```

VERSION
Chrome Version: PDFium with JS / XFA / ASAN enabled.
Operating System: Windows

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]