VULNERABILITY DETAILS
UAF can be triggered in PDFium with XFA enabled when executing the following code.
```
xfa.data.saveXML("pretty");
```

ASAN Log:
=================================================================
==18204==ERROR: AddressSanitizer: heap-use-after-free on address 0x0781cb1c at pc 0x02efe64c bp 0x042ed134 sp 0x042ed124
READ of size 8 at 0x0781cb1c thread T0
==18204==*** WARNING: Failed to initialize DbgHelp!              ***
==18204==*** Most likely this means that the app is already      ***
==18204==*** using DbgHelp, possibly with incompatible flags.    ***
==18204==*** Due to technical reasons, symbolization might crash ***
==18204==*** or produce wrong results.                           ***
    #0 0x2efe666 in __asan_memcpy c:\b\rr\tmpkmvu8v\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_interceptors_memintrinsics.cc:23
    #1 0x2a64d17 in CFX_MemoryStream::WriteBlock C:\pdfium\core\fxcrt\cfx_memorystream.cpp:124
    #2 0x1f2663c in IFX_SeekableStream::WriteBlock C:\pdfium\core\fxcrt\fx_stream.cpp:95
    #3 0x1f266f2 in IFX_SeekableStream::WriteString C:\pdfium\core\fxcrt\fx_stream.cpp:99
    #4 0x2a70d37 in CFX_XMLElement::Save C:\pdfium\core\fxcrt\xml\cfx_xmlelement.cpp:103
    #5 0x2d19d11 in CJX_Node::saveXML C:\pdfium\fxjs\xfa\cjx_node.cpp:357
    #6 0x2d16c65 in CJX_Node::saveXML_static C:\pdfium\fxjs\xfa\cjx_node.h:30
    #7 0x2cec936 in CJX_Object::RunMethod C:\pdfium\fxjs\xfa\cjx_object.cpp:176
    #8 0x2d07c6c in CFXJSE_Engine::NormalMethodCall C:\pdfium\fxjs\cfxjse_engine.cpp:421
    #9 0x2672e15 in `anonymous namespace'::DynPropGetterAdapter_MethodCallback C:\pdfium\fxjs\cfxjse_class.cpp:96
    #10 0x345c6e in v8::internal::FunctionCallbackArguments::Call C:\pdfium\v8\src\api-arguments.cc:29
    #11 0x4fd2ec in v8::internal::`anonymous namespace'::HandleApiCallHelper<0> C:\pdfium\v8\src\builtins\builtins-api.cc:107
    #12 0x4fa309 in v8::internal::Builtin_Impl_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:137
    #13 0x4f97c1 in v8::internal::Builtin_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:125

0x0781cb1c is located 12 bytes inside of 24-byte region [0x0781cb10,0x0781cb28)
freed by thread T0 here:
    #0 0x2efe1e8 in free c:\b\rr\tmpkmvu8v\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:44
    #1 0x1f27f58 in fxcrt::ByteString::~ByteString C:\pdfium\core\fxcrt\bytestring.cpp:227
    #2 0x2a70beb in CFX_XMLElement::Save C:\pdfium\core\fxcrt\xml\cfx_xmlelement.cpp:100
    #3 0x2d19d11 in CJX_Node::saveXML C:\pdfium\fxjs\xfa\cjx_node.cpp:357
    #4 0x2d16c65 in CJX_Node::saveXML_static C:\pdfium\fxjs\xfa\cjx_node.h:30
    #5 0x2cec936 in CJX_Object::RunMethod C:\pdfium\fxjs\xfa\cjx_object.cpp:176
    #6 0x2d07c6c in CFXJSE_Engine::NormalMethodCall C:\pdfium\fxjs\cfxjse_engine.cpp:421
    #7 0x2672e15 in `anonymous namespace'::DynPropGetterAdapter_MethodCallback C:\pdfium\fxjs\cfxjse_class.cpp:96
    #8 0x345c6e in v8::internal::FunctionCallbackArguments::Call C:\pdfium\v8\src\api-arguments.cc:29
    #9 0x4fd2ec in v8::internal::`anonymous namespace'::HandleApiCallHelper<0> C:\pdfium\v8\src\builtins\builtins-api.cc:107
    #10 0x4fa309 in v8::internal::Builtin_Impl_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:137
    #11 0x4f97c1 in v8::internal::Builtin_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:125

previously allocated by thread T0 here:
    #0 0x2efe2cc in malloc c:\b\rr\tmpkmvu8v\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:60
    #1 0x1f28205 in fxcrt::StringDataTemplate<char>::Create C:\pdfium\core\fxcrt\string_data_template.h:39
    #2 0x1f28322 in fxcrt::ByteString::ByteString C:\pdfium\core\fxcrt\bytestring.cpp:184
    #3 0x1f3e802 in FX_UTF8Encode C:\pdfium\core\fxcrt\fx_string.cpp:71
    #4 0x1f393ab in fxcrt::WideString::UTF8Encode C:\pdfium\core\fxcrt\widestring.cpp:666
    #5 0x2a70b55 in CFX_XMLElement::Save C:\pdfium\core\fxcrt\xml\cfx_xmlelement.cpp:100
    #6 0x2d19d11 in CJX_Node::saveXML C:\pdfium\fxjs\xfa\cjx_node.cpp:357
    #7 0x2d16c65 in CJX_Node::saveXML_static C:\pdfium\fxjs\xfa\cjx_node.h:30
    #8 0x2cec936 in CJX_Object::RunMethod C:\pdfium\fxjs\xfa\cjx_object.cpp:176
    #9 0x2d07c6c in CFXJSE_Engine::NormalMethodCall C:\pdfium\fxjs\cfxjse_engine.cpp:421
    #10 0x2672e15 in `anonymous namespace'::DynPropGetterAdapter_MethodCallback C:\pdfium\fxjs\cfxjse_class.cpp:96
    #11 0x345c6e in v8::internal::FunctionCallbackArguments::Call C:\pdfium\v8\src\api-arguments.cc:29
    #12 0x4fd2ec in v8::internal::`anonymous namespace'::HandleApiCallHelper<0> C:\pdfium\v8\src\builtins\builtins-api.cc:107
    #13 0x4fa309 in v8::internal::Builtin_Impl_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:137
    #14 0x4f97c1 in v8::internal::Builtin_HandleApiCall C:\pdfium\v8\src\builtins\builtins-api.cc:125

SUMMARY: AddressSanitizer: heap-use-after-free c:\b\rr\tmpkmvu8v\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_interceptors_memintrinsics.cc:23 in __asan_memcpy
Shadow bytes around the buggy address:
  0x30f03910: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa
  0x30f03920: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x30f03930: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x30f03940: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x30f03950: fd fd fd fa fa fa fd fd fd fd fa fa 00 00 00 04
=>0x30f03960: fa fa fd[fd]fd fa fa fa fd fd fd fd fa fa fd fd
  0x30f03970: fd fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa
  0x30f03980: fd fd fd fd fa fa 00 00 00 fa fa fa fd fd fd fd
  0x30f03990: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x30f039a0: fd fd fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x30f039b0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==18204==ABORTING


VERSION
Chrome Version: PDFium with XFA enabled
Operating System: All

REPRODUCTION CASE
A minimized proof-of-concept file has been attached.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]