63363ec438
* M3: rasters reach egui without a copy on the UI thread Every page, tile and thumbnail raster was copied pixel by pixel on the UI thread (`ColorImage::from_rgba_premultiplied`), because egui's `Color32` is 4-byte aligned and a `Vec<u8>` isn't. That is 0.5 ms per 1024² tile, 5.4 ms for a 33 MB page and 36 ms for a 197 MB page, against a 16.7 ms frame. hayro, vendored patch 7: `render_size` and `render_into` render into a buffer the caller allocates. `render` is `render_into` on a new pixmap, so its output is unchanged. pdfcraft-render renders straight into `Pixels`, the same premultiplied RGBA bytes kept in one 4-byte word per pixel. `Pixels` dereferences to `[u8]`, so every reader of `RenderedPage::rgba` compiles unchanged. The canvas reinterprets the words as `Color32`s and hands them to egui as they are. Pixels are identical: all 33 renders of #260's test file hash the same. The UI-thread copy is gone, and rendering a 6182×8000 page takes 67 ms instead of 71–76 ms. Co-Authored-By: Claude Opus 5.5 <[email protected]> * M3: render_into leaves a buffer of the wrong length untouched instead of reaching vello's assert * M3: regression test for render_into with a wrong-length buffer --------- Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: Brandon Thomas <[email protected]>
10 KiB
Vendored crates
Permissively licensed crates we carry small patches for. Each directory keeps the upstream
licence files unchanged. Every patch is marked PdfCraft patch: in the source, is covered by a
PdfCraft test, and should be proposed upstream. Remove the vendored copy once upstream releases
the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
| Crate | Version | Licence | Patches | Test |
|---|---|---|---|---|
| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select /AP /N appearance states via /AS (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to /Encoding glyph names, then printable ASCII; (3) Type3Glyph::advance_width; (4) InterpreterSettings::ocg_overrides for viewer layer toggles; (5) soft masks whose group lacks /CS were dropped (Chrome gradient text); (6) paint nesting cap MAX_PAINT_NESTING for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in /W and /W2 clamped to MAX_CID (a 0 4294967295 w range hung); (8) InterpreterSettings::hide_comments skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) image_size_ok: images and masks over 2^28 pixels are not decoded (a fuzzed /W 4294967295 stencil mask allocated 4 GiB); (10) MAX_NESTED_PAINTS: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (Charset::glyph_id returns Option); (12) annotation appearances whose /BBox or /Matrix collapses to a line or a point are skipped (mapping them onto /Rect divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its /QuadPoints, /C and /CA with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font /Widths (read_widths): entries only for codes 0–255 (one entry per code below /FirstChar was allocated: 4294967295 asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a /LastChar below /FirstChar gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto /Rect corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from /Rect was drawn shifted); (16) a clip set by W/W* takes effect after whichever path-painting operator ends the path (S, f, B, … as well as n; ISO 32000-2 §8.5.4): it was applied only on n, so re W* S clipped nothing and the clip stayed pending for a later, unrelated n; (17) InterpreterSettings::cancelled: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end) |
(1) raster::tests::widget_appearance_states; (2, 3) xtask text-oracle on corpus/pdfjs issue918; (4) raster::tests::layer_override_hides_content; (5) raster::tests::soft_mask_without_group_colour_space_is_applied; (6) raster::tests::self_referencing_tiling_pattern_terminates, raster::tests::self_referencing_type3_glyph_terminates; (7) raster::tests::huge_cid_width_ranges_terminate; (8) raster::tests::hiding_comments_keeps_fields; (9) raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding; (10) raster::tests::type3_glyphs_that_fan_out_into_themselves_finish; (11) raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly; (12) raster::tests::degenerate_annotation_appearances_are_skipped; (13) raster::tests::highlights_without_an_appearance_are_drawn; (14) raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font, raster::tests::huge_simple_font_first_char_terminates; (15) raster::tests::annotation_appearance_box_maps_onto_rect; (16) raster::tests::clipping_path_applies_after_any_painting_operator; (17) raster::tests::dropping_the_pool_cancels_its_renders, raster::tests::the_watchdog_stops_the_render_it_gives_up_on |
| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) RenderSettings::{x_offset, y_offset} to render one tile of a large page; (2) images over MAX_IMAGE_PIXELS (2^28) are skipped (a fuzzed /W 4294967295 hung in resampling); (3) tiling_cell_scale keeps a tiling pattern's cell pixmap within 3000 px a side whatever its /XStep//YStep (a fuzzed step far beyond /BBox allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed /LW 9223372036854775807 allocated 10 GB in stroke expansion); (5) usable_dash_pattern: a stroke whose dash pattern could cut it into more than MAX_DASHES_PER_STROKE (250,000) pieces, counting kurbo's restart of the pattern at every subpath and ClosePath, is drawn solid (a fuzzed /D [[11] 0] on a line from x = 92234775807 allocated over 5 GB, [0.000001] 0 d on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid ([-1 -1] 0 d looped for ever in kurbo); (7) render_size and render_into: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); render is render_into on a new pixmap | (1) raster::tests::tiles_match_full_render; (2) raster::tests::absurd_image_dimensions_are_skipped; (3) raster::tests::tiling_cells_stay_small_whatever_the_step; (4) raster::tests::absurd_predictor_columns_and_line_widths_render; (5) raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render; (6) raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid; (7) raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over |
| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at 2 × symbols + 1, each plus EXTRA_EMPTY_STEPS (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) raster::tests::jbig2_regions_of_billions_of_pixels_are_refused; (2) the nightly cargo xtask fuzz finding, which now finishes in about a second; (3) raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate |
| lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed /Columns 4294967295 allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared /Colors, aligned with lopdf#589 | (1) inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating, inspect::tests::empty_png_predictor_frames_do_not_allocate_rows; (2) inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused; (3) inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples, inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding |
| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in resolve_pages (visited set + depth cap): a /Kids loop among compressed objects overflowed the stack and aborted the process; (2) ccitt_size_ok: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed /Columns 4294967295 allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating usize, a zero width is refused and a row longer than the data is not allocated (a fuzzed /Columns 9223372036854775807 wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (EI) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose /Length is wrong is recovered only when stream is the next token — scanning ahead to a later object's stream made an indirect appearance-state dictionary (Quartz checkboxes: /AP /N → << /Yes … /Off … >>) render as a non-form, so the widget was skipped | (1) cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers; (2) raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding; (3) raster::tests::absurd_predictor_columns_and_line_widths_render; (4) raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time; (5) raster::tests::indirect_appearance_state_dict_is_not_another_stream |
| winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), WM_DPICHANGED applies the rect Windows suggests. It used to nudge the window onto the monitor MonitorFromWindow names, which during a drag is still the monitor being left; the nudge sent another WM_DPICHANGED, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a (winit#4341), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. The published crate's asset files (docs/res/*.svg, examples/data/*.png) are left out, so its window example doesn't build | (1) pdfcraft tests::winit_carries_the_windows_11_monitor_scale_fix keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11 |
Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and cos/model.
Text extraction: hayro-interpret exposes OutlineGlyph::is_vertical from a Type0 font’s CMap writing mode. PdfCraft follows negative glyph-space y for WMode 1 so upright vertical columns can be searched (#126).