diff --git a/crates/automation/src/a11y/form_tools.rs b/crates/automation/src/a11y/form_tools.rs index 0ef6b92821..1277bf5b64 100644 --- a/crates/automation/src/a11y/form_tools.rs +++ b/crates/automation/src/a11y/form_tools.rs @@ -82,6 +82,60 @@ impl Automation { )) } + /// `js_page`: read the document at a page, running page actions as the viewer does (#169). + pub(crate) fn js_page(&mut self, a: &Args) -> Result { + let id = self.doc(a)?.id; + let page = self.page(a)?; + let clock = self.session.script_clock(id).unwrap_or(0.0); + let run = self.session.show_page(id, page, clock); + // What the actions showed or hid is in the document's view settings. + self.renderers.remove(&id); + Ok(self.script_run_json(id, &run)) + } + + /// `js_advance`: move the script clock on, running the timers that fall due on the way, in + /// the order they do. + pub(crate) fn js_advance(&mut self, a: &Args) -> Result { + /// Most timer runs one call makes (a 10 ms interval for a minute). + const MAX_RUNS: usize = 6000; + let id = self.doc(a)?.id; + let ms = a.opt_num("ms")?.ok_or_else(|| ToolError::InvalidArgs("ms is required".into()))?; + if !(0.0..=3_600_000.0).contains(&ms) { + return Err(ToolError::InvalidArgs("ms must be between 0 and 3600000".into())); + } + let start = self.session.script_clock(id).unwrap_or(0.0); + let end = start + ms; + let mut total = pdfcraft_engine::ScriptRun::default(); + while total.ran < MAX_RUNS { + let Some(at) = self.session.next_timer(id).filter(|at| *at <= end) else { break }; + let run = self.session.run_timers_at_most(id, at.max(start), MAX_RUNS - total.ran); + if run.ran == 0 { + break; + } + merge_runs(&mut total, run); + } + let behind = self.session.next_timer(id).is_some_and(|at| at <= end); + // The clock ends where it was sent; a timer the run cap left behind counts on from there, + // and runs at the next call, not past the cap. + let last = self.session.run_timers_at_most(id, end, MAX_RUNS - total.ran); + merge_runs(&mut total, last); + self.renderers.remove(&id); + let mut out = self.script_run_json(id, &total); + out["ran"] = json!(total.ran); + out["stopped_early"] = json!(behind); + Ok(out) + } + + fn script_run_json(&mut self, id: pdfcraft_engine::DocId, run: &pdfcraft_engine::ScriptRun) -> Value { + let reqs: Vec = run.output.requests.iter().map(request_json).collect(); + let alerts: Vec = run.output.alerts.iter().map(alert_json).collect(); + let pages: Vec = run.pages.iter().map(|p| p + 1).collect(); + let clock = self.session.script_clock(id).unwrap_or(0.0); + let next = self.session.next_timer(id).map(|at| (at - clock).max(0.0)); + json!({ "alerts": alerts, "console": run.output.console, "requests": reqs, "errors": run.output.errors, + "pages": pages, "edited": run.edited, "layers": run.layers, "clock_ms": clock, "next_timer_in_ms": next }) + } + pub(crate) fn js_document_scripts(&self, a: &Args) -> Result { let list: Vec = self.doc(a)?.document_scripts().into_iter().map(|(n, s)| json!({ "name": n, "script": s })).collect(); Ok(json!({ "scripts": list })) @@ -285,3 +339,16 @@ impl Automation { Ok(json!({ "enabled": self.session.javascript() })) } } + +/// Adds what `run` did to `total`. +fn merge_runs(total: &mut pdfcraft_engine::ScriptRun, run: pdfcraft_engine::ScriptRun) { + total.ran += run.ran; + total.edited |= run.edited; + total.layers |= run.layers; + total.output.append(run.output); + for p in run.pages { + if !total.pages.contains(&p) { + total.pages.push(p); + } + } +} diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs index 8de3ff3c27..65731d1fb3 100644 --- a/crates/automation/src/dispatch.rs +++ b/crates/automation/src/dispatch.rs @@ -837,6 +837,8 @@ impl Automation { "ocr_recognize" => self.ocr_recognize(&a)?, "js_run" => self.js_run(&a)?, "js_event" => self.js_event(&a)?, + "js_page" => self.js_page(&a)?, + "js_advance" => self.js_advance(&a)?, "js_document_scripts" => self.js_document_scripts(&a)?, "js_set_document_script" => self.js_set_document_script(&a)?, "js_enabled" => self.js_enabled(&a)?, diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs index 9cecf1654c..78393385e5 100644 --- a/crates/automation/src/tools.rs +++ b/crates/automation/src/tools.rs @@ -1443,6 +1443,10 @@ pub fn tools() -> Vec { }), &["doc", "field", "event"], )), + t("js_page", "Run page actions", "Read the document at `page`, as the viewer does when that page becomes the one being read: the actions the page it was at runs as it closes, then this page's open actions (its own, and its annotations' page-open and page-visible actions, which start an animation made with the LaTeX animate package), in the document's JavaScript context, which buttons, the console and timers share. Fields the actions show or hide change only how the document is shown, and page_render draws them so; values they change are applied as one undoable step. Returns the actions' alerts, console output, requests and errors, the pages showing a field they showed or hid, and when the next timer falls due on the script clock (js_advance moves it).") + .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])), + t("js_advance", "Advance the script clock", "Move the document's script clock on by `ms` milliseconds and run the timers its scripts set (app.setInterval, app.setTimeOut) as they fall due on the way, in order, as the viewer runs them over time: an animation shows its next frames. Fields timers show or hide change only how the document is shown, and page_render draws them so. A timer's alerts and requests go to its console output instead. Returns how many timers ran, their console output and errors, the pages showing a field they showed or hid, the clock, and when the next timer falls due.") + .with(schema(json!({ "doc": doc(), "ms": { "type": "number", "minimum": 0, "maximum": 3600000 } }), &["doc", "ms"])), t("js_document_scripts", "Document JavaScripts", "List the document-level JavaScripts (name and source), which define functions field scripts use.") .ro() .cmd("tools.document_js") diff --git a/crates/automation/tests/it/main.rs b/crates/automation/tests/it/main.rs index 77c3d3eff3..3231364e37 100644 --- a/crates/automation/tests/it/main.rs +++ b/crates/automation/tests/it/main.rs @@ -18,6 +18,7 @@ mod model_3d; mod model_render; mod office; mod optimize_content_boundaries; +mod page_actions; mod portfolio_info; mod redact_after_stray_q_form; mod redact_text_after_q; diff --git a/crates/automation/tests/it/page_actions.rs b/crates/automation/tests/it/page_actions.rs new file mode 100644 index 0000000000..e2ab46913b --- /dev/null +++ b/crates/automation/tests/it/page_actions.rs @@ -0,0 +1,102 @@ +//! Page actions and timers through the tool table (#169): `js_page` reads a page as the viewer +//! does, `js_advance` moves the script clock on, and `page_render` draws what they show. + +use pdfcraft_automation::{Automation, Content}; +use serde_json::{Value, json}; + +fn tool(a: &mut Automation, name: &str, args: Value) -> Value { + match a.call(name, &args).unwrap().remove(0) { + Content::Json(value) => value, + other => panic!("expected JSON: {other:?}"), + } +} + +/// Two pages; on the first, two frames over one another (red showing, green hidden) and a +/// page-open action flipping them every 100 ms, with a page-close action stopping it. +fn animation_pdf() -> Vec { + let fill = |rgb: &str| { + let body = format!("{rgb} rg 0 0 100 100 re f"); + format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >>\nstream\n{body}\nendstream", body.len()) + }; + let open = "var on = 0; function flip() { getField('f' + on).display = display.hidden; on = 1 - on; getField('f' + on).display = display.visible; } \ + var t = app.setInterval('flip()', 100);"; + let objs: Vec = vec![ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >>".into(), + "<< /Type /Pages /Kids [3 0 R 10 0 R] /Count 2 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] /AA << /O << /S /JavaScript /JS 8 0 R >> /C << /S /JavaScript /JS 9 0 R >> >> >>".into(), + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (f0) /F 4 /Rect [0 0 200 300] /P 3 0 R /AP << /N 6 0 R >> >>".into(), + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (f1) /F 6 /Rect [0 0 200 300] /P 3 0 R /AP << /N 7 0 R >> >>".into(), + fill("1 0 0"), + fill("0 1 0"), + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), + "<< /Length 20 >>\nstream\napp.clearInterval(t)\nendstream".into(), + "<< /Type /Page /Parent 2 0 R >>".into(), + ]; + let mut out = b"%PDF-1.7\n".to_vec(); + let mut offsets = Vec::new(); + for (i, o) in objs.iter().enumerate() { + offsets.push(out.len()); + out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes()); + } + let xref = out.len(); + out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes()); + for o in offsets { + out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes()); + } + out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes()); + out +} + +#[test] +fn js_page_and_js_advance_run_an_animation_that_page_render_draws() { + let dir = std::env::temp_dir().join(format!("pdfcraft-page-actions-{}", std::process::id())); + std::fs::create_dir_all(&dir).unwrap(); + std::fs::write(dir.join("anim.pdf"), animation_pdf()).unwrap(); + let mut a = Automation::new().with_root(&dir).unwrap(); + let id = tool(&mut a, "doc_open", json!({ "path": "anim.pdf" }))["doc"].as_u64().unwrap(); + let centre = |a: &mut Automation| { + let (w, h, px) = a.render_pixels(id, 1, 1.0).unwrap(); + let i = ((h / 2 * w + w / 2) * 4) as usize; + px[i..i + 3].to_vec() + }; + assert_eq!(centre(&mut a), [255, 0, 0]); + let out = tool(&mut a, "js_page", json!({ "doc": id, "page": 1 })); + assert_eq!((out["errors"].clone(), out["next_timer_in_ms"].clone()), (json!([]), json!(100.0)), "{out}"); + let out = tool(&mut a, "js_advance", json!({ "doc": id, "ms": 150 })); + assert_eq!((out["ran"].clone(), out["pages"].clone(), out["edited"].clone()), (json!(1), json!([1]), json!(false)), "{out}"); + assert_eq!(out["next_timer_in_ms"], json!(50.0)); + assert_eq!(centre(&mut a), [0, 255, 0], "page_render draws the frame the timer showed"); + let out = tool(&mut a, "js_advance", json!({ "doc": id, "ms": 1000 })); + assert_eq!(out["ran"], json!(10), "{out}"); + assert_eq!(centre(&mut a), [0, 255, 0]); + assert!(a.call("js_advance", &json!({ "doc": id, "ms": 3_600_001 })).is_err()); + let out = tool(&mut a, "js_page", json!({ "doc": id, "page": 2 })); + assert_eq!(out["next_timer_in_ms"], Value::Null, "the page's close action cleared the interval: {out}"); + let doc = a.session().get(pdfcraft_engine::DocId(id)).unwrap(); + assert!(!doc.dirty && doc.undo_depth() == 0, "the frames turned in the view only"); +} + +/// A page whose open action starts a 10 ms interval. +const INTERVAL: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /AA << /O << /S /JavaScript /JS (var n = 0; app.setInterval\\('n++', 10\\);) >> >> >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// `js_advance` runs at most 6,000 timers, even with one still due where the clock ends: that +/// one runs at the next call. +#[test] +fn js_advance_runs_no_more_timers_than_its_cap() { + let dir = std::env::temp_dir().join(format!("pdfcraft-js-advance-cap-{}", std::process::id())); + std::fs::create_dir_all(&dir).unwrap(); + std::fs::write(dir.join("interval.pdf"), INTERVAL).unwrap(); + let mut a = Automation::new().with_root(&dir).unwrap(); + let id = tool(&mut a, "doc_open", json!({ "path": "interval.pdf" }))["doc"].as_u64().unwrap(); + tool(&mut a, "js_page", json!({ "doc": id, "page": 1 })); + let out = tool(&mut a, "js_advance", json!({ "doc": id, "ms": 60_010 })); + assert_eq!((out["ran"].clone(), out["stopped_early"].clone()), (json!(6000), json!(true)), "{out:?}"); + let out = tool(&mut a, "js_advance", json!({ "doc": id, "ms": 0 })); + assert_eq!(out["ran"], json!(1), "{out:?}"); + let _ = std::fs::remove_dir_all(&dir); +} diff --git a/crates/engine/src/document.rs b/crates/engine/src/document.rs index 805e089dd7..8a166330b9 100644 --- a/crates/engine/src/document.rs +++ b/crates/engine/src/document.rs @@ -55,6 +55,8 @@ pub struct Document { pub(crate) js_runtime: js::Runtime, pub(crate) js_zoom: f64, pub(crate) js_page: usize, + /// How its page actions and timers show it while it is read (see [`Session::show_page`](crate::Session::show_page)). + pub(crate) live: crate::live_scripts::LiveView, /// Dynamic XFA forms: what laying the template out produced (pages and fields are /// PdfCraft's; Adobe's viewers draw the form from the XFA packets themselves). pub xfa: Option, diff --git a/crates/engine/src/js.rs b/crates/engine/src/js.rs index bde0d5a02c..39a53d3bb4 100644 --- a/crates/engine/src/js.rs +++ b/crates/engine/src/js.rs @@ -154,7 +154,7 @@ impl JsOutput { /// Adds what a field's own script produced: its alerts, console lines, errors and requests, /// except a request to print, show a side panel, open Save As, or open or save an attached /// file, which is noted on the console and dropped. - fn absorb(&mut self, o: &Outcome) { + pub(crate) fn absorb(&mut self, o: &Outcome) { self.alert(o.alerts.iter().cloned()); self.say(o.console.iter().cloned()); // A field's own scripts (keystroke, format, validate, calculate) run unasked: only a @@ -187,7 +187,8 @@ impl JsOutput { } } - pub(crate) fn append(&mut self, other: JsOutput) { + /// Adds what other scripts produced, telling a document script's error once. + pub fn append(&mut self, other: JsOutput) { self.alert(other.alerts); self.say(other.console); self.requests.extend(other.requests); @@ -535,6 +536,7 @@ impl JsRunner { let mut current = Self::new(cos, &self.doc.file_name, self.doc.runtime_highlight); current.doc.zoom = self.doc.zoom; current.doc.page = self.doc.page; + current.doc.layers = std::mem::take(&mut self.doc.layers); self.doc = current.doc; self.doc_scripts = current.doc_scripts; self.calculations = None; @@ -564,6 +566,7 @@ impl JsRunner { runtime_highlight: highlight, icon_epoch: 0, icon_versions: Default::default(), + layers: Vec::new(), }; // Once XFA owns the form, the PDF container's scripts belong to its fallback view. // Keep them in the file and in Document JavaScripts, but do not initialize an @@ -593,7 +596,7 @@ impl JsRunner { } /// Index calculation sources by PDF object identity, retaining their matching snapshot positions. -fn calculation_scripts(cos: &pdfcraft_cos::Document, fields: &[Field]) -> Vec<(usize, String)> { +pub(crate) fn calculation_scripts(cos: &pdfcraft_cos::Document, fields: &[Field]) -> Vec<(usize, String)> { #[cfg(test)] SNAPSHOT_WORK.with(|c| { let (g, p) = c.get(); @@ -664,6 +667,7 @@ impl Scripts for JsRunner { fields: states, doc_scripts: self.doc_scripts.clone(), calculations, + timer: None, }; #[cfg(not(target_arch = "wasm32"))] let remaining = self.callback_time_left(); @@ -752,6 +756,7 @@ impl Scripts for JsRunner { fields: states, doc_scripts: self.doc_scripts.clone(), calculations: calculations.clone(), + timer: None, }; let remaining = self.callback_time_left(); let outcome = if remaining.is_zero() { @@ -1190,8 +1195,9 @@ impl Session { let mut runner = JsRunner::new(&cos, &doc.name, self.field_highlight); runner.doc.zoom = doc.js_zoom; runner.doc.page = doc.js_page; + runner.doc.layers = crate::live_scripts::js_layers(&doc.info); let fields = pdfcraft_forms::fields(&cos); - let states = std::sync::Arc::new(fields.iter().map(|f| field_state(&cos, f, &runner.doc)).collect::>()); + let states = std::sync::Arc::new(fields.iter().map(|f| crate::live_scripts::live_state(doc, &cos, f, &runner.doc)).collect::>()); let event = match target { Some(t) => pdfcraft_js::Event { will_commit: false, target_id, ..pdfcraft_js::Event::field(event_name.unwrap_or("Mouse Up"), t, "") }, None => pdfcraft_js::Event::doc(event_name.unwrap_or("Console")), @@ -1206,6 +1212,7 @@ impl Session { fields: states.clone(), doc_scripts: runner.doc_scripts, calculations, + timer: None, }, answers, ); @@ -1218,7 +1225,13 @@ impl Session { } /// Convert the worker snapshot delta and reset requests into permission-checked atomic document edits. - fn apply_script_outcome(&mut self, id: DocId, states: &[pdfcraft_js::FieldState], mut o: Outcome, opening: bool) -> Result { + pub(crate) fn apply_script_outcome( + &mut self, + id: DocId, + states: &[pdfcraft_js::FieldState], + mut o: Outcome, + opening: bool, + ) -> Result { if o.execution_refused { o.changed.clear(); o.requests.clear(); @@ -1281,12 +1294,15 @@ impl Session { } } let changes = changes(&baseline, &o.changed, &o.formatted); + let written: Vec = changes.iter().filter(|c| c.display.is_some() || c.icon.is_some()).map(|c| c.name.clone()).collect(); if !changes.is_empty() { edits.push(Edit::ApplyScriptChanges { changes }); } if !edits.is_empty() { self.apply(id, Edit::Batch { label: "Run JavaScript".into(), edits })?; } + // The timers the script left, the layers it turned, and how fields show (#169). + self.after_script(id, &o, &written); Ok(o) } } @@ -1660,9 +1676,10 @@ impl Session { let mut runner = JsRunner::new(cos, &doc.name, self.field_highlight); runner.doc.zoom = doc.js_zoom; runner.doc.page = doc.js_page; + runner.doc.layers = crate::live_scripts::js_layers(&doc.info); let fields = pdfcraft_forms::fields(cos); validate_script_target(target, target_id, &fields)?; - let states = std::sync::Arc::new(fields.iter().map(|f| field_state(cos, f, &runner.doc)).collect::>()); + let states = std::sync::Arc::new(fields.iter().map(|f| crate::live_scripts::live_state(doc, cos, f, &runner.doc)).collect::>()); let job = pdfcraft_js::session::Job { script: script.into(), event: target.map_or_else( @@ -1673,6 +1690,7 @@ impl Session { fields: states.clone(), doc_scripts: runner.doc_scripts, calculations: calculation_scripts(cos, &fields), + timer: None, }; let receiver = doc.js_runtime.lock().map_err(|_| EditError::Invalid("script runtime unavailable".into()))?.start(job).map_err(EditError::Invalid)?; @@ -2008,6 +2026,7 @@ mod widget_budget_review_tests { rotation: 0, caption: None, mouse_up_script: None, + mouse_down: false, list: None, round: false, }; diff --git a/crates/engine/src/layers.rs b/crates/engine/src/layers.rs index b2fab68acb..4443a52b3c 100644 --- a/crates/engine/src/layers.rs +++ b/crates/engine/src/layers.rs @@ -4,7 +4,7 @@ use std::sync::Arc; use pdfcraft_render::{Layer, LayerOp, RenderPool}; -use crate::{Document, display_config, render_threads}; +use crate::{Document, render_threads}; /// Most usage application dictionaries (`/AS` entries) that [`print_layer_states`] reads, and /// most category names and groups it reads in all of them together (entries can share one @@ -132,7 +132,7 @@ pub(crate) fn use_layer_choices(doc: &mut Document) { let overrides: Vec<(i32, i32, bool)> = doc.info.layers.iter().map(|l| (l.id.0 as i32, l.id.1 as i32, l.visible)).collect(); doc.config.layers = Arc::new(overrides); doc.config.print_layers = print_preview_layers(doc.editor.as_ref().map(|e| &e.cos), &doc.info.layers); - doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), display_config(&doc.config)); + doc.renderer = RenderPool::new(doc.display.clone(), render_threads(), crate::live_scripts::screen_config(doc)); } /// The layer overrides a print preview draws with (`RenderConfig::print_layers`): the layers as diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs index adb69cec46..1fb2a6e951 100644 --- a/crates/engine/src/lib.rs +++ b/crates/engine/src/lib.rs @@ -37,6 +37,7 @@ mod history; pub mod js; mod layers; pub mod links; +mod live_scripts; pub mod model3d; mod object_clip; pub mod ocr; @@ -74,6 +75,7 @@ use std::sync::Arc; pub use links::{ MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path, }; +pub use live_scripts::{MAX_TIMER_RUNS, ScriptRun}; pub use pdfcraft_edit::strip_subset_tag; pub use rich_copy::RichCopy; pub use signature_image::{ImageSignaturePreview, SignatureImage}; diff --git a/crates/engine/src/live_scripts.rs b/crates/engine/src/live_scripts.rs new file mode 100644 index 0000000000..b69f7d85d2 --- /dev/null +++ b/crates/engine/src/live_scripts.rs @@ -0,0 +1,415 @@ +//! A document's page actions and timers while it is read (#169): page open/close actions run +//! as the reader moves between pages, `app.setInterval` / `app.setTimeOut` timers fire on the +//! viewer's clock, and what they show or hide (an animation's frames) changes only the view. +//! Everything runs in the document's script realm (#5699), shared with its buttons. + +use std::collections::BTreeMap; + +use pdfcraft_js::{Outcome, Request}; + +use crate::js::{JsOutput, Runtime, calculation_scripts, field_state}; +use crate::{DocId, Document, EditError, Session}; + +/// Most timers one call to [`Session::run_timers`] runs: a document asking for more at once +/// falls behind instead of holding up the viewer. +pub const MAX_TIMER_RUNS: usize = 16; + +/// A timer of a document's scripts, on the caller's clock. +#[derive(Clone, Copy, Debug, PartialEq)] +struct Due { + id: u32, + period_ms: u32, + repeat: bool, + /// When it falls due, in milliseconds. + at: f64, +} + +/// How a document's page actions and timers show it while it is read. Nothing here is part of +/// the document: saving, printing and exporting never see it. +#[derive(Default)] +pub(crate) struct LiveView { + /// The page whose open actions ran last. + page: Option, + timers: Vec, + /// The realm the timers were set in: a fresh realm (an edit's reset, Revert, a full + /// save) starts without them. + timers_of: Option>>, + /// `display` page actions and timers gave fields, by name, over the document's own flags. + shown: BTreeMap, + /// Icons page actions and timers gave push buttons (`buttonSetIcon`), by name: the icon's + /// form object (`None`: no icon), over the button's own. + icons: BTreeMap>, + /// The caller's clock when it last looked, in milliseconds: a timer a button or the + /// console sets counts from here. + clock: f64, +} + +impl LiveView { + /// The timers, unless the realm that set them was replaced since. + fn timers(&mut self, runtime: &Runtime) -> &mut Vec { + if self.timers_of.as_ref().and_then(std::sync::Weak::upgrade).is_none_or(|r| !std::sync::Arc::ptr_eq(&r, runtime)) { + self.timers.clear(); + self.timers_of = None; + } + &mut self.timers + } + + /// Keep the timers realm `runtime` reported after a run: new ones count from the clock, + /// cleared ones go. + fn schedule(&mut self, runtime: &Runtime, reported: &[pdfcraft_js::Timer]) { + let clock = self.clock; + let timers = self.timers(runtime); + timers.retain(|d| reported.iter().any(|t| t.id == d.id)); + for t in reported { + if !timers.iter().any(|d| d.id == t.id) { + timers.push(Due { id: t.id, period_ms: t.period_ms, repeat: t.repeat, at: clock + f64::from(t.period_ms) }); + } + } + self.timers_of = (!self.timers.is_empty()).then(|| std::sync::Arc::downgrade(runtime)); + } +} + +/// What running a document's page actions or timers did, for the viewer. +#[derive(Clone, Debug, Default, PartialEq)] +pub struct ScriptRun { + /// Alerts, console output, requests and errors, as from any script. + pub output: JsOutput, + /// Pages showing a field the scripts showed, hid or gave another icon: draw them again. + pub pages: Vec, + /// The scripts changed the document (a field's value, or a reset): read it again. + pub edited: bool, + /// How many timers ran. + pub ran: usize, + /// Layers were turned on or off (`ocg.state`): draw every page again. + pub layers: bool, +} + +impl ScriptRun { + pub fn is_empty(&self) -> bool { + self.output.is_empty() && self.pages.is_empty() && !self.edited && !self.layers + } +} + +/// The document's layers as scripts see them (`getOCGs`), in the viewer's order. +pub(crate) fn js_layers(info: &pdfcraft_render::DocInfo) -> Vec { + info.layers.iter().map(|l| pdfcraft_js::Layer { name: l.name.clone(), on: l.visible, initial: l.initial }).collect() +} + +/// A field as scripts see it: as the document has it, but shown as page actions and timers +/// left it (its `display` and push button icon), so a button stepping an animation steps from +/// the frame on screen. +pub(crate) fn live_state( + doc: &Document, + cos: &pdfcraft_cos::Document, + f: &pdfcraft_forms::Field, + info: &pdfcraft_js::DocInfo, +) -> pdfcraft_js::FieldState { + let mut s = field_state(cos, f, info); + if let Some(d) = doc.live.shown.get(&f.name) { + s.display = *d; + } + if let Some(icon) = doc.live.icons.get(&f.name) { + s.icon = *icon; + } + s +} + +/// Whether a field with this `display` shows on screen. +fn on_screen(display: i32) -> bool { + display == pdfcraft_js::DISPLAY_VISIBLE || display == pdfcraft_js::DISPLAY_NO_PRINT +} + +/// A widget's object as the renderer names it, when its number fits. +fn object(w: &pdfcraft_forms::Widget) -> Option<(i32, i32)> { + Some((i32::try_from(w.obj.num).ok()?, i32::from(w.obj.generation))) +} + +/// The viewer's render configuration: the document's, with installed fonts, and the fields as +/// page actions and timers show them. Exports and printing use `doc.config`, without them. +pub(crate) fn screen_config(doc: &Document) -> pdfcraft_render::RenderConfig { + with_live_view(doc, crate::display_config(&doc.config)) +} + +/// `config` with the fields as page actions and timers show them. +pub(crate) fn with_live_view(doc: &Document, config: pdfcraft_render::RenderConfig) -> pdfcraft_render::RenderConfig { + let live = &doc.live; + let annotations: Vec<(i32, i32, bool)> = doc + .form + .iter() + .filter_map(|f| live.shown.get(&f.name).map(|d| (f, on_screen(*d)))) + .flat_map(|(f, on)| f.widgets.iter().filter_map(move |w| object(w).map(|(n, g)| (n, g, on)))) + .collect(); + let appearances: Vec<(i32, i32, i32, i32)> = doc + .form + .iter() + .filter_map(|f| { + let id = live.icons.get(&f.name)?; + // No icon: drawn with an object that isn't a form, so nothing (an empty button). + let (num, generation) = id.map_or((0, 0), |id| ((id >> 16) as i32, (id & 0xffff) as i32)); + Some(f.widgets.iter().filter_map(move |w| object(w).map(|(n, g)| (n, g, num, generation)))) + }) + .flatten() + .collect(); + pdfcraft_render::RenderConfig { annotations: std::sync::Arc::new(annotations), appearances: std::sync::Arc::new(appearances), ..config } +} + +/// Draw the viewer with how fields show now. +fn use_live_view(doc: &mut Document) { + doc.renderer = pdfcraft_render::RenderPool::new(doc.display.clone(), crate::render_threads(), screen_config(doc)); +} + +/// Turn layers on or off as a script set them (`ocg.state`), as the Layers panel does: how the +/// document is shown, not the document. Returns whether any changed. +pub(crate) fn set_layers(doc: &mut Document, layers: &[(usize, bool)]) -> bool { + let mut changed = false; + for &(i, on) in layers { + if let Some(l) = doc.info.layers.get_mut(i) + && l.visible != on + { + l.visible = on; + changed = true; + } + } + if changed { + crate::layers::use_layer_choices(doc); + } + changed +} + +/// Push buttons given another icon, by name: the icon's form object (`None`: no icon). +type IconChanges = Vec<(String, Option)>; + +/// The `display` and icon changes in `o`, against the fields as they were (`states`), taken out +/// of it: shown in the view instead of written into the document. +fn take_view_changes(states: &[pdfcraft_js::FieldState], o: &mut Outcome) -> (Vec<(String, i32)>, IconChanges) { + let mut shown = Vec::new(); + let mut icons = Vec::new(); + for a in &mut o.changed { + let b = match a.object_id { + Some(id) => states.iter().find(|s| s.object_id == Some(id)), + None => states.iter().find(|s| s.name == a.name), + }; + let Some(b) = b else { continue }; + if a.display != b.display { + shown.push((a.name.clone(), a.display)); + a.display = b.display; + } + if a.icon_written && a.icon != b.icon { + icons.push((a.name.clone(), a.icon)); + } + a.icon = b.icon; + a.icon_written = false; + } + (shown, icons) +} + +impl Session { + /// After any script of document `id` ran (a button, the console, a page action, a timer): + /// keep the timers its realm has, turn layers as it asked, and let a `display` written + /// into the document win over how page actions and timers showed that field. + pub(crate) fn after_script(&mut self, id: DocId, o: &Outcome, written: &[String]) { + let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return }; + let runtime = doc.js_runtime.clone(); + doc.live.schedule(&runtime, &o.timers); + let before = doc.live.shown.len(); + let icons = doc.live.icons.len(); + doc.live.shown.retain(|name, _| !written.contains(name)); + doc.live.icons.retain(|name, _| !written.contains(name)); + if doc.live.shown.len() != before || doc.live.icons.len() != icons { + use_live_view(doc); + } + set_layers(doc, &o.layers); + } + + /// Run `script` (or timer `timer`) of document `id` in its realm, as a page action or timer + /// runs: with the fields as the view shows them. Returns the fields as the script saw them. + fn run_live( + &mut self, + id: DocId, + script: &str, + event: pdfcraft_js::Event, + timer: Option, + ) -> Result<(std::sync::Arc>, Outcome), EditError> { + let doc = self.get(id).ok_or(EditError::NoDocument)?; + let cos = doc.editor.as_ref().map(|e| e.cos.clone()).ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?; + let mut runner = crate::js::JsRunner::new(&cos, &doc.name, self.field_highlight); + runner.doc.zoom = doc.js_zoom; + runner.doc.page = doc.live.page.unwrap_or(doc.js_page); + runner.doc.layers = js_layers(&doc.info); + let fields = pdfcraft_forms::fields(&cos); + let states: Vec<_> = fields.iter().map(|f| live_state(doc, &cos, f, &runner.doc)).collect(); + let states = std::sync::Arc::new(states); + let job = pdfcraft_js::session::Job { + script: script.into(), + event, + doc: runner.doc, + fields: states.clone(), + doc_scripts: runner.doc_scripts, + calculations: calculation_scripts(&cos, &fields), + timer, + }; + let o = doc.js_runtime.lock().map_err(|_| EditError::Invalid("document script runtime is unavailable".into()))?.run(job, &[]); + Ok((states, o)) + } + + /// Run one page action or timer of document `id` and apply what it did. Fields it showed, + /// hid or gave another icon change only how the document is shown; a value it changed, or + /// a reset, changes the document (one undoable step). A timer runs unasked and again and + /// again, so what it asks of the viewer (alerts, printing, navigation, links) goes to the + /// console instead. + fn live_step(&mut self, id: DocId, script: &str, event: pdfcraft_js::Event, timer: Option, run: &mut ScriptRun) { + let (states, mut o) = match self.run_live(id, script, event, timer) { + Ok(r) => r, + Err(e) => return run.output.errors.push(e.to_string()), + }; + let discard = o.execution_refused && !o.realm_untouched; + let (shown, icons) = take_view_changes(&states, &mut o); + if timer.is_some() { + for a in std::mem::take(&mut o.alerts) { + o.console.push(format!("A timer's alert: {}", a.text)); + } + for r in std::mem::take(&mut o.requests) { + if !matches!(r, Request::Reset(_)) { + o.console.push(format!("A timer asked for {r:?}; timers may only change fields")); + } else { + o.requests.push(r); + } + } + } + let refused = o.execution_refused; + let generation = self.get(id).map(Document::edit_generation); + let layers = |s: &Session| s.get(id).map(|d| d.info.layers.iter().map(|l| l.visible).collect::>()); + let layers_before = layers(self); + match self.apply_script_outcome(id, &states, o, false) { + Ok(o) => { + run.output.absorb(&o); + // Only now: a script whose edits are refused shows nothing it did either. + if !refused { + self.show_view_changes(id, shown, icons, run); + } + } + Err(e) => run.output.errors.push(e.to_string()), + } + run.edited |= self.get(id).map(Document::edit_generation) != generation; + run.layers |= layers(self) != layers_before; + if discard { + self.invalidate_javascript(id); + } + } + + /// Show the fields a page action or timer of document `id` showed or hid (`shown`) or gave + /// another icon (`icons`), and add the pages they are on to `run`. + fn show_view_changes(&mut self, id: DocId, shown: Vec<(String, i32)>, icons: IconChanges, run: &mut ScriptRun) { + if shown.is_empty() && icons.is_empty() { + return; + } + let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return }; + for name in shown.iter().map(|(n, _)| n).chain(icons.iter().map(|(n, _)| n)) { + for p in doc.form.iter().filter(|f| f.name == *name).flat_map(|f| f.widgets.iter().filter_map(|w| w.page)) { + if !run.pages.contains(&p) { + run.pages.push(p); + } + } + } + doc.live.shown.extend(shown); + doc.live.icons.extend(icons); + use_live_view(doc); + } + + /// Document `id` is read at page `page` (0-based), at `now_ms` on the caller's clock (on + /// which its timers fall due). When the page changed, the close actions of the page it was + /// at run, then `page`'s open actions (the page's own `/AA /O`, then each annotation's + /// page-open and page-visible actions, such as an animation's widget). Cheap when nothing + /// changed; call it as often as the page can change. With JavaScript off nothing runs. + pub fn show_page(&mut self, id: DocId, page: usize, now_ms: f64) -> ScriptRun { + let mut run = ScriptRun::default(); + let js_off = self.js_off; + let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { return run }; + doc.live.clock = now_ms; + if js_off || doc.live.page == Some(page) || doc.xfa_template.is_some() { + return run; + } + let before = doc.live.page.replace(page); + let Some(cos) = doc.editor.as_ref().map(|e| e.cos.clone()) else { return run }; + use pdfcraft_forms::PageEvent; + let mut scripts: Vec<(&str, pdfcraft_forms::PageScript)> = Vec::new(); + if let Some(p) = before { + scripts.extend(pdfcraft_forms::page_scripts(&cos, p, PageEvent::Close).into_iter().map(|s| ("Close", s))); + } + scripts.extend(pdfcraft_forms::page_scripts(&cos, page, PageEvent::Open).into_iter().map(|s| ("Open", s))); + for (name, s) in scripts { + let event = pdfcraft_js::Event { kind: "Page".into(), target: s.field, ..pdfcraft_js::Event::doc(name) }; + self.live_step(id, &s.script, event, None, &mut run); + } + run + } + + /// When document `id`'s next timer falls due, on the clock [`Session::show_page`] and + /// [`Session::run_timers`] are given; `None` without timers (or with JavaScript off). + pub fn next_timer(&mut self, id: DocId) -> Option { + if self.js_off { + return None; + } + let doc = self.docs.iter_mut().find(|d| d.id == id)?; + let runtime = doc.js_runtime.clone(); + doc.live.timers(&runtime).iter().map(|d| d.at).min_by(f64::total_cmp) + } + + /// Run document `id`'s timers that are due at `now_ms`, earliest first, at most + /// [`MAX_TIMER_RUNS`] of them. An interval that fell behind runs once and then counts its + /// period from now, rather than catching up run by run. + pub fn run_timers(&mut self, id: DocId, now_ms: f64) -> ScriptRun { + self.run_timers_at_most(id, now_ms, MAX_TIMER_RUNS) + } + + /// [`Session::run_timers`], running at most `max` timers (and never more than + /// [`MAX_TIMER_RUNS`]). With `max` 0 it only moves the clock on to `now_ms`: the timers still + /// due run at the next call. + pub fn run_timers_at_most(&mut self, id: DocId, now_ms: f64, max: usize) -> ScriptRun { + let mut run = ScriptRun::default(); + if let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) { + doc.live.clock = now_ms; + } + for _ in 0..max.min(MAX_TIMER_RUNS) { + if self.js_off { + break; + } + let Some(doc) = self.docs.iter_mut().find(|d| d.id == id) else { break }; + doc.live.clock = now_ms; + let runtime = doc.js_runtime.clone(); + let timers = doc.live.timers(&runtime); + let Some(i) = timers.iter().enumerate().filter(|(_, d)| d.at <= now_ms).min_by(|a, b| a.1.at.total_cmp(&b.1.at)).map(|(i, _)| i) else { + break; + }; + let due = timers[i]; + if due.repeat { + let next = due.at + f64::from(due.period_ms); + timers[i].at = if next <= now_ms { now_ms + f64::from(due.period_ms) } else { next }; + } else { + timers.remove(i); + } + run.ran += 1; + let event = pdfcraft_js::Event { kind: "App".into(), ..pdfcraft_js::Event::doc("Timer") }; + self.live_step(id, "", event, Some(due.id), &mut run); + } + run + } + + /// The clock of document `id`'s live scripts: the time it was last given (milliseconds). + pub fn script_clock(&self, id: DocId) -> Option { + Some(self.get(id)?.live.clock) + } +} + +impl Document { + /// Whether the document's page actions and timers show field `name` on screen (`Some`), over + /// its widgets' own Hidden and NoView flags; `None` when they left it as the document has it. + /// For the viewer's hit test: a frame they showed takes presses, and one they hid doesn't. + pub fn shown_by_scripts(&self, name: &str) -> Option { + self.live.shown.get(name).map(|d| on_screen(*d)) + } +} + +#[cfg(test)] +#[path = "live_scripts_tests.rs"] +mod tests; diff --git a/crates/engine/src/live_scripts_tests.rs b/crates/engine/src/live_scripts_tests.rs new file mode 100644 index 0000000000..2e92ec8ee7 --- /dev/null +++ b/crates/engine/src/live_scripts_tests.rs @@ -0,0 +1,303 @@ +use std::sync::Arc; + +use super::screen_config; +use crate::{DocId, Session}; + +/// A PDF of `objs` (object 1 the catalog), with its cross-reference table. +fn pdf(objs: &[String]) -> Vec { + let mut out = b"%PDF-1.7\n".to_vec(); + let mut offsets = Vec::new(); + for (i, o) in objs.iter().enumerate() { + offsets.push(out.len()); + out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes()); + } + let xref = out.len(); + out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes()); + for o in offsets { + out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes()); + } + out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes()); + out +} + +/// A form XObject filling 100 × 100 with colour `rgb`. +fn fill(rgb: &str) -> String { + let body = format!("{rgb} rg 0 0 100 100 re f"); + format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >>\nstream\n{body}\nendstream", body.len()) +} + +/// A push button widget on page 3 0 R at [50 100 150 200]. +fn widget(name: &str, flags: u32, extra: &str) -> String { + format!("<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T ({name}) /F {flags} /Rect [50 100 150 200] /P 3 0 R {extra} >>") +} + +/// Two pages; on the first, an animation as the LaTeX `animate` package builds one: three +/// frames as push buttons over one another (red showing, green and blue hidden), and a widget +/// whose page-open action defines the player and starts an interval and whose page-close +/// action stops it. +fn animation_pdf() -> Vec { + let open = "if (typeof on == 'undefined') { var on = 0; var t = null; } \ + function show(i) { getField('f' + on).display = display.hidden; on = i; getField('f' + on).display = display.visible; } \ + function step() { show((on + 1) % 3); } t = app.setInterval('step()', 100);"; + pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R 7 0 R] >> >>".into(), // 1 + "<< /Type /Pages /Kids [3 0 R 12 0 R] /Count 2 /MediaBox [0 0 200 300] >>".into(), // 2 + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R 7 0 R] >>".into(), // 3 + widget("f0", 4, "/AP << /N 8 0 R >>"), // 4 + widget("f1", 6, "/AP << /N 9 0 R >>"), // 5 + widget("f2", 6, "/AP << /N 10 0 R >>"), // 6 + widget("anim", 4, "/AA << /PO << /S /JavaScript /JS 11 0 R >> /PC << /S /JavaScript /JS (app.clearInterval\\(t\\);) >> >>"), // 7 + fill("1 0 0"), // 8 + fill("0 1 0"), // 9 + fill("0 0 1"), // 10 + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), // 11 + "<< /Type /Page /Parent 2 0 R >>".into(), // 12 + ]) +} + +const RED: [u8; 4] = [255, 0, 0, 255]; +const GREEN: [u8; 4] = [0, 255, 0, 255]; +const BLUE: [u8; 4] = [0, 0, 255, 255]; + +/// RGBA at PDF point (x, y) on `page` as the viewer draws it (1 px/pt, page height 300). +fn shown(s: &Session, id: DocId, page: usize, x: u32, y: u32) -> [u8; 4] { + let doc = s.get(id).unwrap(); + let mut r = pdfcraft_render::PageRenderer::new(doc.display.clone(), screen_config(doc)); + let out = r.render(pdfcraft_render::RenderRequest { page, scale: 1.0, ..Default::default() }); + assert!(out.error.is_none(), "{:?}", out.error); + let i = (((300 - y) * out.width + x) * 4) as usize; + out.rgba[i..i + 4].try_into().unwrap() +} + +/// RGBA at (x, y) on `page` as it prints or exports: the document itself. +fn printed(s: &Session, id: DocId, page: usize, x: u32, y: u32) -> [u8; 4] { + let doc = s.get(id).unwrap(); + let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone()); + let out = r.render(pdfcraft_render::RenderRequest { page, scale: 1.0, ..Default::default() }); + let i = (((300 - y) * out.width + x) * 4) as usize; + out.rgba[i..i + 4].try_into().unwrap() +} + +#[test] +fn page_actions_start_timers_that_turn_an_animations_frames_without_changing_the_document() { + let mut s = Session::new(); + let id = s.open("animation.pdf", None, Arc::new(animation_pdf()), None).unwrap(); + let bytes = s.get(id).unwrap().bytes.clone(); + assert_eq!(shown(&s, id, 0, 100, 150), RED); + assert_eq!(s.next_timer(id), None); + let run = s.show_page(id, 0, 1000.0); + assert!(run.output.errors.is_empty(), "{run:?}"); + assert_eq!(s.next_timer(id), Some(1100.0)); + assert!(s.show_page(id, 0, 1010.0).is_empty(), "the same page again runs nothing"); + assert!(s.run_timers(id, 1050.0).is_empty(), "not due yet"); + let run = s.run_timers(id, 1100.0); + assert_eq!((run.pages.as_slice(), run.edited, run.ran), ([0].as_slice(), false, 1), "{run:?}"); + assert_eq!(shown(&s, id, 0, 100, 150), GREEN); + assert_eq!(printed(&s, id, 0, 100, 150), RED, "printing and export draw the document"); + assert_eq!(s.next_timer(id), Some(1200.0)); + let doc = s.get(id).unwrap(); + assert!(Arc::ptr_eq(&doc.bytes, &bytes) && !doc.dirty && doc.undo_depth() == 0, "the frames turn in the view, not in the document"); + // An interval that fell behind runs once and counts on from now. + assert_eq!(s.run_timers(id, 1450.0).ran, 1); + assert_eq!(shown(&s, id, 0, 100, 150), BLUE); + assert_eq!(s.next_timer(id), Some(1550.0)); + // A button runs in the same realm: the page action's functions and state are there. + let o = s.run_javascript(id, "step();", Some("f0")).unwrap(); + assert_eq!(o.error, None); + let o = s.run_javascript(id, "on", None).unwrap(); + assert_eq!(o.result.as_deref(), Some("0")); + // Leaving the page runs its close action, which clears the interval. + s.show_page(id, 1, 1500.0); + assert_eq!(s.next_timer(id), None); + // With JavaScript off, page actions don't run. + s.set_javascript(false); + assert!(s.show_page(id, 0, 1600.0).is_empty()); + assert_eq!(s.next_timer(id), None); +} + +#[test] +fn a_button_that_shows_a_frame_changes_the_document_and_the_views_frame_gives_way() { + let mut s = Session::new(); + let id = s.open("animation.pdf", None, Arc::new(animation_pdf()), None).unwrap(); + s.show_page(id, 0, 0.0); + s.run_timers(id, 100.0); + assert_eq!(shown(&s, id, 0, 100, 150), GREEN); + s.run_javascript(id, "step();", Some("f0")).unwrap(); + assert_eq!(shown(&s, id, 0, 100, 150), BLUE); + assert!(s.get(id).unwrap().dirty, "a button's change is the document's"); + assert_eq!(printed(&s, id, 0, 100, 150), BLUE); + s.run_timers(id, 200.0); + assert_eq!(shown(&s, id, 0, 100, 150), RED); +} + +#[test] +fn a_timer_runs_unasked_so_its_alerts_and_requests_go_to_the_console() { + let open = "app.setTimeOut('app.alert(\"hi\"); this.print(); app.launchURL(\"https://example.com\");', 50);"; + let mut s = Session::new(); + let id = s.open("t.pdf", None, Arc::new(timer_pdf(open)), None).unwrap(); + assert!(s.show_page(id, 0, 0.0).output.errors.is_empty()); + let run = s.run_timers(id, 50.0); + assert_eq!(run.ran, 1); + assert!(run.output.alerts.is_empty() && run.output.requests.is_empty(), "{run:?}"); + assert!(run.output.console.iter().any(|l| l.contains("hi")), "{run:?}"); + assert_eq!(s.next_timer(id), None, "a time-out runs once"); +} + +#[test] +fn a_fresh_realm_has_no_timers_and_a_timer_writing_a_value_is_one_undoable_edit() { + let open = "app.setInterval('getField(\"f0\").value = \"x\";', 10);"; + let mut s = Session::new(); + let id = s.open("t.pdf", None, Arc::new(timer_pdf(open)), None).unwrap(); + s.show_page(id, 0, 0.0); + let run = s.run_timers(id, 10.0); + assert!(run.edited && run.output.errors.is_empty(), "{run:?}"); + assert_eq!(s.get(id).unwrap().undo_depth(), 1); + assert!(s.next_timer(id).is_some()); + s.invalidate_javascript(id); + assert_eq!(s.next_timer(id), None, "the timers went with the realm"); +} + +/// One page with a text field f0 whose page-open action is `open`. +fn timer_pdf(open: &str) -> Vec { + pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] >> >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] /AA << /O 5 0 R >> >>".into(), + "<< /Type /Annot /Subtype /Widget /FT /Tx /T (f0) /Rect [50 100 150 200] /P 3 0 R >>".into(), + "<< /S /JavaScript /JS 6 0 R >>".into(), + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), + ]) +} + +/// An animation as `animate` builds one by default (method=icon): hidden frames are buttons +/// holding the icons, and the player gives the one showing button a frame's icon. +#[test] +fn a_timer_giving_a_button_another_icon_draws_that_icon_in_its_place() { + let open = "if (typeof on == 'undefined') { var on = 0; var fr = [getField('f0').buttonGetIcon(), getField('f1').buttonGetIcon()]; } \ + app.setInterval('on = 1 - on; getField(\"anim\").buttonSetIcon(fr[on]);', 100);"; + let out = pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R] >> >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R] >>".into(), + widget("anim", 4, "/AP << /N 7 0 R >> /MK << /I 7 0 R >> /AA << /PO << /S /JavaScript /JS 9 0 R >> >>"), + widget("f0", 6, "/AP << /N 7 0 R >> /MK << /I 7 0 R >>"), + widget("f1", 6, "/AP << /N 8 0 R >> /MK << /I 8 0 R >>"), + fill("1 0 0"), + fill("0 1 0"), + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), + ]); + let mut s = Session::new(); + let id = s.open("icons.pdf", None, Arc::new(out), None).unwrap(); + assert_eq!(shown(&s, id, 0, 100, 150), RED); + assert!(s.show_page(id, 0, 0.0).output.errors.is_empty()); + let run = s.run_timers(id, 100.0); + assert_eq!((run.pages.as_slice(), run.output.errors.len()), ([0].as_slice(), 0), "{run:?}"); + assert_eq!(shown(&s, id, 0, 100, 150), GREEN); + assert_eq!(printed(&s, id, 0, 100, 150), RED); + s.run_timers(id, 200.0); + assert_eq!(shown(&s, id, 0, 100, 150), RED, "its own icon again"); + assert!(!s.get(id).unwrap().dirty); +} + +#[test] +fn get_ocgs_turns_a_layer_in_the_view() { + let open = "this.getOCGs()[0].state = false;"; + let out = pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /OCProperties << /OCGs [5 0 R] /D << /Order [5 0 R] >> >> >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /Properties << /L1 5 0 R >> >> /AA << /O << /S /JavaScript /JS 6 0 R >> >> >>" + .into(), + "<< /Length 41 >>\nstream\n/OC /L1 BDC 1 0 0 rg 0 0 200 300 re f EMC\nendstream".into(), + "<< /Type /OCG /Name (Red) >>".into(), + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), + ]); + let mut s = Session::new(); + let id = s.open("layers.pdf", None, Arc::new(out), None).unwrap(); + assert_eq!(shown(&s, id, 0, 100, 150), RED); + let run = s.show_page(id, 0, 0.0); + assert!(run.layers && run.output.errors.is_empty(), "{run:?}"); + assert!(!s.get(id).unwrap().info.layers[0].visible); + assert_eq!(shown(&s, id, 0, 100, 150), [255, 255, 255, 255]); + assert!(!s.get(id).unwrap().dirty); +} + +/// A page action whose document edit is refused (here: past the reset limit) shows nothing it +/// did either. The frame it showed stays hidden. +#[test] +fn a_page_action_whose_edit_is_refused_shows_nothing() { + let open = "getField('f1').display = display.visible; for (var i = 0; i < 70; i++) this.resetForm();"; + let out = pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] /AA << /O << /S /JavaScript /JS 8 0 R >> >> >>".into(), + widget("f0", 4, "/AP << /N 6 0 R >>"), + widget("f1", 6, "/AP << /N 7 0 R >>"), + fill("1 0 0"), + fill("0 1 0"), + format!("<< /Length {} >>\nstream\n{open}\nendstream", open.len()), + ]); + let mut s = Session::new(); + let id = s.open("refused.pdf", None, Arc::new(out), None).unwrap(); + let run = s.show_page(id, 0, 0.0); + assert!(!run.output.errors.is_empty(), "the edit was refused: {run:?}"); + assert!(run.pages.is_empty(), "{run:?}"); + assert_eq!(shown(&s, id, 0, 100, 150), RED, "the frame it showed stays hidden"); +} + +/// A field's calculation reads the document's layers (`getOCGs`), as page actions and buttons do. +#[test] +fn field_calculations_read_the_documents_layers() { + let calc = "var l = this.getOCGs(); event.value = l ? String(l.length) : 'none';"; + let out = pdf(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] /CO [5 0 R] >> /OCProperties << /OCGs [6 0 R] /D << /Order [6 0 R] >> >> >>" + .into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(), + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >>".into(), + "<< /Type /Annot /Subtype /Widget /FT /Tx /T (a) /Rect [10 10 90 30] /P 3 0 R >>".into(), + "<< /Type /Annot /Subtype /Widget /FT /Tx /T (n) /Rect [10 40 90 60] /P 3 0 R /AA << /C << /S /JavaScript /JS 7 0 R >> >> >>".into(), + "<< /Type /OCG /Name (Red) >>".into(), + format!("<< /Length {} >>\nstream\n{calc}\nendstream", calc.len()), + ]); + let mut s = Session::new(); + let id = s.open("calc.pdf", None, Arc::new(out), None).unwrap(); + s.apply(id, crate::Edit::SetFieldValue { name: "a".into(), value: crate::FieldValue::Text("1".into()) }).unwrap(); + let n = s.get(id).unwrap().form.iter().find(|f| f.name == "n").unwrap().value.clone(); + assert_eq!(n, ["1"], "the calculation saw the document's one layer"); +} + +/// The viewer's hit test asks which fields the scripts show (`shown_by_scripts`): a frame they +/// showed, and one they hid. +#[test] +fn the_view_says_which_fields_the_scripts_show() { + let mut s = Session::new(); + let id = s.open("animation.pdf", None, Arc::new(animation_pdf()), None).unwrap(); + assert_eq!(s.get(id).unwrap().shown_by_scripts("f1"), None); + s.show_page(id, 0, 0.0); + s.run_timers(id, 100.0); + let doc = s.get(id).unwrap(); + assert_eq!((doc.shown_by_scripts("f0"), doc.shown_by_scripts("f1"), doc.shown_by_scripts("anim")), (Some(false), Some(true), None)); +} + +/// With a cap of none, timers due only move the clock on; they run at the next call. +#[test] +fn a_cap_of_no_timer_runs_only_moves_the_clock() { + let mut s = Session::new(); + let id = s.open("animation.pdf", None, Arc::new(animation_pdf()), None).unwrap(); + s.show_page(id, 0, 0.0); + let run = s.run_timers_at_most(id, 100.0, 0); + assert_eq!(run.ran, 0); + assert_eq!((s.script_clock(id), s.next_timer(id)), (Some(100.0), Some(100.0))); + assert_eq!(s.run_timers_at_most(id, 100.0, 1).ran, 1); +} + +/// A script refused before it runs (too long) leaves the page's timers running. +#[test] +fn a_script_refused_before_it_runs_keeps_the_pages_timers() { + let mut s = Session::new(); + let id = s.open("t.pdf", None, Arc::new(timer_pdf("app.setInterval('1', 10);")), None).unwrap(); + s.show_page(id, 0, 0.0); + assert_eq!(s.next_timer(id), Some(10.0)); + let refused = s.run_javascript(id, &"1;".repeat(256 * 1024), None).expect("runs"); + assert!(refused.error.is_some(), "the script is refused"); + assert_eq!(s.next_timer(id), Some(10.0), "and the interval still runs"); +} diff --git a/crates/engine/src/open.rs b/crates/engine/src/open.rs index 685ac50432..6ba418deee 100644 --- a/crates/engine/src/open.rs +++ b/crates/engine/src/open.rs @@ -385,6 +385,7 @@ impl Session { js_runtime: Default::default(), js_zoom: 100.0, js_page: 0, + live: Default::default(), xfa, xfa_template: None, xfa_scripts_off: false, diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs index a039f56798..872d79eb2a 100644 --- a/crates/engine/src/session/editing.rs +++ b/crates/engine/src/session/editing.rs @@ -181,6 +181,7 @@ impl Session { runner.runtime = doc.js_runtime.clone(); runner.doc.zoom = doc.js_zoom; runner.doc.page = doc.js_page; + runner.doc.layers = crate::live_scripts::js_layers(&doc.info); cx.js = Some(runner); } cx.renamed_fields.clear(); @@ -204,13 +205,16 @@ impl Session { // Fail closed. let before: std::collections::HashSet<_> = pdfcraft_model::pages(&editor.cos).iter().map(|p| p.obj).collect(); let after: std::collections::HashSet<_> = pdfcraft_model::pages(&next).iter().map(|p| p.obj).collect(); + // Either refusal also discards what the batch's field scripts left in the realm. if cx.redaction_marks.iter().any(|(o, _)| !after.contains(o)) && after.iter().any(|o| !before.contains(o)) { + discard_edit_callbacks(&cx); return Err(EditError::Invalid( "a batch that deletes a page with a redaction mark and adds pages can't be verified; the document was not changed".into(), )); } guard(|| shown_under_redactions(&next, &cx.redaction_marks, &cx.redaction_overlays, doc.password.as_deref())) - .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label()))))?; + .unwrap_or_else(|m| Err(EditError::Invalid(format!("{} failed unexpectedly ({m}); the document was not changed", edit.label())))) + .inspect_err(|_| discard_edit_callbacks(&cx))?; } // Renamed fields are said, not slipped in: a repair-log note (with the caveat that // scripts were left alone) and a count in the undo step's label. diff --git a/crates/engine/src/session/view.rs b/crates/engine/src/session/view.rs index 7232f64631..a519fb7e76 100644 --- a/crates/engine/src/session/view.rs +++ b/crates/engine/src/session/view.rs @@ -336,9 +336,11 @@ impl Session { } /// How the document's pages are drawn for viewing: its password and view settings (layer - /// visibility, hidden comments, reading colours). `None` when no such document is open. + /// visibility, hidden comments, reading colours), and the fields as its page actions and + /// timers show them (#169). `None` when no such document is open. pub fn render_config(&self, id: DocId) -> Option { - Some(self.get(id)?.config.clone()) + let doc = self.get(id)?; + Some(crate::live_scripts::with_live_view(doc, doc.config.clone())) } /// Acrobat's Summarize Comments ("Comments only" layout): a new PDF listing every comment diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs index bf1a4ebd01..bdd770dda2 100644 --- a/crates/engine/src/tests.rs +++ b/crates/engine/src/tests.rs @@ -14398,6 +14398,31 @@ fn a_budget_refusal_discards_pdf_edits_and_callback_globals() { assert_eq!(s.run_javascript(id, "typeof fromRejectedEdit;", None).unwrap().result.as_deref(), Some("undefined")); } +/// A batch whose field scripts ran and that a redaction check then refuses leaves the script realm +/// as it was, like the document: here the check that a deleted marked page can't be tied to the +/// pages the batch added. +#[test] +fn a_batch_a_redaction_check_refuses_discards_callback_globals() { + let (mut s, id) = reset_order_session(""); + let script = Some("var fromRefusedBatch = 1;".to_string()); + s.apply(id, Edit::SetFieldScript { name: "qty".into(), event: "keystroke".into(), script }).unwrap(); + let shape = Shape::Redact { quads: vec![pdfcraft_annot::rect_quad([10.0, 10.0, 60.0, 30.0])], overlay: String::new(), look: Default::default() }; + let mark = NewAnnotation { page: 0, style: Style::default_for(&shape), shape, contents: String::new(), author: "Ada".into() }; + s.apply(id, Edit::AddAnnotation(mark)).unwrap(); + s.set_javascript(true); + let before = s.save_bytes(id).unwrap(); + let edits = vec![ + Edit::SetFieldValue { name: "qty".into(), value: pdfcraft_forms::FieldValue::Text("10".into()) }, + Edit::ApplyRedactions { pages: None }, + Edit::InsertBlankPage { at: 1, width: 612.0, height: 792.0 }, + Edit::DeletePages { pages: vec![0] }, + ]; + let refused = s.apply(id, Edit::Batch { label: "x".into(), edits }); + assert!(matches!(&refused, Err(EditError::Invalid(m)) if m.contains("can't be verified")), "{refused:?}"); + assert_eq!(s.save_bytes(id).unwrap(), before); + assert_eq!(s.run_javascript(id, "typeof fromRefusedBatch;", None).unwrap().result.as_deref(), Some("undefined")); +} + #[cfg(not(target_arch = "wasm32"))] #[test] fn timeout_after_undo_releases_the_stale_script_runtime() { diff --git a/crates/forms/src/author/lifecycle.rs b/crates/forms/src/author/lifecycle.rs index 28b56749d9..b2de1321a0 100644 --- a/crates/forms/src/author/lifecycle.rs +++ b/crates/forms/src/author/lifecycle.rs @@ -173,6 +173,7 @@ pub fn add_field(doc: &mut Document, page: usize, rect: [f64; 4], kind: &NewFiel rotation: 0, caption: None, mouse_up_script: None, + mouse_down: false, list: None, round: true, }; diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs index 414132b42b..0c71c4077f 100644 --- a/crates/forms/src/lib.rs +++ b/crates/forms/src/lib.rs @@ -31,8 +31,8 @@ pub use author::{ }; pub use calc_order::{CalculatedField, CalculationIssue, CalculationOrder, calculation_order, set_calculation_order}; pub use scripting::{ - DocumentTrigger, FieldChange, FieldEvent, NoScripts, ScriptResult, Scripts, apply_script_changes, document_action_scripts, document_scripts, - document_scripts_named, set_document_script, set_field_script, + DocumentTrigger, FieldChange, FieldEvent, NoScripts, PageEvent, PageScript, ScriptResult, Scripts, apply_script_changes, document_action_scripts, + document_scripts, document_scripts_named, page_scripts, set_document_script, set_field_script, }; mod appearances; @@ -46,7 +46,7 @@ pub use read::selected_options; pub use read::{Fields, acroform, adopted_page_fields, fields, fields_with_adopted}; #[cfg(test)] use read::{MAX_SCRIPT_BYTES, PageWalk, enumerate, form_reads}; -use read::{first_by_export, script, script_budget}; +use read::{first_by_export, qualified_name, script, script_budget}; pub use tab_order::{TabOrder, move_in_tab_order, set_tab_order, tab_orders}; #[cfg(test)] use values::has_password_flag; @@ -140,6 +140,9 @@ pub struct Widget { pub caption: Option, /// Text widget JavaScript to run on a mouse-up click. pub mouse_up_script: Option, + /// The widget has a mouse-down action (`/AA /D`): a press runs it (the LaTeX `animate` + /// package's controls act on mouse down), so a push button with only that still takes a press. + pub mouse_down: bool, /// List boxes: where the options are drawn, so a click can pick the one under the pointer. pub list: Option, /// Drawn round: a radio button, or a check box laid out for a round XFA check button diff --git a/crates/forms/src/read.rs b/crates/forms/src/read.rs index 4a7904f620..49d7e91562 100644 --- a/crates/forms/src/read.rs +++ b/crates/forms/src/read.rs @@ -85,7 +85,7 @@ pub(crate) fn action_fields(doc: &Document, o: &Object) -> Vec { /// The fully qualified name of the field that `r` (a field or one of its widgets) belongs to, /// from the partial names (`/T`) up its `/Parent` chain. -fn qualified_name(doc: &Document, r: ObjRef) -> Option { +pub(crate) fn qualified_name(doc: &Document, r: ObjRef) -> Option { let mut parts = Vec::new(); let mut seen = std::collections::HashSet::new(); let mut cur = Some(r); @@ -733,6 +733,7 @@ fn walk( } else { None }, + mouse_down: wd.get(b"AA").map(|a| doc.resolve(a)).as_deref().and_then(Object::as_dict).is_some_and(|aa| aa.contains(b"D")), list: (kind == FieldKind::List).then(|| appearance::list_rows_of(doc, inh.da.as_deref().unwrap_or("/Helv 0 Tf 0 g"), Some(d), wd)), round: kind == FieldKind::Radio || (kind == FieldKind::CheckBox && appearance::is_round(doc, wd)), }) diff --git a/crates/forms/src/scripting.rs b/crates/forms/src/scripting.rs index 8ce3f1f68a..453eb477be 100644 --- a/crates/forms/src/scripting.rs +++ b/crates/forms/src/scripting.rs @@ -626,6 +626,73 @@ fn in_array(doc: &Document, o: &Object, f: impl FnOnce(&[Object])) { } } +/// When a page's actions run: as it becomes the page being read, or stops being it. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub enum PageEvent { + Open, + Close, +} + +/// A script a page runs as it opens or closes, with the field whose widget carries it (`None`: +/// the page's own action, or an annotation that isn't a field's). +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct PageScript { + pub field: Option, + pub script: String, +} + +/// Most annotations of one page whose actions are read. +const MAX_PAGE_ANNOTATIONS: usize = 10_000; + +/// The JavaScript page `page` (0-based) runs for `event`, in the order it runs: the page's own +/// action (`/AA /O` or `/C`), then each annotation's, in the page's `/Annots` order (`/AA /PO` +/// then `/PV` as the page opens, `/PC` then `/PI` as it closes). Other kinds of action, and +/// actions chained with `/Next`, are left out. +pub fn page_scripts(doc: &Document, page: usize, event: PageEvent) -> Vec { + let Some(page_ref) = crate::page_refs(doc).get(page).copied() else { return Vec::new() }; + let page_obj = doc.get(page_ref); + let Some(pd) = page_obj.as_dict() else { return Vec::new() }; + let (own, keys): (&[u8], [&[u8]; 2]) = match event { + PageEvent::Open => (b"O", [b"PO", b"PV"]), + PageEvent::Close => (b"C", [b"PC", b"PI"]), + }; + let additional = |d: &pdfcraft_cos::Dict| d.get(b"AA").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()); + let mut budget = crate::script_budget(); + let mut out = Vec::new(); + if let Some(action) = additional(pd).and_then(|aa| aa.get(own).cloned()) + && let Some(script) = javascript(doc, &action, &mut budget) + { + out.push(PageScript { field: None, script }); + } + let annots = pd.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default(); + for item in annots.iter().take(MAX_PAGE_ANNOTATIONS) { + let annot = doc.resolve(item); + let Some(ad) = annot.as_dict() else { continue }; + let Some(aa) = additional(ad) else { continue }; + let field = match item { + Object::Ref(r) if ad.name(b"Subtype") == Some(b"Widget".as_slice()) => crate::qualified_name(doc, *r), + _ => None, + }; + for k in keys { + if let Some(action) = aa.get(k) + && let Some(script) = javascript(doc, action, &mut budget) + { + out.push(PageScript { field: field.clone(), script }); + } + } + } + out +} + +/// The script of a JavaScript action (`/S /JavaScript`); `None` for any other action. +fn javascript(doc: &Document, action: &Object, budget: &mut pdfcraft_cos::DecodeBudget) -> Option { + let a = doc.resolve(action); + if a.as_dict()?.name(b"S")? != b"JavaScript" { + return None; + } + crate::script(doc, action, budget) +} + /// Add (or replace) a document-level JavaScript named `name`. pub fn set_document_script(doc: &mut Document, name: &str, js: Option<&str>) -> Result<(), FormError> { let root = doc.root().ok_or(FormError::NoForm)?; diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs index 2ce02626c9..309d0766d0 100644 --- a/crates/forms/src/tests.rs +++ b/crates/forms/src/tests.rs @@ -7496,3 +7496,31 @@ fn simple_calculation_counts_the_first_value_of_a_multiple_selection_list() { recalculate(&mut doc).unwrap(); assert_eq!(field(&fields(&doc), "total").value, ["4"]); } + +/// A page with open and close actions of its own (one script a stream), an animation's widget +/// with page actions (one of them not a script), buttons acting on mouse down, and a screen +/// annotation with a page-open action. +fn page_actions_fixture() -> Document { + document(&[ + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R] >> >>".into(), // 1 + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(), // 2 + "<< /Type /Page /Parent 2 0 R /AA << /O << /S /JavaScript /JS (page_open\\(\\);) >> /C << /S /JavaScript /JS 7 0 R >> >> /Annots [4 0 R 5 0 R 6 0 R 8 0 R] >>".into(), // 3 + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (anim) /Rect [0 0 100 100] /P 3 0 R /AA << /PO << /S /JavaScript /JS (start\\(\\);) >> /PV << /S /JavaScript /JS (start\\(\\);) >> /PC << /S /JavaScript /JS (stop\\(\\);) >> /PI << /S /URI /URI (https://example.com) >> >> >>".into(), // 4 + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (step) /Rect [0 0 10 10] /P 3 0 R /AA << /D << /S /JavaScript /JS (step\\(\\);) >> >> >>".into(), // 5 + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (both) /Rect [20 0 30 10] /P 3 0 R /AA << /D << /S /JavaScript /JS (down\\(\\);) >> /U << /S /JavaScript /JS (up\\(\\);) >> >> >>".into(), // 6 + "<< /Length 7 >>\nstream\nclose()\nendstream".into(), // 7 + "<< /Type /Annot /Subtype /Screen /Rect [0 0 1 1] /AA << /PO << /S /JavaScript /JS (screen\\(\\);) >> >> >>".into(), // 8 + ]) +} + +#[test] +fn page_scripts_are_the_pages_own_then_each_annotations_in_order() { + let doc = page_actions_fixture(); + let open = page_scripts(&doc, 0, PageEvent::Open); + let got: Vec<(Option<&str>, &str)> = open.iter().map(|s| (s.field.as_deref(), s.script.as_str())).collect(); + assert_eq!(got, [(None, "page_open();"), (Some("anim"), "start();"), (Some("anim"), "start();"), (None, "screen();")]); + let close = page_scripts(&doc, 0, PageEvent::Close); + let got: Vec<(Option<&str>, &str)> = close.iter().map(|s| (s.field.as_deref(), s.script.trim())).collect(); + assert_eq!(got, [(None, "close()"), (Some("anim"), "stop();")], "a URI action is not a script"); + assert!(page_scripts(&doc, 1, PageEvent::Open).is_empty(), "no such page"); +} diff --git a/crates/js/src/globals.rs b/crates/js/src/globals.rs index ef7b95c8c7..81624cfca0 100644 --- a/crates/js/src/globals.rs +++ b/crates/js/src/globals.rs @@ -416,11 +416,6 @@ fn js_number(v: f64) -> String { if v.fract() == 0.0 && v.abs() < 1e15 { format!("{}", v as i64) } else { format!("{v}") } } -fn timer(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult { - // Timers never fire in the sandbox; scripts get an object they can pass to clear*. - Ok(ObjectInitializer::new(ctx).build().into()) -} - /// The `color` object: each named color (`transparent`, `black`, `red`, `cyan`, `gray`, …) as /// an array of its color space (`T`, `G`, `RGB` or `CMYK`) followed by its components. fn color_object(ctx: &mut Context) -> JsObject { @@ -489,7 +484,7 @@ fn document_info_get(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult< /// Install the host API once; live document properties continue reading each job's snapshot. pub(crate) fn install(ctx: &mut Context) -> JsResult<()> { - let globals: [(&str, usize, NativeFunction); 12] = [ + let globals: [(&str, usize, NativeFunction); 13] = [ ("getField", 1, NativeFunction::from_fn_ptr(get_field)), ("getNthFieldName", 1, NativeFunction::from_fn_ptr(get_nth_field_name)), ("resetForm", 1, NativeFunction::from_fn_ptr(reset_form)), @@ -502,6 +497,7 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> { ("syncAnnotScan", 0, NativeFunction::from_fn_ptr(noop)), ("dirty", 0, NativeFunction::from_fn_ptr(noop)), ("exportDataObject", 4, NativeFunction::from_fn_ptr(export_data_object)), + ("getOCGs", 1, NativeFunction::from_fn_ptr(crate::ocg::get_ocgs)), ]; for (name, len, f) in globals { ctx.register_global_callable(JsString::from(name), len, f)?; @@ -556,10 +552,10 @@ pub(crate) fn install(ctx: &mut Context) -> JsResult<()> { .function(NativeFunction::from_fn_ptr(launch_url), js_string!("launchURL"), 2) .function(NativeFunction::from_fn_ptr(crate::interaction::popup_menu), js_string!("popUpMenuEx"), 0) .function(NativeFunction::from_fn_ptr(exec_menu_item), js_string!("execMenuItem"), 1) - .function(NativeFunction::from_fn_ptr(timer), js_string!("setTimeOut"), 2) - .function(NativeFunction::from_fn_ptr(timer), js_string!("setInterval"), 2) - .function(NativeFunction::from_fn_ptr(noop), js_string!("clearTimeOut"), 1) - .function(NativeFunction::from_fn_ptr(noop), js_string!("clearInterval"), 1) + .function(NativeFunction::from_fn_ptr(crate::timers::set_time_out), js_string!("setTimeOut"), 2) + .function(NativeFunction::from_fn_ptr(crate::timers::set_interval), js_string!("setInterval"), 2) + .function(NativeFunction::from_fn_ptr(crate::timers::clear), js_string!("clearTimeOut"), 1) + .function(NativeFunction::from_fn_ptr(crate::timers::clear), js_string!("clearInterval"), 1) .property(js_string!("viewerType"), s("Exchange-Pro"), Attribute::READONLY) .property(js_string!("viewerVariation"), s("Full"), Attribute::READONLY) .property(js_string!("viewerVersion"), JsValue::from(24.0), Attribute::READONLY) diff --git a/crates/js/src/host.rs b/crates/js/src/host.rs index d829041ce6..86811171bc 100644 --- a/crates/js/src/host.rs +++ b/crates/js/src/host.rs @@ -33,6 +33,8 @@ pub(crate) struct Host { pub(crate) retained: usize, /// Alerts, console lines and requests the limits left out. pub(crate) dropped: usize, + /// Layers a script turned on or off (`ocg.state`), by their places in [`DocInfo::layers`]. + pub(crate) layers_changed: BTreeSet, } impl Host { diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs index 87bb881e13..c5e0d6b391 100644 --- a/crates/js/src/lib.rs +++ b/crates/js/src/lib.rs @@ -74,6 +74,10 @@ mod geometry; pub use geometry::{rotate_rect, unrotate_rect}; mod icons; +mod ocg; +pub use ocg::Layer; +mod timers; +pub use timers::{MAX_TIMERS, MIN_TIMER_MS, Timer}; pub mod interaction; pub mod session; diff --git a/crates/js/src/model.rs b/crates/js/src/model.rs index b162007420..f9acb2634f 100644 --- a/crates/js/src/model.rs +++ b/crates/js/src/model.rs @@ -187,6 +187,8 @@ pub struct DocInfo { pub xfa: bool, pub zoom: f64, pub runtime_highlight: bool, + /// The document's layers (optional content groups), for `getOCGs`, in the viewer's order. + pub layers: Vec, } /// The icon a script's message shows: `app.alert`'s `nIcon` and `xfa.host.messageBox`'s @@ -388,6 +390,12 @@ pub struct Outcome { pub doc_errors: Vec, /// The script's completion value (what the console prints), unless undefined. pub result: Option, + /// The timers of a document's retained realm as they stand after the run, in the order they + /// were set (`app.setInterval`, `app.setTimeOut`); none from a one-off run. + pub timers: Vec, + /// Layers the script turned on or off (`ocg.state`), as they are now: their places in + /// [`DocInfo::layers`], and whether each is on. + pub layers: Vec<(usize, bool)>, } /// Bounds that keep a script from hanging the viewer. diff --git a/crates/js/src/ocg.rs b/crates/js/src/ocg.rs new file mode 100644 index 0000000000..2f94afa2da --- /dev/null +++ b/crates/js/src/ocg.rs @@ -0,0 +1,64 @@ +//! `this.getOCGs()`: the document's layers (optional content groups) as OCG objects with +//! `name`, `state` and `initState` (#169, ported from #4751). Setting `state` turns a layer on +//! or off as the Layers panel does: how the document is shown, not the document; the caller +//! reads the layers a run turned in [`crate::Outcome::layers`]. + +use crate::host::{arg, error, function, host, s}; +use crate::{Attribute, Context, JsArray, JsResult, JsValue, NativeFunction, ObjectInitializer, js_string}; + +/// A layer as `getOCGs` shows it. +#[derive(Clone, Debug, Default, PartialEq, Eq)] +pub struct Layer { + pub name: String, + /// Shown now (`ocg.state`). + pub on: bool, + /// Shown as the file opens (`ocg.initState`). + pub initial: bool, +} + +/// `this.getOCGs(nPage)`: every layer of the document, whatever the page (which pages a layer +/// is on isn't known here), or `null` when it has none. +pub(crate) fn get_ocgs(_: &JsValue, _: &[JsValue], ctx: &mut Context) -> JsResult { + let n = host(ctx)?.borrow().doc.layers.len(); + if n == 0 { + return Ok(JsValue::null()); + } + let items: Vec = (0..n).map(|i| ocg(ctx, i)).collect(); + Ok(JsArray::from_iter(items, ctx).into()) +} + +fn layer(c: &Context, i: u32) -> JsResult { + host(c)?.borrow().doc.layers.get(i as usize).cloned().ok_or_else(|| error("the layer is no longer available")) +} + +fn ocg(ctx: &mut Context, index: usize) -> JsValue { + fn name(_: &JsValue, _: &[JsValue], i: &u32, c: &mut Context) -> JsResult { + Ok(s(&layer(c, *i)?.name)) + } + fn state(_: &JsValue, _: &[JsValue], i: &u32, c: &mut Context) -> JsResult { + Ok(JsValue::from(layer(c, *i)?.on)) + } + fn initial(_: &JsValue, _: &[JsValue], i: &u32, c: &mut Context) -> JsResult { + Ok(JsValue::from(layer(c, *i)?.initial)) + } + fn set_state(_: &JsValue, args: &[JsValue], i: &u32, c: &mut Context) -> JsResult { + let on = arg(args, 0).to_boolean(); + let mut h = host(c)?.borrow_mut(); + let l = h.doc.layers.get_mut(*i as usize).ok_or_else(|| error("the layer is no longer available"))?; + l.on = on; + h.layers_changed.insert(*i as usize); + Ok(JsValue::undefined()) + } + let i = u32::try_from(index).unwrap_or(u32::MAX); + let name = function(ctx, NativeFunction::from_copy_closure_with_captures(name, i)); + let state = function(ctx, NativeFunction::from_copy_closure_with_captures(state, i)); + let set_state = function(ctx, NativeFunction::from_copy_closure_with_captures(set_state, i)); + let initial = function(ctx, NativeFunction::from_copy_closure_with_captures(initial, i)); + let rw = Attribute::CONFIGURABLE | Attribute::ENUMERABLE; + ObjectInitializer::new(ctx) + .accessor(js_string!("name"), Some(name), None, rw) + .accessor(js_string!("state"), Some(state), Some(set_state), rw) + .accessor(js_string!("initState"), Some(initial), None, rw) + .build() + .into() +} diff --git a/crates/js/src/run.rs b/crates/js/src/run.rs index 7019bd768c..2bbe216b3a 100644 --- a/crates/js/src/run.rs +++ b/crates/js/src/run.rs @@ -1,7 +1,9 @@ use super::globals::{event_object, install}; use super::host::{Host, Shared, host, text}; use super::model::{DocInfo, Event, FieldState, Limits, Outcome}; -use super::{Arc, BTreeSet, Context, HostHooks, JsNativeError, JsResult, JsString, JsValue, NativeFunction, Realm, RefCell, Source, js_string}; +use super::{ + Arc, BTreeSet, Context, HostHooks, JsNativeError, JsObject, JsResult, JsString, JsValue, NativeFunction, Realm, RefCell, Source, js_string, +}; /// Longest script, in bytes. pub(crate) const MAX_SCRIPT_BYTES: usize = 256 * 1024; @@ -148,6 +150,7 @@ pub(crate) fn run_shared_here( reset_calls: 0, calculation_evaluations: 0, calculation_limit_exceeded: false, + call: None, }, limits, ) @@ -200,6 +203,8 @@ pub(crate) struct ScriptSetup<'a> { pub(crate) reset_calls: usize, pub(crate) calculation_evaluations: usize, pub(crate) calculation_limit_exceeded: bool, + /// A timer's function to call in place of the script (#169). + pub(crate) call: Option, } /// Create a restricted temporary Boa context and convert initialization failures into script outcomes. @@ -272,6 +277,7 @@ pub(crate) fn run_in_context( kept: 0, retained: 0, dropped: 0, + layers_changed: BTreeSet::new(), })); let mut out = Outcome { rc: true, value: event.value.clone(), change: event.change.clone(), ..Default::default() }; let mut doc_errors: Vec<(usize, String)> = setup.skipped.iter().map(|(i, why)| (*i, doc_error(*i, why))).collect(); @@ -297,7 +303,10 @@ pub(crate) fn run_in_context( doc_errors.push((i, doc_error(i, &e))); } } - let r = ctx.eval(Source::from_bytes(script))?; + let r = match &setup.call { + Some(f) => f.call(&JsValue::undefined(), &[], ctx)?, + None => ctx.eval(Source::from_bytes(script))?, + }; if !r.is_undefined() { out.result = Some(text(&r, ctx)?); } @@ -328,11 +337,14 @@ pub(crate) fn run_in_context( out.alerts = std::mem::take(&mut h.alerts); out.console = std::mem::take(&mut h.console); out.requests = std::mem::take(&mut h.requests); + let layers = std::mem::take(&mut h.layers_changed); + out.layers = layers.into_iter().filter_map(|i| h.doc.layers.get(i).map(|l| (i, l.on))).collect(); if h.dropped > 0 { out.console.push(format!("the script's messages, console lines and requests passed their limits; {} more were left out", h.dropped)); } ctx.insert_data(RefCell::new(h)); } + out.timers = crate::timers::report(ctx); out } diff --git a/crates/js/src/session.rs b/crates/js/src/session.rs index 1e01674df1..8235706d3d 100644 --- a/crates/js/src/session.rs +++ b/crates/js/src/session.rs @@ -16,6 +16,10 @@ pub struct Job { pub doc_scripts: Vec, /// Target positions in this job's field snapshot and their ordered script sources. pub calculations: Vec<(usize, String)>, + /// Fire this timer of the realm (`app.setInterval`, `app.setTimeOut`) in place of `script` + /// (#169). A timer the realm no longer has runs nothing; nor does any timer of a realm that + /// has not started, or whose document scripts changed (its timers went with it). + pub timer: Option, } /// Live field instances are independent of restorable PDF object-number allocation. #[derive(Default)] @@ -129,8 +133,12 @@ impl Realm { } fn run_job(&mut self, job: Job) -> Outcome { let failed = |why: String| Outcome { rc: true, execution_refused: true, realm_untouched: true, error: Some(why), ..Default::default() }; + if let Some(id) = job.timer { + return self.fire(job, id); + } // A script too long or too deeply nested to run is that script's error, as on `main`: the - // value stays and the edit's other scripts still run. The realm is not touched. + // value stays and the edit's other scripts still run. The realm is not touched, so its + // timers are as they were: they are reported, as after any run, or the viewer drops them. if let Some(why) = crate::refuse(&job.script) { return Outcome { rc: true, @@ -138,6 +146,7 @@ impl Realm { value: job.event.value.clone(), change: job.event.change.clone(), error: Some(why), + timers: self.context.as_ref().map(crate::timers::report).unwrap_or_default(), ..Default::default() }; } @@ -147,7 +156,10 @@ impl Realm { let initialize = self.context.is_none() || self.scripts != job.doc_scripts; if initialize { self.context = match crate::Context::builder().host_hooks(std::rc::Rc::new(crate::run::NoCodeFromStrings)).build() { - Ok(c) => Some(c), + Ok(mut c) => { + crate::timers::enable(&mut c); + Some(c) + } Err(e) => return failed(e.to_string()), }; self.scripts = job.doc_scripts.clone(); @@ -186,6 +198,7 @@ impl Realm { reset_calls: 0, calculation_evaluations: 0, calculation_limit_exceeded: false, + call: None, }, Limits::default(), ); @@ -212,6 +225,7 @@ impl Realm { reset_calls, calculation_evaluations, calculation_limit_exceeded: initial.calculation_limit_exceeded, + call: None, }, Limits::default(), ); @@ -251,6 +265,7 @@ impl Realm { reset_calls: 0, calculation_evaluations: 0, calculation_limit_exceeded: false, + call: None, }, Limits::default(), ) @@ -258,6 +273,43 @@ impl Realm { } } +impl Realm { + /// Run timer `id` that fell due, with the job's form and document: its expression, or the + /// function it was given, in the realm that set it (#169). + fn fire(&mut self, job: Job, id: u32) -> Outcome { + let idle = |timers: Vec| Outcome { rc: true, realm_untouched: true, timers, ..Default::default() }; + let Some(ctx) = self.context.as_mut().filter(|_| self.scripts == job.doc_scripts) else { return idle(Vec::new()) }; + let Some(code) = crate::timers::due(ctx, id) else { return idle(crate::timers::report(ctx)) }; + let (script, call) = match code { + crate::timers::Code::Source(source) => { + if let Some(why) = crate::refuse(&source) { + return Outcome { rc: true, realm_untouched: true, error: Some(why), timers: crate::timers::report(ctx), ..Default::default() }; + } + (source, None) + } + crate::timers::Code::Function(f) => (String::new(), Some(f)), + }; + crate::run::run_in_context( + ctx, + &script, + &job.event, + &job.doc, + job.fields, + crate::run::ScriptSetup { + doc_scripts: &[], + skipped: &[], + calculations: &job.calculations, + initialize: false, + reset_calls: 0, + calculation_evaluations: 0, + calculation_limit_exceeded: false, + call, + }, + Limits::default(), + ) + } +} + #[cfg(not(target_arch = "wasm32"))] static LIVE_WORKERS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0); #[cfg(not(target_arch = "wasm32"))] @@ -577,8 +629,68 @@ mod tests { fields: Arc::new(vec![FieldState::new("go", crate::FieldType::Button, vec!["old".into()])]), doc_scripts: vec!["var buffer='', init=1, opened=event.name;var held=getField('go');function digit(v){buffer+=v;return buffer;}".into()], calculations: Vec::new(), + timer: None, } } + /// A job firing timer `id` of the realm, as the viewer runs one that fell due (#169). + fn fire(id: u32) -> Job { + Job { script: String::new(), event: Event { kind: "App".into(), ..Event::doc("Timer") }, timer: Some(id), ..job("") } + } + #[test] + /// Timers a script sets stay in the document's realm and fire there: an interval until it is + /// cleared, a time-out once; the field writes a timer makes are reported like any script's. + fn timers_fire_in_the_document_realm_until_cleared() { + let mut s = ScriptSession::default(); + let set = s.run( + job("var n = 0; var t = app.setInterval(function () { n++; getField('go').value = 'frame ' + n; }, 40); app.setTimeOut('n += 100', 0);"), + &[], + ); + assert_eq!(set.error, None); + assert_eq!( + set.timers, + [crate::Timer { id: 1, period_ms: 40, repeat: true }, crate::Timer { id: 2, period_ms: crate::MIN_TIMER_MS, repeat: false }] + ); + let first = s.run(fire(1), &[]); + assert_eq!(first.error, None); + assert_eq!(first.changed.iter().map(|f| f.value.clone()).collect::>(), [vec!["frame 1".to_string()]]); + let once = s.run(fire(2), &[]); + assert_eq!(once.timers.len(), 1, "a time-out runs once"); + assert!(s.run(fire(2), &[]).realm_untouched, "and is gone after"); + s.run(fire(1), &[]); + assert_eq!(s.run(job("n;"), &[]).result.as_deref(), Some("102")); + let cleared = s.run(job("app.clearInterval(t); app.clearInterval({}); n;"), &[]); + assert!(cleared.timers.is_empty()); + assert!(s.run(fire(1), &[]).changed.is_empty(), "a cleared timer runs nothing"); + } + #[test] + /// A document keeps at most 64 timers, a timer runs at most every 10 ms, a one-off run keeps + /// none, and changed document scripts start a realm without the old timers. + fn timers_are_bounded_and_belong_to_one_realm() { + let mut s = ScriptSession::default(); + let many = s.run( + job("var made = 0; try { for (var i = 0; i < 70; i++) { app.setInterval('1', -5); made++; } } catch (e) { made + ': ' + e.message; }"), + &[], + ); + assert_eq!(many.result.as_deref(), Some("64: a document's scripts can keep at most 64 timers")); + assert!(many.timers.iter().all(|t| t.period_ms == crate::MIN_TIMER_MS)); + let one_off = crate::run("app.setInterval('1', 50); 'set';", &Event::doc("Console"), &DocInfo::default(), &[], &[], Limits::default()); + assert_eq!(one_off.result.as_deref(), Some("set")); + assert!(one_off.timers.is_empty()); + let changed = Job { doc_scripts: vec!["var other = 1;".into()], ..fire(1) }; + let gone = s.run(changed, &[]); + assert!(gone.timers.is_empty() && gone.changed.is_empty(), "{gone:?}"); + } + #[test] + /// A script refused before it runs (too long) leaves the realm as it was and reports the + /// timers it still has: the viewer keeps only the timers a run reports. + fn a_script_refused_before_it_runs_reports_the_realms_timers() { + let mut s = ScriptSession::default(); + let set = s.run(job("app.setInterval('1', 40);"), &[]); + assert_eq!(set.timers.len(), 1); + let refused = s.run(job(&"1;".repeat(crate::MAX_SCRIPT_BYTES)), &[]); + assert!(refused.realm_untouched && !refused.execution_refused && refused.error.is_some(), "{:?}", refused.error); + assert_eq!(refused.timers, set.timers); + } #[test] /// Retained Field identity, custom properties and keypad buffers persist locally while separate documents stay isolated. fn document_realm_keeps_keypad_state_and_isolates_documents() { @@ -980,6 +1092,7 @@ mod reset_budget_tests { fields: Arc::new(vec![]), doc_scripts: vec!["for(var i=0;i<64;i++)resetForm();".into()], calculations: vec![], + timer: None, }; let out = runtime.run(job.clone(), &[]); assert!(out.reset_limit_exceeded); @@ -1006,6 +1119,7 @@ mod event_identity_tests { fields: Arc::new(vec![field]), doc_scripts: vec![], calculations: vec![], + timer: None, }; let out = ScriptSession::default().run(job, &[]); assert_eq!(out.error, None); @@ -1027,7 +1141,7 @@ mod cache_capacity_tests { }) .collect(), ); - let job=Job{script:"for(var i=0;i<4100;i++)getField('f'+i);var held=getField('f4099');held.custom=42;held===getField('f4099') && getField('f4099').custom===42;".into(),event:Event::doc("Console"),doc:Default::default(),fields,doc_scripts:vec![],calculations:vec![]}; + let job=Job{script:"for(var i=0;i<4100;i++)getField('f'+i);var held=getField('f4099');held.custom=42;held===getField('f4099') && getField('f4099').custom===42;".into(),event:Event::doc("Console"),doc:Default::default(),fields,doc_scripts:vec![],calculations:vec![],timer:None}; let mut session = ScriptSession::default(); let out = session.run(job.clone(), &[]); assert_eq!(out.error, None); @@ -1051,6 +1165,7 @@ mod cache_lifecycle_tests { fields: Arc::new(vec![field.clone()]), doc_scripts: vec![], calculations: vec![], + timer: None, }; let mut realm = Realm::new(); assert_eq!(realm.run(job.clone()).error, None); @@ -1088,6 +1203,7 @@ mod review13_tests { fields: Arc::new(fields), doc_scripts: vec![], calculations: vec![], + timer: None, } } /// A retired accessor must not resolve a replacement even if no job observed the deletion. diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs index ece4443b7d..8668311b8d 100644 --- a/crates/js/src/tests.rs +++ b/crates/js/src/tests.rs @@ -541,6 +541,7 @@ fn app_alert_titles_are_clipped_and_charged() { kept: 0, retained: 0, dropped: 0, + layers_changed: Default::default(), }; h.alert(Message { title: Some("Order form".into()), ..Message::plain("Saved") }); assert_eq!(h.kept, "Saved".len() + "Order form".len()); @@ -2749,6 +2750,29 @@ fn af_simple_calculate_bounds_selector_work_before_expansion() { assert!(out.error.as_deref().is_some_and(|e| e.contains("calculation field lookup exceeds"))); } +/// `getOCGs` lists the document's layers; setting `state` turns one, which the run reports, and +/// a document without layers gives `null` (#169, from #4751). +#[test] +fn get_ocgs_lists_layers_and_reports_the_ones_a_script_turns() { + let layers = + vec![crate::Layer { name: "Frame 1".into(), on: true, initial: true }, crate::Layer { name: "Frame 2".into(), on: false, initial: false }]; + let layered = DocInfo { layers, ..doc() }; + let out = run( + "var o = this.getOCGs(); var before = o.map(function (l) { return l.name + '=' + l.state + '/' + l.initState; }).join(','); \ + o[0].state = false; o[1].state = true; before + ' ' + o[1].state;", + &Event::doc("Console"), + &layered, + &[], + &[], + Default::default(), + ); + assert_eq!(out.error, None); + assert_eq!(out.result.as_deref(), Some("Frame 1=true/true,Frame 2=false/false true")); + assert_eq!(out.layers, [(0, false), (1, true)]); + let none = run("this.getOCGs() === null;", &Event::doc("Console"), &doc(), &[], &[], Default::default()); + assert_eq!(none.result.as_deref(), Some("true")); +} + /// `toSource` writes plain state as a JavaScript literal of the same value (#269, from #344). /// Scripts here can't `eval` it back (strings never compile), so the exact text is checked. #[test] diff --git a/crates/js/src/timers.rs b/crates/js/src/timers.rs new file mode 100644 index 0000000000..88c7d65caf --- /dev/null +++ b/crates/js/src/timers.rs @@ -0,0 +1,132 @@ +//! `app.setInterval`, `app.setTimeOut`, `app.clearInterval` and `app.clearTimeOut` in a +//! document's retained realm (#169, ported from #4751). The realm keeps the timers its scripts +//! set and reports them in every [`crate::Outcome`]; the caller owns the clock and fires one +//! by running a [`crate::session::Job`] with its `timer` when it falls due, in the same realm. A +//! one-off run (a fresh context) keeps none: there the functions return an object and nothing +//! ever fires, as before. + +use std::cell::RefCell; +use std::collections::BTreeMap; + +use crate::host::{arg, error, text}; +use crate::{Context, JsObject, JsResult, JsValue, MAX_SCRIPT_BYTES, ObjectInitializer}; + +/// Most timers one document's scripts keep at once; setting another is an error. +pub const MAX_TIMERS: usize = 64; +/// The shortest period, in milliseconds: a timer asked to run sooner or more often runs at this. +pub const MIN_TIMER_MS: u32 = 10; + +/// A timer a script set, as the realm reports it. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub struct Timer { + /// The realm's name for it, never reused while the realm lives. + pub id: u32, + /// Milliseconds between runs (`setInterval`) or before the one run (`setTimeOut`), at least + /// [`MIN_TIMER_MS`]. + pub period_ms: u32, + /// `setInterval`: it runs until it is cleared. `setTimeOut`: once. + pub repeat: bool, +} + +/// What a timer runs: its expression, or a function the script gave instead. +#[derive(Clone)] +pub(crate) enum Code { + Source(String), + Function(JsObject), +} + +struct Entry { + /// The object `set*` returned, which `clear*` is given back. + handle: JsObject, + code: Code, + period_ms: u32, + repeat: bool, +} + +/// A realm's timers by id, in the order they were set (ids only grow). +#[derive(Default)] +pub(crate) struct Timers { + last: u32, + table: BTreeMap, +} + +type Shared = RefCell; + +/// Let the timers of a retained realm run: the functions keep what they are given from now on. +pub(crate) fn enable(ctx: &mut Context) { + if ctx.get_data::().is_none() { + ctx.insert_data(RefCell::new(Timers::default())); + } +} + +/// The realm's timers as they stand, in the order they were set; none in a one-off run. +pub(crate) fn report(ctx: &Context) -> Vec { + ctx.get_data::() + .map(|t| t.borrow().table.iter().map(|(id, e)| Timer { id: *id, period_ms: e.period_ms, repeat: e.repeat }).collect()) + .unwrap_or_default() +} + +/// What timer `id` runs now that it fell due; a `setTimeOut` timer is gone after this. `None` +/// when it was cleared (or the realm has no timers). +pub(crate) fn due(ctx: &Context, id: u32) -> Option { + let mut timers = ctx.get_data::()?.borrow_mut(); + let entry = timers.table.get(&id)?; + let code = entry.code.clone(); + if !entry.repeat { + timers.table.remove(&id); + } + Some(code) +} + +/// `app.setInterval(cExpr, nMilliseconds)`: run the expression (or a function) every period +/// until it is cleared. +pub(crate) fn set_interval(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult { + set(args, true, ctx) +} + +/// `app.setTimeOut(cExpr, nMilliseconds)`: run the expression (or a function) once, after the +/// period. +pub(crate) fn set_time_out(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult { + set(args, false, ctx) +} + +fn set(args: &[JsValue], repeat: bool, ctx: &mut Context) -> JsResult { + let handle = ObjectInitializer::new(ctx).build(); + if ctx.get_data::().is_none() { + return Ok(handle.into()); + } + let what = arg(args, 0); + let code = match what.as_callable() { + Some(f) => Code::Function(f.clone()), + None => { + let source = text(&what, ctx)?; + if source.len() > MAX_SCRIPT_BYTES { + return Err(error(format!("the timer's script is too long (the limit is {} KiB)", MAX_SCRIPT_BYTES / 1024))); + } + Code::Source(source) + } + }; + let ms = arg(args, 1).to_number(ctx)?; + // A missing, negative or NaN period runs as soon as allowed; the float cast saturates. + let period_ms = if ms.is_nan() { MIN_TIMER_MS } else { (ms.min(f64::from(u32::MAX)) as u32).max(MIN_TIMER_MS) }; + let Some(timers) = ctx.get_data::() else { return Ok(handle.into()) }; + let mut timers = timers.borrow_mut(); + if timers.table.len() >= MAX_TIMERS { + return Err(error(format!("a document's scripts can keep at most {MAX_TIMERS} timers"))); + } + let id = timers.last.checked_add(1).ok_or_else(|| error("no more timers can be set"))?; + timers.last = id; + timers.table.insert(id, Entry { handle: handle.clone(), code, period_ms, repeat }); + Ok(handle.into()) +} + +/// `app.clearInterval(oInterval)` and `app.clearTimeOut(oTime)`: forget the timer the object +/// stands for. Anything else, or a timer already gone, is ignored. +pub(crate) fn clear(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult { + if let Some(o) = arg(args, 0).as_object() + && let Some(timers) = ctx.get_data::() + { + timers.borrow_mut().table.retain(|_, e| !JsObject::equals(&e.handle, &o)); + } + Ok(JsValue::undefined()) +} diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs index cd88021951..370010ee47 100644 --- a/crates/render/src/raster.rs +++ b/crates/render/src/raster.rs @@ -68,6 +68,15 @@ pub struct RenderConfig { pub layers: Arc>, /// View ▸ Hide all comments: markup annotations aren't drawn (fields and links still are). pub hide_comments: bool, + /// Annotations shown or hidden for viewing in place of their Hidden and NoView flags (object + /// number, generation, shown): fields a document's page actions and timers showed or hid + /// (an animation's frames). Display only; the document never changes. + pub annotations: Arc>, + /// Annotations drawn with a form XObject as their normal appearance (object number and + /// generation of the annotation, then of the form): push buttons a document's page actions + /// and timers gave another icon (`buttonSetIcon`, an animation's frames). Display only; the + /// document never changes. + pub appearances: Arc>, /// Refuse a whole-page raster that would be reduced by the renderer's hard size caps. /// Tiled requests remain available for pages that exceed those caps. Both modes refuse /// a raster whose rounded integer dimensions exceed the final pixel-allocation budget. @@ -118,6 +127,8 @@ impl RenderConfig { ocg_overrides: self.layers.clone(), view_auto_state: !self.for_print, hide_comments: self.hide_comments, + annotation_overrides: self.annotations.clone(), + appearance_overrides: self.appearances.clone(), font_resolver: Arc::new(move |query| { japanese_fallback(query).or_else(|| system_fonts.then(|| system_fallback(query)).flatten()).or_else(|| standard(query)) }), @@ -377,7 +388,8 @@ fn render_page<'a>( ) -> Result { // Print previews share the viewer pool, but must use the output font policy and the layers // as they print (`print_layers`). Keep the caller's cancellation/warning hooks and annotation - // settings. A fresh cache is essential: hayro keys cached fonts by PDF dictionary, not by the + // settings, except what a document's scripts show while it is read (`annotations`, + // `appearances`), which never prints. A fresh cache is essential: hayro keys cached fonts by PDF dictionary, not by the // font resolver, so the viewer cache could supply an installed face even after changing the // resolver (and a cached missing font from print preview could blank the viewer on switching // back); nothing drawn with the viewer's layers is reused either. @@ -385,10 +397,13 @@ fn render_page<'a>( let print_cache; let print = req.tag & PRINT_TAG != 0; let print_layers = config.print_layers.as_ref().filter(|_| print); - let (settings, cache) = if (config.system_fonts && print) || print_layers.is_some() { + let live = !settings.annotation_overrides.is_empty() || !settings.appearance_overrides.is_empty(); + let (settings, cache) = if print && (config.system_fonts || print_layers.is_some() || live) { print_settings = InterpreterSettings { font_resolver: RenderConfig { system_fonts: false, ..config.clone() }.settings().font_resolver, ocg_overrides: print_layers.cloned().unwrap_or_else(|| settings.ocg_overrides.clone()), + annotation_overrides: Arc::default(), + appearance_overrides: Arc::default(), ..settings.clone() }; print_cache = RenderCache::new(); diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs index 86d655677b..f1145e7d90 100644 --- a/crates/render/src/raster/tests.rs +++ b/crates/render/src/raster/tests.rs @@ -2741,6 +2741,58 @@ trailer << /Root 1 0 R >> assert_eq!(px(&hidden, 20, 80), vec![255, 0, 0, 255], "fields stay"); } +/// The viewer's overrides (patches 105 and 106) show a hidden widget, hide a shown one and draw +/// one with another form, by object; an entry of `/Annots` that isn't a dictionary is skipped. +#[test] +fn annotation_and_appearance_overrides_change_only_the_view() { + let pdf = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 50] /Annots [42 5 0 R 6 0 R] >> endobj +5 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (a) /F 2 /Rect [0 0 50 50] /AP << /N 7 0 R >> >> endobj +6 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (b) /Rect [50 0 100 50] /AP << /N 8 0 R >> >> endobj +7 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 50 50] /Length 24 >> stream +1 0 0 rg 0 0 50 50 re f +endstream endobj +8 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 50 50] /Length 24 >> stream +0 0 1 rg 0 0 50 50 re f +endstream endobj +9 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 10 10] /Length 24 >> stream +0 1 0 rg 0 0 10 10 re f +endstream endobj +trailer << /Root 1 0 R >> +%%EOF"; + let render = |config: RenderConfig| { + let mut r = PageRenderer::new(Arc::new(pdf.to_vec()), config); + r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() }) + }; + let px = |p: &RenderedPage, x: u32, y: u32| p.rgba[((y * p.width + x) * 4) as usize..][..4].to_vec(); + let (white, red, blue, green) = (vec![255, 255, 255, 255], vec![255, 0, 0, 255], vec![0, 0, 255, 255], vec![0, 255, 0, 255]); + let plain = render(RenderConfig::default()); + assert_eq!((px(&plain, 25, 25), px(&plain, 75, 25)), (white.clone(), blue), "the hidden widget isn't drawn"); + let flipped = render(RenderConfig { annotations: Arc::new(vec![(5, 0, true), (6, 0, false)]), ..RenderConfig::default() }); + assert_eq!((px(&flipped, 25, 25), px(&flipped, 75, 25)), (red, white.clone()), "shown and hidden by object"); + let face = render(RenderConfig { appearances: Arc::new(vec![(6, 0, 9, 0), (5, 0, 99, 0)]), ..RenderConfig::default() }); + assert_eq!((px(&face, 25, 25), px(&face, 75, 25)), (white.clone(), green), "drawn with the other form, scaled to its own rectangle"); + let cleared = render(RenderConfig { appearances: Arc::new(vec![(6, 0, 0, 0)]), ..RenderConfig::default() }); + assert_eq!(px(&cleared, 75, 25), white, "an override naming no form draws nothing (a cleared icon), not the button's own face"); + // A print preview draws the page as it prints, without what the scripts show. + let config = RenderConfig { + annotations: Arc::new(vec![(5, 0, true), (6, 0, false)]), + appearances: Arc::new(vec![(6, 0, 9, 0)]), + ..RenderConfig::default() + }; + let preview = PageRenderer::new(Arc::new(pdf.to_vec()), config).render(RenderRequest { + page: 0, + kind: RequestKind::Pixels, + tile: None, + scale: 1.0, + tag: PRINT_TAG, + ..Default::default() + }); + assert_eq!((px(&preview, 25, 25), px(&preview, 75, 25)), (vec![255, 255, 255, 255], vec![0, 0, 255, 255]), "the print preview"); +} + /// ISO 32000-2 Table 167: Invisible hides an annotation of a type that isn't standard and /// nothing else; §12.5.6.14: a popup has no appearance of its own, so its `/AP` isn't painted. #[test] diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs index 3a1d678d83..eb918de147 100644 --- a/crates/ui-egui/src/app.rs +++ b/crates/ui-egui/src/app.rs @@ -722,6 +722,7 @@ impl PdfCraftApp { let out = self.session.take_js_output(id); self.handle_js(id, out); } + self.script_tick(ctx); if let Some(mut control) = self.control.take() { control.tick(ctx, self); self.control = Some(control); diff --git a/crates/ui-egui/src/canvas/page_input.rs b/crates/ui-egui/src/canvas/page_input.rs index 1f6666933d..a5d5893e8f 100644 --- a/crates/ui-egui/src/canvas/page_input.rs +++ b/crates/ui-egui/src/canvas/page_input.rs @@ -101,6 +101,7 @@ pub(super) fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut tool, pcx: &pcx, form, + doc, can_fill, can_modify, editing_content, @@ -486,6 +487,8 @@ struct PageHits<'a> { tool: QuickTool, pcx: &'a comments::PageCx<'a>, form: &'a [pdfcraft_engine::FormField], + /// Its document: what its scripts show while it is read (`Document::shown_by_scripts`). + doc: &'a pdfcraft_engine::Document, can_fill: bool, can_modify: bool, /// Edit a PDF is open: added text and pictures can be picked up. @@ -576,6 +579,7 @@ impl PageHits<'_> { tool, pcx, form, + doc, can_fill, can_modify, editing_content, @@ -611,7 +615,7 @@ impl PageHits<'_> { let fields = if preparing { crate::prepare::hit(xf, info, page, form, field_tool, prepare_allowed, &view.prepare, p) } else if tool == QuickTool::Select { - crate::forms_ui::hit(xf, info, page, form, tabs, can_fill, p) + crate::forms_ui::hit(xf, info, page, doc, tabs, can_fill, p) } else { None }; @@ -1068,7 +1072,9 @@ fn paint_field_highlights(painter: &egui::Painter, xf: &PageXform, info: &DocInf if !enabled { return; } - for field in form.iter() { + // A push button holds no value, so it is left as drawn (the frames and controls of a LaTeX + // `animate` animation are push buttons). + for field in form.iter().filter(|f| f.kind != pdfcraft_engine::FormFieldKind::PushButton) { let required = field.has(pdfcraft_engine::field_flags::REQUIRED); for widget in field.widgets.iter().filter(|widget| widget.page == Some(page) && !widget.hidden && !widget.read_only) { let rect = widget.rect; diff --git a/crates/ui-egui/src/canvas/sign_tab_tests.rs b/crates/ui-egui/src/canvas/sign_tab_tests.rs index c2d5c20748..79789eddcf 100644 --- a/crates/ui-egui/src/canvas/sign_tab_tests.rs +++ b/crates/ui-egui/src/canvas/sign_tab_tests.rs @@ -58,6 +58,7 @@ fn field(name: &str, page: usize, rect: [f64; 4]) -> FormField { tooltip: None, widgets: vec![FormWidget { mouse_up_script: None, + mouse_down: false, obj: pdfcraft_cos::ObjRef::new(4, 0), page: Some(page), rect, diff --git a/crates/ui-egui/src/tools/forms_ui.rs b/crates/ui-egui/src/tools/forms_ui.rs index 94aafda3f7..e3c0cf0233 100644 --- a/crates/ui-egui/src/tools/forms_ui.rs +++ b/crates/ui-egui/src/tools/forms_ui.rs @@ -421,9 +421,17 @@ fn toggle_edit(f: &FormField, wi: usize) -> Option { Some(Edit::SetFieldValue { name: f.name.clone(), value }) } -/// The first shown widget of `f` on `page` under the pointer at `p`, with its index. -fn widget_at<'a>(xf: &PageXform, info: &DocInfo, page: usize, f: &'a FormField, p: egui::Pos2) -> Option<(usize, &'a FormWidget)> { - f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && !w.hidden && widget_rect(xf, info, page, w.rect).contains(p)) +/// The first shown widget of `f` on `page` under the pointer at `p`, with its index. `shown`: +/// whether the document's scripts show `f` while it is read, over its widgets' own flags. +fn widget_at<'a>( + xf: &PageXform, + info: &DocInfo, + page: usize, + f: &'a FormField, + shown: Option, + p: egui::Pos2, +) -> Option<(usize, &'a FormWidget)> { + f.widgets.iter().enumerate().find(|(_, w)| w.page == Some(page) && shown.unwrap_or(!w.hidden) && widget_rect(xf, info, page, w.rect).contains(p)) } /// The field whose sign tab is under `p`, of `tabs` in the order they are painted: where tabs @@ -432,11 +440,13 @@ pub(crate) fn tab_under<'a>(tabs: &[(&'a str, SignTab)], p: egui::Pos2) -> Optio tabs.iter().rev().find(|(_, tab)| tab.rect.contains(p)).map(|(name, _)| *name) } -/// Whether `w`, a widget of `f`, takes a press: fillable, a push button with an action, or an +/// Whether `w`, a widget of `f`, takes a press: fillable, a push button with an action (a click +/// or mouse-down one), or an /// empty signature field (signed by clicking it, Use a certificate). A radio button of a group can /// be read-only on its own. fn usable(f: &FormField, w: &FormWidget, allowed: bool) -> bool { - let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && f.button.is_some(); + // A button acting only on mouse down (`/AA /D`) takes the press too, which runs it (#4751). + let pressable = f.kind == FormFieldKind::PushButton && !f.read_only() && (f.button.is_some() || w.mouse_down); allowed && !w.read_only && (fillable(f) || pressable || f.kind == FormFieldKind::Signature) } @@ -444,16 +454,26 @@ fn usable(f: &FormField, w: &FormWidget, allowed: bool) -> bool { /// press. It is the first widget under the pointer in the form's order, except on a sign tab /// (`tabs`, with the signature field each one signs), which is drawn over every field and so is /// on its own field. Over the page's text too: a check box drawn with a glyph, or set on printed -/// text, is a button, not text to select. -pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, form: &[FormField], tabs: &[(&str, SignTab)], allowed: bool, p: Pos2) -> Option { +/// text, is a button, not text to select. The fields are `doc`'s, shown as its page actions and +/// timers show them ([`pdfcraft_engine::Document::shown_by_scripts`]). +pub(crate) fn hit( + xf: &PageXform, + info: &DocInfo, + page: usize, + doc: &pdfcraft_engine::Document, + tabs: &[(&str, SignTab)], + allowed: bool, + p: Pos2, +) -> Option { if !xf.rect.contains(p) { return None; } let under = |only: Option<&str>| { - form.iter() + doc.form + .iter() .enumerate() .filter(|(_, f)| only.is_none_or(|name| f.name == name && f.kind == FormFieldKind::Signature)) - .find_map(|(fi, f)| widget_at(xf, info, page, f, p).map(|(wi, w)| (fi, f, wi, w))) + .find_map(|(fi, f)| widget_at(xf, info, page, f, doc.shown_by_scripts(&f.name), p).map(|(wi, w)| (fi, f, wi, w))) }; // A tab lies inside its field's widget, so that widget is under the pointer too. let (field, f, widget, w) = tab_under(tabs, p).and_then(|name| under(Some(name))).or_else(|| under(None))?; @@ -551,6 +571,8 @@ pub(crate) fn page_input( _ if f.read_only() || w.read_only => view.forms.notice = Some(FormNotice::ReadOnly(f.name.clone())), FormFieldKind::PushButton => match &f.button { Some(a) => view.forms.button = Some((f.name.clone(), pdfcraft_engine::js::field_object_id(f.obj), a.clone())), + // Its press already ran its mouse-down action. + None if w.mouse_down => {} None => view.forms.notice = Some(FormNotice::NoAction(f.name.clone())), }, FormFieldKind::Text if let Some(script) = &w.mouse_up_script => { diff --git a/crates/ui-egui/src/workflows/js_ui.rs b/crates/ui-egui/src/workflows/js_ui.rs index 1f3721c511..a8d28d7c3a 100644 --- a/crates/ui-egui/src/workflows/js_ui.rs +++ b/crates/ui-egui/src/workflows/js_ui.rs @@ -200,6 +200,62 @@ impl PdfCraftApp { true } + /// Each frame: the live scripts of the document being read (#169). Its page's open actions + /// run when the page changes (after the close actions of the page it was at), and its timers + /// when they fall due, such as an animation's frames (LaTeX `animate`). Only the active tab + /// runs: an animation in another tab waits until its tab shows again. + pub(crate) fn script_tick(&mut self, ctx: &egui::Context) { + // Nothing acts on the document under a dialog or prompt (`modal_open`): page actions and + // timers wait, and an interval that fell behind runs once when it closes. + if self.modal_open() { + return; + } + let Some((i, id)) = self.active_ids() else { return }; + let now_ms = ctx.input(|input| input.time) * 1000.0; + let page = self.views[i].current; + // The page's actions, then its timers, if what the actions asked for left the viewer as it + // was: a page they went to runs its close and open actions (next frame) before any timer, + // and a dialog they opened holds the timers too. + for timers in [false, true] { + if timers && (self.modal_open() || self.active_ids() != Some((i, id)) || self.views[i].current != page) { + ctx.request_repaint(); + break; + } + // The field being edited as it was, so a script changing it shows in its editor while + // a draft the user already typed into is kept (as `run_field_triggers` does). + let before: Option<(String, Vec)> = self.views[i].forms.focus.as_ref().and_then(|e| { + crate::forms_ui::focused_field(e, &self.session.get(id)?.form).map(|f| (crate::forms_ui::draft_text(f), f.value.clone())) + }); + let run = if timers { self.session.run_timers(id, now_ms) } else { self.session.show_page(id, page, now_ms) }; + if run.is_empty() { + continue; + } + if run.edited { + if let Some(info) = self.session.get(id).map(|d| d.info.clone()) { + self.views[i].document_changed(&info); + } + if let Some(before) = &before + && let Some(draft) = self.views[i].forms.focus.as_mut() + && let Some(f) = self.session.get(id).and_then(|d| crate::forms_ui::focused_field(draft, &d.form)) + { + crate::forms_ui::refresh_draft(draft, (&before.0, &before.1), (crate::forms_ui::draft_text(f), &f.value)); + } + } else if run.layers { + self.views[i].invalidate_content(); + } else { + for p in &run.pages { + self.views[i].page_changed(*p); + } + } + self.handle_js(id, run.output); + ctx.request_repaint(); + } + if let Some(at) = self.session.next_timer(id) { + let wait = ((at - now_ms) / 1000.0).clamp(0.0, 3600.0); + ctx.request_repaint_after(std::time::Duration::from_secs_f64(wait)); + } + } + /// Run document `id`'s catalog JavaScript for `event` (Will Save before a save, Will Print /// before printing) and show what it said. What it changed is part of what is saved or /// printed. A failing script is reported and the save or print still goes ahead. diff --git a/crates/ui-egui/tests/it/field_triggers.rs b/crates/ui-egui/tests/it/field_triggers.rs index f648b7a445..1144560561 100644 --- a/crates/ui-egui/tests/it/field_triggers.rs +++ b/crates/ui-egui/tests/it/field_triggers.rs @@ -1,6 +1,7 @@ //! A form field widget's pointer scripts in the app (#269, ported from #344): the pointer //! moving onto and off a widget runs its Mouse Enter and Mouse Exit JavaScript, and a click on a -//! check box runs its Mouse Up JavaScript after the click stored the new value (#247). +//! check box runs its Mouse Up JavaScript after the click stored the new value (#247). A push +//! button with only a mouse-down action runs it when pressed (#4751). use egui_kittest::Harness; use pdfcraft_ui_egui::PdfCraftApp; @@ -9,15 +10,16 @@ use pdfcraft_ui_egui::PdfCraftApp; /// `strike` (a check box) shows or hides `note` from its Mouse Up script by its own new value. fn form() -> Vec { let objs = [ - "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R 8 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 7 0 R >> >> >> >>", + "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R 8 0 R 10 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 7 0 R >> >> >> >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>", - "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R 8 0 R] >>", + "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R 8 0 R 10 0 R] >>", "<< /Type /Annot /Subtype /Widget /FT /Tx /T (log) /V () /Rect [20 350 280 370] /P 3 0 R /F 4 >>", "<< /Type /Annot /Subtype /Widget /FT /Tx /T (hot) /V () /Rect [20 250 280 290] /P 3 0 R /F 4 /AA << /E << /S /JavaScript /JS (getField\\('log'\\).value += 'in;';) >> /X << /S /JavaScript /JS (getField\\('log'\\).value += 'out;';) >> >> >>", "<< /Type /Annot /Subtype /Widget /FT /Btn /T (strike) /V /Off /AS /Off /Rect [20 300 50 330] /P 3 0 R /F 4 /MK << /CA (4) >> /AP << /N << /Yes 9 0 R /Off 9 0 R >> >> /A << /S /JavaScript /JS (getField\\('note'\\).display = event.target.value == 'Off' ? display.hidden : display.visible; getField\\('log'\\).value += 'up:' + event.target.value + ';';) >> >>", "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>", "<< /Type /Annot /Subtype /Widget /FT /Tx /T (note) /V (struck) /Rect [60 300 280 330] /P 3 0 R /F 6 >>", "<< /Type /XObject /Subtype /Form /BBox [0 0 30 30] /Length 0 >>\nstream\n\nendstream", + "<< /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (step) /Rect [20 232 120 248] /P 3 0 R /F 4 /MK << /CA (Step) >> /AA << /D << /S /JavaScript /JS (getField\\('log'\\).value += event.name + ';';) >> >> >>", ]; let mut out = b"%PDF-1.7\n".to_vec(); let mut offsets = Vec::new(); @@ -102,3 +104,19 @@ fn a_check_box_mouse_up_script_sees_the_value_its_click_stored() { crate::support::wait_until(&mut h, "unchecked and its Mouse Up ran", |app| field(app, "log").value.join(",") == "up:Yes;up:Off;"); assert!(field(h.state(), "note").widgets[0].hidden, "hidden again"); } + +/// A push button with only a mouse-down action (`/AA /D`, as the LaTeX `animate` package's +/// controls have) takes the press and runs it as Mouse Down, once per click (#4751). +#[test] +fn a_push_button_with_only_a_mouse_down_action_runs_it_on_press() { + let mut h = harness(); + let step = centre(&h, "step"); + h.hover_at(step); + h.run_steps(1); + h.drag_at(step); + h.run_steps(1); + h.drop_at(step); + crate::support::wait_until(&mut h, "Mouse Down ran", |app| field(app, "log").value.join(",") == "Mouse Down;"); + h.run_steps(4); + assert_eq!(log(&h), "Mouse Down;", "the click runs nothing more"); +} diff --git a/crates/ui-egui/tests/it/view.rs b/crates/ui-egui/tests/it/view.rs index c56743d00b..196818e462 100644 --- a/crates/ui-egui/tests/it/view.rs +++ b/crates/ui-egui/tests/it/view.rs @@ -1880,6 +1880,205 @@ fn highlight_fields_leaves_a_groups_read_only_button_alone() { assert_eq!(tinted, 1, "only the button that can be chosen is tinted"); } +/// A push button and a text field, with fields highlighted. +const BUTTON_AND_TEXT: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] >> endobj +4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (frame) /Rect [50 200 250 340] /P 3 0 R >> endobj +5 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (name) /Rect [50 100 250 130] /P 3 0 R >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// A push button holds no value, so Highlight fields leaves it as drawn (an `animate` +/// animation's frames are push buttons); the text field beside it is tinted. +#[test] +fn highlight_fields_leaves_push_buttons_alone() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("button.pdf", None, BUTTON_AND_TEXT.to_vec()).expect("opens"); + app.set_option("left", "closed").unwrap(); + app.set_option("panel", "none").unwrap(); + app.set_option("fields", "on").unwrap(); + app + }); + h.run_steps(6); + let tint = egui::Color32::from_rgba_unmultiplied(0x6E, 0x8E, 0xF5, 48); + let tinted = h.output().shapes.iter().filter(|c| matches!(&c.shape, egui::Shape::Rect(r) if r.fill == tint)).count(); + assert_eq!(tinted, 1, "only the text field is tinted"); +} + +/// A page whose open action starts an interval writing a counter into the console. +const PAGE_TIMER: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /AA << /O << /S /JavaScript /JS (var n = 0; app.setInterval\\('n++', 10\\);) >> >> >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// The viewer runs the open action of the page being read, and its timers as they fall due. +#[test] +fn the_viewer_runs_the_pages_open_action_and_its_timers() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("timer.pdf", None, PAGE_TIMER.to_vec()).expect("opens"); + app + }); + h.run_steps(2); + let id = h.state().views[0].id; + assert!(h.state_mut().session.next_timer(id).is_some(), "the page's open action set the interval"); + std::thread::sleep(std::time::Duration::from_millis(30)); + h.run_steps(4); + let n = h.state_mut().session.run_javascript(id, "n", None).expect("runs").result; + assert!(n.as_deref().and_then(|n| n.parse::().ok()).is_some_and(|n| n >= 1), "the interval ran: {n:?}"); +} + +/// Under a dialog nothing acts on the document: the page's open action waits until it closes. +#[test] +fn page_actions_and_timers_wait_under_a_dialog() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("timer.pdf", None, PAGE_TIMER.to_vec()).expect("opens"); + app.dialog = Some(pdfcraft_ui_egui::Dialog::Shortcuts); + app + }); + h.run_steps(3); + let id = h.state().views[0].id; + assert!(h.state_mut().session.next_timer(id).is_none(), "the open action waits under the dialog"); + h.state_mut().dialog = None; + h.run_steps(2); + assert!(h.state_mut().session.next_timer(id).is_some(), "and runs once it closes"); +} + +/// Three pages: the first's open action starts an interval counting `n`; the second's open +/// action goes on to the third, and its close action stops the interval. +const PAGE_HOP: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /AA << /O << /S /JavaScript /JS (var n = 0; var t = app.setInterval\\('n++', 10\\);) >> >> >> endobj +4 0 obj << /Type /Page /Parent 2 0 R /AA << /O << /S /JavaScript /JS (this.pageNum = 2;) >> /C << /S /JavaScript /JS (app.clearInterval\\(t\\);) >> >> >> endobj +5 0 obj << /Type /Page /Parent 2 0 R >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// A page whose open action goes to another page runs no timer before its close action: the +/// interval that close action stops doesn't run in between. +#[test] +fn timers_wait_for_the_page_a_page_action_goes_to() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("hop.pdf", None, PAGE_HOP.to_vec()).expect("opens"); + app + }); + h.run_steps(2); + let id = h.state().views[0].id; + assert!(h.state_mut().session.next_timer(id).is_some(), "the first page's open action set the interval"); + let count = |h: &mut Harness<'static, PdfCraftApp>| h.state_mut().session.run_javascript(id, "n", None).expect("runs").result; + let before = count(&mut h); + std::thread::sleep(std::time::Duration::from_millis(30)); + h.state_mut().views[0].go_to_page(1); + h.run_steps(4); + assert_eq!(h.state().views[0].current, 2, "the second page's open action went on"); + assert_eq!(h.state_mut().session.next_timer(id), None, "and its close action stopped the interval"); + assert_eq!(count(&mut h), before, "which didn't run in between"); +} + +/// A text field, with a default appearance for its editor. +const FIELD_TIMER: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/Helv 10 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R] >> endobj +4 0 obj << /Type /Annot /Subtype /Widget /FT /Tx /T (clock) /Rect [50 100 250 130] /P 3 0 R /F 4 >> endobj +5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// Press field `name`'s first widget, wherever the document has it. +fn press_field(h: &mut Harness<'static, PdfCraftApp>, name: &str) { + let p = { + let s = h.state(); + let doc = s.session.get(s.views[0].id).unwrap(); + let f = doc.form.iter().find(|f| f.name == name).unwrap(); + pdfcraft_ui_egui::forms_ui::field_screen_rect(&s.views[0], &doc.info, f, 0).expect("on screen").center() + }; + h.hover_at(p); + h.run_steps(1); + h.drag_at(p); + h.run_steps(1); + h.drop_at(p); + h.run_steps(3); +} + +/// A time-out writing the field being edited shows in its editor: leaving the field then keeps the +/// timer's value instead of writing the old one back. +#[test] +fn a_timer_writing_the_focused_field_shows_in_its_editor() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("clock.pdf", None, FIELD_TIMER.to_vec()).expect("opens"); + app.set_option("left", "closed").unwrap(); + app.set_option("zoom", "150").unwrap(); + app + }); + for _ in 0..30 { + h.run_steps(2); + } + press_field(&mut h, "clock"); + assert_eq!(h.state().views[0].forms.focus.as_ref().map(|f| (f.name.as_str(), f.text.as_str())), Some(("clock", ""))); + // Set only now, with the field being edited: the harness's clock runs ahead of the test's. + let id = h.state().views[0].id; + let set = h.state_mut().session.run_javascript(id, "app.setTimeOut('getField(\"clock\").value = \"tick\";', 50);", None).expect("runs"); + assert_eq!(set.error, None); + let value = |h: &Harness<'static, PdfCraftApp>| { + let s = h.state(); + s.session.get(s.views[0].id).unwrap().form.iter().find(|f| f.name == "clock").unwrap().value.clone() + }; + for _ in 0..600 { + if value(&h) == ["tick"] { + break; + } + std::thread::sleep(std::time::Duration::from_millis(10)); + h.run_steps(1); + } + assert_eq!(value(&h), ["tick"], "the time-out wrote the field"); + let focus = h.state().views[0].forms.focus.as_ref().map(|f| (f.name.clone(), f.text.clone())); + assert_eq!(focus, Some(("clock".into(), "tick".into())), "the editor shows the time-out's value"); +} + +/// Two push buttons: "shown" hidden in the document and "gone" not; the page's open action shows +/// the first and hides the second. Each one's mouse-up action says it was pressed. +const SHOWN_BY_SCRIPT: &[u8] = b"%PDF-1.7 +1 0 obj << /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R] >> >> endobj +2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >> endobj +3 0 obj << /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R] /AA << /O << /S /JavaScript /JS (var pressed = ''; getField\\('shown'\\).display = display.visible; getField\\('gone'\\).display = display.hidden;) >> >> >> endobj +4 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (shown) /F 6 /Rect [50 200 250 240] /P 3 0 R /AA << /U << /S /JavaScript /JS (pressed += 'shown';) >> >> >> endobj +5 0 obj << /Type /Annot /Subtype /Widget /FT /Btn /Ff 65536 /T (gone) /F 4 /Rect [50 100 250 140] /P 3 0 R /AA << /U << /S /JavaScript /JS (pressed += 'gone';) >> >> >> endobj +trailer << /Root 1 0 R >> +%%EOF"; + +/// A button the page's open action showed takes presses, and one it hid takes none, whatever +/// their flags in the document say. +#[test] +fn buttons_take_presses_as_the_scripts_show_them() { + let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| { + let mut app = PdfCraftApp::new(); + app.set_option("language", "en").unwrap(); + app.open_bytes("frames.pdf", None, SHOWN_BY_SCRIPT.to_vec()).expect("opens"); + app + }); + h.run_steps(2); + press_field(&mut h, "shown"); + press_field(&mut h, "gone"); + let id = h.state().views[0].id; + let pressed = h.state_mut().session.run_javascript(id, "pressed", None).expect("runs").result; + assert_eq!(pressed.as_deref(), Some("shown")); +} + /// A radio group's read-only button can't be chosen by a click, while the group's other button /// can. #[test] diff --git a/docs/acroform-script-workflows.md b/docs/acroform-script-workflows.md index ae08396dc6..0393b6e932 100644 --- a/docs/acroform-script-workflows.md +++ b/docs/acroform-script-workflows.md @@ -83,8 +83,38 @@ host path cancels unanswered popups and response dialogs; no web-interaction par This work does not add timer execution, PDF annotations/layers to the JS object model, or the remaining document action triggers. +## Page actions, timers and layers + +When the page being read changes (the active tab's current page), the close actions of the +page it was at run, then the new page's open actions: the page's own `/AA /O` and `/C`, and +each annotation's `/PO`, `/PV` (opening) and `/PC`, `/PI` (closing), in `/Annots` order. They +run in the document realm, so the functions and variables they define are there for buttons, +the console and timers. This is how LaTeX `animate` animations start and stop. + +`app.setInterval`, `app.setTimeOut`, `app.clearInterval` and `app.clearTimeOut` keep up to 64 +timers per realm, each at least 10 ms apart. The viewer fires those that are due each frame (at +most 16 per call; an interval that fell behind runs once and then counts from now). A timer +runs unasked, so its alerts and requests go to the console. A fresh realm (after an edit +resets it, Revert, or a full save) has no timers. + +Fields that page actions and timers show, hide or give another icon (`display`, +`buttonSetIcon`) change only how the document is shown, through view-only render overrides +(hayro-interpret patches 105 and 106). They aren't saved, printed or exported, and they don't +mark the document as changed. Buttons and the console see the fields as shown, and a `display` +or icon a button writes into the document takes over from the view's. A value or a reset from +a page action or timer is one undoable edit. + +`this.getOCGs()` lists the document's layers (`name`, `state`, `initState`); setting +`ocg.state` turns a layer as the Layers panel does. + ## Automation +`js_page` reads the document at a page and runs its page actions as the viewer does, and +`js_advance` moves the script clock on by `ms` (up to one hour) and runs the timers that fall +due on the way (at most 6,000 runs per call). Both return the scripts' output, the pages to +draw again, and when the next timer is due; `page_render` draws the fields as the scripts show +them. + The existing `js_run` accepts `answers`, an optional array of up to 32 strings or null values: ```json diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml index 6eb57527d3..babc7c6f3c 100644 --- a/parity/acrobat-features.toml +++ b/parity/acrobat-features.toml @@ -3295,11 +3295,11 @@ title = "Page open/close actions" area = "D" tier = "P2" milestone = "M6" -status = "planned" +status = "partial" commands = [] -tools = [] -evidence = [] -notes = "" +tools = ["js_page"] +evidence = ["crates/forms/src/tests.rs::page_scripts_are_the_pages_own_then_each_annotations_in_order", "crates/engine/src/live_scripts_tests.rs::page_actions_start_timers_that_turn_an_animations_frames_without_changing_the_document", "crates/automation/tests/it/page_actions.rs::js_page_and_js_advance_run_an_animation_that_page_render_draws"] +notes = "JavaScript page actions run in the document's script realm when the page being read changes (the active tab's current page): the page's own open and close actions (/AA /O, /C) and its annotations' page-open, page-visible, page-close and page-invisible actions (/PO, /PV, /PC, /PI), which start and stop LaTeX animate animations. Fields they show, hide or give another icon change only how the document is shown (not saved, printed or exported); values they change are one undoable edit. Not yet: non-JavaScript page actions, actions chained with /Next, and the page-visible/invisible distinction for pages scrolled into view without becoming current." [[feature]] id = "organize.page-templates" @@ -5362,9 +5362,9 @@ tier = "P0" milestone = "M6" status = "partial" commands = ["tools.js_console"] -tools = ["js_run", "js_event"] -evidence = ["crates/js/src/tests.rs::to_source_writes_plain_state_as_a_literal", "crates/js/src/tests.rs::to_source_refuses_cycles_functions_and_oversized_state", "crates/js/src/tests.rs::set_items_and_set_action_change_the_field", "crates/engine/src/document_actions_tests.rs::set_items_and_set_action_are_written_to_the_document", "crates/engine/src/document_actions_tests.rs::pointer_and_focus_triggers_run_the_widget_scripts", "crates/engine/src/document_actions_tests.rs::only_a_click_trigger_may_print", "crates/engine/src/document_actions_tests.rs::a_check_box_mouse_up_reads_the_value_its_click_stored", "crates/ui-egui/tests/it/field_triggers.rs::the_pointer_entering_and_leaving_a_widget_runs_its_scripts", "crates/ui-egui/tests/it/field_triggers.rs::a_check_box_mouse_up_script_sees_the_value_its_click_stored", "crates/automation/tests/it/timesheet_compat.rs::timesheet_keypad_geometry_icons_calculation_and_persistence", "crates/automation/tests/it/timesheet_compat.rs::popup_and_manual_response_resume_the_same_script_and_validate_choices", "crates/js/src/session.rs::document_realm_keeps_keypad_state_and_isolates_documents", "crates/js/src/tests.rs::calculate_scripts_read_fields_and_set_the_value", "crates/engine/src/tests.rs::form_javascript_validates_calculates_and_formats", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/js/src/tests.rs::an_xfa_form_sees_the_xfa_plugin_installed", "crates/js/src/tests.rs::a_plain_form_sees_the_xfa_version_but_not_installed", "crates/engine/src/tests.rs::scripts_in_an_xfa_form_see_the_xfa_plugin_installed", "crates/js/src/tests.rs::scand_allows_separators_between_fields_but_nothing_before_or_after_them", "crates/js/src/tests.rs::app_alert_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_reads_the_object_form", "crates/js/src/tests.rs::app_alert_falls_back_on_bad_icon_and_button_numbers", "crates/js/src/tests.rs::app_alert_titles_are_clipped_and_charged", "crates/ui-egui/tests/it/javascript.rs::every_message_a_script_shows_takes_the_toast_in_turn", "crates/ui-egui/tests/it/forms.rs::a_form_button_opens_its_attached_instructions_in_a_new_tab", "crates/js/src/tests.rs::widget_rect_reads_and_writes_a_four_number_array", "crates/engine/src/tests.rs::javascript_field_rect_moves_first_widget_and_undoes"] -notes = "Document-scoped native Boa realms shared by button, console and field events; synchronous calculateNow in CO order; normal captions/icons; rect and appearance/tooltip writeback; effective page boxes; native explicit-button popup/response/alert continuation and viewer requests, including opening or saving attachments from form buttons. Headless js_run has deterministic ordered answers. A widget's Mouse Enter, Mouse Exit, Mouse Down, Focus and Blur JavaScript run in the app and through js_event (and form_focus for focus), and a check box's or radio button's Mouse Up runs after its click stored the new value (#247); field.setItems, field.setAction and a bounded Object.prototype.toSource (plain data only) are written back to the document (#269, ported from #344). Partial: web prompt UI, timers, annotation/layer APIs, non-normal button faces, widget-indexed Field access, and Will Close / Did Save / Did Print are not implemented. See docs/acroform-script-workflows.md for lifecycle, limits and validation scope." +tools = ["js_run", "js_event", "js_advance"] +evidence = ["crates/js/src/tests.rs::to_source_writes_plain_state_as_a_literal", "crates/js/src/tests.rs::to_source_refuses_cycles_functions_and_oversized_state", "crates/js/src/tests.rs::set_items_and_set_action_change_the_field", "crates/engine/src/document_actions_tests.rs::set_items_and_set_action_are_written_to_the_document", "crates/engine/src/document_actions_tests.rs::pointer_and_focus_triggers_run_the_widget_scripts", "crates/engine/src/document_actions_tests.rs::only_a_click_trigger_may_print", "crates/engine/src/document_actions_tests.rs::a_check_box_mouse_up_reads_the_value_its_click_stored", "crates/ui-egui/tests/it/field_triggers.rs::the_pointer_entering_and_leaving_a_widget_runs_its_scripts", "crates/ui-egui/tests/it/field_triggers.rs::a_check_box_mouse_up_script_sees_the_value_its_click_stored", "crates/automation/tests/it/timesheet_compat.rs::timesheet_keypad_geometry_icons_calculation_and_persistence", "crates/automation/tests/it/timesheet_compat.rs::popup_and_manual_response_resume_the_same_script_and_validate_choices", "crates/js/src/session.rs::document_realm_keeps_keypad_state_and_isolates_documents", "crates/js/src/tests.rs::calculate_scripts_read_fields_and_set_the_value", "crates/engine/src/tests.rs::form_javascript_validates_calculates_and_formats", "crates/automation/tests/it/automation.rs::javascript_through_tools", "crates/js/src/tests.rs::an_xfa_form_sees_the_xfa_plugin_installed", "crates/js/src/tests.rs::a_plain_form_sees_the_xfa_version_but_not_installed", "crates/engine/src/tests.rs::scripts_in_an_xfa_form_see_the_xfa_plugin_installed", "crates/js/src/tests.rs::scand_allows_separators_between_fields_but_nothing_before_or_after_them", "crates/js/src/tests.rs::app_alert_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_reads_the_object_form", "crates/js/src/tests.rs::app_alert_falls_back_on_bad_icon_and_button_numbers", "crates/js/src/tests.rs::app_alert_titles_are_clipped_and_charged", "crates/ui-egui/tests/it/javascript.rs::every_message_a_script_shows_takes_the_toast_in_turn", "crates/ui-egui/tests/it/forms.rs::a_form_button_opens_its_attached_instructions_in_a_new_tab", "crates/js/src/tests.rs::widget_rect_reads_and_writes_a_four_number_array", "crates/engine/src/tests.rs::javascript_field_rect_moves_first_widget_and_undoes", "crates/js/src/session.rs::timers_fire_in_the_document_realm_until_cleared", "crates/engine/src/live_scripts_tests.rs::a_timer_giving_a_button_another_icon_draws_that_icon_in_its_place", "crates/engine/src/live_scripts_tests.rs::get_ocgs_turns_a_layer_in_the_view"] +notes = "Document-scoped native Boa realms shared by button, console and field events; synchronous calculateNow in CO order; normal captions/icons; rect and appearance/tooltip writeback; effective page boxes; native explicit-button popup/response/alert continuation and viewer requests, including opening or saving attachments from form buttons. Headless js_run has deterministic ordered answers. A widget's Mouse Enter, Mouse Exit, Mouse Down, Focus and Blur JavaScript run in the app and through js_event (and form_focus for focus), and a check box's or radio button's Mouse Up runs after its click stored the new value (#247); field.setItems, field.setAction and a bounded Object.prototype.toSource (plain data only) are written back to the document (#269, ported from #344). Partial: web prompt UI, non-normal button faces, widget-indexed Field access, and Will Close / Did Save / Did Print are not implemented; annotation scripting covers only view-only display and appearance changes. See docs/acroform-script-workflows.md for lifecycle, limits and validation scope. app.setInterval/setTimeOut/clearInterval/clearTimeOut (at most 64 timers, 10 ms minimum) fire in the document realm on the viewer clock (js_advance headless); timer alerts and requests go to the console. this.getOCGs() with ocg.name/state/initState turns layers as the Layers panel does." [[feature]] id = "form.js-console" diff --git a/vendor/README.md b/vendor/README.md index cfe8c512ff..028e1490b0 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -55,7 +55,7 @@ Other resource categories retain their existing parent-chain lookup. | Crate | Version | Licence | Patches | Test | |---|---|---|---|---| -| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (61) stroke geometry by ISO 32000-2 §8.5.3.2 and §8.4.3: a degenerate subpath (a single-point closed path, or points that all coincide) is stroked as a dot of the line width with round caps and not at all with butt or projecting square caps (upstream nudged a zero-length `l` so square caps drew a square, and `x y m h` lost its `h` because kurbo's `is_empty` counts only segments); a segment after `h` begins a new subpath with a `MoveTo` to the point `h` reached (§8.5.2.1, Table 58), so `h` then an `l` back to that point is a degenerate subpath of its own; a dash array that is all zero or has a negative or non-finite entry is kept as `[]`, a solid line (`[0 0]` became hundredth-of-a-point dashes, a faint half-covered line); a negative or non-finite line width (`w`, `/LW`) is kept as 0, so no device sees one below zero; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (65) a fill or clip whose path has no width or no height (but not both) marks the device pixels the line touches (ISO 32000-2 §10.7.4: "A zero-width or zero-height rectangle paints a line 1 pixel wide", and a clip is "the set of pixels that would be included by a fill operation"): whole pixels when the line stays within one device row or column, a band one device pixel wide when a rotated or skewed CTM carries it across rows and columns, built per subpath so the gap between two subpaths on one line stays unpainted (`degenerate_fill_area`). A zero-height clip such as `10 10 100 0 re W n` hid everything painted after it, and the fill fell back to a thinnest-line stroke that half-covered two rows on a pixel boundary. A point paints as before, and a path with area, however thin, is filled as the shape it is (the thinnest-line fallback took a side under 1/256 unit as zero, so a thin rectangle that the CTM scales up to whole pixels was drawn as a hairline across its bounding box); (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (71) a lookup table in an indirect string reads: it was read as a stream first, which uses up a reference (ISO 32000-2 §8.6.6.3); (72) an uncoloured pattern's underlying space given as a name or a reference is used: it was skipped, so a CMYK cyan drew red (ISO 32000-2 §8.7.3.3); (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated`; so is an image whose JBIG2 soft mask or `/Mask` one of the decoder's limits refuses, or PdfCraft's bound on the pixels of an image (`image_size_ok`), where a mask the file damaged still leaves its image whole (#6722), and an image drawn on its own, a stencil mask included, that a limit refuses is still a failed image (`ImageXObject::masks_picture`): `decode_raster` leaves the image out when its mask reported `ContentTruncated`, decoded or kept by the cache (91), and a size or count the file damaged can read as past a limit and is taken for one, the safe side; (74) colour spaces nest at most 32 levels, through every way one names another, so a chain of them ends instead of overflowing the stack; an ICC profile's `/Alternate` is read where it's met and isn't kept with the profile, or a page could build a chain past the limit on spaces already read; (75) a soft hyphen (U+00AD) that a CFF substitute for a CID font has no glyph for draws its hyphen, as Annex D.2 reads WinAnsi 0xAD in (30), instead of the CID taken as a glyph index (#5888); (76) a CID of an Arial the PDF doesn't embed (`CIDFontType2`, not of an Adobe character collection; `ArialMT`, `Arial-BoldMT`, `Arial,Bold` and the other two faces, not Arial Narrow, Black or Unicode MS) that no Unicode route draws names, through its `/CIDToGIDMap`, the Arial glyph of the standard Macintosh order (read-fonts' `post::DEFAULT_GLYPH_NAMES`, its first 258 glyphs), and a CFF substitute draws its glyph of that name (.notdef when it has none) instead of the CID taken as its own glyph index (#5889); (77) a standard 14 font drawn with its bundled stand-in (`StandardFontBlob::Cff`) reads each glyph's own advance from its charstring (`CffFontBlob::advance_width`), so a stand-in glyph wider or narrower than the standard metrics is fitted to them as the OpenType stand-ins already were (ISO 32000-2 §9.6.2.2): with no advance the outline was drawn as it is, and the stand-ins' € (WinAnsiEncoding code 128, Annex D Table D.2), 667 to 722 units wide against the metrics' 556 (Helvetica) and 500 (Times), overlapped the next glyph. Symbol and ZapfDingbats (Annex D.5, D.6) are fitted the same way, the check mark `4` a check box draws for its `/MK /CA` caption among them; (78) `TilingPattern::instance` numbers each setting of a tiling pattern (`scn`/`SCN`), its copies keeping the number, and `TilingPattern::is_coloured` reports `/PaintType 1`, so a renderer can draw a coloured cell once for every fill of one setting (hayro patch (30)); (79) text extraction from a symbolic embedded TrueType font with no `/Encoding` (and no `/ToUnicode`) reads a code through the `post` table name of the glyph its `cmap` selects (`EmbeddedKind::symbolic_text`), when that name has a Unicode value by the glyph-name rules of `glyph_name_text`, which are the Adobe Glyph List Specification's (ISO 32000-2 §9.10.2) and the editor's in pdfcraft-fonts (a `.suffix` is dropped, `_` separates the characters of a ligature, `uni` with one or more groups of exactly four uppercase hex digits and `u` with four to six are code points; lowercase digits, other lengths and surrogate or out-of-range values name nothing, so `uni20ac` reads as WinAnsi), instead of reading the code as WinAnsi: FrameMaker files distilled with Distiller 3 number their codes in the Macintosh glyph order, 29 below ASCII, so `Solid` was extracted, edited and exported to Word as `6ROLG` (#3962). Codes with no glyph, or whose glyph has no such name, still read as WinAnsi; glyph selection is unchanged; (80) an `/Indexed` colour space that breaks ISO 32000-2 §8.6.6.3 is drawn as most readers draw it: a lookup table shorter than m × (hival + 1) bytes keeps the entries it holds in full and an index past them is drawn black after conversion, in any base space (zero bytes would be white in DeviceCMYK, Separation and DeviceN, and blue in Lab); a `hival` past 255 is taken as 255, and a real `hival` is truncated toward zero. An image drawn so reports `InterpreterWarning::MalformedIndexedImage`, surfaced as `RenderWarning::MalformedIndexedImage`, and a fill or stroke colour in such a space reports `ColorFallback`. An image whose lookup is missing, not a string or a stream, or a stream that does not decode (or decodes to nothing although it holds data) is not drawn, with the same warning; a colour set in such a space keeps the upstream DeviceGray fallback. Upstream treated all of these as an unreadable space and fell back to DeviceGray, painting the indices near-black, even ones whose entries were present. A `hival` below zero or not a number has no reading: the space falls back as upstream, and an image in it reports the warning. A lookup string given by an indirect reference is read (upstream consumed the reference trying it as a stream and found no table). The warning is taken from the space as built, so no table is read twice: inline images naming the space through a resource read its table once however many there are (`InterpreterCache::indexed_lookup_reads`); (82) a soft mask (or `/Mask` image) larger than its image and more than twice as large on a side as the device pixels its image is drawn at is averaged down to that size, rounded up to a power of two, in `ImageXObject::decoded_soft_mask`, and cached there (`DecodedImageKey::shrunk_to`, with the image's raster keyed by the same rounded size); every size is made from one cached intermediate mask at most 4096 on a side, so the full mask is decoded once however many sizes it is drawn at: it bypassed the decoded-image cache and was decoded, copied and staged at full size each time it was drawn. A 2 × 2 image with a 34,862 × 4,332 mask drawn 40 times on one slide (pdf.js `issue16263.pdf`) took about 3.6 s a draw and minutes a page; it now decodes the mask once and draws the page in about 2.5 s. A mask no larger than twice its drawn size keeps its resolution, which the renderer filters as before; `InterpreterCache::decoded_mask_decodes` counts the masks among the decodes; (83) an embedded TrueType program whose `head.indexToLocFormat` holds neither 0 nor 1 is read with the `loca` format its table's length gives (`with_loca_format_fixed`): the glyph reader took anything but 1 as short offsets, so a font marked 256 had its long offsets misread and drew boxes (pdf.js `issue2537r.pdf`); (84) a Type 0 font of an Adobe character collection (Japan1, GB1, CNS1, Korea1) reads a code its `/ToUnicode` has nothing for, or every code when it has none, through the collection's UCS2 CMap, code to CID to Unicode, embedded or not (ISO 32000-2 §9.10.2; `Type0Font::ucs2`, parsed the first time a code needs it): only fonts that are not embedded took that route, so Japanese and Chinese pages whose fonts are embedded without a `/ToUnicode`, or with one that maps nothing, had no text to select, find or copy; (85) a Type 0 font's `/ToUnicode` written as a CID CMap (`begincidchar` / `begincidrange`, destinations as numbers, as Word writes it) gives each number as the code's Unicode value for text, as glyph lookup (`map_via_unicode`) already read it and as pdftotext and PDFium extract it; ISO 32000-2 §9.10.3 has `beginbfchar` / `beginbfrange` there, and such text extracted nothing (pdf.js `issue9367`); (86) form fields' widgets are drawn after the page's other annotations, each group in `/Annots` order (`interpret_page`), as MuPDF and PDFium draw them; ISO 32000-2 doesn't order the two: a check box listed before a filled square comment that covers it was hidden under the comment (pdf.js `issue13003.pdf`); (87) a Type 3 font keeps each glyph procedure it decoded (`Type3::decoded_proc`), so a glyph shown again isn't inflated again: a font used as a fill pattern drew one glyph about 650,000 times on a page and decoded its procedure for each; a procedure over 64 KiB isn't kept, and the fonts of one `InterpreterCache` keep at most 32 MiB together (`MAX_CACHED_TYPE3_PROCS`), each kept procedure counting its bytes, its name and 64 bytes besides, as fonts live as long as the cache; a procedure holds its bytes within the page's content budget while the glyph is painted, kept or not (`context::hold_content`), so a page skips the same glyphs once the budget is spent, and one decoded with no more than 64 KiB of budget left, which the budget may have cut short, isn't kept; `InterpreterCache::type3_proc_decodes` counts the procedures decoded; (88) the rule of (76) also reads Times New Roman (`TimesNewRomanPSMT`, `TimesNewRomanPS-BoldMT`, `TimesNewRoman,Bold` and the other faces, not Times or Times New Roman MT Std), whose first 258 glyphs follow that order too: in a public form whose embedded Times New Roman subsets keep their glyph indexes, 941 of 942 `/ToUnicode` entries below 258 name that order's character, and its non-embedded `TimesNewRoman,Bold` drew "Salarié(e) du régime général" as "Salari²*g+f w't²i lo g'ì²p²tcn" (#6449); (89) a form XObject already being drawn is not drawn inside itself (`Context::enter_form`, reported as `ContentTruncated`, §8.10.1): a name in its content that reached it again, through its own resources or the page resources a form with its own still falls back on, drew it until the page's nested-paint budget was spent (PDFBOX-5782, 38 s); the forms being drawn are kept per page and thread, so the tiling patterns, Type 3 glyphs, soft masks and groups painted inside a form, which are interpreted in contexts of their own, see it too; (90) a Type 3 font without `/Widths` (or `/FirstChar`/`/LastChar`) advances each glyph by the width its glyph procedure sets with `d0` or `d1` (`Type3::proc_width`, ISO 32000-2 9.6.4) instead of 0, read once per code; a font with `/Widths` is unchanged, a code outside `/FirstChar`..`/LastChar` keeping width 0 (Table 110) (PDFBOX-2943: a misspelt `/Widths` key drew every glyph on one spot), and selecting such a font reports `InterpreterWarning::Type3WidthsMissing` (`Font::type3_widths_missing`, checked in `Context::resolve_font`); (91) the decoded-image cache keeps a failed decode for its key, as the warnings it reported, so a picture or stencil mask that doesn't decode (damaged data, a JPX or JBIG2 stream its decoder refuses) isn't decoded again at every draw, tile and render that shares the cache, and each draw still reports what the decode did (`DecodedImageCache::get_or_insert_with`, `ImageXObject::reporting_to`); a failure counts 128 bytes towards the cache's budget, and one the page's JBIG2 allowance may have caused (73) isn't kept (the hayro-syntax comment on `charge_page_reading` says so), nor one a JBIG2 mask's decoding work refused, while a JBIG2 mask refused by a limit its stream reaches by itself is kept, with the image it takes out (`note_stream_limited`), so a page drawing that image a hundred times decodes it once; (92) the text of a glyph whose name is not in the glyph list reads `uniXXXX` and `uXXXX` to `uXXXXXX` by the Adobe Glyph List Specification (`agl_unicode_from_name`: `uni` and exactly four uppercase hex digits, `u` and four to six, no surrogate, nothing past U+10FFFF), so `uni65`, `u65`, `uni20ac` and `uni+065` read as nothing instead of `e` and `€`; upstream's lenient `unicode_from_name` stays for finding a glyph in a font (TrueType `cmap` lookup, accented standard-font letters), so drawing is unchanged; (93) a CID-keyed CFF font keeps the font dicts it can read: a font dict without a Private DICT (one a subsetter emptied) leaves only the glyphs FDSelect gives it missing, where one such dict dropped the whole font and its text drew with a fallback (ISO 32000-2 §9.9 Table 124, Adobe TN #5176); (94) a font dictionary whose `/Subtype` is missing or the empty name (`/Subtype /`) is read as Type 1, so its `/BaseFont` picks the face (ISO 32000-2 Table 109 requires `/Subtype`; other readers fall back this way): a `/Courier-Bold` was drawn in the Helvetica fallback (PDFBOX-1988). Any other unknown subtype is still refused; (98) a non-embedded font named `SymbolMT`, or `Symbol`/`SymbolMT` with a `,` or `-` style suffix (`Symbol,Bold`, `Symbol-Bold`; `SYMBOL_STYLES`, so `Symbol-Helvetica` stays another font), is the standard Symbol font and draws through its built-in encoding, so a TrueType `SymbolMT` declaring `/WinAnsiEncoding` draws `mu` for code 0x6D, not `m` (ISO 32000-2 §9.6.2.2); (99) the mesh sampler walks each row of a triangle only across the columns where that row's sample points can lie in it, not its whole box (a row with none still costs a visit): thin triangles of the fixed 19 × 19 patch grid lying across the pixel grid (a narrow curved band of tensor patches) have boxes many times their area, and a mesh painted through a path the size of its own box spent the visit budget before its last patches and left them unpainted; (100) a Type 1 or Type 3 font glyph name that only numbers its glyph (`C39`, `MT72`, `G4E`: one to three letters, then decimal or hexadecimal digits) and names the very code it is shown with reads as that code's Latin-1 character (controls excepted; in a Type 3 font, which already reads codes 32-126 by the code, above 126), in a font where every such name names its own code (`numbered_names_name_their_codes`, worked out once per font); a font with any numbered name at another code (`/C1` at 233, review on #3239; `/Differences [1 /C70 …]`) or at a C0 control code (a subset counting its glyphs from code 1, `/Differences [1 /C1 /C2 …]`, where `/C65` is the 65th glyph used) keeps reading them as nothing (#3170); (101) a symbolic TrueType font with no encoding reads a code as Mac OS Roman in text extraction when its Macintosh Roman (1, 0) `cmap` subtable selects the glyph the code draws (ISO 32000-2 §9.6.5.4) and that glyph sits where the standard Macintosh glyph order (`post` version 1.0) puts the code's Mac OS Roman character, for a font whose `post` table names no glyphs, that names no base encoding (an unknown name included) and that isn't Symbol or ZapfDingbats (§9.6.6.1), after `/Differences` and before the WinAnsi last resort; Windows subsets in the same order keep their WinAnsi reading, and glyph selection is unchanged; (102) `OutlineGlyph::vertical_glyph_width`: a vertical-writing Type 0 glyph's width w0 from `/W` or `/DW`, its extent across the column (ISO 32000-2 §9.7.4.3), which `advance_width` (the horizontal advance, 0 in vertical writing) does not give; (81) a reply of type R (a markup annotation with an `/IRT` and an `/RT` other than `/Group`; R is the default, so a missing, unknown or malformed `/RT` reads as R; a widget, link or pop-up with `/IRT` still draws) is not drawn, whatever its appearance or flags: ISO 32000-2 Table 172 says such replies "shall not" be displayed individually but in their comment's thread (files from editors that give every reply a note-icon appearance showed a stack of icons, #5631); a `/RT /Group` member still draws; (103) `InterpreterSettings::view_auto_state` (on by default): the default configuration's auto state for the View event (`/AS` usage applications with `/Event /View` and `/View` in `/Category`) sets each managed group from its `/Usage /View /ViewState` before `ocg_overrides`, ON only if every recommendation is ON (ISO 32000-2 §8.11.4.4); `/Zoom`, `/User` and `/Language` give no recommendation; at most 256 applications, 4096 `/OCGs` entries and 16 categories each are read; off for print renders; (104) an additive colour (`DeviceRGB`, `CalRGB`, `Lab`, three-component ICCBased) painted in an isolated `DeviceCMYK` group has ink tints, the ink that draws back to it through the CMYK profile (`cmyk_inverse::srgb_to_cmyk`: black `0.4 · k₀² + 0.6 · k₀⁸` with `k₀ = 1 − max(r, g, b)`, then cyan, magenta and yellow by at most 12 Newton steps; the last colour is cached per thread), so the group blends in CMYK instead of falling back to RGB | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (61) `stroke_geometry::{degenerate_subpaths_draw_a_round_dot_or_nothing, degenerate_subpaths_leave_the_rest_of_the_path_alone, a_segment_after_h_begins_a_new_subpath, all_zero_dash_arrays_draw_a_solid_line, invalid_dash_arrays_reach_a_device_as_solid, valid_dash_patterns_still_dash, negative_line_widths_reach_a_device_as_zero, negative_line_widths_draw_the_thinnest_line_in_the_stroke_colour}` (pdfcraft-render integration tests); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (65) `it::zero_area_fill_clip` (`crates/render/tests/it/zero_area_fill_clip.rs`); (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (71) `raster::tests::an_indexed_lookup_table_is_read_in_every_legal_form` (pdfcraft-render); (72) `raster::tests::an_uncoloured_pattern_uses_its_underlying_space_in_every_form` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn`, `a_picture_whose_jbig2_mask_a_decoder_limit_refuses_is_not_drawn`, `a_jbig2_image_drawn_on_its_own_that_a_limit_refuses_is_a_failed_image`, `a_limit_refusal_says_nothing_of_the_next_image`, `a_jpx_picture_whose_jbig2_mask_a_limit_refuses_stays_out_at_every_size` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render); (74) `raster::tests::{a_chain_of_colour_spaces_ends, colour_spaces_are_read_to_the_limit_of_their_nesting, a_chain_built_on_spaces_already_read_ends, a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top}` (pdfcraft-render); (75) `raster::tests::a_soft_hyphen_a_substitute_lacks_draws_its_hyphen` (pdfcraft-render); (76) `raster::tests::non_embedded_arial::{an_arial_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (77) `euro_width::the_euro_fits_its_standard_advance`, `euro_width::two_euros_stay_apart`, `euro_width::a_slanted_euro_fits_its_standard_advance`, `symbol_dingbats_width::{symbol_glyphs_keep_their_standard_advances, zapf_dingbats_glyphs_keep_their_standard_advances}` (pdfcraft-render `tests/it`), `dingbat_check_box::a_check_box_caption_check_is_drawn_at_its_standard_advance` (pdfcraft-engine `tests/it`); (78) `raster::tests::{fills_of_one_pattern_setting_share_its_cell, fills_of_interleaved_pattern_settings_each_show_their_own_cell, an_uncoloured_pattern_shows_each_settings_colour}` (pdfcraft-render); (79) `raster::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names`, `pdf::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names` (pdfcraft-fonts, the editor's reading by the same rules) ; (80) `crates/render/tests/it/indexed_lookup.rs` (`cargo test -p pdfcraft-render --test it indexed_lookup`), `raster::tests::indexed_lookup_cache`; (82) `raster::tests::a_soft_mask_far_larger_than_where_it_is_drawn_is_shrunk_once`, `raster::tests::an_averaged_down_soft_mask_follows_its_samples_and_its_drawn_size`, `raster::tests::decoded_images_serve_every_size_they_are_drawn_at` (pdfcraft-render); (83) `raster::tests::truetype_loca_format::a_truetype_font_with_an_out_of_range_loca_format_draws_its_glyphs` (pdfcraft-render); (84) `text::tests::an_embedded_adobe_collection_font_reads_through_its_ucs2_cmap`, `every_adobe_collection_reads_through_its_own_ucs2_cmap` (GB1, CNS1, Korea1, Identity-V, `/H` over CFF) and `a_font_outside_the_adobe_collections_gets_no_text_from_a_ucs2_cmap` (pdfcraft-render); (85) `text::tests::{a_tounicode_written_as_cid_ranges_gives_text, a_tounicode_bf_entry_wins_over_a_cid_entry_for_the_same_code}` (pdfcraft-render); (86) `widgets_above_annotations::a_widget_is_drawn_above_the_comments_on_its_page` (pdfcraft-render `tests/it`); (87) `raster::tests::type3_proc_cache::{a_type3_glyph_shown_again_decodes_its_procedure_once, a_procedure_over_64_kib_is_decoded_for_each_copy, the_procedures_one_cache_keeps_stop_at_32_mib, fonts_with_the_same_glyph_name_keep_their_own_procedures}` (pdfcraft-render); (88) `raster::tests::non_embedded_arial::{a_times_new_roman_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (89) `raster::tests::a_form_that_draws_itself_is_drawn_once`, `raster::tests::a_form_that_reaches_itself_through_a_pattern_or_a_glyph_is_drawn_once` (pdfcraft-render); (90) `raster::tests::type3_proc_widths::{a_type3_font_without_widths_advances_by_its_glyph_procedures, a_code_outside_first_char_to_last_char_still_has_width_zero, widths_the_font_gives_are_kept, a_code_without_a_usable_procedure_width_still_advances_nothing, a_type3_font_without_widths_is_reported}` (pdfcraft-render); (91) `raster::tests::failed_image_decodes::{a_picture_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_that_does_not_decode_is_decoded_once_at_each_size, a_stencil_mask_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_whose_soft_mask_does_not_decode_draws_unmasked_decoded_once, a_picture_that_decodes_is_still_decoded_once_and_drawn_every_time, a_picture_left_out_for_the_pages_allowance_draws_on_the_next_page, a_picture_whose_jbig2_mask_a_limit_refuses_is_decoded_once_however_often_it_is_drawn, a_picture_whose_jbig2_mask_is_refused_for_its_work_is_decoded_at_every_draw}` (pdfcraft-render); (92) `text::tests::agl_unicode_from_name_rule_reads_text` (pdfcraft-render); (93) `cid_cff_unusable_font_dict::{glyphs_of_a_usable_font_dict_draw_beside_an_unusable_one, a_program_with_no_usable_font_dict_draws_no_square}` (pdfcraft-render integration tests); (94) `raster::tests::a_font_without_a_subtype_is_drawn_by_its_base_font` (pdfcraft-render); (98) `symbol_mt_builtin_encoding::{symbol_mt_draws_symbols_through_the_built_in_encoding, a_name_that_only_starts_with_symbol_is_not_symbol, symbol_mt_applies_its_differences, an_embedded_symbol_mt_draws_its_own_program}` (pdfcraft-render integration tests); (99) `raster::tests::thin_patches_of_a_mesh_in_a_tight_path_are_all_painted` (pdfcraft-render); (100) `text::tests::numbered_glyph_names_read_as_their_own_code`, `text::tests::numbered_type3_glyph_names_read_as_their_own_code`, `text::tests::glyph_names_outside_the_glyph_list_still_read_as_text` (pdfcraft-render); (101) `raster::tests::symbolic_truetype_mac_roman_text::{a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman, winansi_codes_of_a_font_in_the_macintosh_order_read_as_before, a_symbolic_truetype_font_without_a_1_0_subtable_reads_as_before, a_1_0_subtable_selecting_other_glyphs_than_the_drawn_ones_is_not_read, a_font_that_names_its_glyphs_is_not_read_by_their_order, a_symbol_or_zapfdingbats_font_in_the_macintosh_order_gets_no_mac_roman_reading, differences_naming_notdef_clear_the_mac_roman_reading_for_its_code, a_base_encoding_name_this_reader_does_not_know_keeps_the_mac_roman_reading_off}` (pdfcraft-render), `pdf::tests::a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman` (pdfcraft-fonts); (102) `text::tests::tracked_vertical_latin_stays_one_line` (pdfcraft-render); (81) `raster::tests::replies_are_not_drawn_but_their_comment_and_group_members_are`, `raster::tests::an_unknown_or_malformed_rt_is_a_reply_and_a_widget_with_irt_still_draws` (hayro-interpret); (103) `raster::tests::the_view_auto_state_sets_a_groups_state_on_screen`, `raster::tests::layer_toggles_and_print_renders_are_not_the_view_auto_state` and `raster::tests::malformed_view_auto_state_is_ignored` (pdfcraft-render); (104) `raster::tests::isolated_cmyk_groups::an_rgb_colour_in_an_isolated_cmyk_group_blends_as_its_ink` and `::an_rgb_colour_with_a_non_finite_component_has_no_tints` (pdfcraft-render) | +| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (61) stroke geometry by ISO 32000-2 §8.5.3.2 and §8.4.3: a degenerate subpath (a single-point closed path, or points that all coincide) is stroked as a dot of the line width with round caps and not at all with butt or projecting square caps (upstream nudged a zero-length `l` so square caps drew a square, and `x y m h` lost its `h` because kurbo's `is_empty` counts only segments); a segment after `h` begins a new subpath with a `MoveTo` to the point `h` reached (§8.5.2.1, Table 58), so `h` then an `l` back to that point is a degenerate subpath of its own; a dash array that is all zero or has a negative or non-finite entry is kept as `[]`, a solid line (`[0 0]` became hundredth-of-a-point dashes, a faint half-covered line); a negative or non-finite line width (`w`, `/LW`) is kept as 0, so no device sees one below zero; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (65) a fill or clip whose path has no width or no height (but not both) marks the device pixels the line touches (ISO 32000-2 §10.7.4: "A zero-width or zero-height rectangle paints a line 1 pixel wide", and a clip is "the set of pixels that would be included by a fill operation"): whole pixels when the line stays within one device row or column, a band one device pixel wide when a rotated or skewed CTM carries it across rows and columns, built per subpath so the gap between two subpaths on one line stays unpainted (`degenerate_fill_area`). A zero-height clip such as `10 10 100 0 re W n` hid everything painted after it, and the fill fell back to a thinnest-line stroke that half-covered two rows on a pixel boundary. A point paints as before, and a path with area, however thin, is filled as the shape it is (the thinnest-line fallback took a side under 1/256 unit as zero, so a thin rectangle that the CTM scales up to whole pixels was drawn as a hairline across its bounding box); (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (71) a lookup table in an indirect string reads: it was read as a stream first, which uses up a reference (ISO 32000-2 §8.6.6.3); (72) an uncoloured pattern's underlying space given as a name or a reference is used: it was skipped, so a CMYK cyan drew red (ISO 32000-2 §8.7.3.3); (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated`; so is an image whose JBIG2 soft mask or `/Mask` one of the decoder's limits refuses, or PdfCraft's bound on the pixels of an image (`image_size_ok`), where a mask the file damaged still leaves its image whole (#6722), and an image drawn on its own, a stencil mask included, that a limit refuses is still a failed image (`ImageXObject::masks_picture`): `decode_raster` leaves the image out when its mask reported `ContentTruncated`, decoded or kept by the cache (91), and a size or count the file damaged can read as past a limit and is taken for one, the safe side; (74) colour spaces nest at most 32 levels, through every way one names another, so a chain of them ends instead of overflowing the stack; an ICC profile's `/Alternate` is read where it's met and isn't kept with the profile, or a page could build a chain past the limit on spaces already read; (75) a soft hyphen (U+00AD) that a CFF substitute for a CID font has no glyph for draws its hyphen, as Annex D.2 reads WinAnsi 0xAD in (30), instead of the CID taken as a glyph index (#5888); (76) a CID of an Arial the PDF doesn't embed (`CIDFontType2`, not of an Adobe character collection; `ArialMT`, `Arial-BoldMT`, `Arial,Bold` and the other two faces, not Arial Narrow, Black or Unicode MS) that no Unicode route draws names, through its `/CIDToGIDMap`, the Arial glyph of the standard Macintosh order (read-fonts' `post::DEFAULT_GLYPH_NAMES`, its first 258 glyphs), and a CFF substitute draws its glyph of that name (.notdef when it has none) instead of the CID taken as its own glyph index (#5889); (77) a standard 14 font drawn with its bundled stand-in (`StandardFontBlob::Cff`) reads each glyph's own advance from its charstring (`CffFontBlob::advance_width`), so a stand-in glyph wider or narrower than the standard metrics is fitted to them as the OpenType stand-ins already were (ISO 32000-2 §9.6.2.2): with no advance the outline was drawn as it is, and the stand-ins' € (WinAnsiEncoding code 128, Annex D Table D.2), 667 to 722 units wide against the metrics' 556 (Helvetica) and 500 (Times), overlapped the next glyph. Symbol and ZapfDingbats (Annex D.5, D.6) are fitted the same way, the check mark `4` a check box draws for its `/MK /CA` caption among them; (78) `TilingPattern::instance` numbers each setting of a tiling pattern (`scn`/`SCN`), its copies keeping the number, and `TilingPattern::is_coloured` reports `/PaintType 1`, so a renderer can draw a coloured cell once for every fill of one setting (hayro patch (30)); (79) text extraction from a symbolic embedded TrueType font with no `/Encoding` (and no `/ToUnicode`) reads a code through the `post` table name of the glyph its `cmap` selects (`EmbeddedKind::symbolic_text`), when that name has a Unicode value by the glyph-name rules of `glyph_name_text`, which are the Adobe Glyph List Specification's (ISO 32000-2 §9.10.2) and the editor's in pdfcraft-fonts (a `.suffix` is dropped, `_` separates the characters of a ligature, `uni` with one or more groups of exactly four uppercase hex digits and `u` with four to six are code points; lowercase digits, other lengths and surrogate or out-of-range values name nothing, so `uni20ac` reads as WinAnsi), instead of reading the code as WinAnsi: FrameMaker files distilled with Distiller 3 number their codes in the Macintosh glyph order, 29 below ASCII, so `Solid` was extracted, edited and exported to Word as `6ROLG` (#3962). Codes with no glyph, or whose glyph has no such name, still read as WinAnsi; glyph selection is unchanged; (80) an `/Indexed` colour space that breaks ISO 32000-2 §8.6.6.3 is drawn as most readers draw it: a lookup table shorter than m × (hival + 1) bytes keeps the entries it holds in full and an index past them is drawn black after conversion, in any base space (zero bytes would be white in DeviceCMYK, Separation and DeviceN, and blue in Lab); a `hival` past 255 is taken as 255, and a real `hival` is truncated toward zero. An image drawn so reports `InterpreterWarning::MalformedIndexedImage`, surfaced as `RenderWarning::MalformedIndexedImage`, and a fill or stroke colour in such a space reports `ColorFallback`. An image whose lookup is missing, not a string or a stream, or a stream that does not decode (or decodes to nothing although it holds data) is not drawn, with the same warning; a colour set in such a space keeps the upstream DeviceGray fallback. Upstream treated all of these as an unreadable space and fell back to DeviceGray, painting the indices near-black, even ones whose entries were present. A `hival` below zero or not a number has no reading: the space falls back as upstream, and an image in it reports the warning. A lookup string given by an indirect reference is read (upstream consumed the reference trying it as a stream and found no table). The warning is taken from the space as built, so no table is read twice: inline images naming the space through a resource read its table once however many there are (`InterpreterCache::indexed_lookup_reads`); (82) a soft mask (or `/Mask` image) larger than its image and more than twice as large on a side as the device pixels its image is drawn at is averaged down to that size, rounded up to a power of two, in `ImageXObject::decoded_soft_mask`, and cached there (`DecodedImageKey::shrunk_to`, with the image's raster keyed by the same rounded size); every size is made from one cached intermediate mask at most 4096 on a side, so the full mask is decoded once however many sizes it is drawn at: it bypassed the decoded-image cache and was decoded, copied and staged at full size each time it was drawn. A 2 × 2 image with a 34,862 × 4,332 mask drawn 40 times on one slide (pdf.js `issue16263.pdf`) took about 3.6 s a draw and minutes a page; it now decodes the mask once and draws the page in about 2.5 s. A mask no larger than twice its drawn size keeps its resolution, which the renderer filters as before; `InterpreterCache::decoded_mask_decodes` counts the masks among the decodes; (83) an embedded TrueType program whose `head.indexToLocFormat` holds neither 0 nor 1 is read with the `loca` format its table's length gives (`with_loca_format_fixed`): the glyph reader took anything but 1 as short offsets, so a font marked 256 had its long offsets misread and drew boxes (pdf.js `issue2537r.pdf`); (84) a Type 0 font of an Adobe character collection (Japan1, GB1, CNS1, Korea1) reads a code its `/ToUnicode` has nothing for, or every code when it has none, through the collection's UCS2 CMap, code to CID to Unicode, embedded or not (ISO 32000-2 §9.10.2; `Type0Font::ucs2`, parsed the first time a code needs it): only fonts that are not embedded took that route, so Japanese and Chinese pages whose fonts are embedded without a `/ToUnicode`, or with one that maps nothing, had no text to select, find or copy; (85) a Type 0 font's `/ToUnicode` written as a CID CMap (`begincidchar` / `begincidrange`, destinations as numbers, as Word writes it) gives each number as the code's Unicode value for text, as glyph lookup (`map_via_unicode`) already read it and as pdftotext and PDFium extract it; ISO 32000-2 §9.10.3 has `beginbfchar` / `beginbfrange` there, and such text extracted nothing (pdf.js `issue9367`); (86) form fields' widgets are drawn after the page's other annotations, each group in `/Annots` order (`interpret_page`), as MuPDF and PDFium draw them; ISO 32000-2 doesn't order the two: a check box listed before a filled square comment that covers it was hidden under the comment (pdf.js `issue13003.pdf`); (87) a Type 3 font keeps each glyph procedure it decoded (`Type3::decoded_proc`), so a glyph shown again isn't inflated again: a font used as a fill pattern drew one glyph about 650,000 times on a page and decoded its procedure for each; a procedure over 64 KiB isn't kept, and the fonts of one `InterpreterCache` keep at most 32 MiB together (`MAX_CACHED_TYPE3_PROCS`), each kept procedure counting its bytes, its name and 64 bytes besides, as fonts live as long as the cache; a procedure holds its bytes within the page's content budget while the glyph is painted, kept or not (`context::hold_content`), so a page skips the same glyphs once the budget is spent, and one decoded with no more than 64 KiB of budget left, which the budget may have cut short, isn't kept; `InterpreterCache::type3_proc_decodes` counts the procedures decoded; (88) the rule of (76) also reads Times New Roman (`TimesNewRomanPSMT`, `TimesNewRomanPS-BoldMT`, `TimesNewRoman,Bold` and the other faces, not Times or Times New Roman MT Std), whose first 258 glyphs follow that order too: in a public form whose embedded Times New Roman subsets keep their glyph indexes, 941 of 942 `/ToUnicode` entries below 258 name that order's character, and its non-embedded `TimesNewRoman,Bold` drew "Salarié(e) du régime général" as "Salari²*g+f w't²i lo g'ì²p²tcn" (#6449); (89) a form XObject already being drawn is not drawn inside itself (`Context::enter_form`, reported as `ContentTruncated`, §8.10.1): a name in its content that reached it again, through its own resources or the page resources a form with its own still falls back on, drew it until the page's nested-paint budget was spent (PDFBOX-5782, 38 s); the forms being drawn are kept per page and thread, so the tiling patterns, Type 3 glyphs, soft masks and groups painted inside a form, which are interpreted in contexts of their own, see it too; (90) a Type 3 font without `/Widths` (or `/FirstChar`/`/LastChar`) advances each glyph by the width its glyph procedure sets with `d0` or `d1` (`Type3::proc_width`, ISO 32000-2 9.6.4) instead of 0, read once per code; a font with `/Widths` is unchanged, a code outside `/FirstChar`..`/LastChar` keeping width 0 (Table 110) (PDFBOX-2943: a misspelt `/Widths` key drew every glyph on one spot), and selecting such a font reports `InterpreterWarning::Type3WidthsMissing` (`Font::type3_widths_missing`, checked in `Context::resolve_font`); (91) the decoded-image cache keeps a failed decode for its key, as the warnings it reported, so a picture or stencil mask that doesn't decode (damaged data, a JPX or JBIG2 stream its decoder refuses) isn't decoded again at every draw, tile and render that shares the cache, and each draw still reports what the decode did (`DecodedImageCache::get_or_insert_with`, `ImageXObject::reporting_to`); a failure counts 128 bytes towards the cache's budget, and one the page's JBIG2 allowance may have caused (73) isn't kept (the hayro-syntax comment on `charge_page_reading` says so), nor one a JBIG2 mask's decoding work refused, while a JBIG2 mask refused by a limit its stream reaches by itself is kept, with the image it takes out (`note_stream_limited`), so a page drawing that image a hundred times decodes it once; (92) the text of a glyph whose name is not in the glyph list reads `uniXXXX` and `uXXXX` to `uXXXXXX` by the Adobe Glyph List Specification (`agl_unicode_from_name`: `uni` and exactly four uppercase hex digits, `u` and four to six, no surrogate, nothing past U+10FFFF), so `uni65`, `u65`, `uni20ac` and `uni+065` read as nothing instead of `e` and `€`; upstream's lenient `unicode_from_name` stays for finding a glyph in a font (TrueType `cmap` lookup, accented standard-font letters), so drawing is unchanged; (93) a CID-keyed CFF font keeps the font dicts it can read: a font dict without a Private DICT (one a subsetter emptied) leaves only the glyphs FDSelect gives it missing, where one such dict dropped the whole font and its text drew with a fallback (ISO 32000-2 §9.9 Table 124, Adobe TN #5176); (94) a font dictionary whose `/Subtype` is missing or the empty name (`/Subtype /`) is read as Type 1, so its `/BaseFont` picks the face (ISO 32000-2 Table 109 requires `/Subtype`; other readers fall back this way): a `/Courier-Bold` was drawn in the Helvetica fallback (PDFBOX-1988). Any other unknown subtype is still refused; (98) a non-embedded font named `SymbolMT`, or `Symbol`/`SymbolMT` with a `,` or `-` style suffix (`Symbol,Bold`, `Symbol-Bold`; `SYMBOL_STYLES`, so `Symbol-Helvetica` stays another font), is the standard Symbol font and draws through its built-in encoding, so a TrueType `SymbolMT` declaring `/WinAnsiEncoding` draws `mu` for code 0x6D, not `m` (ISO 32000-2 §9.6.2.2); (99) the mesh sampler walks each row of a triangle only across the columns where that row's sample points can lie in it, not its whole box (a row with none still costs a visit): thin triangles of the fixed 19 × 19 patch grid lying across the pixel grid (a narrow curved band of tensor patches) have boxes many times their area, and a mesh painted through a path the size of its own box spent the visit budget before its last patches and left them unpainted; (100) a Type 1 or Type 3 font glyph name that only numbers its glyph (`C39`, `MT72`, `G4E`: one to three letters, then decimal or hexadecimal digits) and names the very code it is shown with reads as that code's Latin-1 character (controls excepted; in a Type 3 font, which already reads codes 32-126 by the code, above 126), in a font where every such name names its own code (`numbered_names_name_their_codes`, worked out once per font); a font with any numbered name at another code (`/C1` at 233, review on #3239; `/Differences [1 /C70 …]`) or at a C0 control code (a subset counting its glyphs from code 1, `/Differences [1 /C1 /C2 …]`, where `/C65` is the 65th glyph used) keeps reading them as nothing (#3170); (101) a symbolic TrueType font with no encoding reads a code as Mac OS Roman in text extraction when its Macintosh Roman (1, 0) `cmap` subtable selects the glyph the code draws (ISO 32000-2 §9.6.5.4) and that glyph sits where the standard Macintosh glyph order (`post` version 1.0) puts the code's Mac OS Roman character, for a font whose `post` table names no glyphs, that names no base encoding (an unknown name included) and that isn't Symbol or ZapfDingbats (§9.6.6.1), after `/Differences` and before the WinAnsi last resort; Windows subsets in the same order keep their WinAnsi reading, and glyph selection is unchanged; (102) `OutlineGlyph::vertical_glyph_width`: a vertical-writing Type 0 glyph's width w0 from `/W` or `/DW`, its extent across the column (ISO 32000-2 §9.7.4.3), which `advance_width` (the horizontal advance, 0 in vertical writing) does not give; (81) a reply of type R (a markup annotation with an `/IRT` and an `/RT` other than `/Group`; R is the default, so a missing, unknown or malformed `/RT` reads as R; a widget, link or pop-up with `/IRT` still draws) is not drawn, whatever its appearance or flags: ISO 32000-2 Table 172 says such replies "shall not" be displayed individually but in their comment's thread (files from editors that give every reply a note-icon appearance showed a stack of icons, #5631); a `/RT /Group` member still draws; (103) `InterpreterSettings::view_auto_state` (on by default): the default configuration's auto state for the View event (`/AS` usage applications with `/Event /View` and `/View` in `/Category`) sets each managed group from its `/Usage /View /ViewState` before `ocg_overrides`, ON only if every recommendation is ON (ISO 32000-2 §8.11.4.4); `/Zoom`, `/User` and `/Language` give no recommendation; at most 256 applications, 4096 `/OCGs` entries and 16 categories each are read; off for print renders; (104) an additive colour (`DeviceRGB`, `CalRGB`, `Lab`, three-component ICCBased) painted in an isolated `DeviceCMYK` group has ink tints, the ink that draws back to it through the CMYK profile (`cmyk_inverse::srgb_to_cmyk`: black `0.4 · k₀² + 0.6 · k₀⁸` with `k₀ = 1 − max(r, g, b)`, then cyan, magenta and yellow by at most 12 Newton steps; the last colour is cached per thread), so the group blends in CMYK instead of falling back to RGB; (105) `InterpreterSettings::annotation_overrides`: the viewer shows or hides an annotation by object in place of its Hidden and NoView flags (scripted animation frames), and an `/Annots` entry that isn't a dictionary is skipped instead of ending the list; (106) `InterpreterSettings::appearance_overrides`: the viewer draws an annotation with another form XObject as its normal appearance, in its own `/Rect` (nothing, when the override names an object that isn't a form: a cleared icon) (`buttonSetIcon` from page actions and timers) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (61) `stroke_geometry::{degenerate_subpaths_draw_a_round_dot_or_nothing, degenerate_subpaths_leave_the_rest_of_the_path_alone, a_segment_after_h_begins_a_new_subpath, all_zero_dash_arrays_draw_a_solid_line, invalid_dash_arrays_reach_a_device_as_solid, valid_dash_patterns_still_dash, negative_line_widths_reach_a_device_as_zero, negative_line_widths_draw_the_thinnest_line_in_the_stroke_colour}` (pdfcraft-render integration tests); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (65) `it::zero_area_fill_clip` (`crates/render/tests/it/zero_area_fill_clip.rs`); (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (71) `raster::tests::an_indexed_lookup_table_is_read_in_every_legal_form` (pdfcraft-render); (72) `raster::tests::an_uncoloured_pattern_uses_its_underlying_space_in_every_form` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn`, `a_picture_whose_jbig2_mask_a_decoder_limit_refuses_is_not_drawn`, `a_jbig2_image_drawn_on_its_own_that_a_limit_refuses_is_a_failed_image`, `a_limit_refusal_says_nothing_of_the_next_image`, `a_jpx_picture_whose_jbig2_mask_a_limit_refuses_stays_out_at_every_size` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render); (74) `raster::tests::{a_chain_of_colour_spaces_ends, colour_spaces_are_read_to_the_limit_of_their_nesting, a_chain_built_on_spaces_already_read_ends, a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top}` (pdfcraft-render); (75) `raster::tests::a_soft_hyphen_a_substitute_lacks_draws_its_hyphen` (pdfcraft-render); (76) `raster::tests::non_embedded_arial::{an_arial_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (77) `euro_width::the_euro_fits_its_standard_advance`, `euro_width::two_euros_stay_apart`, `euro_width::a_slanted_euro_fits_its_standard_advance`, `symbol_dingbats_width::{symbol_glyphs_keep_their_standard_advances, zapf_dingbats_glyphs_keep_their_standard_advances}` (pdfcraft-render `tests/it`), `dingbat_check_box::a_check_box_caption_check_is_drawn_at_its_standard_advance` (pdfcraft-engine `tests/it`); (78) `raster::tests::{fills_of_one_pattern_setting_share_its_cell, fills_of_interleaved_pattern_settings_each_show_their_own_cell, an_uncoloured_pattern_shows_each_settings_colour}` (pdfcraft-render); (79) `raster::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names`, `pdf::tests::a_symbolic_truetype_font_without_an_encoding_reads_its_glyph_names` (pdfcraft-fonts, the editor's reading by the same rules) ; (80) `crates/render/tests/it/indexed_lookup.rs` (`cargo test -p pdfcraft-render --test it indexed_lookup`), `raster::tests::indexed_lookup_cache`; (82) `raster::tests::a_soft_mask_far_larger_than_where_it_is_drawn_is_shrunk_once`, `raster::tests::an_averaged_down_soft_mask_follows_its_samples_and_its_drawn_size`, `raster::tests::decoded_images_serve_every_size_they_are_drawn_at` (pdfcraft-render); (83) `raster::tests::truetype_loca_format::a_truetype_font_with_an_out_of_range_loca_format_draws_its_glyphs` (pdfcraft-render); (84) `text::tests::an_embedded_adobe_collection_font_reads_through_its_ucs2_cmap`, `every_adobe_collection_reads_through_its_own_ucs2_cmap` (GB1, CNS1, Korea1, Identity-V, `/H` over CFF) and `a_font_outside_the_adobe_collections_gets_no_text_from_a_ucs2_cmap` (pdfcraft-render); (85) `text::tests::{a_tounicode_written_as_cid_ranges_gives_text, a_tounicode_bf_entry_wins_over_a_cid_entry_for_the_same_code}` (pdfcraft-render); (86) `widgets_above_annotations::a_widget_is_drawn_above_the_comments_on_its_page` (pdfcraft-render `tests/it`); (87) `raster::tests::type3_proc_cache::{a_type3_glyph_shown_again_decodes_its_procedure_once, a_procedure_over_64_kib_is_decoded_for_each_copy, the_procedures_one_cache_keeps_stop_at_32_mib, fonts_with_the_same_glyph_name_keep_their_own_procedures}` (pdfcraft-render); (88) `raster::tests::non_embedded_arial::{a_times_new_roman_the_pdf_does_not_embed_draws_the_glyphs_its_codes_name, codes_of_other_fonts_are_not_read_in_the_macintosh_order}` (pdfcraft-render); (89) `raster::tests::a_form_that_draws_itself_is_drawn_once`, `raster::tests::a_form_that_reaches_itself_through_a_pattern_or_a_glyph_is_drawn_once` (pdfcraft-render); (90) `raster::tests::type3_proc_widths::{a_type3_font_without_widths_advances_by_its_glyph_procedures, a_code_outside_first_char_to_last_char_still_has_width_zero, widths_the_font_gives_are_kept, a_code_without_a_usable_procedure_width_still_advances_nothing, a_type3_font_without_widths_is_reported}` (pdfcraft-render); (91) `raster::tests::failed_image_decodes::{a_picture_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_that_does_not_decode_is_decoded_once_at_each_size, a_stencil_mask_that_does_not_decode_is_decoded_once_however_often_it_is_drawn, a_picture_whose_soft_mask_does_not_decode_draws_unmasked_decoded_once, a_picture_that_decodes_is_still_decoded_once_and_drawn_every_time, a_picture_left_out_for_the_pages_allowance_draws_on_the_next_page, a_picture_whose_jbig2_mask_a_limit_refuses_is_decoded_once_however_often_it_is_drawn, a_picture_whose_jbig2_mask_is_refused_for_its_work_is_decoded_at_every_draw}` (pdfcraft-render); (92) `text::tests::agl_unicode_from_name_rule_reads_text` (pdfcraft-render); (93) `cid_cff_unusable_font_dict::{glyphs_of_a_usable_font_dict_draw_beside_an_unusable_one, a_program_with_no_usable_font_dict_draws_no_square}` (pdfcraft-render integration tests); (94) `raster::tests::a_font_without_a_subtype_is_drawn_by_its_base_font` (pdfcraft-render); (98) `symbol_mt_builtin_encoding::{symbol_mt_draws_symbols_through_the_built_in_encoding, a_name_that_only_starts_with_symbol_is_not_symbol, symbol_mt_applies_its_differences, an_embedded_symbol_mt_draws_its_own_program}` (pdfcraft-render integration tests); (99) `raster::tests::thin_patches_of_a_mesh_in_a_tight_path_are_all_painted` (pdfcraft-render); (100) `text::tests::numbered_glyph_names_read_as_their_own_code`, `text::tests::numbered_type3_glyph_names_read_as_their_own_code`, `text::tests::glyph_names_outside_the_glyph_list_still_read_as_text` (pdfcraft-render); (101) `raster::tests::symbolic_truetype_mac_roman_text::{a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman, winansi_codes_of_a_font_in_the_macintosh_order_read_as_before, a_symbolic_truetype_font_without_a_1_0_subtable_reads_as_before, a_1_0_subtable_selecting_other_glyphs_than_the_drawn_ones_is_not_read, a_font_that_names_its_glyphs_is_not_read_by_their_order, a_symbol_or_zapfdingbats_font_in_the_macintosh_order_gets_no_mac_roman_reading, differences_naming_notdef_clear_the_mac_roman_reading_for_its_code, a_base_encoding_name_this_reader_does_not_know_keeps_the_mac_roman_reading_off}` (pdfcraft-render), `pdf::tests::a_symbolic_truetype_font_in_the_macintosh_order_reads_its_codes_as_mac_roman` (pdfcraft-fonts); (102) `text::tests::tracked_vertical_latin_stays_one_line` (pdfcraft-render); (81) `raster::tests::replies_are_not_drawn_but_their_comment_and_group_members_are`, `raster::tests::an_unknown_or_malformed_rt_is_a_reply_and_a_widget_with_irt_still_draws` (hayro-interpret); (103) `raster::tests::the_view_auto_state_sets_a_groups_state_on_screen`, `raster::tests::layer_toggles_and_print_renders_are_not_the_view_auto_state` and `raster::tests::malformed_view_auto_state_is_ignored` (pdfcraft-render); (104) `raster::tests::isolated_cmyk_groups::an_rgb_colour_in_an_isolated_cmyk_group_blends_as_its_ink` and `::an_rgb_colour_with_a_non_finite_component_has_no_tints` (pdfcraft-render); (105, 106) `raster::tests::annotation_and_appearance_overrides_change_only_the_view` (pdfcraft-render) | | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour (since (21), only inside Type 3 glyphs), planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk image that is interpolated (or, since (21), area-averaged) and whose axes lie along the device's (upright, mirrored or a quarter turn, as on a page under `/Rotate`) is snapped to whole device pixels: shrunk once to its rounded device rectangle (halves round up, so a tile snaps an edge where the whole page does) and drawn 1:1 from the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat, and until #5530 a turned one still did, up to 200 grey levels off the same page drawn upright). An image counts as axis-aligned when the terms the snap drops move its far edges by at most a hundredth of a device pixel (`SNAP_SKEW`), not by a tolerance on the coefficients, which let a slight skew of a very wide image through; and the snapped 1:1 transform is used only when the shrink produced the snapped size, so a failed resize keeps the full transform instead of drawing the source raster at its source size; (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (21) an image that does not request interpolation and is drawn below its resolution, outside a Type 3 glyph, is shrunk by area averaging (`area_shrink`: each device pixel the coverage-weighted mean of the samples it covers, in 16.16 fixed point whose weights sum to exactly one, premultiplied when the image has a mask; a soft mask no larger than the image is first sampled onto the image's grid by `mask_on_image_grid` (nearest-neighbour, or bilinearly when the mask asks for `/Interpolate`, so its edge stays as smooth as an enlarged mask's), so its colour and mask are averaged together instead of the averaged colour of transparent samples showing under a mask layer at the mask's edges) to its snapped device rectangle, instead of nearest-neighbour: `/Interpolate` asks for smoothing only when an image is enlarged (ISO 32000-2 §8.9.5.3), and nearest-neighbour kept one sample in N per axis, so the text of a 300 dpi scan at 100% lost most of its strokes (sampling them again at a fractional offset dropped more). PicScale's `Box` and `Area` filters were not used: shrinking, both average a window four target pixels wide. On a 13-page 300 dpi scan every rendered sample at 96, 120 and 192 dpi is within 1 of the exact area average (it was up to 255 off, 17-23% of samples by more than 1). A snapped image whose shrink failed keeps the full transform, so it is not drawn at its source size. The shrink never enlarges: a side drawn at or above its resolution (an image shrunk across and stretched down, as a 204 × 98 dpi fax is) keeps its samples for the sampler. Each target row averages the whole source rows it covers (contiguous, cheap) and is then shrunk across with taps worked out once per image, which made the shrink about three times faster (a 300 dpi page at 96 dpi: 25 ms, nearest-neighbour 11 ms); working a row at a time (`area_shrink_rows`) keeps its work memory to a few rows. An image with a soft mask, a stencil's ink included, is premultiplied a source row at a time as it is averaged (`area_shrink_premultiplied`), never as a full-resolution RGBA copy: a 10718 × 13701 stencil shown at page size peaked at 1.16 GB with that copy and peaks at 1.03 GB without it, as with nearest-neighbour. A source with a side over `MAX_RESAMPLING_SOURCE_SIDE` (2^20) keeps (10)'s nearest-neighbour shrink, and `area_shrink` refuses it, so its accumulator row and tap table stay a few times one source row (a 2^27 × 2 image of zeros is a tiny file); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1); (28) an image of page-scan size (`SMOOTHED_IMAGE_SIDE`: 512 samples or more on its shorter side) that does not request interpolation is drawn with `ImageQuality::Medium` (bilinear, as interpolated images are) when enlarged by more than 1% on either side (`SMOOTHED_IMAGE_SCALE`: a scan drawn at its resolution can come out a few ulps above 1, and blurred by half a pixel at a half-pixel offset), also when the other side is shrunk (the area shrink leaves that side at 1:1), outside a Type 3 glyph: scans rarely set `/Interpolate`, and drawn nearest-neighbour every sample of a zoomed scan became a block, so its text had staircase edges; icons, QR codes and pixel art keep their hard pixels. Bicubic (`High`) looked the same on a zoomed 300 dpi scan and drew four 1024 px tiles at 400% in 267 ms against 50 ms; (30) a stencil mask painted with a pattern is drawn under a clip of its device rectangle, padded by two pixels: the pattern in an isolated layer, cut to the stencil by a layer holding it composited with `Compose::DestIn` (drawn without a Type 3 glyph's image rules, as the sub-render it replaces was), instead of through a canvas-sized luminance mask rendered for every draw; and a coloured tiling pattern's cell pixmap, repeated or shown once under patch (20), is drawn once per setting of the pattern and cell scale (`Renderer::tiling_cell`, `TilingCells`, eight entries per renderer, keyed by hayro-interpret patch (78)'s `TilingPattern::instance`) instead of once per fill, where every cell was kept until the page was composited. pdf.js issue 8078 paints 73,047 16 × 16 stencils with one pattern whose cell is 3.5 MB at 36 dpi: it ran out of memory after 5 minutes and now renders in about 5 s. For its tests, `offscreen_draws` counts on each thread the tiling cells drawn and the pixels of every pixmap drawn offscreen (all made by `offscreen_pixmap`), so a page's cost is checked by count, not by time; (31) `RenderSettings::max_coverage` keeps the rasterizer to that many coverage values for the page (vello_cpu patch 1), and a page whose paths it left out says so with `InterpreterWarning::ContentTruncated` | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_averages_the_columns_each_pixel_covers`, `raster::tests::non_integer_minification_averages_colour_and_mask_together`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::minified_image_edges_snap_to_whole_pixels`, `raster::tests::a_tile_snaps_half_pixel_image_edges_as_the_whole_page_does` (`cargo test -p hayro`), `raster::tests::a_turned_or_mirrored_minified_image_snaps_to_whole_pixels`, `rotated_image_snap::a_shrunk_image_on_a_turned_page_is_the_upright_render_turned` (`cargo test -p pdfcraft-render --test it`), `renderer::snap_tests::a_skew_that_moves_a_far_edge_is_not_snapped` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (21) `raster::tests::non_interpolated_minification_keeps_thin_strokes`, `raster::tests::non_integer_minification_averages_the_columns_each_pixel_covers`, `raster::tests::non_integer_minification_averages_colour_and_mask_together`, `raster::tests::non_interpolated_minification_does_not_bleed_transparent_colour`, `raster::tests::a_smaller_soft_mask_does_not_bleed_transparent_colour_when_minified`, `raster::tests::an_interpolated_smaller_soft_mask_stays_smooth_when_its_image_is_minified`, `raster::tests::a_shrunk_stencil_mask_keeps_thin_strokes`, `raster::tests::minified_image_edges_snap_to_whole_pixels`, `raster::tests::an_image_shrunk_one_way_and_stretched_the_other_is_still_averaged`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`, `renderer::area_shrink_tests` (`cargo test -p hayro`); (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`); (28) `raster::tests::large_non_interpolated_images_are_smoothed_when_enlarged`, `raster::tests::small_non_interpolated_images_keep_hard_pixels_when_enlarged`, `raster::tests::a_scan_shrunk_one_way_is_smoothed_the_way_it_is_stretched`, `raster::tests::a_scan_drawn_a_rounding_error_above_its_resolution_stays_sharp`; (30) `raster::tests::{a_patterned_stencil_mask_paints_only_where_it_inks, a_patterned_stencil_mask_under_a_soft_mask_is_masked_once, a_patterned_stencil_mask_in_a_type3_glyph_keeps_thin_strokes, many_patterned_stencil_masks_draw_no_page_sized_masks, fills_of_one_pattern_setting_share_its_cell, fills_of_interleaved_pattern_settings_each_show_their_own_cell, an_uncoloured_pattern_shows_each_settings_colour}`; (31) `raster::tests::coverage_budget::a_page_past_its_coverage_leaves_the_rest_out_and_says_so` | | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap and page bitmap, and 2^25 cells per halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one, and a 4-byte value per cell); (2) at most as many symbol pixels per symbol dictionary as the largest page bitmap holds, 2^28 (a fuzzed dictionary decoded for minutes; each symbol now pays for its pixels out of the stream's decoding work and is held in the retained bitmaps, and at the earlier 2^26 the soft mask of a scanned drawing, one dictionary of 7,559 symbols, was refused: #6722), and a refusal by one of the decoder's limits is told apart from damaged data (`DecodeError::is_limit`, `OverflowError::BitmapLimit`); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176); (5) what a page's segments hold for later ones (intermediate regions, pattern and symbol dictionaries with their headers and retained contexts, and Huffman tables) is at most 64 MiB, two square bitmaps of 16,384 a side (`MAX_RETAINED_WORDS`), and a dictionary's new and exported symbols are counted against it as they are made: each was bounded on its own, but a few dozen bytes an intermediate region held 33 MB each, and 8 MiB symbols exported again and again killed the process, so a few kilobytes could exhaust memory; (6) a segment may refer to at most 2^20 symbols, checked before any are collected: references may repeat, and 65,535 of them to one dictionary, in a 78 KB stream, asked for 17 GB; (7) a pattern dictionary keeps at most 16 MiB of shifted copies, which only speed up drawing, and none that wouldn't fit what the page has left (`MAX_SHIFTED_WORDS`); (8) a custom Huffman table has at most 2^16 lines, and a stream with its globals at most 2^20 segments and 2^22 references, checked as they are read: both grew before anything counted them, and PDFs of a kilobyte or so reached 5 GB and more behind nested Flate; (9) a page past the bounds of (1) is refused when the stream is opened: a caller sizes its output from the header before the page bitmap is made, and an Indexed image in a 743-byte PDF asked for 137 GB, which aborts; (10) a stream may ask for at most 2^30 units of decoding work, four of the largest pages, about 6 s to 17 s (`MAX_WORK`): decoding a bitmap costs a pixel each and 4 a row, copying one a word each and 1 a row, and each integer an item reads costs 38, what one takes at worst, so one with no pixels pays too, before it is decoded: each bitmap was bounded, but nothing bounded how many there were, and a 795-byte PDF took 265 s; (11) `Image::decode_within` spends from what a run of images may still do, starting with its page's pixels, and `charge_reading` charges reading a stream and its globals before anything is parsed, so an operation over a document can bound what `MAX_WORK` bounds for one image, and images that fail or decode nothing add up too: a file of thousands of images made to reach that limit took as many times as long; (12) adding to a location, a reference offset, a symbol's corner or a Huffman range line near the end of an `i32`, and negating a decoded integer of 2^31, overflowed: a panic wherever overflow is checked. The refinement context, a text region's corners, the integer decoder and the Huffman table wrap, as a release build did, and `Bitmap::combine` saturates, which comes to the same, as a location that overflows is past the end of any page. What is drawn doesn't change; (13) a bitmap filled with a default pixel of 1 (a page, or an intermediate text or halftone region) had 1s past its width in the last word of each row, and a refinement, which reads its reference a word at a time, read them as pixels where the standard has 0 (6.3.5.2): refining such a reference not a multiple of 32 wide decoded to other pixels than were coded, release builds too. `Bitmap::clear_padding` clears those bits when a bitmap is filled with 1s, as cutting symbols and patterns from a collective bitmap already did. Ghostscript reads the test's page and text streams as they decode now; (14) a region's location is unsigned (5.4.4), so one past `i32::MAX` is off the page, where the decoder took it for a signed one: a region there was drawn back onto the page from the left or the top (at 0xFFFFFFFC, four pixels left of it), and a refinement there, of the page or of a region at the same place (7.4.7.5), was refused as an overflow, and the page with it. `Bitmap::combine_region` keeps such a location past the page. A refinement of another region refines it where it is, as Table 35 has it (GRREFERENCEDX and GRREFERENCEDY 0), whatever the two locations say; a refinement of the page, see (16); (15) a refinement whose reference is offset right of it (GRREFERENCEDX above 0, which a refined text instance has from a wider bitmap, Table 12, and a refined symbol from an RDX above 0, Table 18) read the reference's first 32 columns as 0: `RefinementContextGatherer::maybe_reload_buffers` emptied its buffers left of the reference and didn't load them again at its first column. Such a refinement decoded to other pixels than were coded, or failed and lost the page. Left of the reference the buffers now keep the words of its first column each row starts with; with an offset of 0 or less nothing changes; (16) a refinement of the page refines "the current contents of the page buffer, restricted to the area of the page buffer specified by this segment's region segment information field" (7.4.7.4), at an offset of 0 (Table 35): `Bitmap::area` copies that area a word at a time, 0 off the page and past its width whatever the padding of its rows holds, and every refinement region reads its reference at offset 0. The page around the area was read too, so a refinement of the page decoded to other pixels than were coded, and one wider or taller than the page was refused. And `RefinementContextGatherer::start_row` loads the reference's words a column left of where a row starts in it, as the reload would, not from column 0: with the reference offset 32 or more left of the refinement (GRREFERENCEDX below −31, as a refined text instance has from a narrower bitmap or an RDX below −31, and a refined symbol from such an RDX), each row's first context read 0 for the reference column it starts at, and from 33 left for the one before it too, and the refinement decoded to other pixels or failed; (17) `Image::new_embedded` reads data that starts with a JBIG2 file header (the ID string `0x97 4A 42 32 0D 0A 1A 0A`, flags and an optional page count, D.4) past it, in the organization the header declares (sequential or random access), its segments counted together with the globals' as (8) has them: ISO 32000-1 7.4.7 has `JBIG2Decode` data in the embedded organization (D.3), but some producers write the file header too, and Acrobat and PDFBox draw such streams. The header's ID string was read as a segment header and the image failed (`unknown or reserved segment type`), so the page drew white | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`, `raster::tests::jbig2_halftone_grids_past_their_bound_are_refused`; (2) the nightly `cargo xtask fuzz` finding (about a second at the earlier 2^26 bound; not run at 2^28), `raster::tests::a_symbol_dictionary_holds_as_many_pixels_as_a_page`, and for `is_limit` and `BitmapLimit` `error::pdfcraft_limit_tests`, `bitmap::pdfcraft_limit_tests` and `gray_scale::pdfcraft_limit_tests` (hayro-jbig2); (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`); (5) `raster::tests::jbig2_regions_held_past_a_pages_bound_are_refused`, `jbig2_symbols_without_pixels_count_towards_a_pages_bound`, `jbig2_retained_contexts_count_towards_a_pages_bound`, `jbig2_huffman_tables_count_towards_a_pages_bound`, `jbig2_new_symbols_count_towards_a_pages_bound`, `jbig2_new_symbols_are_held_to_what_a_page_has_left`, `jbig2_pattern_dictionaries_count_towards_a_pages_bound`, and in the crate (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) `decode::symbol::tests::exported_symbols_are_counted_before_they_are_copied`, `tests::the_room_left_shrinks_as_segments_are_stored`; (6) `raster::tests::jbig2_segments_referring_to_too_many_symbols_are_refused`; (7) `raster::tests::jbig2_pattern_dictionaries_too_large_to_shift_still_draw`, `jbig2_shifted_patterns_never_refuse_an_image`; (8) `raster::tests::jbig2_huffman_tables_of_too_many_lines_are_refused`, `jbig2_streams_of_too_many_segments_are_refused`, `jbig2_streams_of_too_many_references_are_refused`, and in the crate `tests::the_segments_of_a_stream_and_its_globals_count_together`; (9) `raster::tests::jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them`, `tests::a_page_past_the_bounds_is_refused_when_opened`; (10) `raster::tests::jbig2_decoding_work_is_counted_item_by_item`; (11) `jbig2::decode::tests::a_run_of_images_spends_its_allowance_down_to_the_step` (pdfcraft-filters); (12) `raster::tests::jbig2_placements_at_the_end_of_an_i32_draw_nothing`; (13) `jbig2::decode::tests::a_refinement_reads_nothing_past_its_references_width` (pdfcraft-filters), and in the crate `tests::a_bitmap_of_1s_has_nothing_past_its_width`; (14) `jbig2::decode::tests::a_region_located_past_i32_max_is_off_the_page` (pdfcraft-filters), and in the crate `tests::a_region_located_past_i32_max_is_off_the_page` and `tests::a_refinement_of_a_region_decodes_the_same_wherever_they_are`; (15) `jbig2::decode::tests::a_refinement_reads_a_reference_right_of_it_from_its_first_column` (pdfcraft-filters), and in the crate `tests::a_refinement_reads_a_reference_right_of_it_from_its_first_column`; (16) `jbig2::decode::tests::a_refinement_refines_the_page_in_its_area_and_any_reference_where_it_is` (pdfcraft-filters), and in the crate `tests::a_refinement_refines_the_page_in_its_area_and_any_reference_where_it_is` and `tests::a_page_area_is_the_page_inside_it_and_0_outside` ; (17) `jbig2::decode::tests::a_stream_with_a_jbig2_file_header_decodes_past_it`, `jbig2::decode::tests::a_truncated_jbig2_file_header_is_an_error`, `jbig2::decode::tests::segments_after_a_jbig2_file_header_count_with_the_globals` (pdfcraft-filters), `raster::tests::a_jbig2_image_with_a_file_header_draws` (pdfcraft-render) | | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365); (7) object parsing builds at most 4,194,304 objects (every array element and dictionary value at any depth, `parser::MAX_OBJECT_NODES`, the same cap as `pdfcraft_cos`) per top-level object, an object stream reads at most 1,000,000 index entries (cos's `/N` clamp), and one load builds at most 8,388,608 objects from all of its object streams together, shared across rayon workers (a decoded stream of `0 0 0 ...` inside the 256 MiB decompression limit built ~120M objects, 10+ GB, and aborted). A lookup parses only the member it wants, so it isn't skipped behind a large member, and a load parses only the members it would add: none its cross-reference table places in another stream (stale copies) and none already loaded as an ordinary object or from an earlier stream. Members the table doesn't list at all are still parsed (a rebuilt table lists no compressed objects) and share the budget, so they can spend it before listed members of the same stream; a load expands its object streams one at a time in object-number order, a stream's members in parallel only when the budget holds all of them and otherwise in index order, so a spent budget skips the same members on every load (#5083) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog`; (7) `inspect::tests::{object_stream_members_over_the_node_cap_are_skipped, object_stream_index_entries_past_the_clamp_are_ignored, object_streams_of_one_load_share_their_node_budget, object_streams_loaded_in_parallel_share_their_node_budget, a_malformed_object_stream_member_refunds_its_reservation, a_tight_budget_builds_object_stream_members_in_index_order, a_lookup_in_an_object_stream_parses_only_the_member_it_wants}` (pdfcraft-render; `NodeBudget` and `ObjectStream::new_within` are public so these can use a small budget) | diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs index 8beee094c5..0e341b124e 100644 --- a/vendor/hayro-interpret/src/interpret/mod.rs +++ b/vendor/hayro-interpret/src/interpret/mod.rs @@ -117,6 +117,16 @@ pub struct InterpreterSettings { /// `ocg_overrides`. On by default: that is the state for viewing. Off for output made for /// printing, which the View event is not. pub view_auto_state: bool, + /// PdfCraft patch (105): viewer overrides for annotations (object number, generation, shown), + /// applied in place of their Hidden and NoView flags: what a document's scripts show and + /// hide while it is read (frames of an animation), without changing the document. + pub annotation_overrides: Arc>, + /// PdfCraft patch (106): annotations the viewer draws with a form XObject as their normal + /// appearance (object number and generation of the annotation, then of the form), in their + /// own `/Rect`: a push button a document's script gave another icon (`buttonSetIcon`) while + /// it is read, without changing the document. An override naming an object that isn't a form + /// draws nothing (the script cleared the icon). + pub appearance_overrides: Arc>, /// PdfCraft patch: once this is `true`, interpretation stops before the next content /// operator. What was drawn is then incomplete, so only set it when the output will be /// thrown away (a viewer's render whose result nobody can receive any more). @@ -151,6 +161,8 @@ impl Default for InterpreterSettings { hide_comments: false, ocg_overrides: Arc::new(Vec::new()), view_auto_state: true, + annotation_overrides: Arc::new(Vec::new()), + appearance_overrides: Arc::new(Vec::new()), cancelled: None, preview: false, jbig2_work: hayro_syntax::MAX_PAGE_JBIG2_WORK, @@ -222,8 +234,17 @@ pub fn interpret_page<'a>( // annotations, each group in `/Annots` order, as other readers draw them: a filled // comment listed after a check box covered the box. ISO 32000-2 doesn't order the two. // Two passes over the array, so nothing is held for every entry of a long one. + // PdfCraft patch (105): each annotation with its object, so the viewer can show or hide + // it by its object (`annotation_overrides`). An entry that isn't a dictionary is + // skipped; it no longer ends the list. + let xref = context.xref; for widgets in [false, true] { - for annot in annot_arr.iter::>() { + let annots = annot_arr.raw_iter().filter_map(|item| match item { + hayro_syntax::object::MaybeRef::Ref(r) => xref.get::>(r.into()).map(|d| (d, Some(r))), + hayro_syntax::object::MaybeRef::NotRef(Object::Dict(d)) => Some((d, None)), + hayro_syntax::object::MaybeRef::NotRef(_) => None, + }); + for (annot, obj) in annots { if (annot.get::>(SUBTYPE).as_deref() == Some(b"Widget")) != widgets { continue; } @@ -231,7 +252,16 @@ pub fn interpret_page<'a>( // Annotation should be hidden (Hidden = bit 2, NoView = bit 6). // PdfCraft patch: NoView was not honoured upstream. - if flags & (2 | 32) != 0 { + // PdfCraft patch (105): the viewer's override, when it has one, decides instead. + let overridden = obj.and_then(|r| { + context + .settings + .annotation_overrides + .iter() + .find(|(num, generation, _)| *num == r.obj_number && *generation == r.gen_number) + .map(|(_, _, shown)| !*shown) + }); + if overridden.unwrap_or(flags & (2 | 32) != 0) { continue; } // PdfCraft patch (56): Invisible (bit 1) hides an annotation of a type that isn't one @@ -265,13 +295,27 @@ pub fn interpret_page<'a>( // PdfCraft patch: `/N` may be a stream or a dictionary of appearance states selected // by `/AS` (checkboxes, radio buttons, …). Upstream only handled the stream form. - let normal = annot.get::>(AP).and_then(|ap| { - ap.get::>(N).or_else(|| { - let states = ap.get::>(N)?; - let state = annot.get::>(AS)?; - states.get::>(state.as_ref()) - }) + // PdfCraft patch (106): the viewer may draw it with another form instead + // (`appearance_overrides`). + // An override naming an object that isn't a form draws nothing: a script cleared the + // button's icon. + let face = obj.and_then(|r| { + context + .settings + .appearance_overrides + .iter() + .find(|(num, generation, _, _)| *num == r.obj_number && *generation == r.gen_number) }); + let normal = match face { + Some(&(_, _, num, generation)) => xref.get::>(hayro_syntax::object::ObjectIdentifier::new(num, generation)), + None => annot.get::>(AP).and_then(|ap| { + ap.get::>(N).or_else(|| { + let states = ap.get::>(N)?; + let state = annot.get::>(AS)?; + states.get::>(state.as_ref()) + }) + }), + }; if let Some(apx) = normal.and_then(|o| FormXObject::new(&o)) { let Some(rect) = annot.get::(RECT) else { continue;