Embedpdf/feature/thread confined by bobsingor · Pull Request #29 · embedpdf/runtime

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor · 2026-06-15T08:44:52Z

No description provided.

Introduce optional per-thread PDFium globals to support a thread-confined runtime for server worker pools. Adds core/fxcrt/epdf_tls.h (EPDF_TLS) and converts numerous process-global singletons to be thread-local when embedpdf_thread_local_globals is enabled. Exposes EPDF_InitThread/EPDF_ShutdownThread as lifecycle entry points, makes localtime usage thread-safe, and adjusts RNG/errno/timer/render/color/font/module globals accordingly. Adds a thread-soak test harness (testing/tools:epdf_thread_soak), build/test scripts (scripts/embedpdf-runtime/*), GN flag (embedpdf_thread_local_globals) and a GitHub Actions workflow (pdfium-tsan-thread-soak.yml) to run the TSAN-backed soak. Default behavior remains unchanged (flag off) so builds are byte-for-byte compatible unless explicitly enabled.

Mark the parser's static recursion depth variable as thread-local (EPDF_TLS) in both the header and source. Adds an #include for core/fxcrt/epdf_tls.h. This ensures each thread has its own s_CurrentRecursionDepth to avoid cross-thread interference when parsing concurrently; kParserMaxRecursionDepth is unchanged.

Add two PDF fixtures under testing/resources/pixel to exercise ICC profile parsing: icc_profile_bad_component.pdf embeds an ICCBased color space with N=1 (one component instead of the expected 3) but still triggers DetectSRGB(); icc_profile_bad_value.pdf contains a profile/value (0x80000000) that overflows when multiplied by 255. These files are used by pixel tests to validate robustness and error handling of ICC profile processing.

Add platform-specific defines for gmtime variants in BUILD.gn (HAVE_GMTIME_R on Linux/ChromeOS/Android/mac/iOS, HAVE_GMTIME_S on Windows). Update cmsplugin.c::_cmsGetTime to guard against gmtime returning NULL: copy the result into ptr_time only if non-NULL and return a boolean success value, avoiding a NULL dereference inside the critical section.

Add clarifying comments about concurrency and ThreadSanitizer findings in two lcms sources. In cmsplugin.c note that gmtime()'s shared static result is copied while holding the LCMS mutex to avoid TSan-reported races when creating ICC profiles concurrently. In cmswtpnt.c document that the D50 XYZ constant is safe for concurrent readers and that the xyY value is computed in a thread-confined way to avoid writing to a shared static on each call.

Introduce new EmbedPDF extension APIs to operate on pages by PDF object number. LoadPageByValidatedIndex gains a `normalize` flag to override page rotation to 0 for normalized coordinates, and EPDFDoc_LoadPageByObjectNumberNormalized is exported. Add EPDFDoc_DeletePageByObjectNumber to delete the first visible page matching an indirect object number (with XFA-backed documents rejected), and EPDFDoc_SetPageRotationByObjectNumber to update a page's /Rotate value (validates rotate in 0..3). Update public/fpdfview.h with API docs, add tests and test registrations in fpdf_view_embeddertest.cpp and fpdf_view_c_api_test.c, and include fpdf_edit.h where needed.

bobsingor added 7 commits June 2, 2026 23:24

Update cmswtpnt.c
2520dc1