Embedpdf/feature/forms

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }

BUILD.gn

@@ -198,6 +198,15 @@ source_set("pdfium_public_headers_impl") {
  sources = [
  "public/cpp/fpdf_deleters.h",
  "public/cpp/fpdf_scopers.h",
+ # EmbedPDF: detached, read-only PDF action models.
+ "public/epdf_action.h",
+ # EmbedPDF: public runtime font registration API used by page fallback
+ # rendering and annotation authoring.
+ "public/epdf_font.h",
+ # EmbedPDF: session-free AcroForm model, write transactions, FDF/XFDF.
+ "public/epdf_form.h",
+ # EmbedPDF: generic namespace-scoped document/page /PieceInfo metadata.
+ "public/epdf_pieceinfo.h",
  "public/epdf_redact.h",
  "public/fpdf_annot.h",
  "public/fpdf_attachment.h",

core/fpdfapi/edit/cpdf_pagecontentgenerator.cpp

@@ -379,8 +379,42 @@ void CPDF_PageContentGenerator::GenerateContent() {
  return;
  }
 
+ // EmbedPDF: did this pass rewrite EVERY existing content stream? Computed
+ // before the move — an append-only pass (a lone kNoContentStream bucket)
+ // leaves the existing streams' ops out of `page_objects_`' bookkeeping, so
+ // resource pruning must not run (see UpdateResourcesDict).
+ const int32_t existing_streams = CountExistingContentStreams();
+ bool regenerated_all_streams = true;
+ for (int32_t i = 0; i < existing_streams; ++i) {
+ if (!pdfium::Contains(new_stream_data, i)) {
+ regenerated_all_streams = false;
+ break;
+ }
+ }
+
  UpdateContentStreams(std::move(new_stream_data));
- UpdateResourcesDict();
+ UpdateResourcesDict(regenerated_all_streams);
+}
+
+int32_t CPDF_PageContentGenerator::CountExistingContentStreams() {
+ if (obj_holder_->GetMutableFormStream()) {
+ return 1;
+ }
+ RetainPtr<const CPDF_Object> contents =
+ obj_holder_->GetDict()->GetObjectFor(pdfium::page_object::kContents);
+ if (!contents) {
+ return 0;
+ }
+ // Resolve indirection: /Contents is commonly an indirect reference to a
+ // stream or to an array of streams.
+ RetainPtr<const CPDF_Object> direct = contents->GetDirect();
+ if (!direct) {
+ return 0;
+ }
+ if (const CPDF_Array* arr = direct->AsArray()) {
+ return pdfium::checked_cast<int32_t>(arr->size());
+ }
+ return direct->IsStream() ? 1 : 0;
 }
 
 std::map<int32_t, fxcrt::ostringstream>
@@ -540,7 +574,7 @@ void CPDF_PageContentGenerator::UpdateContentStreams(
  }
 }
 
-void CPDF_PageContentGenerator::UpdateResourcesDict() {
+void CPDF_PageContentGenerator::UpdateResourcesDict(bool regenerated_all_streams) {
  RetainPtr<CPDF_Dictionary> resources = obj_holder_->GetMutableResources();
  if (!resources) {
  return;
@@ -560,6 +594,17 @@ void CPDF_PageContentGenerator::UpdateResourcesDict() {
  // shared. Checked for that and clone those as well.
  CloneResourcesDictEntries(document_, resources);
 
+ // EmbedPDF: pruning is only sound when THIS pass rewrote every content
+ // stream. `page_objects_` / `seen_resources` describe the SERIALIZED
+ // output; an untouched stream's raw ops can reference resources no page
+ // object records — e.g. a page-level `/C1 cs` prolog whose colorspace is
+ // inherited by a bare-`scn` Form XObject. Pruning after an append-only
+ // pass orphans those references (the classic symptom: the whole page
+ // collapses to grayscale after applying a redaction that touched nothing).
+ if (!regenerated_all_streams) {
+ return;
+ }
+
  ResourcesMap seen_resources;
  for (auto& page_object : page_objects_) {
  if (!page_object->IsActive()) {

core/fpdfapi/edit/cpdf_pagecontentgenerator.h

@@ -81,7 +81,14 @@ class CPDF_PageContentGenerator {
 
  // Updates the resource dictionary for `obj_holder_` to account for all the
  // changes.
- void UpdateResourcesDict();
+ // EmbedPDF: `regenerated_all_streams` reports whether THIS pass rewrote
+ // every existing content stream. Resource pruning is only sound then —
+ // see the guard in the implementation.
+ void UpdateResourcesDict(bool regenerated_all_streams);
+
+ // EmbedPDF: the holder's current content-stream count (form = its single
+ // stream; page = resolved /Contents array size, or 1 for a lone stream).
+ int32_t CountExistingContentStreams();
 
  UnownedPtr<CPDF_PageObjectHolder> const obj_holder_;
  UnownedPtr<CPDF_Document> const document_;

core/fpdfapi/font/cpdf_font.cpp

@@ -30,8 +30,10 @@
 #include "core/fxcrt/check.h"
 #include "core/fxcrt/fx_codepage.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/stl_util.h"
 #include "core/fxge/cfx_fontmapper.h"
+#include "core/fxge/cfx_fontregistry.h"
 #include "core/fxge/cfx_substfont.h"
 #include "core/fxge/fx_font.h"
 #include "core/fxge/fx_fontencoding.h"
@@ -395,14 +397,38 @@ const char* CPDF_Font::GetAdobeCharName(
 }
 
 uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) {
+ // EmbedPDF: prefer fonts registered through EPDFFont_* before falling back to
+ // PDFium's hard-coded Arial substitute. This lets broken PDFs with missing
+ // glyph coverage render through the same runtime fallback registry used by
+ // annotation authoring, without repairing or mutating the source PDF.
+ WideString str = UnicodeFromCharCode(charcode);
+ uint32_t unicode = !str.IsEmpty() ? str[0] : charcode;
+ for (size_t i = 0; i < font_fallbacks_.size(); ++i) {
+ if (font_fallbacks_[i]->GetFace() &&
+ font_fallbacks_[i]->GetFace()->GetCharIndex(unicode) != 0) {
+ return pdfium::checked_cast<uint32_t>(i);
+ }
+ }
+
+ FX_SAFE_INT32 safe_weight = stem_v_;
+ safe_weight *= 5;
+ const int weight = safe_weight.ValueOrDefault(pdfium::kFontWeightNormal);
+ if (auto font_id = CFX_FontRegistry::FindFallbackFont(unicode, weight,
+ italic_angle_ != 0)) {
+ std::unique_ptr<CFX_Font> fallback_font =
+ CFX_FontRegistry::CreateFont(*font_id);
+ if (fallback_font) {
+ font_fallbacks_.push_back(std::move(fallback_font));
+ return pdfium::checked_cast<uint32_t>(font_fallbacks_.size() - 1);
+ }
+ }
+
  if (font_fallbacks_.empty()) {
- font_fallbacks_.push_back(std::make_unique<CFX_Font>());
- FX_SAFE_INT32 safe_weight = stem_v_;
- safe_weight *= 5;
- font_fallbacks_[0]->LoadSubst(
- "Arial", IsTrueTypeFont(), flags_,
- safe_weight.ValueOrDefault(pdfium::kFontWeightNormal), italic_angle_,
- FX_CodePage::kDefANSI, IsVertWriting());
+ auto fallback_font = std::make_unique<CFX_Font>();
+ fallback_font->LoadSubst("Arial", IsTrueTypeFont(), flags_, weight,
+ italic_angle_, FX_CodePage::kDefANSI,
+ IsVertWriting());
+ font_fallbacks_.push_back(std::move(fallback_font));
  }
  return 0;
 }

core/fpdfapi/page/cpdf_annotcontext.h

@@ -35,6 +35,10 @@ class CPDF_AnnotContext {
  // Never nullptr.
  IPDF_Page* GetPage() const { return page_; }
 
+ // Index at the time the annotation handle was created, or -1 when the
+ // handle was not created from a page annotation lookup.
+ int GetAnnotIndex() const { return annot_index_; }
+
  private:
  void EnsureMutableBackingForAnnotDict();
 

core/fpdfdoc/BUILD.gn

@@ -13,6 +13,12 @@ source_set("fpdfdoc") {
  "cpdf_action.h",
  "cpdf_annot.cpp",
  "cpdf_annot.h",
+ # EmbedPDF: registered FreeText annotation fonts and per-layer subset
+ # embedding. Keep these fork-owned files when rebasing from upstream PDFium.
+ "cpdf_annotfontmap.cpp",
+ "cpdf_annotfontmap.h",
+ "cpdf_annotfontsubset.cpp",
+ "cpdf_annotfontsubset.h",
  "cpdf_annotlist.cpp",
  "cpdf_annotlist.h",
  "cpdf_apsettings.cpp",
@@ -92,6 +98,9 @@ source_set("fpdfdoc") {
  "../fpdfapi/render",
  "../fxcrt",
  "../fxge",
+ # EmbedPDF: CPDF_AnnotFontSubset uses HarfBuzz subsetting to embed only the
+ # glyphs used by each saved annotation/layer.
+ "../../third_party/harfbuzz-ng",
  ]
  visibility = [ "../../*" ]
 }

core/fpdfdoc/cpdf_annot_unittest.cpp

@@ -189,5 +189,7 @@ TEST_F(CPDFAnnotWithPageModuleTest,
  EXPECT_FALSE(annot_dict->KeyExist(pdfium::annotation::kAP));
  EXPECT_EQ(CFX_FloatRect(0, 0, 10, 10),
  annot_dict->GetRectFor(pdfium::annotation::kRect));
- EXPECT_EQ(CFX_FloatRect(-2, -2, 12, 12), annot.GetRect());
+ // The drawing rect is the minimal union of the authored /Rect and the
+ // stroked ink bounds: points 1..9 inflated by half the width (2).
+ EXPECT_EQ(CFX_FloatRect(-1, -1, 11, 11), annot.GetRect());
 }