@reekon-tools/react-native-pdf-canvas 0.1.0 → 0.2.0

package/native/tests/main.cpp

@@ -0,0 +1,64 @@
+#include <chrono>
+#include <cstdio>
+#include <cstring>
+#include <exception>
+#include <string>
+
+#include "harness.h"
+
+namespace harness {
+
+Context& current() {
+  static Context context;
+  return context;
+}
+
+std::vector<Case>& cases() {
+  static std::vector<Case> all;
+  return all;
+}
+
+}  // namespace harness
+
+int main(int argc, char** argv) {
+  const char* filter = nullptr;
+  for (int i = 1; i < argc; i++) {
+    if (std::strcmp(argv[i], "--filter") == 0 && i + 1 < argc) filter = argv[++i];
+  }
+
+  int ran = 0;
+  int failed = 0;
+  for (const auto& test : harness::cases()) {
+    if (filter != nullptr && std::strstr(test.name, filter) == nullptr) continue;
+    ran++;
+    harness::current().failures.clear();
+    const auto started = std::chrono::steady_clock::now();
+    try {
+      test.body();
+    } catch (const harness::Abort&) {
+      // Already recorded.
+    } catch (const pdfcanvas::PdfError& error) {
+      harness::current().fail("<runner>", 0,
+                              std::string("unexpected PdfError ") +
+                                  pdfcanvas::wireName(error.code()) + ": " + error.message());
+    } catch (const std::exception& error) {
+      harness::current().fail("<runner>", 0,
+                              std::string("unexpected exception: ") + error.what());
+    }
+    const auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
+                        std::chrono::steady_clock::now() - started)
+                        .count();
+    if (harness::current().failures.empty()) {
+      std::printf("PASS  %-64s %5lld ms\n", test.name, static_cast<long long>(ms));
+    } else {
+      failed++;
+      std::printf("FAIL  %s\n", test.name);
+      for (const auto& failure : harness::current().failures) {
+        std::printf("      %s:%d: %s\n", failure.file.c_str(), failure.line,
+                    failure.message.c_str());
+      }
+    }
+  }
+  std::printf("---\n%d cases, %d failed\n", ran, failed);
+  return failed == 0 && ran > 0 ? 0 : 1;
+}

package/native/tests/pixels_util.h

@@ -0,0 +1,126 @@
+// Reading pixels back, and the vocabulary every rendering test is written in.
+//
+// `RasterPixels` is indexed from the TOP-LEFT, because that is what doc space
+// is. The fixtures are y-UP in PDF space, so a quadrant that is "bottom-left"
+// in the PDF reads at the bottom-left of the raster too — the flip is PDFium's,
+// not the test's, and a test that reasoned in PDF coordinates would be testing
+// its own arithmetic against the library's.
+#pragma once
+
+#include <algorithm>
+#include <cstdlib>
+#include <string>
+
+#include "harness.h"
+#include "pdfcanvas/document.h"
+
+namespace px {
+
+struct Pixel {
+  int r, g, b, a;
+  bool operator==(const Pixel& o) const { return r == o.r && g == o.g && b == o.b && a == o.a; }
+  /// Within `tolerance` on every channel. Antialiasing makes exact equality
+  /// wrong near an edge.
+  bool near(const Pixel& o, int tolerance = 4) const {
+    return std::abs(r - o.r) <= tolerance && std::abs(g - o.g) <= tolerance &&
+           std::abs(b - o.b) <= tolerance && std::abs(a - o.a) <= tolerance;
+  }
+  std::string str() const {
+    return "[" + std::to_string(r) + "," + std::to_string(g) + "," + std::to_string(b) + "," +
+           std::to_string(a) + "]";
+  }
+};
+
+inline const Pixel kRed{255, 0, 0, 255};
+inline const Pixel kGreen{0, 255, 0, 255};
+inline const Pixel kBlue{0, 0, 255, 255};
+inline const Pixel kBlack{0, 0, 0, 255};
+inline const Pixel kWhite{255, 255, 255, 255};
+inline const Pixel kClear{0, 0, 0, 0};
+inline const Pixel kGrey{128, 128, 128, 255};
+
+inline Pixel at(const pdfcanvas::RasterPixels& raster, int x, int y) {
+  return {raster.channel(x, y, 0), raster.channel(x, y, 1), raster.channel(x, y, 2),
+          raster.channel(x, y, 3)};
+}
+
+/// A coarse letter map, so a failure in the log says what happened.
+inline std::string map(const pdfcanvas::RasterPixels& raster, int cols = 16, int rows = 16) {
+  std::string out;
+  for (int row = 0; row < rows; row++) {
+    for (int col = 0; col < cols; col++) {
+      const int x = std::min(raster.width - 1, (col * raster.width) / cols + raster.width / (cols * 2));
+      const int y = std::min(raster.height - 1, (row * raster.height) / rows + raster.height / (rows * 2));
+      const Pixel p = at(raster, x, y);
+      if (p.a == 0) out += '_';
+      else if (p.r > 200 && p.g > 200 && p.b > 200) out += 'W';
+      else if (p.r > 200 && p.g < 60 && p.b < 60) out += 'r';
+      else if (p.g > 200 && p.r < 60 && p.b < 60) out += 'g';
+      else if (p.b > 200 && p.r < 60 && p.g < 60) out += 'b';
+      else if (p.r < 60 && p.g < 60 && p.b < 60) out += 'k';
+      else out += '.';
+    }
+    out += '\n';
+  }
+  return out;
+}
+
+struct Diff {
+  int differing = 0;
+  int maxDelta = 0;
+  int total = 0;
+};
+
+/// Compares `a` against the region of `b` starting at (offsetX, offsetY).
+inline Diff compare(const pdfcanvas::RasterPixels& a, const pdfcanvas::RasterPixels& b,
+                    int offsetX = 0, int offsetY = 0) {
+  Diff diff;
+  for (int y = 0; y < a.height; y++) {
+    for (int x = 0; x < a.width; x++) {
+      const Pixel pa = at(a, x, y);
+      const Pixel pb = at(b, x + offsetX, y + offsetY);
+      const int d = std::max({std::abs(pa.r - pb.r), std::abs(pa.g - pb.g), std::abs(pa.b - pb.b),
+                              std::abs(pa.a - pb.a)});
+      if (d != 0) diff.differing++;
+      diff.maxDelta = std::max(diff.maxDelta, d);
+    }
+  }
+  diff.total = a.width * a.height;
+  return diff;
+}
+
+inline pdfcanvas::RasterRequest request(int page, double x, double y, double width, double height,
+                                        double scale, bool annotations = false,
+                                        pdfcanvas::Background background = pdfcanvas::Background::White) {
+  pdfcanvas::RasterRequest r;
+  r.page = page;
+  r.x = x;
+  r.y = y;
+  r.width = width;
+  r.height = height;
+  r.scale = scale;
+  r.annotations = annotations;
+  r.background = background;
+  return r;
+}
+
+/// Renders the whole of `page` at `scale` to the heap.
+inline pdfcanvas::RasterPixels renderWhole(pdfcanvas::Document& document, int page = 0,
+                                           double scale = 1, bool annotations = false,
+                                           pdfcanvas::Background background = pdfcanvas::Background::White) {
+  const auto& geometry = document.geometry(page);
+  return document.render(request(page, 0, 0, geometry.width, geometry.height, scale, annotations, background),
+                         nullptr, nullptr);
+}
+
+}  // namespace px
+
+#define CHECK_PIXEL(raster, x, y, expected)                                                    \
+  do {                                                                                         \
+    const ::px::Pixel _actual = ::px::at((raster), (x), (y));                                  \
+    if (!_actual.near(expected))                                                               \
+      ::harness::current().fail(__FILE__, __LINE__,                                            \
+                                "(" + std::to_string(x) + "," + std::to_string(y) + ") is " +  \
+                                    _actual.str() + ", expected " + (expected).str() + "\n" +  \
+                                    ::px::map(raster));                                        \
+  } while (0)

package/native/tests/test_document.cpp

@@ -0,0 +1,485 @@
+// What the core actually draws.
+//
+// Every test here names the bug it catches, because every one of these failure
+// modes produces a plausible image rather than an error: a channel swap, a
+// stride shear, a y-flip, a page ignored, an annotation drawn when it was not
+// asked for, a transparent page composited as black.
+
+#include <string>
+#include <thread>
+
+#include "fixtures.h"
+#include "harness.h"
+#include "pdfcanvas/document.h"
+#include "pixels_util.h"
+
+using namespace pdfcanvas;
+using px::kBlack;
+using px::kBlue;
+using px::kClear;
+using px::kGreen;
+using px::kGrey;
+using px::kRed;
+using px::kWhite;
+
+namespace {
+
+std::unique_ptr<Document> openFixture(const fixtures::Bytes& bytes, const std::string& name,
+                                      const char* password = nullptr) {
+  Source source;
+  source.path = fixtures::writeTemp(bytes, name);
+  if (password != nullptr) {
+    source.hasPassword = true;
+    source.password = password;
+  }
+  return Document::open(source);
+}
+
+}  // namespace
+
+/* ------------------------------------------------------------------ *
+ * The doc-space contract
+ * ------------------------------------------------------------------ */
+
+/// The four quadrants land where doc space says, which pins the y-flip, the
+/// channel order (RGBA, via FPDF_REVERSE_BYTE_ORDER) and the stride at once.
+TEST(quadrantsLandWhereDocSpaceSaysTheyShould) {
+  auto document = openFixture(fixtures::quadrants(200, 100), "quadrants.pdf");
+  auto raster = px::renderWhole(*document, 0, 2);
+  CHECK_EQ(raster.width, 400);
+  CHECK_EQ(raster.height, 200);
+  CHECK_EQ(raster.rowBytes, 1600);
+  CHECK_PIXEL(raster, 20, 20, kBlue);
+  CHECK_PIXEL(raster, 380, 20, kBlack);
+  CHECK_PIXEL(raster, 20, 180, kRed);
+  CHECK_PIXEL(raster, 380, 180, kGreen);
+}
+
+/// A tile is the same region cropped from a whole-page render — THE PROPERTY
+/// THE ENTIRE DETAIL LAYER RESTS ON. The tile's origin and size are
+/// deliberately not round numbers.
+///
+/// `maxDelta <= 1`, not 0: PDFium's AGG rasterizer accumulates antialiased
+/// coverage in device space, so a shallow diagonal edge can come out one level
+/// different when the bitmap origin moves — the web backend measured the same
+/// (24 of 9,600 pixels, always by exactly one level) and spike S1 measured it
+/// on Android's PdfRenderer, which is the same engine. A registration error
+/// moves whole pixels of this high-frequency pattern and cannot hide under it.
+TEST(aTileIsIdenticalToThatRegionOfAWholePageRender) {
+  auto document = openFixture(fixtures::grid(200, 100), "grid-tile.pdf");
+  const double scale = 4.0;
+  auto whole = px::renderWhole(*document, 0, scale);
+  auto tile = document->render(px::request(0, 37, 23, 64, 41, scale), nullptr, nullptr);
+  CHECK_EQ(tile.width, 256);
+  CHECK_EQ(tile.height, 164);
+  const auto diff = px::compare(tile, whole, static_cast<int>(37 * scale), static_cast<int>(23 * scale));
+  const std::string summary = std::to_string(diff.differing) + "/" + std::to_string(diff.total) +
+                              " pixels differ, maxDelta " + std::to_string(diff.maxDelta);
+  CHECK_MSG(diff.maxDelta <= 1, summary);
+  CHECK_MSG(diff.differing * 100 < diff.total * 2, summary);
+}
+
+/// Two tiles at the same scale agree over their overlap, with heights that
+/// round in OPPOSITE directions.
+TEST(rastersAtTheSameScaleAgreeWhereTheyOverlap) {
+  auto document = openFixture(fixtures::grid(200, 200), "grid-overlap.pdf");
+  const double scale = 4.0;
+  auto a = document->render(px::request(0, 10, 10, 50.1, 25.1, scale), nullptr, nullptr);
+  auto b = document->render(px::request(0, 10, 20, 50.1, 25.4, scale), nullptr, nullptr);
+  CHECK(a.height != b.height);
+  const int overlapRows = static_cast<int>((35.1 - 20) * scale) - 1;
+  int differing = 0;
+  for (int row = 0; row < overlapRows; row++) {
+    for (int x = 0; x < a.width; x++) {
+      if (!(px::at(a, x, row + static_cast<int>(10 * scale)) == px::at(b, x, row))) differing++;
+    }
+  }
+  CHECK_EQ(differing, 0);
+}
+
+/// The rounding rule is `round`, at least 1 — the planner's rule.
+TEST(pixelExtentsRoundAndFloorAtOne) {
+  CHECK_EQ(px::request(0, 0, 0, 128.125, 128.1, 4).pixelWidth(), 513);
+  CHECK_EQ(px::request(0, 0, 0, 128.125, 128.1, 4).pixelHeight(), 512);
+  CHECK_EQ(px::request(0, 0, 0, 0.01, 0.01, 1).pixelWidth(), 1);
+  CHECK_EQ(px::request(0, 0, 0, 0.01, 0.01, 1).pixelHeight(), 1);
+}
+
+/// Cost is flat in scale: the engine clips rather than rasterizing the whole
+/// page and discarding it. Not a threshold in milliseconds — a shape assertion.
+TEST(costIsFlatInScale) {
+  auto document = openFixture(fixtures::grid(fixtures::kArchDW, fixtures::kArchDH), "grid-archd.pdf");
+  const double side = 256;
+  auto best = [&](double scale) {
+    double best = 1e9;
+    for (int i = 0; i < 5; i++) {
+      const auto started = std::chrono::steady_clock::now();
+      (void)document->render(px::request(0, 100, 100, side / scale, side / scale, scale), nullptr, nullptr);
+      const double ms = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count();
+      best = std::min(best, ms);
+    }
+    return best;
+  };
+  (void)best(1);
+  const double one = best(1);
+  const double eight = best(8);
+  CHECK_MSG(eight < one * 8 + 10,
+            "256px at 8x took " + std::to_string(eight) + "ms against " + std::to_string(one) + "ms at 1x");
+}
+
+/* ------------------------------------------------------------------ *
+ * Backgrounds and alpha
+ * ------------------------------------------------------------------ */
+
+TEST(whiteBackgroundFillsEverythingTheContentDoesNotPaint) {
+  auto document = openFixture(fixtures::page({0, 0, 100, 100}, nullptr, 0, "1 0 0 rg 0 0 40 40 re f\n"),
+                              "sparse.pdf");
+  auto raster = px::renderWhole(*document, 0, 1, false, Background::White);
+  CHECK_PIXEL(raster, 90, 10, kWhite);
+  CHECK_PIXEL(raster, 50, 50, kWhite);
+  CHECK_PIXEL(raster, 10, 90, kRed);
+}
+
+TEST(transparentBackgroundLeavesUnpaintedAreaClear) {
+  auto document = openFixture(fixtures::page({0, 0, 100, 100}, nullptr, 0, "1 0 0 rg 0 0 40 40 re f\n"),
+                              "sparse-clear.pdf");
+  auto raster = px::renderWhole(*document, 0, 1, false, Background::Transparent);
+  CHECK_PIXEL(raster, 90, 10, kClear);
+  CHECK_PIXEL(raster, 10, 90, kRed);
+}
+
+/// ALPHA IS STRAIGHT, measured off the bytes. A partially covered opaque-white
+/// edge reads `[255,255,255,a]`; premultiplied would be `[a,a,a,a]`. The TS
+/// adapter declares `'straight'` for both native platforms on the strength of
+/// this — the retired cores were both premultiplied, and getting it wrong is
+/// invisible under a white background and wrong under a transparent one.
+TEST(alphaIsStraight) {
+  auto document = openFixture(fixtures::antialiasedWhiteEdge(), "aa-edge.pdf");
+  auto raster = px::renderWhole(*document, 0, 1, false, Background::Transparent);
+  int partial = 0;
+  int straight = 0;
+  for (int y = 0; y < raster.height; y++) {
+    for (int x = 0; x < raster.width; x++) {
+      const px::Pixel p = px::at(raster, x, y);
+      if (p.a > 10 && p.a < 245) {
+        partial++;
+        if (p.r >= 250 && p.g >= 250 && p.b >= 250) straight++;
+      }
+    }
+  }
+  CHECK_MSG(partial > 20, "an antialiased circle must have partially covered edge pixels; got " +
+                              std::to_string(partial));
+  CHECK_EQ(partial, straight);
+}
+
+/* ------------------------------------------------------------------ *
+ * Annotations and forms
+ * ------------------------------------------------------------------ */
+
+/// The green is INSIDE an annotation's appearance stream and nowhere else, so
+/// green in the raster can only have come from compositing the annotation.
+TEST(annotationsAreDrawnOnlyWhenAsked) {
+  auto document = openFixture(fixtures::annotatedPage(), "annotated.pdf");
+  auto with = px::renderWhole(*document, 0, 1, true);
+  auto without = px::renderWhole(*document, 0, 1, false);
+  // The annotation covers PDF (50,50)-(150,150), i.e. doc (50,50)-(150,150).
+  CHECK_PIXEL(with, 100, 100, kGreen);
+  CHECK_PIXEL(without, 100, 100, kWhite);
+  // The content stream is unaffected by the flag.
+  CHECK_PIXEL(with, 25, 175, kRed);
+  CHECK_PIXEL(without, 25, 175, kRed);
+}
+
+/// FORM FIELDS ARE WIDGET ANNOTATIONS, and `FPDF_RenderPageBitmap` skips them
+/// even with FPDF_ANNOT — they are drawn by `FPDF_FFLDraw` through the form-fill
+/// environment. Without that second pass a filled-in form renders as a blank
+/// form, which is exactly the "annotations are missing" report this rewrite
+/// exists to close.
+TEST(formFieldsAreDrawnWithAnnotations) {
+  auto document = openFixture(fixtures::formFieldPage(), "form.pdf");
+  auto with = px::renderWhole(*document, 0, 1, true);
+  auto without = px::renderWhole(*document, 0, 1, false);
+  // The widget covers PDF (50,50)-(150,100): doc y 100..150.
+  const px::Pixel inside = px::at(with, 100, 125);
+  CHECK_MSG(!inside.near(kWhite), "the widget must paint something at its centre; got " + inside.str() +
+                                      "\n" + px::map(with));
+  CHECK_PIXEL(without, 100, 125, kWhite);
+  CHECK_PIXEL(with, 25, 175, kRed);
+}
+
+/// Annotations tile exactly like content: a tile of the annotated region equals
+/// that region of the whole-page render.
+TEST(annotationTilesRegisterLikeContent) {
+  auto document = openFixture(fixtures::annotatedPage(), "annotated-tile.pdf");
+  auto whole = px::renderWhole(*document, 0, 3, true);
+  auto tile = document->render(px::request(0, 40, 40, 70, 55, 3, true), nullptr, nullptr);
+  const auto diff = px::compare(tile, whole, 120, 120);
+  CHECK_EQ(diff.differing, 0);
+}
+
+/* ------------------------------------------------------------------ *
+ * Geometry
+ * ------------------------------------------------------------------ */
+
+TEST(pageGeometryIsPostRotation) {
+  auto document = openFixture(fixtures::rotated(90), "rotated-90.pdf");
+  CHECK_EQ(document->pageCount(), 1);
+  CHECK_NEAR(document->geometry(0).width, 792, 0.01);
+  CHECK_NEAR(document->geometry(0).height, 612, 0.01);
+  CHECK_EQ(document->geometry(0).rotation, 0);
+}
+
+/// `/Rotate 90` is clockwise: the unrotated top-left marker (red) lands at the
+/// displayed TOP-RIGHT and the unrotated bottom-left (blue) at the top-left.
+TEST(rotatedPagesDrawUpright) {
+  {
+    auto document = openFixture(fixtures::rotated(90), "rotated-90-draw.pdf");
+    auto raster = px::renderWhole(*document, 0, 0.5);
+    CHECK_EQ(raster.width, 396);
+    CHECK_EQ(raster.height, 306);
+    CHECK_PIXEL(raster, 380, 20, kRed);
+    CHECK_PIXEL(raster, 20, 20, kBlue);
+    CHECK_PIXEL(raster, 200, 200, kWhite);
+  }
+  {
+    auto document = openFixture(fixtures::rotated(180), "rotated-180-draw.pdf");
+    auto raster = px::renderWhole(*document, 0, 0.5);
+    CHECK_EQ(raster.width, 306);
+    CHECK_EQ(raster.height, 396);
+    // Red (unrotated top-left) is now bottom-right; blue (bottom-left) is top-right.
+    CHECK_PIXEL(raster, 290, 380, kRed);
+    CHECK_PIXEL(raster, 290, 20, kBlue);
+  }
+  {
+    auto document = openFixture(fixtures::rotated(270), "rotated-270-draw.pdf");
+    auto raster = px::renderWhole(*document, 0, 0.5);
+    CHECK_EQ(raster.width, 396);
+    CHECK_PIXEL(raster, 20, 290, kRed);
+    CHECK_PIXEL(raster, 380, 290, kBlue);
+  }
+}
+
+TEST(rotationIsReportedPerPage) {
+  auto document = openFixture(
+      fixtures::multiPage({{200, 100, 0, "1 0 0 rg 0 0 40 40 re f\n"},
+                           {200, 100, 90, "1 0 0 rg 0 0 40 40 re f\n"},
+                           {200, 100, 270, "1 0 0 rg 0 0 40 40 re f\n"}}),
+      "rotated-pages.pdf");
+  CHECK_NEAR(document->geometry(0).width, 200, 0.01);
+  CHECK_NEAR(document->geometry(1).width, 100, 0.01);
+  CHECK_NEAR(document->geometry(1).height, 200, 0.01);
+  CHECK_NEAR(document->geometry(2).width, 100, 0.01);
+}
+
+/// The crop box origin is subtracted: with MediaBox 0 0 400 400 and CropBox
+/// 100 150 300 350, the page is 200x200 and the red marker sits at doc (0,0).
+TEST(cropBoxOriginIsSubtracted) {
+  auto document = openFixture(fixtures::offsetCropBox(), "cropbox.pdf");
+  CHECK_NEAR(document->geometry(0).width, 200, 0.01);
+  CHECK_NEAR(document->geometry(0).height, 200, 0.01);
+  auto raster = px::renderWhole(*document, 0, 1);
+  CHECK_PIXEL(raster, 20, 20, kRed);
+  CHECK_PIXEL(raster, 180, 180, kBlue);
+  CHECK_PIXEL(raster, 100, 100, kGrey);
+}
+
+TEST(cropBoxIsIntersectedWithMediaBox) {
+  auto document = openFixture(fixtures::cropBoxOverhangingMediaBox(), "cropbox-overhang.pdf");
+  CHECK_NEAR(document->geometry(0).width, 150, 0.01);
+  CHECK_NEAR(document->geometry(0).height, 150, 0.01);
+}
+
+TEST(eachPageReportsItsOwnSize) {
+  auto document = openFixture(fixtures::mixedSizeDocument(), "mixed.pdf");
+  CHECK_EQ(document->pageCount(), 3);
+  CHECK_NEAR(document->geometry(0).width, fixtures::kLetterW, 0.01);
+  CHECK_NEAR(document->geometry(1).width, fixtures::kArchDW, 0.01);
+  CHECK_NEAR(document->geometry(1).height, fixtures::kArchDH, 0.01);
+  CHECK_NEAR(document->geometry(2).width, 200, 0.01);
+  CHECK_NEAR(document->geometry(2).height, 900, 0.01);
+}
+
+TEST(eachPageRendersItsOwnContent) {
+  auto document = openFixture(fixtures::coloredPages({{1, 0, 0}, {0, 1, 0}, {0, 0, 1}}, 100, 100),
+                              "colored.pdf");
+  CHECK_PIXEL(px::renderWhole(*document, 0), 50, 50, kRed);
+  CHECK_PIXEL(px::renderWhole(*document, 1), 50, 50, kGreen);
+  CHECK_PIXEL(px::renderWhole(*document, 2), 50, 50, kBlue);
+  // Back to the first, which the page cache (capacity 3) still holds; and
+  // then a fourth pattern that forces an eviction and a reload.
+  CHECK_PIXEL(px::renderWhole(*document, 0), 50, 50, kRed);
+  auto four = openFixture(fixtures::coloredPages({{1, 0, 0}, {0, 1, 0}, {0, 0, 1}, {0, 0, 0}}, 50, 50),
+                          "colored-4.pdf");
+  for (int round = 0; round < 3; round++) {
+    CHECK_PIXEL(px::renderWhole(*four, 0), 25, 25, kRed);
+    CHECK_PIXEL(px::renderWhole(*four, 1), 25, 25, kGreen);
+    CHECK_PIXEL(px::renderWhole(*four, 2), 25, 25, kBlue);
+    CHECK_PIXEL(px::renderWhole(*four, 3), 25, 25, kBlack);
+  }
+}
+
+TEST(openBytesMatchesOpenFile) {
+  const auto bytes = fixtures::grid(120, 80);
+  auto fromFile = openFixture(bytes, "bytes-vs-file.pdf");
+  Source memory;
+  memory.bytes = bytes;
+  auto fromMemory = Document::open(memory);
+  auto a = px::renderWhole(*fromFile, 0, 2);
+  auto b = px::renderWhole(*fromMemory, 0, 2);
+  CHECK_EQ(px::compare(a, b).differing, 0);
+}
+
+/* ------------------------------------------------------------------ *
+ * Failures
+ * ------------------------------------------------------------------ */
+
+TEST(openFailuresAreDistinguishable) {
+  Source missing;
+  missing.path = fixtures::tempDir() + "/does-not-exist.pdf";
+  EXPECT_ERROR(Document::open(missing), ErrorCode::NotFound);
+
+  Source directory;
+  directory.path = fixtures::tempDir();
+  EXPECT_ERROR(Document::open(directory), ErrorCode::NotFound);
+
+  Source empty;
+  empty.path = fixtures::writeTemp({}, "empty.pdf");
+  EXPECT_ERROR(Document::open(empty), ErrorCode::Corrupt);
+
+  Source emptyBytes;
+  EXPECT_ERROR(Document::open(emptyBytes), ErrorCode::Corrupt);
+
+  Source notPdf;
+  notPdf.path = fixtures::writeTemp(fixtures::notAPdfAtAll(), "not-a-pdf.pdf");
+  EXPECT_ERROR(Document::open(notPdf), ErrorCode::Corrupt);
+
+  Source garbage;
+  garbage.path = fixtures::writeTemp(fixtures::headerOnlyGarbage(), "header-only.pdf");
+  EXPECT_ERROR(Document::open(garbage), ErrorCode::Corrupt);
+
+  // And a good document still opens afterwards: nothing poisons the process,
+  // which is the API-24 `PdfRenderer` behaviour the old preflight existed for.
+  auto fine = openFixture(fixtures::quadrants(40, 40), "after-garbage.pdf");
+  CHECK_EQ(fine->pageCount(), 1);
+}
+
+TEST(encryptedDocuments) {
+  const auto bytes = fixtures::encrypted();
+  Source locked;
+  locked.path = fixtures::writeTemp(bytes, "encrypted.pdf");
+  EXPECT_ERROR(Document::open(locked), ErrorCode::PasswordRequired);
+
+  Source wrong = locked;
+  wrong.hasPassword = true;
+  wrong.password = "nope";
+  EXPECT_ERROR(Document::open(wrong), ErrorCode::PasswordIncorrect);
+
+  Source right = locked;
+  right.hasPassword = true;
+  right.password = fixtures::kUserPassword;
+  auto document = Document::open(right);
+  auto raster = px::renderWhole(*document, 0, 0.5);
+  CHECK_PIXEL(raster, 50, 50, kRed);
+
+  // The owner password opens it too — that is what an owner password is for.
+  Source owner = locked;
+  owner.hasPassword = true;
+  owner.password = fixtures::kOwnerPassword;
+  CHECK_EQ(Document::open(owner)->pageCount(), 1);
+}
+
+TEST(outOfRangePageIsNotFound) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "range.pdf");
+  EXPECT_ERROR(document->geometry(1), ErrorCode::NotFound);
+  EXPECT_ERROR(document->geometry(-1), ErrorCode::NotFound);
+  EXPECT_ERROR(document->render(px::request(1, 0, 0, 10, 10, 1), nullptr, nullptr), ErrorCode::NotFound);
+}
+
+TEST(degenerateRequestsAreRefused) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "degenerate.pdf");
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 0, 10, 1), nullptr, nullptr), ErrorCode::BackendFailure);
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 10, -1, 1), nullptr, nullptr), ErrorCode::BackendFailure);
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 10, 10, 0), nullptr, nullptr), ErrorCode::BackendFailure);
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 10, 10, -2), nullptr, nullptr), ErrorCode::BackendFailure);
+  EXPECT_ERROR(document->render(px::request(0, 1.0 / 0.0, 0, 10, 10, 1), nullptr, nullptr), ErrorCode::BackendFailure);
+}
+
+TEST(anAbsurdRasterIsRefused) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "absurd.pdf");
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 40, 40, 300), nullptr, nullptr), ErrorCode::OutOfMemory);
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 1, 1, 1e12), nullptr, nullptr), ErrorCode::OutOfMemory);
+}
+
+TEST(renderingAfterCloseFails) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "closed.pdf");
+  document->close();
+  document->close();
+  CHECK(document->isClosed());
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 10, 10, 1), nullptr, nullptr), ErrorCode::BackendFailure);
+  // Geometry is precomputed and still readable — a closed handle can still
+  // describe its pages, which is what a layout holding on to sizes needs.
+  CHECK_NEAR(document->geometry(0).width, 40, 0.01);
+}
+
+/* ------------------------------------------------------------------ *
+ * Cancellation
+ * ------------------------------------------------------------------ */
+
+TEST(aCancelBeforeStartStopsTheRender) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "cancel-before.pdf");
+  Cancellation signal;
+  signal.cancel();
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, 40, 40, 1), &signal, nullptr), ErrorCode::Cancelled);
+}
+
+/// A cancel that lands DURING the draw stops it. The affordance flips the flag
+/// on the second time PDFium asks whether to pause, which is inside the render
+/// and nowhere else — the property neither retired core could offer.
+TEST(aCancelMidRenderStopsTheDrawAndLeavesThePageUsable) {
+  auto document = openFixture(fixtures::grid(fixtures::kArchDW, fixtures::kArchDH, 4), "cancel-mid.pdf");
+  Cancellation signal;
+  signal.cancelAfterPolls(2);
+  EXPECT_ERROR(document->render(px::request(0, 0, 0, fixtures::kArchDW, fixtures::kArchDH, 1), &signal, nullptr),
+               ErrorCode::Cancelled);
+  CHECK(signal.isCancelled());
+  // The progressive render was closed properly: the same page renders again.
+  // (6,2) sits between the 4pt grid lines and off both red diagonals — one of
+  // which passes through the doc-space origin, so (2,2) would be red.
+  auto raster = document->render(px::request(0, 0, 0, 100, 100, 1), nullptr, nullptr);
+  CHECK_EQ(raster.width, 100);
+  CHECK_PIXEL(raster, 6, 2, kWhite);
+  // On the antialiased edge of the 2pt red diagonal: reddish, not exactly red.
+  const px::Pixel onDiagonal = px::at(raster, 2, 2);
+  CHECK_MSG(onDiagonal.r > 200 && onDiagonal.g < 120, "expected the red diagonal at (2,2), got " + onDiagonal.str());
+}
+
+TEST(anUncancelledSignalIsTransparent) {
+  auto document = openFixture(fixtures::quadrants(40, 40), "cancel-none.pdf");
+  Cancellation signal;
+  auto raster = document->render(px::request(0, 0, 0, 40, 40, 1), &signal, nullptr);
+  CHECK_EQ(raster.width, 40);
+  CHECK(!signal.isCancelled());
+}
+
+/// Closing while a render is in flight on another thread is safe: close waits
+/// for the library lock, and the render completes or cancels first.
+TEST(closeWhileRenderingIsSafe) {
+  auto document = openFixture(fixtures::grid(fixtures::kArchDW, fixtures::kArchDH, 4), "close-inflight.pdf");
+  Cancellation signal;
+  std::exception_ptr failure;
+  std::thread worker([&] {
+    try {
+      (void)document->render(px::request(0, 0, 0, fixtures::kArchDW, fixtures::kArchDH, 2), &signal, nullptr);
+    } catch (const PdfError&) {
+      // Cancelled or closed under us: both are correct outcomes.
+    } catch (...) {
+      failure = std::current_exception();
+    }
+  });
+  std::this_thread::sleep_for(std::chrono::milliseconds(5));
+  signal.cancel();
+  document->close();
+  worker.join();
+  CHECK(!failure);
+  CHECK(document->isClosed());
+}