@reekon-tools/react-native-pdf-canvas 0.1.0 → 0.2.0

package/android/src/androidTest/java/tools/reekon/pdfcanvas/PdfCanvasJsiTransportTest.java

@@ -1,783 +0,0 @@
-package tools.reekon.pdfcanvas;
-
-import static org.junit.Assert.assertArrayEquals;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertTrue;
-
-import android.content.Context;
-import android.util.Base64;
-import android.util.Log;
-
-import androidx.test.ext.junit.runners.AndroidJUnit4;
-import androidx.test.platform.app.InstrumentationRegistry;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.io.File;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.Callable;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicReference;
-
-import tools.reekon.pdfcanvas.jsi.PdfCanvasPixelBridge;
-
-/**
- * The raster transport's byte fidelity, on device.
- *
- * <h3>What this can and cannot reach</h3>
- *
- * This is the STANDALONE build: no React Native, no Hermes, no libjsi.so — see
- * {@code android/build.gradle}. So the JS half of the transport is out of reach
- * here and always will be. What IS in reach, and is the only part that can
- * corrupt a raster, is the JNI copy: {@code nativeStore} reads a Java
- * {@code byte[]} into the C++ buffer that the ArrayBuffer will later wrap
- * WITHOUT COPYING. Everything downstream of that buffer is a pointer hand-off;
- * everything upstream is the rasterizer, which the rest of this suite proves.
- *
- * So the question worth asking on device is exactly one: are the bytes that
- * enter the transport the same bytes the base64 path would have delivered? A
- * transport that is fast and wrong is worthless, and it would fail silently —
- * a stride slip shears, a channel swap discolours, a signed-byte widening
- * mangles every value above 0x7F. None of those throw.
- *
- * <h3>TWO fills now, and the second one is the shipped one</h3>
- *
- * {@code nativeStore} reads a Java {@code byte[]}. {@code nativeStoreFromBitmap}
- * reads the {@code Bitmap}'s own pixels through
- * {@code AndroidBitmap_lockPixels} and is what a production render actually
- * uses — it deletes the {@code byte[]} entirely. They are different memcpys
- * from different sources, so proving one says nothing about the other, and
- * section 5 asks the same fidelity question of the second.
- *
- * <p>That section is also the ONLY place the direct fill can be checked at all.
- * The install-time probe that gates the whole transport
- * ({@code PdfCanvasModule.installJsiTransport}) round-trips
- * {@link PdfCanvasPixelBridge#PROBE_BYTES} through {@code nativeStore}, because
- * a probe needs bytes both sides already agree on and there is no Bitmap at
- * install time. What the probe proves is the JS half — the host function is
- * installed, Hermes will wrap a {@code MutableBuffer}, byte values survive the
- * ArrayBuffer view. It does NOT exercise the fill that every subsequent raster
- * uses. This file is what covers that, which is why it ships in the standalone
- * build rather than living behind an app.
- *
- * <h3>Why the comparison is against base64 rather than against the bitmap</h3>
- *
- * Because base64 is the thing being replaced. {@code Base64.encodeToString} then
- * {@code Base64.decode} is the round trip the shipped transport performs, so
- * asserting the new path equals it is asserting the replacement is a
- * replacement. Comparing against {@code pixels.bytes} directly would only prove
- * the copy copied — true of a path that had never been through base64 either.
- */
-@RunWith(AndroidJUnit4.class)
-public class PdfCanvasJsiTransportTest {
-
-  private static final String TAG = "PDFCANVAS";
-
-  private static Context ctx() {
-    return InstrumentationRegistry.getInstrumentation().getTargetContext();
-  }
-
-  /** Slot ids are the caller's to choose; this suite owns a range of its own. */
-  private static long slot = 1_000_000L;
-
-  private static long nextSlot() {
-    return slot++;
-  }
-
-  @Before
-  public void drainSlots() {
-    // Each test starts from a known slot count, so the leak assertions below
-    // measure this test rather than the one before it.
-    PdfCanvasPixelBridge.nativeReleaseAll();
-    assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-  }
-
-  /* ================================================================ *
-   * 1. The library loaded at all
-   * ================================================================ */
-
-  /**
-   * CATCHES: the native build silently not running.
-   *
-   * {@code PdfCanvasPixelBridge.isLoaded()} is false-tolerant by design — every
-   * caller falls back to base64 — which means a CMake misconfiguration, a
-   * missing ABI or a dropped source set produces a working app that is simply
-   * never fast. There is no error anywhere. This is the assertion that turns
-   * that into a red test.
-   */
-  @Test
-  public void nativeTransportLibraryIsPresent() {
-    assertTrue(
-        "libpdfcanvasjsi.so did not load. Every render will fall back to base64.",
-        PdfCanvasPixelBridge.isLoaded());
-  }
-
-  /**
-   * The other half of the two-build split, asserted rather than assumed.
-   *
-   * This build compiles the transport with {@code PDFCANVAS_WITH_JSI} undefined,
-   * so there is no {@code jsi/jsi.h} and no host function to install. Install
-   * must report false rather than crash — a JNI method that is declared but has
-   * no definition throws {@code UnsatisfiedLinkError} at CALL time, and that is
-   * exactly the shape of failure this asserts is absent.
-   */
-  @Test
-  public void installReportsFalseInABuildWithoutJsi() {
-    assertFalse(PdfCanvasPixelBridge.nativeInstall(0L));
-    // A non-null pointer must be refused just as calmly: there is no runtime
-    // here for it to point at.
-    assertFalse(PdfCanvasPixelBridge.nativeInstall(1L));
-  }
-
-  /* ================================================================ *
-   * 2. Byte fidelity against the transport being replaced
-   * ================================================================ */
-
-  /**
-   * THE TEST THIS FILE EXISTS FOR.
-   *
-   * A real raster of a four-colour page, moved through the transport, must be
-   * byte-identical to the same raster moved through base64.
-   *
-   * CATCHES: a channel swap (R and B differ per quadrant), a stride slip (the
-   * quadrant boundary would drift one pixel per row), a truncated tail (the last
-   * row is BLACK here and its bytes are 0x00/0xFF, so a short copy shows up as a
-   * length mismatch rather than as plausible content), and a signed-byte
-   * widening — {@code Color.RED} is 0xFF in one channel, above Java's
-   * {@code byte} range, and {@code GetByteArrayRegion} is the one call in this
-   * path that could get it wrong.
-   */
-  @Test
-  public void transportBytesEqualBase64BytesForARealRaster() throws Exception {
-    File pdf = TestPdfs.quadrants(ctx(), "jsi-quadrants.pdf", TestPdfs.LETTER_W, TestPdfs.LETTER_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      RasterPixels pixels =
-          r.render(
-              new RasterRequest(
-                  0, 0f, 0f, TestPdfs.LETTER_W, TestPdfs.LETTER_H, 2f, false,
-                  RasterRequest.BACKGROUND_WHITE),
-              null);
-
-      // What the shipped transport delivers to JS, produced by the shipped calls.
-      byte[] viaBase64 =
-          Base64.decode(Base64.encodeToString(pixels.bytes, Base64.NO_WRAP), Base64.DEFAULT);
-
-      long id = nextSlot();
-      PdfCanvasPixelBridge.nativeStore(id, pixels.bytes);
-      byte[] viaTransport = PdfCanvasPixelBridge.nativeTakeForTest(id);
-
-      assertNotNull("slot came back empty", viaTransport);
-      assertEquals(
-          "length differs: " + viaBase64.length + " vs " + viaTransport.length,
-          viaBase64.length,
-          viaTransport.length);
-      assertArrayEquals(viaBase64, viaTransport);
-
-      // And the reference is itself right — otherwise the assertion above is two
-      // wrong things agreeing. Top-left is RED in an RGBA_8888 buffer.
-      assertEquals(255, pixels.channel(4, 4, 0));
-      assertEquals(0, pixels.channel(4, 4, 1));
-      assertEquals(0, pixels.channel(4, 4, 2));
-
-      Log.i(
-          TAG,
-          "PDFCANVAS-TRANSPORT identical bytes="
-              + viaTransport.length
-              + " ("
-              + pixels.width
-              + "x"
-              + pixels.height
-              + " rowBytes="
-              + pixels.rowBytes
-              + ")");
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * The same claim at the FIELD'S tile size, because a 4 MiB copy is a different
-   * call from a 40 KiB one.
-   *
-   * CATCHES: an {@code int} overflow or a truncating cast in the JNI length
-   * handling, and any per-chunk copy that loses a boundary. 1024x1024 at 131.25
-   * devpx/pt is the exact geometry the split measurement used, so this is also
-   * the payload the speed numbers are quoted against.
-   */
-  @Test
-  public void transportBytesEqualBase64BytesForAFieldSizedTile() throws Exception {
-    File pdf = TestPdfs.pattern(ctx(), "jsi-tile.pdf", TestPdfs.LETTER_W, TestPdfs.LETTER_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      final float scale = 131.25f;
-      final float points = 1024f / scale;
-      RasterPixels pixels =
-          r.render(
-              new RasterRequest(0, 0f, 0f, points, points, scale, false,
-                  RasterRequest.BACKGROUND_WHITE),
-              null);
-      assertEquals(1024, pixels.width);
-      assertEquals(1024, pixels.height);
-      assertEquals(1024 * 1024 * 4, pixels.bytes.length);
-
-      byte[] viaBase64 =
-          Base64.decode(Base64.encodeToString(pixels.bytes, Base64.NO_WRAP), Base64.DEFAULT);
-
-      long id = nextSlot();
-      PdfCanvasPixelBridge.nativeStore(id, pixels.bytes);
-      byte[] viaTransport = PdfCanvasPixelBridge.nativeTakeForTest(id);
-
-      assertNotNull(viaTransport);
-      assertArrayEquals(viaBase64, viaTransport);
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * Every byte value, so the sign question is settled outright rather than by
-   * whichever values a rasterized page happened to contain.
-   *
-   * CATCHES: {@code GetByteArrayRegion} into a {@code uint8_t*} going through a
-   * sign-extending conversion. Values 0x80-0xFF are the entire failure set and
-   * a white-background raster is mostly 0xFF, which would HIDE the bug rather
-   * than expose it — a page that is all 0xFF looks identical whether or not the
-   * copy is correct for 0x80.
-   */
-  @Test
-  public void everyByteValueSurvivesTheCopy() {
-    byte[] all = new byte[256 * 7];
-    for (int i = 0; i < all.length; i++) {
-      all[i] = (byte) (i & 0xFF);
-    }
-    long id = nextSlot();
-    PdfCanvasPixelBridge.nativeStore(id, all);
-    assertArrayEquals(all, PdfCanvasPixelBridge.nativeTakeForTest(id));
-  }
-
-  /**
-   * The probe payload the JS negotiation compares against, round-tripped here.
-   *
-   * CATCHES: the two restatements of the probe drifting apart. Java's copy is
-   * {@code PdfCanvasPixelBridge.PROBE_BYTES} and TypeScript's is
-   * {@code TRANSPORT_PROBE_BYTES} in {@code src/rasterizer/android.ts}; they are
-   * restated rather than derived, on purpose, so that a divergence disables the
-   * fast path instead of shipping a shear. This asserts the Java half at least
-   * survives its own transport — the values are checked literally so that
-   * editing the constant without editing the TypeScript is a red test HERE,
-   * where the reason is written down, rather than a silent fallback in the field.
-   */
-  @Test
-  public void probeBytesRoundTrip() {
-    assertArrayEquals(
-        new byte[] {0x00, 0x01, 0x02, (byte) 0xFD, (byte) 0xFE, (byte) 0xFF, 0x2A, 0x07},
-        PdfCanvasPixelBridge.PROBE_BYTES);
-
-    long id = nextSlot();
-    PdfCanvasPixelBridge.nativeStore(id, PdfCanvasPixelBridge.PROBE_BYTES);
-    assertArrayEquals(
-        PdfCanvasPixelBridge.PROBE_BYTES, PdfCanvasPixelBridge.nativeTakeForTest(id));
-  }
-
-  /* ================================================================ *
-   * 3. Slot lifecycle — where a raster-sized leak would live
-   * ================================================================ */
-
-  /**
-   * CATCHES: a slot that survives being taken.
-   *
-   * The ArrayBuffer handed to JS owns the buffer from the moment the take
-   * succeeds. If the map kept a reference too, every raster would stay resident
-   * for the life of the process — tens of megabytes per epoch — and nothing
-   * would report it.
-   */
-  @Test
-  public void takingASlotEmptiesIt() {
-    long id = nextSlot();
-    PdfCanvasPixelBridge.nativeStore(id, new byte[] {1, 2, 3, 4});
-    assertEquals(1, PdfCanvasPixelBridge.nativeSlotCount());
-
-    assertArrayEquals(new byte[] {1, 2, 3, 4}, PdfCanvasPixelBridge.nativeTakeForTest(id));
-    assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-
-    // Second take is empty rather than a stale buffer. On the JS side this is
-    // what becomes a named throw instead of a black tile.
-    assertNull(PdfCanvasPixelBridge.nativeTakeForTest(id));
-  }
-
-  /** CATCHES: release doing nothing, so a cancelled raster is held forever. */
-  @Test
-  public void releaseDropsASlotWithoutReadingIt() {
-    long id = nextSlot();
-    PdfCanvasPixelBridge.nativeStore(id, new byte[1024]);
-    PdfCanvasPixelBridge.nativeRelease(id);
-    assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-    assertNull(PdfCanvasPixelBridge.nativeTakeForTest(id));
-
-    // Releasing an absent slot is a no-op, not a crash: `invalidate()` runs it
-    // over slots that may already have been taken.
-    PdfCanvasPixelBridge.nativeRelease(id);
-  }
-
-  /**
-   * CATCHES: {@code invalidate()} leaving stranded rasters behind.
-   *
-   * A Fast Refresh drops the JS side between a promise resolving and its
-   * continuation running, so slots stored for those renders can never be taken.
-   * Dozens of reloads a day at several megabytes each is the whole budget.
-   */
-  @Test
-  public void releaseAllDrainsEverything() {
-    for (int i = 0; i < 16; i++) {
-      PdfCanvasPixelBridge.nativeStore(nextSlot(), new byte[64 * 1024]);
-    }
-    assertEquals(16, PdfCanvasPixelBridge.nativeSlotCount());
-    PdfCanvasPixelBridge.nativeReleaseAll();
-    assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-  }
-
-  /* ================================================================ *
-   * 4. Threading
-   * ================================================================ */
-
-  /**
-   * CATCHES: an unsynchronised slot map.
-   *
-   * In production the stores happen on the render executor — up to
-   * {@code MAX_POOL_SIZE} threads at once, one per lane — while the takes happen
-   * on the JS thread. An unlocked {@code std::unordered_map} under that pattern
-   * does not usually throw; it corrupts a bucket chain and either loses a slot
-   * or returns the wrong one, which on the JS side is a tile drawn with another
-   * tile's pixels. Four writers and a concurrent reader for 200 rounds is enough
-   * to make an unguarded map fail reliably.
-   */
-  @Test
-  public void concurrentStoresAndTakesKeepTheirOwnBytes() throws Exception {
-    final int threads = 4;
-    final int rounds = 200;
-    ExecutorService pool = Executors.newFixedThreadPool(threads);
-    try {
-      List<Future<Boolean>> futures = new ArrayList<>();
-      for (int t = 0; t < threads; t++) {
-        final int lane = t;
-        futures.add(
-            pool.submit(
-                (Callable<Boolean>)
-                    () -> {
-                      for (int i = 0; i < rounds; i++) {
-                        byte[] payload = new byte[512];
-                        // Lane-stamped, so a slot returned to the wrong caller is
-                        // detectable rather than merely "some bytes".
-                        for (int b = 0; b < payload.length; b++) {
-                          payload[b] = (byte) ((lane * 37 + i * 11 + b) & 0xFF);
-                        }
-                        long id;
-                        synchronized (PdfCanvasJsiTransportTest.class) {
-                          id = nextSlot();
-                        }
-                        PdfCanvasPixelBridge.nativeStore(id, payload);
-                        byte[] back = PdfCanvasPixelBridge.nativeTakeForTest(id);
-                        if (back == null || !java.util.Arrays.equals(payload, back)) {
-                          return false;
-                        }
-                      }
-                      return true;
-                    }));
-      }
-      for (Future<Boolean> future : futures) {
-        assertTrue("a lane got back bytes it did not store", future.get(60, TimeUnit.SECONDS));
-      }
-      assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-    } finally {
-      pool.shutdownNow();
-    }
-  }
-
-  /**
-   * MEASUREMENT, not verification — the Java-side cost the new transport ADDS.
-   *
-   * The base64 encode it replaces was 19.88 ms p50 for this payload. This is the
-   * number that has to be smaller, and it is the only new cost on the native
-   * side. Logged rather than asserted: a threshold here would fail on a slower
-   * device for a reason that is not a bug.
-   */
-  @Test
-  public void measuresTheStoreCostAgainstTheBase64EncodeItReplaces() {
-    byte[] tile = new byte[1024 * 1024 * 4];
-    for (int i = 0; i < tile.length; i++) tile[i] = (byte) (i & 0xFF);
-
-    final int iterations = 7;
-    long[] store = new long[iterations];
-    long[] encode = new long[iterations];
-    for (int i = 0; i < iterations; i++) {
-      long id = nextSlot();
-      long t0 = System.nanoTime();
-      PdfCanvasPixelBridge.nativeStore(id, tile);
-      store[i] = System.nanoTime() - t0;
-      PdfCanvasPixelBridge.nativeRelease(id);
-
-      long t1 = System.nanoTime();
-      String encoded = Base64.encodeToString(tile, Base64.NO_WRAP);
-      encode[i] = System.nanoTime() - t1;
-      assertTrue(encoded.length() > 0);
-    }
-    java.util.Arrays.sort(store);
-    java.util.Arrays.sort(encode);
-    Log.i(
-        TAG,
-        "PDFCANVAS-TRANSPORT-COST bytes="
-            + tile.length
-            + " storeMs="
-            + (store[iterations / 2] / 1e6)
-            + " base64EncodeMs="
-            + (encode[iterations / 2] / 1e6));
-  }
-
-  /* ================================================================ *
-   * 5. The ONE-COPY fill: Bitmap -> native memory, no Java heap
-   * ================================================================ */
-
-  /**
-   * THE TEST THE ONE-COPY PATH EXISTS TO BE HELD TO.
-   *
-   * {@code renderToNativeSlot} never materialises a {@code byte[]}: the raster
-   * goes from the {@code Bitmap}'s pixels into the slot in one memcpy. So the
-   * only way to know it moved the RIGHT bytes is to render the same request
-   * twice — once down the heap path, once down the direct path — and compare.
-   *
-   * CATCHES everything the heap path is already checked for, because the direct
-   * fill re-derives all of it from {@code AndroidBitmap_getInfo} instead of from
-   * {@code Bitmap.getRowBytes}: a stride disagreement between the NDK and the
-   * Java API (the quadrant boundary would drift one pixel per row), a format
-   * mismatch reading ARGB as something else (R and B swap), and a short copy
-   * (the two arrays would differ in length). It also catches the fill silently
-   * refusing on every device, which would leave the transport correct and
-   * permanently slow with nothing anywhere to say so — hence the assert that
-   * the raster really did come back in a slot.
-   */
-  @Test
-  public void directFillBytesEqualTheHeapPathForARealRaster() throws Exception {
-    File pdf =
-        TestPdfs.quadrants(ctx(), "jsi-direct-quadrants.pdf", TestPdfs.LETTER_W, TestPdfs.LETTER_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      RasterRequest request =
-          new RasterRequest(
-              0, 0f, 0f, TestPdfs.LETTER_W, TestPdfs.LETTER_H, 2f, false,
-              RasterRequest.BACKGROUND_WHITE);
-
-      RasterPixels viaHeap = r.render(request, null);
-      byte[] expected =
-          Base64.decode(Base64.encodeToString(viaHeap.bytes, Base64.NO_WRAP), Base64.DEFAULT);
-
-      long id = nextSlot();
-      RasterPixels viaDirect = r.renderToNativeSlot(request, null, id);
-      assertTrue(
-          "the direct fill refused, so this ran on the heap path and proved nothing "
-              + "about the fill under test",
-          viaDirect.isInNativeSlot());
-      assertEquals(id, viaDirect.slot);
-      assertNull("a slot-backed raster must not also hold a byte[]", viaDirect.bytes);
-      // The geometry has to agree too: it is read from the Bitmap on one path
-      // and cross-checked against the NDK's view of the same Bitmap on the
-      // other, and a disagreement there is what would shear the image.
-      assertEquals(viaHeap.width, viaDirect.width);
-      assertEquals(viaHeap.height, viaDirect.height);
-      assertEquals(viaHeap.rowBytes, viaDirect.rowBytes);
-      assertEquals(viaHeap.format, viaDirect.format);
-
-      byte[] actual = PdfCanvasPixelBridge.nativeTakeForTest(id);
-      assertNotNull("the slot came back empty", actual);
-      assertEquals(
-          "length differs: " + expected.length + " vs " + actual.length,
-          expected.length,
-          actual.length);
-      assertArrayEquals(expected, actual);
-      assertEquals(
-          "the take must have emptied the slot", 0, PdfCanvasPixelBridge.nativeSlotCount());
-
-      Log.i(
-          TAG,
-          "PDFCANVAS-DIRECT identical bytes="
-              + actual.length
-              + " ("
-              + viaDirect.width
-              + "x"
-              + viaDirect.height
-              + " rowBytes="
-              + viaDirect.rowBytes
-              + ")");
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * The same claim at the FIELD'S tile size, for the same reason the heap path
-   * is checked twice: a 4 MiB memcpy is a different call from a 40 KiB one.
-   *
-   * CATCHES an {@code int} overflow or a truncating cast in the byteCount
-   * cross-check — {@code stride * height} is computed in 64-bit on the native
-   * side precisely so a 32-bit product cannot wrap into agreement.
-   */
-  @Test
-  public void directFillBytesEqualTheHeapPathForAFieldSizedTile() throws Exception {
-    File pdf =
-        TestPdfs.pattern(ctx(), "jsi-direct-tile.pdf", TestPdfs.LETTER_W, TestPdfs.LETTER_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      final float scale = 131.25f;
-      final float points = 1024f / scale;
-      RasterRequest request =
-          new RasterRequest(
-              0, 0f, 0f, points, points, scale, false, RasterRequest.BACKGROUND_WHITE);
-
-      RasterPixels viaHeap = r.render(request, null);
-      assertEquals(1024, viaHeap.width);
-      assertEquals(1024 * 1024 * 4, viaHeap.bytes.length);
-
-      long id = nextSlot();
-      RasterPixels viaDirect = r.renderToNativeSlot(request, null, id);
-      assertTrue("the direct fill refused", viaDirect.isInNativeSlot());
-
-      byte[] actual = PdfCanvasPixelBridge.nativeTakeForTest(id);
-      assertNotNull(actual);
-      assertArrayEquals(viaHeap.bytes, actual);
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * CATCHES: a slot-backed raster pretending its pixels are readable.
-   *
-   * {@code RasterPixels.bytes} is null on this path, so every pixel accessor is
-   * a latent NPE from somewhere deep in a caller. They throw by name instead,
-   * and that has to stay true — the base64 fallback reads {@code bytes}
-   * directly and the module branches on {@code isInNativeSlot()} to avoid it.
-   */
-  @Test
-  public void aDirectFilledRasterRefusesToBeReadFromJava() throws Exception {
-    File pdf = TestPdfs.quadrants(ctx(), "jsi-direct-read.pdf", 200, 300);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      long id = nextSlot();
-      RasterPixels px =
-          r.renderToNativeSlot(
-              new RasterRequest(0, 0f, 0f, 200f, 300f, 1f, false,
-                  RasterRequest.BACKGROUND_WHITE),
-              null,
-              id);
-      assertTrue(px.isInNativeSlot());
-      try {
-        px.channel(1, 1, 0);
-        throw new AssertionError("channel() read a raster that is not on the Java heap");
-      } catch (IllegalStateException expected) {
-        assertTrue(
-            "the message must name the slot: " + expected.getMessage(),
-            expected.getMessage().contains(String.valueOf(id)));
-      }
-
-      // And release() is what the abandon paths call, so it has to actually free.
-      assertEquals(1, PdfCanvasPixelBridge.nativeSlotCount());
-      px.release();
-      assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-      // Idempotent: PdfCanvasModule's finally can run after the rasterizer has
-      // already released the same raster.
-      px.release();
-      assertEquals(0, PdfCanvasPixelBridge.nativeSlotCount());
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * CATCHES: THE LEAK. A cancel observed AFTER the draw finished must not strand
-   * the raster it already filled.
-   *
-   * This is the one abandon path inside the rasterizer, and it is not
-   * hypothetical: a superseded epoch produces a stream of late cancels, so a
-   * miss here is megabytes of native memory per gesture, freed only by the next
-   * reload. On the heap path the dropped {@code byte[]} was simply collected and
-   * there was nothing to get wrong — which is exactly why this needs its own
-   * test now.
-   *
-   * The cancel has to land inside the render window to reach the post-draw
-   * check, and the window is device-dependent, so the delay is adapted the same
-   * way {@code PdfCanvasCancellationTest} adapts it: a cancel reported at any
-   * other stage is retried rather than accepted. Reaching the window is
-   * ASSERTED — a run that never got there has not tested the leak.
-   */
-  @Test
-  public void cancellingAfterTheDrawLeavesNoSlotBehind() throws Exception {
-    File pdf =
-        TestPdfs.pattern(ctx(), "jsi-direct-cancel.pdf", TestPdfs.ARCH_D_W, TestPdfs.ARCH_D_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      // Big destination, because S1 finding 2 says cost tracks bitmap area.
-      RasterRequest heavy =
-          new RasterRequest(
-              0, 200f, 300f, 800f, 800f, 2f, false, RasterRequest.BACKGROUND_WHITE);
-
-      long baselineMs = Long.MAX_VALUE;
-      for (int i = 0; i < 3; i++) {
-        long t = System.nanoTime();
-        r.render(heavy, null);
-        baselineMs = Math.min(baselineMs, (System.nanoTime() - t) / 1_000_000);
-      }
-
-      long delayMs = Math.max(5, baselineMs / 2);
-      boolean reachedPostDraw = false;
-
-      for (int attempt = 0; attempt < 8 && !reachedPostDraw; attempt++) {
-        PdfCanvasPixelBridge.nativeReleaseAll();
-        final long id = nextSlot();
-        final RasterCancellation signal = new RasterCancellation();
-        final CountDownLatch started = new CountDownLatch(1);
-        final AtomicReference<PdfRasterException> thrown = new AtomicReference<>();
-        final AtomicReference<RasterPixels> returned = new AtomicReference<>();
-
-        Thread worker =
-            new Thread(
-                () -> {
-                  started.countDown();
-                  try {
-                    returned.set(r.renderToNativeSlot(heavy, signal, id));
-                  } catch (PdfRasterException e) {
-                    thrown.set(e);
-                  }
-                });
-        worker.start();
-        assertTrue(started.await(10, TimeUnit.SECONDS));
-        Thread.sleep(delayMs);
-        signal.cancel();
-        worker.join(120_000);
-
-        PdfRasterException e = thrown.get();
-        if (e == null) {
-          // Landed after the render returned: the raster is legitimately parked.
-          assertNotNull(returned.get());
-          returned.get().release();
-          delayMs = Math.max(2, delayMs / 2);
-          continue;
-        }
-        assertEquals(PdfErrorCode.CANCELLED, e.code());
-        if (!e.getMessage().contains("after render")) {
-          // Landed before the draw. Nothing was filled, so nothing can leak —
-          // but assert that too, since a slot allocated early would show here.
-          assertEquals(
-              "a cancel before the draw must not have filled a slot",
-              0,
-              PdfCanvasPixelBridge.nativeSlotCount());
-          delayMs = Math.max(delayMs * 2, delayMs + 5);
-          continue;
-        }
-
-        reachedPostDraw = true;
-        assertEquals(
-            "a raster cancelled AFTER it was drawn left its slot behind — nothing "
-                + "will ever take it",
-            0,
-            PdfCanvasPixelBridge.nativeSlotCount());
-        assertNull(PdfCanvasPixelBridge.nativeTakeForTest(id));
-      }
-
-      assertTrue(
-          "never managed to cancel inside the render window, so the post-draw abandon "
-              + "path was not exercised; baseline=" + baselineMs + "ms",
-          reachedPostDraw);
-    } finally {
-      r.close();
-    }
-  }
-
-  /**
-   * MEASUREMENT, not verification — what the one-copy fill is worth per tile.
-   *
-   * Three numbers on the same payload and the same thread: the direct fill, the
-   * two-copy store it replaces (allocate a {@code byte[]},
-   * {@code copyPixelsToBuffer} into it, then {@code nativeStore} it), and the
-   * base64 encode both replace. The DIFFERENCE between the first two is the whole
-   * claim of this change, and it is a difference of one full-raster ART
-   * allocation plus one full-raster memcpy.
-   *
-   * Logged, never asserted: a threshold would fail on a slower device for a
-   * reason that is not a bug. See {@code PdfCanvasPhaseTimingTest} for the number
-   * that actually decides whether this was worth shipping — per-tile cost inside
-   * the lane schedule, where the render executor is the serialised bottleneck.
-   */
-  @Test
-  public void measuresTheDirectFillAgainstTheTwoCopyStoreItReplaces() throws Exception {
-    File pdf =
-        TestPdfs.pattern(ctx(), "jsi-direct-cost.pdf", TestPdfs.LETTER_W, TestPdfs.LETTER_H);
-    PdfCanvasRasterizer r = PdfCanvasRasterizer.openFile(pdf, null, 1);
-    try {
-      final float scale = 131.25f;
-      final float points = 1024f / scale;
-      RasterRequest request =
-          new RasterRequest(
-              0, 0f, 0f, points, points, scale, false, RasterRequest.BACKGROUND_WHITE);
-
-      final int iterations = 7;
-      long[] direct = new long[iterations];
-      long[] twoCopy = new long[iterations];
-      long[] encode = new long[iterations];
-
-      // Warm both paths so the first sample is not paying for class init.
-      r.render(request, null);
-      long warmId = nextSlot();
-      r.renderToNativeSlot(request, null, warmId).release();
-
-      for (int i = 0; i < iterations; i++) {
-        // The whole render is inside the clock for both, because the phase this
-        // change touches cannot be separated from it: the fill happens while the
-        // Bitmap is still alive, inside the rasterizer.
-        long id = nextSlot();
-        long t0 = System.nanoTime();
-        RasterPixels viaDirect = r.renderToNativeSlot(request, null, id);
-        direct[i] = System.nanoTime() - t0;
-        assertTrue(viaDirect.isInNativeSlot());
-        viaDirect.release();
-
-        long id2 = nextSlot();
-        long t1 = System.nanoTime();
-        RasterPixels viaHeap = r.render(request, null);
-        PdfCanvasPixelBridge.nativeStore(id2, viaHeap.bytes);
-        twoCopy[i] = System.nanoTime() - t1;
-        PdfCanvasPixelBridge.nativeRelease(id2);
-
-        long t2 = System.nanoTime();
-        String encoded = Base64.encodeToString(viaHeap.bytes, Base64.NO_WRAP);
-        encode[i] = System.nanoTime() - t2;
-        assertTrue(encoded.length() > 0);
-      }
-
-      java.util.Arrays.sort(direct);
-      java.util.Arrays.sort(twoCopy);
-      java.util.Arrays.sort(encode);
-      Log.i(
-          TAG,
-          String.format(
-              "PDFCANVAS-DIRECT-COST 1024x1024  render+directFill=%.2f ms"
-                  + "  render+heap+nativeStore=%.2f ms  saved=%.2f ms"
-                  + "  (base64 encode alone=%.2f ms)",
-              direct[iterations / 2] / 1e6,
-              twoCopy[iterations / 2] / 1e6,
-              (twoCopy[iterations / 2] - direct[iterations / 2]) / 1e6,
-              encode[iterations / 2] / 1e6));
-    } finally {
-      r.close();
-    }
-  }
-}