@reekon-tools/react-native-pdf-canvas 0.1.0 → 0.2.0

package/ios/Tests/PdfCanvasCoreTests/SinkTests.swift

@@ -1,287 +0,0 @@
-import Foundation
-import XCTest
-
-@testable import PdfCanvasCore
-
-/**
- A recording sink, standing in for the JSI slot store.
-
- The real one lives in `ios/Sources/PdfCanvasBridge/PdfCanvasSlots.mm`, which
- SwiftPM cannot build — it needs `<jsi/jsi.h>` from a pod. What CAN be proven here
- is the CONTRACT: reserve once, before the draw; publish last; abandon on every path
- that drops a raster. Those are the three properties whose violation is a leak or a
- use-after-free rather than a wrong pixel, so they are worth pinning without a
- device.
- */
-class RecordingSink: NSObject, PdfCanvasPixelSink {
-  /// Set to refuse the reservation, which is the fallback-to-heap path.
-  var refuse = false
-  var reserveCount = 0
-  var publishCount = 0
-  var abandonCount = 0
-  /// The identifier `publish` hands back. Non-zero means "in a native slot".
-  var slot: Int64 = 4242
-
-  private var storage: UnsafeMutableRawPointer?
-  private var length = 0
-  private(set) var published = false
-
-  /// The reserved bytes, so a test can check what CoreGraphics wrote into them.
-  func bytes() -> [UInt8] {
-    guard let storage else { return [] }
-    return Array(UnsafeRawBufferPointer(start: storage, count: length))
-  }
-
-  @objc dynamic func pdfCanvasReserveBytes(_ length: UInt) -> UnsafeMutableRawPointer? {
-    reserveCount += 1
-    if refuse { return nil }
-    self.length = Int(length)
-    // `calloc`, because ZEROED IS PART OF THE SINK CONTRACT — it is what makes
-    // `background: transparent` free and what stops a published buffer ever
-    // handing out memory nobody wrote.
-    storage = calloc(Int(length), 1)
-    return storage
-  }
-
-  func pdfCanvasPublish() -> Int64 {
-    publishCount += 1
-    published = true
-    return slot
-  }
-
-  func pdfCanvasAbandon() {
-    abandonCount += 1
-    if let storage {
-      free(storage)
-      self.storage = nil
-      length = 0
-    }
-  }
-
-  deinit {
-    if let storage { free(storage) }
-  }
-}
-
-final class SinkTests: XCTestCase {
-
-  private func rasterizer() throws -> PdfCanvasRasterizer {
-    try openFixture(TestPdfs.quadrants(width: 200, height: 100), name: "sink.pdf")
-  }
-
-  /**
-   A sink gets exactly one reservation, one publish, and no abandon.
-
-   The counts matter more than they look: a second reservation would mean the
-   rasterizer had drawn twice, and an abandon on the happy path would free the
-   buffer the caller is about to redeem.
-   */
-  func testTheHappyPathReservesOnceAndPublishesOnce() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    let pixels = try r.render(
-      request(width: 200, height: 100, scale: 2), cancellation: nil, sink: sink)
-
-    XCTAssertEqual(sink.reserveCount, 1)
-    XCTAssertEqual(sink.publishCount, 1)
-    XCTAssertEqual(sink.abandonCount, 0)
-    XCTAssertTrue(pixels.isInNativeSlot)
-    XCTAssertEqual(pixels.slot, 4242)
-    XCTAssertNil(pixels.bytes, "a slot-backed raster has no heap bytes")
-    r.close()
-  }
-
-  /**
-   The bytes CoreGraphics wrote are the sink's own buffer — no copy anywhere.
-
-   This is the whole point of the sink protocol: `CGBitmapContextCreate` takes the
-   destination pointer, so the raster is written once, by the rasterizer, into
-   memory the transport already owns. Android's fast path costs one full-raster
-   memcpy and cannot do better, because `PdfRenderer` owns its `Bitmap`'s pixels.
-   */
-  func testCoreGraphicsWritesStraightIntoTheSinksBuffer() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    let pixels = try r.render(
-      request(width: 200, height: 100, scale: 1), cancellation: nil, sink: sink)
-    XCTAssertTrue(pixels.isInNativeSlot)
-
-    let bytes = sink.bytes()
-    XCTAssertEqual(bytes.count, 200 * 100 * 4)
-    // Doc top-left is the PDF's top-left, which the fixture paints blue.
-    XCTAssertEqual([bytes[0], bytes[1], bytes[2], bytes[3]], [0, 0, 255, 255])
-    // And the same raster rendered to the heap agrees byte for byte.
-    let heap = try r.render(
-      request(width: 200, height: 100, scale: 1), cancellation: nil, sink: nil)
-    XCTAssertEqual(bytes, Array(heap.bytes!))
-    r.close()
-  }
-
-  /**
-   A REFUSED reservation falls through to the heap, and the tile still goes out.
-
-   The refusal happens before anything is drawn, so it costs nothing — which is the
-   structural advantage over Android, where `nativeStoreFromBitmap` can only refuse
-   after the raster exists.
-   */
-  func testARefusedReservationFallsBackToTheHeap() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    sink.refuse = true
-    let pixels = try r.render(
-      request(width: 200, height: 100, scale: 1), cancellation: nil, sink: sink)
-
-    XCTAssertEqual(sink.reserveCount, 1, "asked once")
-    XCTAssertEqual(sink.publishCount, 0, "and never published to")
-    XCTAssertFalse(pixels.isInNativeSlot, "the result must be heap-backed")
-    XCTAssertEqual(pixels.slot, 0)
-    XCTAssertNotNil(pixels.bytes)
-    // And it is a correct raster, not a degraded one.
-    assertPixel(pixels, 10, 10, .blue)
-    assertPixel(pixels, 190, 90, .green)
-    r.close()
-  }
-
-  /// A nil sink is the heap, which is what every pixel-reading caller uses.
-  func testANilSinkProducesAHeapRaster() throws {
-    let r = try rasterizer()
-    let pixels = try r.render(
-      request(width: 200, height: 100, scale: 1), cancellation: nil, sink: nil)
-    XCTAssertFalse(pixels.isInNativeSlot)
-    XCTAssertEqual(pixels.slot, 0)
-    XCTAssertNotNil(pixels.bytes)
-    r.close()
-  }
-
-  /**
-   A raster ABANDONED after the draw releases its sink.
-
-   The one path the rasterizer owns: a cancellation observed after the pixels are
-   already finished. Without the abandon, a superseded epoch strands one whole
-   raster per tile in a process-wide map — megabytes per gesture, freed only by the
-   next teardown.
-   */
-  func testACancellationAfterTheDrawAbandonsTheSink() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    let signal = PdfCanvasCancellation()
-    // `PdfCanvasCancellation` is checked before start, after the pool wait, and
-    // after the draw. Cancelling up front would be caught by the first check and
-    // would never reach the sink, so this test needs the signal to fire only once
-    // the reservation has happened — which is what a subclass that cancels inside
-    // `reserveBytes` gives it.
-    final class CancelOnReserve: RecordingSink {
-      var signal: PdfCanvasCancellation?
-      override func pdfCanvasReserveBytes(_ length: UInt) -> UnsafeMutableRawPointer? {
-        let pointer = super.pdfCanvasReserveBytes(length)
-        signal?.cancel()
-        return pointer
-      }
-    }
-    let cancelling = CancelOnReserve()
-    cancelling.signal = signal
-
-    XCTAssertThrowsError(
-      try r.render(
-        request(width: 200, height: 100, scale: 1), cancellation: signal,
-        sink: cancelling)
-    ) { error in
-      XCTAssertEqual(PdfCanvasErrorCodeOf(error as NSError), .cancelled)
-      XCTAssertTrue(
-        (error as NSError).localizedDescription.contains("after render"),
-        "the stage should say the draw had already finished: "
-          + (error as NSError).localizedDescription)
-    }
-    XCTAssertEqual(cancelling.reserveCount, 1)
-    XCTAssertEqual(cancelling.publishCount, 0, "never published")
-    XCTAssertEqual(cancelling.abandonCount, 1, "and released")
-    _ = sink
-    r.close()
-  }
-
-  /**
-   A refusal is NOT an error, which is the half of the fallback worth stating.
-
-   `out-of-memory` is reserved for a request neither destination can serve, and
-   that case is not reachable deterministically from here: the heap path allocates
-   through `NSMutableData dataWithLength:`, and the only size that reliably fails is
-   one the 64 Mpx backstop rejects first — which is a different error, covered by
-   `testAnAbsurdRasterIsRefused`. So what this pins is the boundary: a refusing sink
-   produces a raster, not a failure.
-   */
-  func testARefusalIsNotAnError() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    sink.refuse = true
-    let pixels = try r.render(
-      request(width: 10, height: 10, scale: 1), cancellation: nil, sink: sink)
-    XCTAssertFalse(pixels.isInNativeSlot)
-    XCTAssertEqual(pixels.width, 10)
-    r.close()
-  }
-
-  /**
-   `releaseSlot` is idempotent and a no-op for a heap raster.
-
-   Called from every abandon path in the binding above it, some of which overlap —
-   a `@finally` that releases unless the slot was handed to the promise can
-   legitimately run after a take.
-   */
-  func testReleaseSlotIsIdempotent() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    let pixels = try r.render(
-      request(width: 20, height: 20, scale: 1), cancellation: nil, sink: sink)
-    XCTAssertEqual(sink.abandonCount, 0)
-    pixels.releaseSlot()
-    XCTAssertEqual(sink.abandonCount, 1)
-    pixels.releaseSlot()
-    pixels.releaseSlot()
-    XCTAssertEqual(sink.abandonCount, 1, "idempotent")
-
-    let heap = try r.render(
-      request(width: 20, height: 20, scale: 1), cancellation: nil, sink: nil)
-    heap.releaseSlot()  // must not crash and must do nothing
-    XCTAssertNotNil(heap.bytes)
-    r.close()
-  }
-
-  /// Reading pixels off a slot-backed raster fails by name rather than by NPE.
-  func testReadingASlotBackedRasterRaises() throws {
-    let r = try rasterizer()
-    let sink = RecordingSink()
-    let pixels = try r.render(
-      request(width: 20, height: 20, scale: 1), cancellation: nil, sink: sink)
-    // `NSException` from Objective-C is not a Swift error, so this is checked
-    // through the property that is safe to read instead. The message is what a
-    // developer sees, and it is asserted in the ObjC unit of the binding suite.
-    XCTAssertTrue(pixels.isInNativeSlot)
-    XCTAssertNil(pixels.bytes)
-    r.close()
-  }
-
-  /**
-   The heap sink zeroes its buffer, which is the contract `transparent` relies on.
-
-   Checked directly rather than through a render, because a render with a white
-   background would overwrite the evidence.
-   */
-  func testTheHeapSinkReservesZeroedMemory() {
-    let sink = PdfCanvasHeapSink()
-    let pointer = sink.pdfCanvasReserveBytes(1024)
-    XCTAssertNotNil(pointer)
-    let bytes = Array(UnsafeRawBufferPointer(start: pointer!, count: 1024))
-    XCTAssertTrue(bytes.allSatisfy { $0 == 0 }, "reserveBytes must zero")
-    XCTAssertEqual(sink.pdfCanvasPublish(), 0, "the heap sink has no identifier")
-    XCTAssertNotNil(sink.data)
-    sink.pdfCanvasAbandon()
-    XCTAssertNil(sink.data)
-  }
-
-  /// A second reservation on one sink is refused, so a double draw cannot happen quietly.
-  func testTheHeapSinkRefusesASecondReservation() {
-    let sink = PdfCanvasHeapSink()
-    XCTAssertNotNil(sink.pdfCanvasReserveBytes(64))
-    XCTAssertNil(sink.pdfCanvasReserveBytes(64))
-  }
-}

package/ios/Tests/PdfCanvasCoreTests/SlotsTests.swift

@@ -1,396 +0,0 @@
-import Foundation
-import XCTest
-
-@testable import PdfCanvasCore
-@testable import PdfCanvasSlots
-
-/**
- The REAL slot store — the same storage the device runs, not a double.
-
- `SinkTests.swift` covers the sink CONTRACT with a recording double, which is the right
- tool for "does the rasterizer reserve once and abandon on the cancel path". This file
- covers the storage itself, and the reason it can is an `#if __has_include(<jsi/jsi.h>)`
- in `PdfCanvasSlots.mm`: with the header absent, `PdfCanvasSlotsInstall` reports NO and
- everything else — allocate, fill, publish, take, release — compiles and runs on a
- laptop. Android draws the identical split for the identical reason.
-
- WHY IT IS WORTH THE IFDEF. Every failure mode here is a leak or a use-after-free rather
- than a wrong pixel, so a device session does not show any of them: 48 tiles rendered
- correctly on an iPhone with the store leaking every superseded raster would look exactly
- like 48 tiles rendered correctly. The one thing the ifdef does not cover is the JSI call
- itself, and that is proven on device by the negotiation probe.
- */
-final class SlotsTests: XCTestCase {
-
-  override func setUp() {
-    super.setUp()
-    // The store is process-wide, and these tests assert on its size. Draining first
-    // makes each one independent of whatever the last left behind — including a
-    // deliberate leak a test was checking for.
-    PdfCanvasSlotsReleaseAll()
-  }
-
-  override func tearDown() {
-    PdfCanvasSlotsReleaseAll()
-    super.tearDown()
-  }
-
-  // ---------------------------------------------------------------- //
-  // The probe
-  // ---------------------------------------------------------------- //
-
-  /**
-   The probe bytes are the ones the TypeScript side and Android both expect.
-
-   Three copies of this list exist — here, `TRANSPORT_PROBE_BYTES` in
-   `native-bridge.ts`, and `PdfCanvasPixelBridge.PROBE_BYTES` in Java — and they are
-   restated rather than derived on purpose: they are the only place the transport's byte
-   fidelity is asserted, so a mismatch has to make the probe FAIL and the platform fall
-   back to base64, not silently pass with different bytes.
-   */
-  func testProbeBytesMatchTheSharedList() {
-    let expected: [UInt8] = [0x00, 0x01, 0x02, 0xFD, 0xFE, 0xFF, 0x2A, 0x07]
-    XCTAssertEqual(Array(PdfCanvasSlotsProbeBytes()), expected)
-  }
-
-  /// The probe round-trips through the real store, which is what `negotiateTransport` does.
-  func testTheProbeRoundTrips() {
-    let slot = PdfCanvasSlotsStoreProbe()
-    XCTAssertGreaterThan(slot, 0, "a published slot id is never 0 — that is the heap sentinel")
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1)
-    let taken = PdfCanvasSlotsTakeForTest(slot)
-    XCTAssertEqual(taken.map { Array($0) }, Array(PdfCanvasSlotsProbeBytes()))
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0, "a take removes the slot")
-  }
-
-  // ---------------------------------------------------------------- //
-  // Taken exactly once
-  // ---------------------------------------------------------------- //
-
-  /**
-   A slot is taken EXACTLY once, and a second take finds nothing.
-
-   The host function reports "nothing" by throwing, and that is deliberate: an empty
-   `ArrayBuffer` would reach Skia and draw a black tile. So the storage has to actually
-   erase, not merely hand out a copy.
-   */
-  func testASlotIsTakenExactlyOnce() {
-    let slot = PdfCanvasSlotsStoreProbe()
-    XCTAssertNotNil(PdfCanvasSlotsTakeForTest(slot))
-    XCTAssertNil(PdfCanvasSlotsTakeForTest(slot), "the second take must find nothing")
-    XCTAssertNil(PdfCanvasSlotsTakeForTest(slot))
-  }
-
-  /// Slot ids are monotonic per process, which is what makes a collision unrepresentable.
-  func testSlotIdsAreMonotonic() {
-    var ids: [Int64] = []
-    for _ in 0..<8 { ids.append(PdfCanvasSlotsStoreProbe()) }
-    XCTAssertEqual(ids, ids.sorted(), "ids must increase")
-    XCTAssertEqual(Set(ids).count, ids.count, "and never repeat")
-    XCTAssertEqual(PdfCanvasSlotsCount(), 8)
-  }
-
-  /**
-   Ids are NOT reused after a take.
-
-   Android's C++ has to REFUSE a colliding id, because its ids are handed in from Java
-   and React Native builds a fresh module on every reload while the old one may still
-   have rasters parked — an overwrite there would hand one module another module's
-   raster, which is a wrong image rather than an error. Allocating the id inside the
-   store, next to the map, removes that whole failure class; this pins it.
-   */
-  func testIdsAreNotReusedAfterATake() {
-    let first = PdfCanvasSlotsStoreProbe()
-    _ = PdfCanvasSlotsTakeForTest(first)
-    let second = PdfCanvasSlotsStoreProbe()
-    XCTAssertGreaterThan(second, first, "a freed id must not come back")
-  }
-
-  // ---------------------------------------------------------------- //
-  // Release
-  // ---------------------------------------------------------------- //
-
-  func testReleaseDropsOneSlotAndIsIdempotent() {
-    let a = PdfCanvasSlotsStoreProbe()
-    let b = PdfCanvasSlotsStoreProbe()
-    XCTAssertEqual(PdfCanvasSlotsCount(), 2)
-    PdfCanvasSlotsRelease(a)
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1)
-    PdfCanvasSlotsRelease(a)
-    PdfCanvasSlotsRelease(a)
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1, "releasing twice is a no-op")
-    XCTAssertNil(PdfCanvasSlotsTakeForTest(a))
-    XCTAssertNotNil(PdfCanvasSlotsTakeForTest(b), "the other slot is untouched")
-  }
-
-  /**
-   `releaseAll` drains everything, which is what a Fast Refresh depends on.
-
-   A reload drops the JS side without calling `close`, so every slot whose promise
-   resolved but whose continuation never ran is a whole raster — megabytes — held in C++
-   with nothing left that could take it. `PdfCanvasModule.invalidate` calls this.
-   */
-  func testReleaseAllDrainsTheStore() {
-    for _ in 0..<16 { _ = PdfCanvasSlotsStoreProbe() }
-    XCTAssertEqual(PdfCanvasSlotsCount(), 16)
-    PdfCanvasSlotsReleaseAll()
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-    PdfCanvasSlotsReleaseAll()
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0, "draining an empty store is a no-op")
-  }
-
-  /// Releasing a slot id that never existed does nothing, rather than corrupting the map.
-  func testReleasingAnUnknownSlotIsHarmless() {
-    let real = PdfCanvasSlotsStoreProbe()
-    PdfCanvasSlotsRelease(0)
-    PdfCanvasSlotsRelease(-1)
-    PdfCanvasSlotsRelease(real + 100_000)
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1)
-    XCTAssertNotNil(PdfCanvasSlotsTakeForTest(real))
-  }
-
-  // ---------------------------------------------------------------- //
-  // The real sink, through the real rasterizer
-  // ---------------------------------------------------------------- //
-
-  /**
-   THE HEADLINE: the bytes taken out of a slot are byte-identical to the same raster
-   rendered to the heap.
-
-   This is the transport's whole promise, and it is the one thing that cannot be checked
-   by looking at the code: CoreGraphics is handed a pointer into a `SlotBuffer` and
-   writes the tile in place, so if the buffer, the stride or the publish were wrong the
-   result would be a plausible-looking wrong image rather than an error. Its Android
-   counterpart is `directFillBytesEqualTheHeapPathForARealRaster`, which has to run on a
-   device; this one runs on a laptop.
-   */
-  func testSlotBytesAreIdenticalToTheHeapPathForARealRaster() throws {
-    let rasterizer = try openFixture(
-      TestPdfs.grid(width: 400, height: 300), name: "slots-fidelity.pdf")
-
-    let req = request(x: 37, y: 23, width: 64, height: 41, scale: 4)
-    let heap = try rasterizer.render(req, cancellation: nil, sink: nil)
-    XCTAssertNotNil(heap.bytes)
-
-    let sink = PdfCanvasSlotSink()
-    let slotted = try rasterizer.render(req, cancellation: nil, sink: sink)
-    XCTAssertTrue(slotted.isInNativeSlot, "the real sink must produce a slot")
-    XCTAssertNil(slotted.bytes, "and no heap bytes")
-    XCTAssertEqual(slotted.width, heap.width)
-    XCTAssertEqual(slotted.height, heap.height)
-    XCTAssertEqual(slotted.rowBytes, heap.rowBytes)
-
-    let taken = PdfCanvasSlotsTakeForTest(slotted.slot)
-    XCTAssertNotNil(taken, "the slot must still be there before anyone takes it")
-    XCTAssertEqual(
-      Array(taken!), Array(heap.bytes!),
-      "the slot path and the heap path must produce identical bytes")
-    XCTAssertEqual(taken!.count, heap.rowBytes * heap.height)
-    rasterizer.close()
-  }
-
-  /// And on a transparent background, where the untouched bytes are the reserved zeroes.
-  func testSlotBytesMatchTheHeapPathOnATransparentBackground() throws {
-    let rasterizer = try openFixture(
-      TestPdfs.page(mediaBox: (0, 0, 100, 100), content: "1 0 0 rg 0 0 40 40 re f\n"),
-      name: "slots-transparent.pdf")
-    let req = request(width: 100, height: 100, scale: 2, background: .transparent)
-    let heap = try rasterizer.render(req, cancellation: nil, sink: nil)
-    let sink = PdfCanvasSlotSink()
-    let slotted = try rasterizer.render(req, cancellation: nil, sink: sink)
-    let taken = PdfCanvasSlotsTakeForTest(slotted.slot)
-    XCTAssertEqual(Array(taken!), Array(heap.bytes!))
-    // And the reserved memory really was zeroed — otherwise the untouched area would
-    // carry whatever the allocator had, which is the "tile of somebody else's heap"
-    // failure the value-initialised buffer exists to prevent.
-    let bytes = Array(taken!)
-    let cornerOffset = 10 * heap.rowBytes + 190 * 4
-    XCTAssertEqual(
-      Array(bytes[cornerOffset..<(cornerOffset + 4)]), [0, 0, 0, 0],
-      "unpainted area on a transparent background must be exactly zero")
-    rasterizer.close()
-  }
-
-  /**
-   A raster the rasterizer ABANDONS leaves nothing in the store.
-
-   The path is a cancellation observed after the draw finished. Without the abandon a
-   superseded epoch strands one whole raster per tile — megabytes per gesture, freed only
-   by the next reload — and nothing about the rendered output would look wrong.
-   */
-  func testAnAbandonedRasterLeavesNoSlotBehind() throws {
-    let rasterizer = try openFixture(
-      TestPdfs.grid(width: 200, height: 200), name: "slots-abandon.pdf")
-    let signal = PdfCanvasCancellation()
-
-    // A sink that cancels once the buffer is reserved, so the cancel lands after the
-    // draw rather than before it.
-    final class CancelOnReserve: PdfCanvasSlotSink {
-      var signal: PdfCanvasCancellation?
-      override func pdfCanvasReserveBytes(_ length: UInt) -> UnsafeMutableRawPointer? {
-        let pointer = super.pdfCanvasReserveBytes(length)
-        signal?.cancel()
-        return pointer
-      }
-    }
-    let sink = CancelOnReserve()
-    sink.signal = signal
-
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-    XCTAssertThrowsError(
-      try rasterizer.render(
-        request(width: 200, height: 200, scale: 2), cancellation: signal, sink: sink)
-    ) { error in
-      XCTAssertEqual(PdfCanvasErrorCodeOf(error as NSError), .cancelled)
-    }
-    XCTAssertEqual(
-      PdfCanvasSlotsCount(), 0,
-      "the abandoned raster must not be parked in the store")
-    rasterizer.close()
-  }
-
-  /// `releaseSlot` on a published raster takes it back out of the store.
-  func testReleaseSlotOnAPublishedRasterDrainsIt() throws {
-    let rasterizer = try openFixture(
-      TestPdfs.grid(width: 100, height: 100), name: "slots-release.pdf")
-    let pixels = try rasterizer.render(
-      request(width: 100, height: 100, scale: 1), cancellation: nil,
-      sink: PdfCanvasSlotSink())
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1)
-    pixels.releaseSlot()
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-    pixels.releaseSlot()
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0, "idempotent")
-    XCTAssertNil(PdfCanvasSlotsTakeForTest(pixels.slot))
-    rasterizer.close()
-  }
-
-  /// A `releaseSlot` AFTER a successful take is harmless — the normal ordering in the binding.
-  func testReleaseSlotAfterATakeIsHarmless() throws {
-    let rasterizer = try openFixture(
-      TestPdfs.grid(width: 100, height: 100), name: "slots-late-release.pdf")
-    let pixels = try rasterizer.render(
-      request(width: 100, height: 100, scale: 1), cancellation: nil,
-      sink: PdfCanvasSlotSink())
-    XCTAssertNotNil(PdfCanvasSlotsTakeForTest(pixels.slot))
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-    pixels.releaseSlot()  // must not crash, must not free anything else
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-    rasterizer.close()
-  }
-
-  /**
-   A sink is single-use: a second reservation is refused.
-
-   Which is what makes "reserve once, before the draw" enforceable rather than merely
-   documented — a rasterizer that drew twice into one sink would otherwise silently
-   publish the second draw.
-   */
-  func testASinkRefusesASecondReservation() {
-    let sink = PdfCanvasSlotSink()
-    XCTAssertNotNil(sink.pdfCanvasReserveBytes(1024))
-    XCTAssertNil(sink.pdfCanvasReserveBytes(1024))
-    XCTAssertNil(sink.pdfCanvasReserveBytes(8))
-  }
-
-  /// A zero-length reservation is refused rather than publishing an empty buffer.
-  func testAZeroLengthReservationIsRefused() {
-    let sink = PdfCanvasSlotSink()
-    XCTAssertNil(sink.pdfCanvasReserveBytes(0))
-    XCTAssertEqual(sink.pdfCanvasPublish(), 0, "nothing to publish")
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-  }
-
-  /**
-   RESERVE DOES NOT PUBLISH. The buffer is unreachable from the store until `publish`.
-
-   THE SAFETY PROPERTY OF THE WHOLE FILE. A buffer reachable from the process-wide map
-   before it is filled can be freed by `PdfCanvasSlotsReleaseAll` — which runs on
-   another thread, on every Fast Refresh — while CoreGraphics is still writing into it.
-   The Android JSI file calls that outcome "silent heap corruption, weeks from the change
-   that caused it".
-   */
-  func testAReservedBufferIsNotInTheStoreUntilPublished() {
-    let sink = PdfCanvasSlotSink()
-    let pointer = sink.pdfCanvasReserveBytes(4096)
-    XCTAssertNotNil(pointer)
-    XCTAssertEqual(
-      PdfCanvasSlotsCount(), 0,
-      "a reserved-but-unpublished buffer must be unreachable from the store")
-    // Draining now must not touch it — this is the reload-lands-mid-draw case.
-    PdfCanvasSlotsReleaseAll()
-    // Still writable. If releaseAll had freed it, this is where ASan would fire.
-    memset(pointer!, 0xAB, 4096)
-    let slot = sink.pdfCanvasPublish()
-    XCTAssertGreaterThan(slot, 0)
-    XCTAssertEqual(PdfCanvasSlotsCount(), 1)
-    let taken = PdfCanvasSlotsTakeForTest(slot)
-    XCTAssertEqual(taken?.count, 4096)
-    XCTAssertEqual(Array(taken!).first, 0xAB, "the bytes written after the drain survived")
-  }
-
-  /// Reserved memory is zeroed, which is the contract `background: transparent` rests on.
-  func testReservedMemoryIsZeroed() {
-    let sink = PdfCanvasSlotSink()
-    let pointer = sink.pdfCanvasReserveBytes(8192)
-    XCTAssertNotNil(pointer)
-    let bytes = Array(UnsafeRawBufferPointer(start: pointer!, count: 8192))
-    XCTAssertTrue(bytes.allSatisfy { $0 == 0 })
-    sink.pdfCanvasAbandon()
-  }
-
-  /**
-   The store is safe to publish into and take from concurrently.
-
-   The real schedule: several render lanes publishing while the JS thread takes. A map
-   without a lock would corrupt here rather than merely race.
-   */
-  func testConcurrentPublishAndTake() {
-    let lock = NSLock()
-    var slots: [Int64] = []
-    DispatchQueue.concurrentPerform(iterations: 64) { index in
-      let sink = PdfCanvasSlotSink()
-      guard let pointer = sink.pdfCanvasReserveBytes(1024) else {
-        XCTFail("reservation \(index) failed")
-        return
-      }
-      memset(pointer, Int32(index & 0xFF), 1024)
-      let slot = sink.pdfCanvasPublish()
-      lock.lock()
-      slots.append(slot)
-      lock.unlock()
-    }
-    XCTAssertEqual(slots.count, 64)
-    XCTAssertEqual(Set(slots).count, 64, "every publish got its own id")
-    XCTAssertEqual(PdfCanvasSlotsCount(), 64)
-
-    let taken = NSLock()
-    var lengths: [Int] = []
-    DispatchQueue.concurrentPerform(iterations: slots.count) { index in
-      if let data = PdfCanvasSlotsTakeForTest(slots[index]) {
-        taken.lock()
-        lengths.append(data.count)
-        taken.unlock()
-      }
-    }
-    XCTAssertEqual(lengths.count, 64, "every slot was taken exactly once")
-    XCTAssertTrue(lengths.allSatisfy { $0 == 1024 })
-    XCTAssertEqual(PdfCanvasSlotsCount(), 0)
-  }
-
-  /**
-   `PdfCanvasSlotsInstall` reports NO in this build, honestly.
-
-   Not a stub for its own sake: this is the configuration that lets every test above
-   run, and the value it returns is what a build with no JSI genuinely has to say. A
-   `YES` here would be a lie that made the JS side arm a transport it cannot redeem.
-   */
-  func testInstallDeclinesWithoutAJsiRuntime() {
-    XCTAssertFalse(PdfCanvasSlotsInstall(nil))
-    var dummy = 0
-    XCTAssertFalse(
-      PdfCanvasSlotsInstall(&dummy),
-      "the SwiftPM build has no jsi.h, so install must decline rather than "
-        + "dereference whatever it was handed")
-  }
-}