@reekon-tools/react-native-pdf-canvas 0.1.1 → 0.2.0

package/native/core/src/jsi.cpp

@@ -0,0 +1,66 @@
+#include "pdfcanvas/jsi.h"
+
+#include "pdfcanvas/jsi_config.h"
+#include "pdfcanvas/slots.h"
+
+#if PDFCANVAS_HAS_JSI
+#include <jsi/jsi.h>
+#include <string>
+#endif
+
+namespace pdfcanvas {
+
+#if PDFCANVAS_HAS_JSI
+
+bool installTakePixels(void* runtimePointer) {
+  if (runtimePointer == nullptr) return false;
+  auto& runtime = *static_cast<facebook::jsi::Runtime*>(runtimePointer);
+  try {
+    auto name = facebook::jsi::PropNameID::forAscii(runtime, "__pdfCanvasTakePixels");
+    auto take = facebook::jsi::Function::createFromHostFunction(
+        runtime, name, 1,
+        [](facebook::jsi::Runtime& rt, const facebook::jsi::Value&,
+           const facebook::jsi::Value* args, size_t count) -> facebook::jsi::Value {
+          if (count < 1 || !args[0].isNumber()) {
+            throw facebook::jsi::JSError(
+                rt, "__pdfCanvasTakePixels(slot): slot must be a number.");
+          }
+          const auto slot = static_cast<int64_t>(args[0].asNumber());
+          std::shared_ptr<SlotBuffer> buffer = slots::take(slot);
+          if (buffer == nullptr) {
+            // Every slot is taken exactly once, so this means the render that
+            // filled it was torn down (a reload drains every slot) or the same
+            // slot was taken twice. Named rather than silently empty: an empty
+            // ArrayBuffer would reach Skia and draw a black tile.
+            throw facebook::jsi::JSError(
+                rt, "__pdfCanvasTakePixels: no raster is waiting in slot " +
+                        std::to_string(slot) +
+                        ". It was already taken, or the module was invalidated.");
+          }
+          // The ArrayBuffer BORROWS this buffer and the shared_ptr keeps it
+          // alive; the slot map has already dropped its reference, so JS is now
+          // the sole owner and the GC is what frees it.
+          return facebook::jsi::Value(
+              rt, facebook::jsi::ArrayBuffer(rt, std::move(buffer)));
+        });
+    runtime.global().setProperty(runtime, name, take);
+    return true;
+  } catch (...) {
+    // A runtime that refuses to install a host function is a runtime this
+    // package will not use. The JS side falls back to base64.
+    return false;
+  }
+}
+
+#else
+
+bool installTakePixels(void* runtimePointer) {
+  // No JSI in this build. The honest answer, not a stub: there is no runtime
+  // to install into and nothing that could call the host function.
+  (void)runtimePointer;
+  return false;
+}
+
+#endif
+
+}  // namespace pdfcanvas

package/native/core/src/library.cpp

@@ -0,0 +1,52 @@
+#include "pdfcanvas/library.h"
+
+#include <mutex>
+
+#include "fpdfview.h"
+
+namespace pdfcanvas {
+
+std::mutex& Library::mutex() {
+  static std::mutex m;
+  return m;
+}
+
+const char** Library::userFontPaths() {
+#if defined(__ANDROID__)
+  // PDFium's Android font mapper scans /system/fonts on its own; these are the
+  // folders a vendor build may add, and passing them is harmless where the
+  // mapper ignores them.
+  static const char* paths[] = {"/system/fonts", "/system/font", "/data/fonts",
+                                "/product/fonts", nullptr};
+  return paths;
+#elif defined(__APPLE__)
+  // PDFium's Apple mapper adds /System/Library/Fonts itself. On iOS the
+  // system's own fonts sit in subfolders of it, and the folder scan is
+  // recursive, so a PDF that does not embed Helvetica gets the real one where
+  // the sandbox allows the read and PDFium's built-in Foxit Sans where it does
+  // not. Both are legible; only the former is pixel-identical to Preview.
+  static const char* paths[] = {"/System/Library/Fonts", "/Library/Fonts", nullptr};
+  return paths;
+#else
+  return nullptr;
+#endif
+}
+
+void Library::ensureInitialized() {
+  static std::once_flag once;
+  std::call_once(once, [] {
+    FPDF_LIBRARY_CONFIG config{};
+    // Version 2: the newest the header calls stable. m_pIsolate / the embedder
+    // slot only matter for a V8 build, which this is not.
+    config.version = 2;
+    config.m_pUserFontPaths = userFontPaths();
+    config.m_pIsolate = nullptr;
+    config.m_v8EmbedderSlot = 0;
+    FPDF_InitLibraryWithConfig(&config);
+    // FPDF_DestroyLibrary is deliberately never called: the library lives for
+    // the process, and tearing it down while a late render might still be
+    // holding a page is exactly the kind of exit-time crash nobody can debug.
+  });
+}
+
+}  // namespace pdfcanvas

package/native/core/src/pixels.cpp

@@ -0,0 +1,45 @@
+#include "pdfcanvas/pixels.h"
+#include "pdfcanvas/types.h"
+
+#include <cmath>
+#include <limits>
+#include <new>
+
+namespace pdfcanvas {
+
+namespace {
+
+/// `llround`, which is round-half-away-from-zero — what JavaScript's
+/// `Math.round` is for the positive values that reach here (a non-positive
+/// extent is rejected before this is read). `(int)(v + 0.5)` differs at exactly
+/// representable halves and is the version that silently disagrees with the
+/// planner.
+int pixelExtent(double points, double scale) {
+  if (!std::isfinite(points) || !std::isfinite(scale)) return 1;
+  const double product = points * scale;
+  if (product >= static_cast<double>((std::numeric_limits<int>::max)())) {
+    return (std::numeric_limits<int>::max)();
+  }
+  const long long rounded = std::llround(product);
+  return rounded < 1 ? 1 : static_cast<int>(rounded);
+}
+
+}  // namespace
+
+int RasterRequest::pixelWidth() const { return pixelExtent(width, scale); }
+int RasterRequest::pixelHeight() const { return pixelExtent(height, scale); }
+
+uint8_t* HeapSink::reserve(size_t length) {
+  if (reserved_ || length == 0) return nullptr;
+  reserved_ = true;
+  try {
+    // Value-initialised: zeroed, per the sink contract.
+    bytes_.assign(length, 0);
+  } catch (const std::bad_alloc&) {
+    bytes_.clear();
+    return nullptr;
+  }
+  return bytes_.data();
+}
+
+}  // namespace pdfcanvas

package/native/core/src/service.cpp

@@ -0,0 +1,156 @@
+#include "pdfcanvas/service.h"
+
+#include <string>
+
+#include "pdfcanvas/slots.h"
+
+namespace pdfcanvas {
+
+int64_t Service::signalKey(int handle, int64_t token) noexcept {
+  return (static_cast<int64_t>(handle) << 32) | (token & 0xffffffffLL);
+}
+
+Service::Opened Service::open(const Source& source) {
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (invalidated_) {
+      throw PdfError(ErrorCode::BackendFailure, "The PdfCanvas module has been invalidated.");
+    }
+  }
+  // Opened OUTSIDE the service mutex: a parse of a large document must not
+  // block a cancel or a close of some other document.
+  std::shared_ptr<Document> document = Document::open(source);
+
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (invalidated_) {
+    // Invalidated while opening. Nothing has been handed to a caller yet, so
+    // closing here is the whole cleanup.
+    document->close();
+    throw PdfError(ErrorCode::BackendFailure, "The PdfCanvas module was invalidated while opening.");
+  }
+  Opened opened;
+  opened.handle = nextHandle_++;
+  opened.pages = document->pages();
+  documents_.emplace(opened.handle, std::move(document));
+  return opened;
+}
+
+std::shared_ptr<Document> Service::documentFor(int handle) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  auto found = documents_.find(handle);
+  return found == documents_.end() ? nullptr : found->second;
+}
+
+void Service::registerCancellation(int handle, int64_t token) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  signals_[signalKey(handle, token)] = std::make_shared<Cancellation>();
+}
+
+RasterPixels Service::render(int handle, const RasterRequest& request, int64_t token,
+                             bool useSlot) {
+  const int64_t key = signalKey(handle, token);
+  std::shared_ptr<Cancellation> signal;
+  std::shared_ptr<Document> document;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    auto found = signals_.find(key);
+    if (found != signals_.end()) {
+      signal = found->second;
+    } else {
+      // Not registered ahead of time: a caller that dispatched without the
+      // register step. It still gets a signal, so a cancel that arrives while
+      // this render runs is honoured.
+      signal = std::make_shared<Cancellation>();
+      signals_.emplace(key, signal);
+    }
+    auto doc = documents_.find(handle);
+    document = doc == documents_.end() ? nullptr : doc->second;
+  }
+
+  // Unregistered on EVERY path out, including a throw — otherwise a superseded
+  // epoch, which produces a stream of cancelled renders, grows the map for the
+  // life of the module.
+  struct Unregister {
+    Service* service;
+    int64_t key;
+    ~Unregister() {
+      std::lock_guard<std::mutex> lock(service->mutex_);
+      service->signals_.erase(key);
+    }
+  } unregister{this, key};
+
+  if (document == nullptr) {
+    throw PdfError(ErrorCode::BackendFailure,
+                   "No open document for handle " + std::to_string(handle) + ".");
+  }
+
+  // Read ONCE per render: whether to reach for a slot. The sink may still
+  // refuse, in which case the raster comes back heap-backed and the caller
+  // branches on where the pixels ARE, not on what was asked for.
+  if (useSlot) {
+    SlotSink sink;
+    return document->render(request, signal.get(), &sink);
+  }
+  return document->render(request, signal.get(), nullptr);
+}
+
+void Service::cancel(int handle, int64_t token) {
+  std::shared_ptr<Cancellation> signal;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    auto found = signals_.find(signalKey(handle, token));
+    if (found == signals_.end()) return;
+    signal = found->second;
+  }
+  // A pure lookup, deliberately not a speculative insert. "No signal
+  // registered" is far more commonly a cancel that arrived AFTER its render
+  // finished than one that beat its render here, and planting an entry for
+  // each would grow the map forever.
+  signal->cancel();
+}
+
+void Service::close(int handle) {
+  std::shared_ptr<Document> document;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    auto found = documents_.find(handle);
+    if (found == documents_.end()) return;
+    document = std::move(found->second);
+    documents_.erase(found);
+  }
+  // Outside the service mutex: this blocks until an in-flight render on the
+  // document releases the library lock, and a cancel for that render must be
+  // able to get in meanwhile.
+  document->close();
+}
+
+void Service::invalidate() {
+  std::vector<std::shared_ptr<Document>> open;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    invalidated_ = true;
+    for (auto& entry : documents_) open.push_back(std::move(entry.second));
+    documents_.clear();
+    // Every in-flight render observes its signal at the next checkpoint and
+    // stops, so `close()` below waits for at most one progressive batch each.
+    for (auto& entry : signals_) entry.second->cancel();
+    signals_.clear();
+  }
+  for (auto& document : open) document->close();
+  // A reload also strands any slot whose promise resolved but whose JS
+  // continuation never ran. Each one is a whole raster — megabytes — held in
+  // C++ with nothing left that could ever take it.
+  slots::releaseAll();
+}
+
+bool Service::isInvalidated() const {
+  std::lock_guard<std::mutex> lock(mutex_);
+  return invalidated_;
+}
+
+size_t Service::openCount() const {
+  std::lock_guard<std::mutex> lock(mutex_);
+  return documents_.size();
+}
+
+}  // namespace pdfcanvas

package/native/core/src/slots.cpp

@@ -0,0 +1,139 @@
+#include "pdfcanvas/slots.h"
+
+#include <atomic>
+#include <cstring>
+#include <mutex>
+#include <new>
+#include <unordered_map>
+
+namespace pdfcanvas {
+
+namespace {
+
+/// Slots are published on a render worker and taken on the JS thread, so the
+/// map is guarded. The lock is held only around the map operation itself —
+/// never across an allocation, never across a fill, never across a JSI call.
+std::mutex& slotsMutex() {
+  static std::mutex m;
+  return m;
+}
+
+std::unordered_map<int64_t, std::shared_ptr<SlotBuffer>>& slotMap() {
+  static std::unordered_map<int64_t, std::shared_ptr<SlotBuffer>> map;
+  return map;
+}
+
+/// Slot ids, from one counter per PROCESS, starting at 1 because 0 is the
+/// heap-backed sentinel on the wire. Process-wide rather than per-module for
+/// the reason both retired stores gave: React Native builds a fresh set of
+/// native modules on every reload while the outgoing one may still have
+/// rasters parked, and a per-module counter would hand the same id to two
+/// modules — a wrong image, not an error.
+std::atomic<int64_t> g_nextSlot{1};
+
+void publishBuffer(int64_t slot, std::shared_ptr<SlotBuffer> buffer) {
+  std::lock_guard<std::mutex> lock(slotsMutex());
+  // Assignment, not emplace-and-check: the id came from the process-wide
+  // counter a moment ago, so a collision is unrepresentable.
+  slotMap()[slot] = std::move(buffer);
+}
+
+}  // namespace
+
+namespace slots {
+
+const std::array<uint8_t, 8>& probeBytes() {
+  // Chosen, not arbitrary. 0x00 and 0xFF pin both ends of the range, and
+  // 0xFD/0xFE/0xFF sit above 0x7F where a signed-byte slip in a Java copy
+  // would show up.
+  static const std::array<uint8_t, 8> bytes{0x00, 0x01, 0x02, 0xFD,
+                                            0xFE, 0xFF, 0x2A, 0x07};
+  return bytes;
+}
+
+int64_t storeProbe() {
+  SlotSink sink;
+  uint8_t* bytes = sink.reserve(probeBytes().size());
+  if (bytes == nullptr) return -1;
+  std::memcpy(bytes, probeBytes().data(), probeBytes().size());
+  return sink.publish();
+}
+
+std::shared_ptr<SlotBuffer> take(int64_t slot) {
+  std::lock_guard<std::mutex> lock(slotsMutex());
+  auto& map = slotMap();
+  auto found = map.find(slot);
+  if (found == map.end()) return nullptr;
+  std::shared_ptr<SlotBuffer> buffer = std::move(found->second);
+  map.erase(found);
+  return buffer;
+}
+
+bool release(int64_t slot) {
+  // Freed outside the lock, by `take`'s returned shared_ptr going out of scope
+  // here rather than inside the critical section.
+  return take(slot) != nullptr;
+}
+
+void releaseAll() {
+  std::unordered_map<int64_t, std::shared_ptr<SlotBuffer>> drained;
+  {
+    std::lock_guard<std::mutex> lock(slotsMutex());
+    drained.swap(slotMap());
+  }
+  // Dropping several megabytes of buffers is not something to do while the JS
+  // thread might be waiting on the same mutex.
+}
+
+size_t count() {
+  std::lock_guard<std::mutex> lock(slotsMutex());
+  return slotMap().size();
+}
+
+}  // namespace slots
+
+/* ------------------------------------------------------------------ *
+ * SlotSink
+ * ------------------------------------------------------------------ */
+
+uint8_t* SlotSink::reserve(size_t length) {
+  if (reserved_ || length == 0) return nullptr;
+  reserved_ = true;
+  try {
+    buffer_ = std::make_shared<SlotBuffer>(length);
+  } catch (const std::bad_alloc&) {
+    // Reported as a refusal rather than propagated: the rasterizer falls
+    // straight through to a heap sink and the tile still goes out.
+    buffer_ = nullptr;
+    return nullptr;
+  }
+  // Allocated next to the map it goes into, so a collision at publish cannot
+  // happen. Held HERE and nowhere else until publish — see the header.
+  slot_ = g_nextSlot.fetch_add(1, std::memory_order_relaxed);
+  return buffer_->data();
+}
+
+int64_t SlotSink::publish() {
+  if (buffer_ == nullptr || published_) return 0;
+  publishBuffer(slot_, buffer_);
+  published_ = true;
+  // The map holds the only reference this object needs to care about from
+  // here on: a successful take is then the sole owner, so the buffer dies with
+  // the JS ArrayBuffer rather than with this sink.
+  buffer_ = nullptr;
+  return slot_;
+}
+
+void SlotSink::abandon() {
+  if (published_) {
+    // Already in the map. Taking it back out is what frees it — and finding
+    // nothing is the normal case when JS has already redeemed it.
+    slots::take(slot_);
+    published_ = false;
+    slot_ = 0;
+    return;
+  }
+  buffer_ = nullptr;
+}
+
+}  // namespace pdfcanvas