pdfcraft/vendor/hayro-interpret
Maksim Popov d415749556
Heavy pages: cull off-tile images, cache decodes, preview backdrops, calmer queues (#1117)
* Heavy pages: cull off-tile images, cache decodes, preview backdrops, calmer queues

A large CAD sheet (page 24 of the benchmark file: ~5050 pt wide, 2104
images, 9 MB of content) cost a full page interpret per tile: 4.3 s for a
1024 px tile at 1000%, 10.5 s for the whole page, and a storm of renders on
every pan frame. Tiles now cost 0.6 s, the sheet is covered by a handful of
large tiles, and gestures no longer queue work faster than workers finish it.

- Vendored hayro patch (10): skip images whose stream-size box misses the
  canvas before decoding them, so a tile no longer decodes, resamples and
  rasterizes every image on its page. Pixel-identical; the skip regression
  test now covers images too.
- Vendored hayro-interpret patch (23): decoded image pixels shared across
  renders through the interpreter cache, keyed by stream and decode target
  size within a 64 MiB budget.
- Preview renders (hayro patch 11, RenderRequest::preview through to the
  device): backdrops, thumbnails, grid cells and signature-drag backgrounds
  skip images under 16 device px. Tiles, whole pages, print and export always
  draw everything. Previews may differ by those pixels; finals don't.
- Viewer: zoom/pan settle holds apply only to pages whose raster proved slow
  (slow_pages, 500 ms), so fast pages render with no added latency; tile sides
  grow with zoom and page size (giant sheets need ~8 tiles, not ~28), queued
  center-first and keyed by exact coordinates; Edit-text outlines capped.
- vendor/README.md records the new patches with their tests.

Co-Authored-By: Muse Spark <noreply@meta.com>

* Decoded-image cache: key every decode input, survive a poisoned lock

The key was the dictionary's bytes and the target size, so two images with byte-identical
dictionaries (uncompressed, one size) shared pixels, and an image drawn under a transfer
function reused pixels decoded without it. DecodedImageKey now holds the dictionary's place
in the document (its data follows it), its bytes and object, mask/stencil/raster output,
interpolation, the target size and preview or final quality; images under a transfer
function and inline images (named colour spaces, dictionaries in content streams) are not
cached, and an image over the budget is never kept. A poisoned lock decodes uncached
instead of panicking. Soft masks: the per-renderer cache can't carry a preview mask into a
final render (documented). Regression tests for identical dictionaries, preview then final
through one cache, and transfer functions.

---------

Co-authored-by: Muse Spark <noreply@meta.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
2026-10-11 17:42:48 -04:00
..
assets more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
examples more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
src Heavy pages: cull off-tile images, cache decodes, preview backdrops, calmer queues (#1117) 2026-10-11 17:42:48 -04:00
.cargo-ok more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
.cargo_vcs_info.json more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
Cargo.lock more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
Cargo.toml Never crash: Type 1 font programs can't hang or overflow the stack (skrifa 0.47) 2026-10-05 10:47:39 -04:00
Cargo.toml.orig more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
LICENSE-APACHE more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
LICENSE-MIT more progress, roadmap, wip 2026-09-30 11:00:02 -04:00
README.md M2: bound PDF functions and reject invalid calculator operations (#581) 2026-10-09 18:53:42 -04:00

README.md

hayro-interpret

Crates.io Documentation

A crate for interpreting PDF files.

This crate provides an abstraction to interpret the content of a PDF file and render them into an abstract [Device], which clients can implement as needed. This allows you, for example, to render PDF files to bitmaps (which is what the hayro crate does), or other formats such as SVG.

It should be noted that this crate is still very much in development. Therefore it currently lacks pretty much any documentation on how to use it. It's current API also only really makes it useful for rendering to PNG or SVG, though this will be improved upon in the future.

Examples

See the examples folder on the GitHub repository. Apart from that, you can also consult the implementation of hayro and hayro-svg to get an idea on how to use this crate.

Safety

This crate forbids unsafe code via a crate-level attribute.

Cargo features

This crate has one optional feature:

  • embed-fonts: PDF processors are required to support 14 predefined fonts that do not need to be embedded into a PDF file. If you enable this feature, hayro will embed a (permissively-licensed) substitute for each font, so that you don't have to implement your custom font loading logic. This will add around ~240KB to your binary.

License

Licensed under either of

at your option.

PdfCraft function limits

The PdfCraft patch rejects function construction after 64 nested functions or 10,000 total function nodes, including repeated references, and detects cycles on the current path. Shared children in different branches remain valid. Stitching functions reject empty or unresolved child lists instead of silently truncating them. Calculator functions have a shared limit of 64 procedure levels and 10,000 parsed tokens (operators and procedure openings); evaluation has its own 10,000-operator limit across selected branches. These are implementation resource limits rather than PDF format limits. Rejection returns the existing None, and the optional logging feature reports the reason and limit; no new interface warning is introduced.

Calculator integer division without an integer result is also rejected. Bit shifting discards bits beyond the 32-bit word and fills with zeroes, including logical right shifts of negative words; rotation accepts the full signed shift range without negating the minimum integer. Fixed-size operand and procedure-stack overflow errors propagate instead of truncating work. Normal function signatures and supported color/transfer-function behavior remain unchanged.