mirror of
https://github.com/mozilla/pdf.js.git
synced 2026-07-25 08:27:19 +02:00
778aa450d9
The Type-4 PostScript -> Wasm compiler emitted i32.const immediates with the unsigned LEB128 encoder (_emitULEB128). Wasm decodes i32.const as a *signed* LEB128, so any immediate whose final 7-bit group has bit 0x40 set is mis-decoded (e.g. 64 -> single byte 0x40 -> read back as -64). The output-store address for the i-th result is emitted as i32.const (i*8). For a function with >= 9 outputs the 9th offset is 64, which decodes as -64, so f64.store targets 0xFFFFFFC0 and traps (memory access out of bounds). The module still validates and instantiates, so the JS fallback in function.js is not engaged; the trap only surfaces at render time (the affected shading / tint transform silently fails to render). The same mis-encoding affects the constant bitshift amount. Add a signed-LEB128 emitter (_emitSLEB128) and use it for the three i32.const immediate sites; local/import/type indices remain unsigned (correct). Add a unit test covering functions with 9+ outputs, and a reference test rendering a shading whose colour function has 9 outputs.