Skip to content

Discard the state of a corrupt XRef table/stream before parsing the next one - #22375

Merged
Snuffleupagus merged 1 commit into
mozilla:masterfrom
andrewfader:xref-discard-corrupt-state
Oct 31, 2026
Merged

Snuffleupagus merged 1 commit into
mozilla:masterfrom
andrewfader:xref-discard-corrupt-state

Conversation

@andrewfader

@andrewfader andrewfader commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #22370

The state of an XRef table/stream is kept, so that parsing can resume after a MissingDataException. However, when parsing failed for any other reason the state was left behind and then used for the next XRef table/stream.

In a linearized file where the linearization dictionary and the first-page XRef stream were overwritten, startxref points to the hint stream which is parsed as an XRef stream and fails, since it has no /W entry. The main XRef stream was then read with the hint stream's state and failed as well, which lost all of its compressed entries, hence "Invalid Root reference." even in recovery mode.

The new unit test reproduces this with issue22370.pdf, which is empty.pdf with its linearization dictionary and first-page XRef stream overwritten by spaces. It fails on master with "Invalid Root reference." and passes with this patch.

@andrewfader
andrewfader force-pushed the xref-discard-corrupt-state branch 2 times, most recently from 421f5e8 to 2d3f884 Compare October 28, 2026 18:18
@andrewfader
andrewfader force-pushed the xref-discard-corrupt-state branch 3 times, most recently from 11fad16 to 7075a48 Compare October 28, 2026 20:02

@Snuffleupagus Snuffleupagus left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming that it passes all tests, this is probably a generally reasonable change.

Comment thread test/unit/api_spec.js Resolved
@andrewfader
andrewfader force-pushed the xref-discard-corrupt-state branch from 7075a48 to 6c51707 Compare October 28, 2026 20:40
@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Viewer preview

🗑️ Viewer previews removed.

@codecov-commenter

codecov-commenter commented Oct 28, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.58%. Comparing base (743102c) to head (4794c39).
⚠️ Report is 6 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #22375      +/-   ##
==========================================
- Coverage   90.58%   90.58%   -0.01%     
==========================================
  Files         278      278              
  Lines       68573    68586      +13     
==========================================
+ Hits        62117    62126       +9     
- Misses       6456     6460       +4     
Flag Coverage Δ
browsertest 66.26% <100.00%> (-0.03%) ⬇️
fonttest 8.99% <ø> (ø)
integrationtest 69.59% <0.00%> (+0.04%) ⬆️
unittest 61.27% <100.00%> (+0.01%) ⬆️
unittestcli 59.00% <100.00%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@codspeed

codspeed Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Merging this PR will improve performance by 16.28%

⚡ 2 improved benchmarks
✅ 86 untouched benchmarks
⏩ 174 skipped benchmarks1

Performance Changes

Benchmark BASE HEAD Efficiency
⚡ getUnicodeRangeFor (bug1473809.pdf) 33.4 ms 27.2 ms +22.69%
⚡ PartialEvaluator.buildPath: lines (bug1743245.pdf) 18.4 ms 16.7 ms +10.21%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.


Comparing andrewfader:xref-discard-corrupt-state (4794c39) with master (ab3819f)

Open in CodSpeed

Footnotes

  1. 174 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Reference tests

Results for 4794c39 (run, references from mozilla/pdf.js.refs@46378a2139).

Platform Status Tests Total runtime Errors Different FBF No reference Report
Linux ⚠️ 1413 13m 1s 0 10 0 0 view differences
Windows ⚠️ 1413 16m 52s 0 11 0 0 view differences

The report is kept for 30 days and replaced by the next run.

sync-pdfs-for-pdf-js Bot pushed a commit to mozilla/pdf.js.refs that referenced this pull request Oct 28, 2026

@Snuffleupagus Snuffleupagus left a comment •

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me, with merge conflicts fixed; thanks.

@Snuffleupagus

Copy link
Copy Markdown
Collaborator

The commits must be squashed (and merge commits aren't allowed in PRs).

…ext one

The state of an XRef table/stream is kept, so that parsing can resume after a
`MissingDataException`. However, when parsing failed for any other reason the
state was left behind and then used for the next XRef table/stream.

In a linearized file where the linearization dictionary and the first-page XRef
stream were overwritten, `startxref` points to the hint stream which is parsed
as an XRef stream and fails, since it has no /W entry. The main XRef stream was
then read with the hint stream's state and failed as well, which lost all of
its compressed entries, hence "Invalid Root reference." even in recovery mode.
@andrewfader
andrewfader force-pushed the xref-discard-corrupt-state branch from 73dcd4d to 4794c39 Compare October 31, 2026 19:01
sync-pdfs-for-pdf-js Bot pushed a commit to mozilla/pdf.js.refs that referenced this pull request Oct 31, 2026
@Snuffleupagus
Snuffleupagus merged commit 956f0cd into mozilla:master Oct 31, 2026
27 checks passed
@andrewfader
andrewfader deleted the xref-discard-corrupt-state branch October 31, 2026 20:56

This branch was successfully deployed

1 active deployment
sync_pdfs — 4794c398 Deployed Oct 31, 2026 by Snuffleupagus via request #684
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: "Invalid Root reference." when an invalid XRef stream precedes a valid one

3 participants