Remove allow_unsafe_buffers pragma in //pdf

Mechanically wrap all problematic code in UNSAFE_TODO().

Bug: 383593259
Low-Coverage-Reason: TRIVIAL_CHANGE Just annotating existing code.
Change-Id: I4ca3c819c37148aff41cf14187be06de172408d9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6089518
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1395470}

pdf/loader/chunk_stream.h

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #ifndef PDF_LOADER_CHUNK_STREAM_H_
 #define PDF_LOADER_CHUNK_STREAM_H_
 
@@ -19,6 +14,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/compiler_specific.h"
 #include "pdf/loader/range_set.h"
 
 namespace chrome_pdf {
@@ -59,8 +55,10 @@ class ChunkStream {
       const size_t chunk_start = start % kChunkSize;
       const size_t len =
           std::min(kChunkSize - chunk_start, range.end() - start);
-      memcpy(data_buffer, data_[chunk_index]->data() + chunk_start, len);
-      data_buffer += len;
+      UNSAFE_TODO({
+        memcpy(data_buffer, data_[chunk_index]->data() + chunk_start, len);
+        data_buffer += len;
+      });
       start += len;
     }
     return true;

pdf/loader/document_loader_impl.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/loader/document_loader_impl.h"
 
 #include <stddef.h>
@@ -16,6 +11,7 @@
 #include <utility>
 
 #include "base/check_op.h"
+#include "base/compiler_specific.h"
 #include "base/containers/span.h"
 #include "base/feature_list.h"
 #include "base/functional/bind.h"
@@ -343,8 +339,10 @@ bool DocumentLoaderImpl::SaveBuffer(uint32_t input_size) {
 
     const size_t new_chunk_data_len =
         std::min(DataStream::kChunkSize - chunk_.data_size, input.size());
-    memcpy(chunk_.chunk_data->data() + chunk_.data_size, input.data(),
-           new_chunk_data_len);
+    UNSAFE_TODO({
+      memcpy(chunk_.chunk_data->data() + chunk_.data_size, input.data(),
+             new_chunk_data_len);
+    });
     chunk_.data_size += new_chunk_data_len;
     if (chunk_.data_size == DataStream::kChunkSize ||
         (document_size > 0 && document_size <= EndOfCurrentChunk())) {

pdf/loader/url_loader_wrapper_impl.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/loader/url_loader_wrapper_impl.h"
 
 #include <stddef.h>
@@ -20,6 +15,7 @@
 #include <utility>
 
 #include "base/check_op.h"
+#include "base/compiler_specific.h"
 #include "base/containers/span.h"
 #include "base/functional/bind.h"
 #include "base/functional/callback.h"
@@ -96,14 +92,20 @@ bool IsDoubleEndLineAtEnd(const char* buffer, int size) {
   if (size < 2)
     return false;
 
-  if (buffer[size - 1] == '\n' && buffer[size - 2] == '\n')
-    return true;
+  UNSAFE_TODO({
+    if (buffer[size - 1] == '\n' && buffer[size - 2] == '\n') {
+      return true;
+    }
+  });
 
-  if (size < 4)
+  if (size < 4) {
     return false;
+  }
 
-  return buffer[size - 1] == '\n' && buffer[size - 2] == '\r' &&
-         buffer[size - 3] == '\n' && buffer[size - 4] == '\r';
+  UNSAFE_TODO({
+    return buffer[size - 1] == '\n' && buffer[size - 2] == '\r' &&
+           buffer[size - 3] == '\n' && buffer[size - 4] == '\r';
+  });
 }
 
 }  // namespace
@@ -221,7 +223,7 @@ void URLLoaderWrapperImpl::ParseHeaders(const std::string& response_headers) {
         const char* boundary = strstr(type.c_str(), "boundary=");
         DCHECK(boundary);
         if (boundary) {
-          multipart_boundary_ = std::string(boundary + 9);
+          UNSAFE_TODO({ multipart_boundary_ = std::string(boundary + 9); });
           is_multipart_ = !multipart_boundary_.empty();
         }
       }
@@ -272,7 +274,7 @@ void URLLoaderWrapperImpl::DidRead(base::OnceCallback<void(int)> callback,
       if (GetByteRangeFromHeaders(std::string(buffer_.data(), i), &start_pos,
                                   &end_pos)) {
         byte_range_ = gfx::Range(start_pos, end_pos);
-        start += i;
+        UNSAFE_TODO({ start += i; });
         length -= i;
       }
       break;

pdf/pdf_view_web_plugin.cc

@@ -4,11 +4,6 @@
 
 #include "pdf/pdf_view_web_plugin.h"
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <stddef.h>
 #include <stdint.h>
 
@@ -21,6 +16,7 @@
 
 #include "base/auto_reset.h"
 #include "base/check_op.h"
+#include "base/compiler_specific.h"
 #include "base/containers/fixed_flat_map.h"
 #include "base/containers/queue.h"
 #include "base/debug/crash_logging.h"
@@ -1633,8 +1629,11 @@ void PdfViewWebPlugin::HandleGetNamedDestinationMessage(
     std::ostringstream view_stream;
     view_stream << named_destination->view;
     if (named_destination->xyz_params.empty()) {
-      for (unsigned long i = 0; i < named_destination->num_params; ++i)
-        view_stream << "," << named_destination->params[i];
+      UNSAFE_TODO({
+        for (unsigned long i = 0; i < named_destination->num_params; ++i) {
+          view_stream << "," << named_destination->params[i];
+        }
+      });
     } else {
       view_stream << "," << named_destination->xyz_params;
     }

pdf/pdfium/accessibility_unittest.cc

@@ -2,15 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/accessibility.h"
 
 #include <string>
 
+#include "base/compiler_specific.h"
 #include "pdf/accessibility_structs.h"
 #include "pdf/pdfium/pdfium_engine.h"
 #include "pdf/pdfium/pdfium_test_base.h"
@@ -94,27 +90,32 @@ TEST_P(AccessibilityTest, GetAccessibilityPage) {
   bool using_test_fonts = UsingTestFonts();
 
   ASSERT_EQ(kExpectedTextRunCount, text_runs.size());
-  for (size_t i = 0; i < kExpectedTextRunCount; ++i) {
-    const auto& expected = kExpectedTextRuns[i];
-    EXPECT_EQ(expected.len, text_runs[i].len) << i;
-    EXPECT_FLOAT_EQ(expected.font_size, text_runs[i].style.font_size) << i;
-    EXPECT_FLOAT_EQ(expected.bounds_x, text_runs[i].bounds.x()) << i;
-    EXPECT_FLOAT_EQ(expected.bounds_y, text_runs[i].bounds.y()) << i;
-    float expected_bounds_w =
-        GetExpectedBoundsWidth(using_test_fonts, i, expected.bounds_w);
-    EXPECT_FLOAT_EQ(expected_bounds_w, text_runs[i].bounds.width()) << i;
-    EXPECT_FLOAT_EQ(expected.bounds_h, text_runs[i].bounds.height()) << i;
-    EXPECT_EQ(AccessibilityTextDirection::kLeftToRight, text_runs[i].direction);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < kExpectedTextRunCount; ++i) {
+      const auto& expected = kExpectedTextRuns[i];
+      EXPECT_EQ(expected.len, text_runs[i].len) << i;
+      EXPECT_FLOAT_EQ(expected.font_size, text_runs[i].style.font_size) << i;
+      EXPECT_FLOAT_EQ(expected.bounds_x, text_runs[i].bounds.x()) << i;
+      EXPECT_FLOAT_EQ(expected.bounds_y, text_runs[i].bounds.y()) << i;
+      float expected_bounds_w =
+          GetExpectedBoundsWidth(using_test_fonts, i, expected.bounds_w);
+      EXPECT_FLOAT_EQ(expected_bounds_w, text_runs[i].bounds.width()) << i;
+      EXPECT_FLOAT_EQ(expected.bounds_h, text_runs[i].bounds.height()) << i;
+      EXPECT_EQ(AccessibilityTextDirection::kLeftToRight,
+                text_runs[i].direction);
+    }
+  });
 
   ASSERT_EQ(kExpectedCharCount, chars.size());
-  for (size_t i = 0; i < kExpectedCharCount; ++i) {
-    const auto& expected = kExpectedChars[i];
-    EXPECT_EQ(expected.unicode_character, chars[i].unicode_character) << i;
-    double expected_char_width =
-        GetExpectedCharWidth(using_test_fonts, i, expected.char_width);
-    EXPECT_NEAR(expected_char_width, chars[i].char_width, 0.001) << i;
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < kExpectedCharCount; ++i) {
+      const auto& expected = kExpectedChars[i];
+      EXPECT_EQ(expected.unicode_character, chars[i].unicode_character) << i;
+      double expected_char_width =
+          GetExpectedCharWidth(using_test_fonts, i, expected.char_width);
+      EXPECT_NEAR(expected_char_width, chars[i].char_width, 0.001) << i;
+    }
+  });
 }
 
 TEST_P(AccessibilityTest, GetAccessibilityImageInfo) {
@@ -141,12 +142,15 @@ TEST_P(AccessibilityTest, GetAccessibilityImageInfo) {
   EXPECT_EQ(chars.size(), page_info.char_count);
   ASSERT_EQ(page_objects.images.size(), std::size(kExpectedImageInfo));
 
-  for (size_t i = 0; i < page_objects.images.size(); ++i) {
-    EXPECT_EQ(page_objects.images[i].alt_text, kExpectedImageInfo[i].alt_text);
-    EXPECT_EQ(kExpectedImageInfo[i].bounds, page_objects.images[i].bounds);
-    EXPECT_EQ(page_objects.images[i].text_run_index,
-              kExpectedImageInfo[i].text_run_index);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < page_objects.images.size(); ++i) {
+      EXPECT_EQ(page_objects.images[i].alt_text,
+                kExpectedImageInfo[i].alt_text);
+      EXPECT_EQ(kExpectedImageInfo[i].bounds, page_objects.images[i].bounds);
+      EXPECT_EQ(page_objects.images[i].text_run_index,
+                kExpectedImageInfo[i].text_run_index);
+    }
+  });
 }
 
 TEST_P(AccessibilityTest, GetUnderlyingTextRangeForRect) {
@@ -459,16 +463,18 @@ TEST_P(AccessibilityTest, GetAccessibilityLinkInfo) {
   EXPECT_EQ(chars.size(), page_info.char_count);
   ASSERT_EQ(page_objects.links.size(), std::size(expected_link_info));
 
-  for (size_t i = 0; i < page_objects.links.size(); ++i) {
-    const AccessibilityLinkInfo& link_info = page_objects.links[i];
-    EXPECT_EQ(link_info.url, expected_link_info[i].url);
-    EXPECT_EQ(link_info.index_in_page, expected_link_info[i].index_in_page);
-    EXPECT_EQ(expected_link_info[i].bounds, link_info.bounds);
-    EXPECT_EQ(link_info.text_range.index,
-              expected_link_info[i].text_range.index);
-    EXPECT_EQ(link_info.text_range.count,
-              expected_link_info[i].text_range.count);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < page_objects.links.size(); ++i) {
+      const AccessibilityLinkInfo& link_info = page_objects.links[i];
+      EXPECT_EQ(link_info.url, expected_link_info[i].url);
+      EXPECT_EQ(link_info.index_in_page, expected_link_info[i].index_in_page);
+      EXPECT_EQ(expected_link_info[i].bounds, link_info.bounds);
+      EXPECT_EQ(link_info.text_range.index,
+                expected_link_info[i].text_range.index);
+      EXPECT_EQ(link_info.text_range.count,
+                expected_link_info[i].text_range.count);
+    }
+  });
 }
 
 TEST_P(AccessibilityTest, GetAccessibilityHighlightInfo) {
@@ -498,19 +504,21 @@ TEST_P(AccessibilityTest, GetAccessibilityHighlightInfo) {
   EXPECT_EQ(chars.size(), page_info.char_count);
   ASSERT_EQ(page_objects.highlights.size(), std::size(kExpectedHighlightInfo));
 
-  for (size_t i = 0; i < page_objects.highlights.size(); ++i) {
-    const AccessibilityHighlightInfo& highlight_info =
-        page_objects.highlights[i];
-    EXPECT_EQ(highlight_info.index_in_page,
-              kExpectedHighlightInfo[i].index_in_page);
-    EXPECT_EQ(kExpectedHighlightInfo[i].bounds, highlight_info.bounds);
-    EXPECT_EQ(highlight_info.text_range.index,
-              kExpectedHighlightInfo[i].text_range.index);
-    EXPECT_EQ(highlight_info.text_range.count,
-              kExpectedHighlightInfo[i].text_range.count);
-    EXPECT_EQ(highlight_info.color, kExpectedHighlightInfo[i].color);
-    EXPECT_EQ(highlight_info.note_text, kExpectedHighlightInfo[i].note_text);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < page_objects.highlights.size(); ++i) {
+      const AccessibilityHighlightInfo& highlight_info =
+          page_objects.highlights[i];
+      EXPECT_EQ(highlight_info.index_in_page,
+                kExpectedHighlightInfo[i].index_in_page);
+      EXPECT_EQ(kExpectedHighlightInfo[i].bounds, highlight_info.bounds);
+      EXPECT_EQ(highlight_info.text_range.index,
+                kExpectedHighlightInfo[i].text_range.index);
+      EXPECT_EQ(highlight_info.text_range.count,
+                kExpectedHighlightInfo[i].text_range.count);
+      EXPECT_EQ(highlight_info.color, kExpectedHighlightInfo[i].color);
+      EXPECT_EQ(highlight_info.note_text, kExpectedHighlightInfo[i].note_text);
+    }
+  });
 }
 
 TEST_P(AccessibilityTest, GetAccessibilityTextFieldInfo) {
@@ -546,23 +554,25 @@ TEST_P(AccessibilityTest, GetAccessibilityTextFieldInfo) {
   ASSERT_EQ(page_objects.form_fields.text_fields.size(),
             std::size(kExpectedTextFieldInfo));
 
-  for (size_t i = 0; i < page_objects.form_fields.text_fields.size(); ++i) {
-    const AccessibilityTextFieldInfo& text_field_info =
-        page_objects.form_fields.text_fields[i];
-    EXPECT_EQ(kExpectedTextFieldInfo[i].name, text_field_info.name);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].value, text_field_info.value);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].is_read_only,
-              text_field_info.is_read_only);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].is_required,
-              text_field_info.is_required);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].is_password,
-              text_field_info.is_password);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].index_in_page,
-              text_field_info.index_in_page);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].text_run_index,
-              text_field_info.text_run_index);
-    EXPECT_EQ(kExpectedTextFieldInfo[i].bounds, text_field_info.bounds);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < page_objects.form_fields.text_fields.size(); ++i) {
+      const AccessibilityTextFieldInfo& text_field_info =
+          page_objects.form_fields.text_fields[i];
+      EXPECT_EQ(kExpectedTextFieldInfo[i].name, text_field_info.name);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].value, text_field_info.value);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].is_read_only,
+                text_field_info.is_read_only);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].is_required,
+                text_field_info.is_required);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].is_password,
+                text_field_info.is_password);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].index_in_page,
+                text_field_info.index_in_page);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].text_run_index,
+                text_field_info.text_run_index);
+      EXPECT_EQ(kExpectedTextFieldInfo[i].bounds, text_field_info.bounds);
+    }
+  });
 }
 
 TEST_P(AccessibilityTest, SelectionActionHandling) {

pdf/pdfium/pdfium_engine.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/pdfium/pdfium_engine.h"
 
 #include <math.h>
@@ -457,21 +452,25 @@ std::string GetXYZParamsString(FPDF_DEST dest, PDFiumPage* page) {
 }
 
 void SetXYZParamsInScreenCoords(PDFiumPage* page, float* params) {
-  gfx::PointF page_coords(params[0], params[1]);
-  gfx::PointF screen_coords = page->TransformPageToScreenXY(page_coords);
-  params[0] = screen_coords.x();
-  params[1] = screen_coords.y();
+  UNSAFE_TODO({
+    gfx::PointF page_coords(params[0], params[1]);
+    gfx::PointF screen_coords = page->TransformPageToScreenXY(page_coords);
+    params[0] = screen_coords.x();
+    params[1] = screen_coords.y();
+  });
 }
 
 void SetFitRParamsInScreenCoords(PDFiumPage* page, float* params) {
-  gfx::PointF point_1 =
-      page->TransformPageToScreenXY(gfx::PointF(params[0], params[1]));
-  gfx::PointF point_2 =
-      page->TransformPageToScreenXY(gfx::PointF(params[2], params[3]));
-  params[0] = point_1.x();
-  params[1] = point_1.y();
-  params[2] = point_2.x();
-  params[3] = point_2.y();
+  UNSAFE_TODO({
+    gfx::PointF point_1 =
+        page->TransformPageToScreenXY(gfx::PointF(params[0], params[1]));
+    gfx::PointF point_2 =
+        page->TransformPageToScreenXY(gfx::PointF(params[2], params[3]));
+    params[0] = point_1.x();
+    params[1] = point_1.y();
+    params[2] = point_2.x();
+    params[3] = point_2.y();
+  });
 }
 
 // A helper function that transforms the in-page coordinates in `params` to
@@ -3510,10 +3509,12 @@ void PDFiumEngine::Highlight(const RegionData& region,
         continue;
       }
 
-      uint8_t* pixel = row.data() + x * 4;
-      pixel[0] = static_cast<uint8_t>(pixel[0] * color_f.fB);
-      pixel[1] = static_cast<uint8_t>(pixel[1] * color_f.fG);
-      pixel[2] = static_cast<uint8_t>(pixel[2] * color_f.fR);
+      UNSAFE_TODO({
+        uint8_t* pixel = row.data() + x * 4;
+        pixel[0] = static_cast<uint8_t>(pixel[0] * color_f.fB);
+        pixel[1] = static_cast<uint8_t>(pixel[1] * color_f.fG);
+        pixel[2] = static_cast<uint8_t>(pixel[2] * color_f.fR);
+      });
     }
   }
 }
@@ -3732,10 +3733,12 @@ std::optional<PDFiumEngine::RegionData> PDFiumEngine::GetRegion(
   }
 
   size_t stride = image_data.rowBytes();
-  base::span<uint8_t> buffer_span(buffer, image_data.height() * stride);
-  size_t x_offset = location.x() + page_offset_.x();
-  size_t offset = location.y() * stride + x_offset * 4;
-  return PDFiumEngine::RegionData(buffer_span.subspan(offset), stride);
+  UNSAFE_TODO({
+    base::span<uint8_t> buffer_span(buffer, image_data.height() * stride);
+    size_t x_offset = location.x() + page_offset_.x();
+    size_t offset = location.y() * stride + x_offset * 4;
+    return PDFiumEngine::RegionData(buffer_span.subspan(offset), stride);
+  });
 }
 
 void PDFiumEngine::OnSelectionTextChanged() {

pdf/pdfium/pdfium_engine_unittest.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/pdfium/pdfium_engine.h"
 
 #include <stdint.h>
@@ -15,6 +10,7 @@
 #include <optional>
 #include <utility>
 
+#include "base/compiler_specific.h"
 #include "base/files/file_path.h"
 #include "base/functional/callback.h"
 #include "base/hash/md5.h"
@@ -624,7 +620,7 @@ TEST_P(PDFiumEngineTest, GetNamedDestination) {
   EXPECT_EQ(0u, valid_page_obj->page);
   EXPECT_EQ("XYZ", valid_page_obj->view);
   ASSERT_EQ(3u, valid_page_obj->num_params);
-  EXPECT_EQ(1.2f, valid_page_obj->params[2]);
+  UNSAFE_TODO({ EXPECT_EQ(1.2f, valid_page_obj->params[2]); });
 
   // A destination with an invalid page object
   std::optional<PDFiumEngine::NamedDestination> invalid_page_obj =

pdf/pdfium/pdfium_page_unittest.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "pdf/pdfium/pdfium_page.h"
 
 #include <optional>
@@ -14,6 +9,7 @@
 #include <vector>
 
 #include "base/check.h"
+#include "base/compiler_specific.h"
 #include "base/files/file_path.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -414,26 +410,30 @@ TEST_P(PDFiumPageLinkTest, AnnotLinkGeneration) {
   const std::vector<PDFiumPage::Link>& links = GetLinks(*engine, 0);
   ASSERT_EQ(kExpectedLinkCount, links.size());
 
-  for (size_t i = 0; i < kExpectedLinkCount; ++i) {
-    const PDFiumPage::Link& actual_current_link = links[i];
-    const ExpectedLink& expected_current_link = expected_links[i];
-    EXPECT_EQ(expected_current_link.start_char_index,
-              actual_current_link.start_char_index);
-    EXPECT_EQ(expected_current_link.char_count, actual_current_link.char_count);
-    size_t bounds_size = actual_current_link.bounding_rects.size();
-    ASSERT_EQ(expected_current_link.bounding_rects.size(), bounds_size);
-    for (size_t bounds_index = 0; bounds_index < bounds_size; ++bounds_index) {
-      EXPECT_EQ(expected_current_link.bounding_rects[bounds_index],
-                actual_current_link.bounding_rects[bounds_index]);
+  UNSAFE_TODO({
+    for (size_t i = 0; i < kExpectedLinkCount; ++i) {
+      const PDFiumPage::Link& actual_current_link = links[i];
+      const ExpectedLink& expected_current_link = expected_links[i];
+      EXPECT_EQ(expected_current_link.start_char_index,
+                actual_current_link.start_char_index);
+      EXPECT_EQ(expected_current_link.char_count,
+                actual_current_link.char_count);
+      size_t bounds_size = actual_current_link.bounding_rects.size();
+      ASSERT_EQ(expected_current_link.bounding_rects.size(), bounds_size);
+      for (size_t bounds_index = 0; bounds_index < bounds_size;
+           ++bounds_index) {
+        EXPECT_EQ(expected_current_link.bounding_rects[bounds_index],
+                  actual_current_link.bounding_rects[bounds_index]);
+      }
+      EXPECT_EQ(expected_current_link.url, actual_current_link.target.url);
+      if (actual_current_link.target.url.empty()) {
+        EXPECT_EQ(expected_current_link.page, actual_current_link.target.page);
+        ASSERT_TRUE(actual_current_link.target.y_in_pixels.has_value());
+        EXPECT_FLOAT_EQ(expected_current_link.y_in_pixels,
+                        actual_current_link.target.y_in_pixels.value());
+      }
     }
-    EXPECT_EQ(expected_current_link.url, actual_current_link.target.url);
-    if (actual_current_link.target.url.empty()) {
-      EXPECT_EQ(expected_current_link.page, actual_current_link.target.page);
-      ASSERT_TRUE(actual_current_link.target.y_in_pixels.has_value());
-      EXPECT_FLOAT_EQ(expected_current_link.y_in_pixels,
-                      actual_current_link.target.y_in_pixels.value());
-    }
-  }
+  });
 }
 
 TEST_P(PDFiumPageLinkTest, GetLinkTarget) {
@@ -885,15 +885,17 @@ TEST_P(PDFiumPageHighlightTest, PopulateHighlights) {
   page.PopulateAnnotations();
   ASSERT_EQ(std::size(kExpectedHighlights), page.highlights_.size());
 
-  for (size_t i = 0; i < page.highlights_.size(); ++i) {
-    ASSERT_EQ(kExpectedHighlights[i].start_char_index,
-              page.highlights_[i].start_char_index);
-    ASSERT_EQ(kExpectedHighlights[i].char_count,
-              page.highlights_[i].char_count);
-    EXPECT_EQ(kExpectedHighlights[i].bounding_rect,
-              page.highlights_[i].bounding_rect);
-    ASSERT_EQ(kExpectedHighlights[i].color, page.highlights_[i].color);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < page.highlights_.size(); ++i) {
+      ASSERT_EQ(kExpectedHighlights[i].start_char_index,
+                page.highlights_[i].start_char_index);
+      ASSERT_EQ(kExpectedHighlights[i].char_count,
+                page.highlights_[i].char_count);
+      EXPECT_EQ(kExpectedHighlights[i].bounding_rect,
+                page.highlights_[i].bounding_rect);
+      ASSERT_EQ(kExpectedHighlights[i].color, page.highlights_[i].color);
+    }
+  });
 }
 
 INSTANTIATE_TEST_SUITE_P(All, PDFiumPageHighlightTest, testing::Bool());
@@ -925,13 +927,15 @@ TEST_P(PDFiumPageTextFieldTest, PopulateTextFields) {
   size_t text_fields_count = page.text_fields_.size();
   ASSERT_EQ(std::size(kExpectedTextFields), text_fields_count);
 
-  for (size_t i = 0; i < text_fields_count; ++i) {
-    EXPECT_EQ(kExpectedTextFields[i].name, page.text_fields_[i].name);
-    EXPECT_EQ(kExpectedTextFields[i].value, page.text_fields_[i].value);
-    EXPECT_EQ(kExpectedTextFields[i].bounding_rect,
-              page.text_fields_[i].bounding_rect);
-    EXPECT_EQ(kExpectedTextFields[i].flags, page.text_fields_[i].flags);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < text_fields_count; ++i) {
+      EXPECT_EQ(kExpectedTextFields[i].name, page.text_fields_[i].name);
+      EXPECT_EQ(kExpectedTextFields[i].value, page.text_fields_[i].value);
+      EXPECT_EQ(kExpectedTextFields[i].bounding_rect,
+                page.text_fields_[i].bounding_rect);
+      EXPECT_EQ(kExpectedTextFields[i].flags, page.text_fields_[i].flags);
+    }
+  });
 }
 
 INSTANTIATE_TEST_SUITE_P(All, PDFiumPageTextFieldTest, testing::Bool());
@@ -1006,21 +1010,23 @@ TEST_P(PDFiumPageChoiceFieldTest, PopulateChoiceFields) {
   size_t choice_fields_count = page.choice_fields_.size();
   ASSERT_EQ(std::size(kExpectedChoiceFields), choice_fields_count);
 
-  for (size_t i = 0; i < choice_fields_count; ++i) {
-    EXPECT_EQ(kExpectedChoiceFields[i].name, page.choice_fields_[i].name);
-    size_t choice_field_options_count = page.choice_fields_[i].options.size();
-    ASSERT_EQ(std::size(kExpectedChoiceFields[i].options),
-              choice_field_options_count);
-    for (size_t j = 0; j < choice_field_options_count; ++j) {
-      EXPECT_EQ(kExpectedChoiceFields[i].options[j].name,
-                page.choice_fields_[i].options[j].name);
-      EXPECT_EQ(kExpectedChoiceFields[i].options[j].is_selected,
-                page.choice_fields_[i].options[j].is_selected);
+  UNSAFE_TODO({
+    for (size_t i = 0; i < choice_fields_count; ++i) {
+      EXPECT_EQ(kExpectedChoiceFields[i].name, page.choice_fields_[i].name);
+      size_t choice_field_options_count = page.choice_fields_[i].options.size();
+      ASSERT_EQ(std::size(kExpectedChoiceFields[i].options),
+                choice_field_options_count);
+      for (size_t j = 0; j < choice_field_options_count; ++j) {
+        EXPECT_EQ(kExpectedChoiceFields[i].options[j].name,
+                  page.choice_fields_[i].options[j].name);
+        EXPECT_EQ(kExpectedChoiceFields[i].options[j].is_selected,
+                  page.choice_fields_[i].options[j].is_selected);
+      }
+      EXPECT_EQ(kExpectedChoiceFields[i].bounding_rect,
+                page.choice_fields_[i].bounding_rect);
+      EXPECT_EQ(kExpectedChoiceFields[i].flags, page.choice_fields_[i].flags);
     }
-    EXPECT_EQ(kExpectedChoiceFields[i].bounding_rect,
-              page.choice_fields_[i].bounding_rect);
-    EXPECT_EQ(kExpectedChoiceFields[i].flags, page.choice_fields_[i].flags);
-  }
+  });
 }
 
 INSTANTIATE_TEST_SUITE_P(All, PDFiumPageChoiceFieldTest, testing::Bool());
@@ -1091,19 +1097,21 @@ TEST_P(PDFiumPageButtonTest, PopulateButtons) {
   size_t buttons_count = page.buttons_.size();
   ASSERT_EQ(std::size(kExpectedButtons), buttons_count);
 
-  for (size_t i = 0; i < buttons_count; ++i) {
-    EXPECT_EQ(kExpectedButtons[i].name, page.buttons_[i].name);
-    EXPECT_EQ(kExpectedButtons[i].value, page.buttons_[i].value);
-    EXPECT_EQ(kExpectedButtons[i].type, page.buttons_[i].type);
-    EXPECT_EQ(kExpectedButtons[i].flags, page.buttons_[i].flags);
-    EXPECT_EQ(kExpectedButtons[i].is_checked, page.buttons_[i].is_checked);
-    EXPECT_EQ(kExpectedButtons[i].control_count,
-              page.buttons_[i].control_count);
-    EXPECT_EQ(kExpectedButtons[i].control_index,
-              page.buttons_[i].control_index);
-    EXPECT_EQ(kExpectedButtons[i].bounding_rect,
-              page.buttons_[i].bounding_rect);
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < buttons_count; ++i) {
+      EXPECT_EQ(kExpectedButtons[i].name, page.buttons_[i].name);
+      EXPECT_EQ(kExpectedButtons[i].value, page.buttons_[i].value);
+      EXPECT_EQ(kExpectedButtons[i].type, page.buttons_[i].type);
+      EXPECT_EQ(kExpectedButtons[i].flags, page.buttons_[i].flags);
+      EXPECT_EQ(kExpectedButtons[i].is_checked, page.buttons_[i].is_checked);
+      EXPECT_EQ(kExpectedButtons[i].control_count,
+                page.buttons_[i].control_count);
+      EXPECT_EQ(kExpectedButtons[i].control_index,
+                page.buttons_[i].control_index);
+      EXPECT_EQ(kExpectedButtons[i].bounding_rect,
+                page.buttons_[i].bounding_rect);
+    }
+  });
 }
 
 INSTANTIATE_TEST_SUITE_P(All, PDFiumPageButtonTest, testing::Bool());