diff --git a/core/fpdfapi/render/cpdf_rendershading.cpp b/core/fpdfapi/render/cpdf_rendershading.cpp
index 5575205..8f4d6cb 100644
--- a/core/fpdfapi/render/cpdf_rendershading.cpp
+++ b/core/fpdfapi/render/cpdf_rendershading.cpp
@@ -409,7 +409,7 @@
       r_result += r_unit;
       g_result += g_unit;
       b_result += b_unit;
-      FXARGB_SETDIB(dib_buf, ArgbEncode(alpha, static_cast<int>(r_result * 255),
+      FXARGB_SetDIB(dib_buf, ArgbEncode(alpha, static_cast<int>(r_result * 255),
                                         static_cast<int>(g_result * 255),
                                         static_cast<int>(b_result * 255)));
       dib_span = dib_span.subspan(4);
diff --git a/core/fxcodec/progressive_decoder.cpp b/core/fxcodec/progressive_decoder.cpp
index 669949e..5e3c695 100644
--- a/core/fxcodec/progressive_decoder.cpp
+++ b/core/fxcodec/progressive_decoder.cpp
@@ -430,7 +430,7 @@
       }
       case 12: {
         for (int col = 0; col < sizeX; col++) {
-          FXARGB_SETDIB(pScanline, argb);
+          FXARGB_SetDIB(pScanline, argb);
           pScanline += 4;
         }
         break;
diff --git a/core/fxge/agg/fx_agg_driver.cpp b/core/fxge/agg/fx_agg_driver.cpp
index 0be44eb..a380a78 100644
--- a/core/fxge/agg/fx_agg_driver.cpp
+++ b/core/fxge/agg/fx_agg_driver.cpp
@@ -99,7 +99,7 @@
       for (int col = 0; col < width; col++) {
         uint8_t back_alpha = dest_scan[3];
         if (back_alpha == 0) {
-          FXARGB_SETRGBORDERDIB(dest_scan, argb);
+          FXARGB_SetRGBOrderDIB(dest_scan, argb);
           dest_scan += 4;
           continue;
         }
@@ -162,7 +162,7 @@
           pSrcBitmap->GetScanline(src_top + row).subspan(src_x_offset).data();
       if (Bpp == 4) {
         for (int col = 0; col < width; col++) {
-          FXARGB_SETRGBORDERDIB(dest_scan,
+          FXARGB_SetRGBOrderDIB(dest_scan,
                                 *reinterpret_cast<const uint32_t*>(src_scan));
           dest_scan += 4;
           src_scan += 4;
@@ -212,7 +212,7 @@
       const uint8_t* src_scan =
           pSrcBitmap->GetScanline(src_top + row).subspan(src_x_offset).data();
       for (int col = 0; col < width; col++) {
-        FXARGB_SETDIB(dest_scan,
+        FXARGB_SetDIB(dest_scan,
                       ArgbEncode(0xff, src_scan[0], src_scan[1], src_scan[2]));
         dest_scan += 4;
         src_scan += 3;
@@ -230,7 +230,7 @@
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_x_offset).data();
     for (int col = 0; col < width; col++) {
-      FXARGB_SETDIB(dest_scan,
+      FXARGB_SetDIB(dest_scan,
                     ArgbEncode(0xff, src_scan[0], src_scan[1], src_scan[2]));
       src_scan += 4;
       dest_scan += 4;
diff --git a/core/fxge/cfx_renderdevice.cpp b/core/fxge/cfx_renderdevice.cpp
index 4dc06a8..8e96719 100644
--- a/core/fxge/cfx_renderdevice.cpp
+++ b/core/fxge/cfx_renderdevice.cpp
@@ -160,7 +160,7 @@
                    int src_alpha) {
   uint8_t back_alpha = dest[3];
   if (back_alpha == 0)
-    FXARGB_SETDIB(dest, ArgbEncode(src_alpha, r, g, b));
+    FXARGB_SetDIB(dest, ArgbEncode(src_alpha, r, g, b));
   else if (src_alpha != 0)
     ApplyDestAlpha(back_alpha, src_alpha, r, g, b, dest);
 }
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index ec91d70..aa1996a 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -430,9 +430,9 @@
                           : ArgbEncode(0xff, *pos, *pos, *pos);
     case FXDIB_Format::kRgb:
     case FXDIB_Format::kRgb32:
-      return FXARGB_GETDIB(pos) | 0xff000000;
+      return FXARGB_GetDIB(pos) | 0xff000000;
     case FXDIB_Format::kArgb:
-      return FXARGB_GETDIB(pos);
+      return FXARGB_GetDIB(pos);
     default:
       break;
   }
@@ -794,7 +794,7 @@
       for (int col = 0; col < width; col++) {
         uint8_t back_alpha = dest_scan[3];
         if (back_alpha == 0) {
-          FXARGB_SETDIB(dest_scan, ArgbEncode(src_alpha, color_p[2], color_p[1],
+          FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, color_p[2], color_p[1],
                                               color_p[0]));
           dest_scan += 4;
           continue;
diff --git a/core/fxge/dib/cfx_dibitmap_unittest.cpp b/core/fxge/dib/cfx_dibitmap_unittest.cpp
index 5473ce0..2c7de3e 100644
--- a/core/fxge/dib/cfx_dibitmap_unittest.cpp
+++ b/core/fxge/dib/cfx_dibitmap_unittest.cpp
@@ -121,7 +121,7 @@
 TEST(CFX_DIBitmap, UnPreMultiply_FromCleared) {
   auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
   ASSERT_TRUE(bitmap->Create(1, 1, FXDIB_Format::kArgb));
-  FXARGB_SETDIB(bitmap->GetBuffer().data(), 0x7f'7f'7f'7f);
+  FXARGB_SetDIB(bitmap->GetWritableBuffer().data(), 0x7f'7f'7f'7f);
 
   bitmap->UnPreMultiply();
 
@@ -132,7 +132,7 @@
   auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
   ASSERT_TRUE(bitmap->Create(1, 1, FXDIB_Format::kArgb));
   bitmap->ForcePreMultiply();
-  FXARGB_SETDIB(bitmap->GetBuffer().data(), 0x7f'7f'7f'7f);
+  FXARGB_SetDIB(bitmap->GetWritableBuffer().data(), 0x7f'7f'7f'7f);
 
   bitmap->UnPreMultiply();
 
@@ -143,7 +143,7 @@
   auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
   ASSERT_TRUE(bitmap->Create(1, 1, FXDIB_Format::kArgb));
   bitmap->UnPreMultiply();
-  FXARGB_SETDIB(bitmap->GetBuffer().data(), 0x7f'ff'ff'ff);
+  FXARGB_SetDIB(bitmap->GetWritableBuffer().data(), 0x7f'ff'ff'ff);
 
   bitmap->UnPreMultiply();
 
diff --git a/core/fxge/dib/cfx_scanlinecompositor.cpp b/core/fxge/dib/cfx_scanlinecompositor.cpp
index b15cedc..4cb5b91 100644
--- a/core/fxge/dib/cfx_scanlinecompositor.cpp
+++ b/core/fxge/dib/cfx_scanlinecompositor.cpp
@@ -246,8 +246,8 @@
     uint8_t src_alpha = GetAlpha(src_scan[3], clip_scan, col);
     if (back_alpha == 0) {
       if (clip_scan) {
-        FXARGB_SETDIB(dest_scan,
-                      (FXARGB_GETDIB(src_scan) & 0xffffff) | (src_alpha << 24));
+        FXARGB_SetDIB(dest_scan,
+                      (FXARGB_GetDIB(src_scan) & 0xffffff) | (src_alpha << 24));
       } else {
         memcpy(dest_scan, src_scan, 4);
       }
@@ -298,9 +298,9 @@
     uint8_t back_alpha = *dest_alpha;
     if (back_alpha == 0) {
       if (src_Bpp == 4) {
-        FXARGB_SETDIB(dest_scan, 0xff000000 | FXARGB_GETDIB(src_scan));
+        FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
       } else {
-        FXARGB_SETDIB(dest_scan,
+        FXARGB_SetDIB(dest_scan,
                       ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
       }
       dest_scan += 4;
@@ -416,9 +416,9 @@
   const uint8_t* src_scan = src_span.data();
   for (int col = 0; col < width; col++) {
     if (src_Bpp == 4) {
-      FXARGB_SETDIB(dest_scan, 0xff000000 | FXARGB_GETDIB(src_scan));
+      FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
     } else {
-      FXARGB_SETDIB(dest_scan,
+      FXARGB_SetDIB(dest_scan,
                     ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
     }
     dest_scan += 4;
@@ -902,7 +902,7 @@
     int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
     uint8_t back_alpha = dest_scan[3];
     if (back_alpha == 0) {
-      FXARGB_SETDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
+      FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
       dest_scan += 4;
       continue;
     }
@@ -1055,7 +1055,7 @@
     FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
     for (int col = 0; col < pixel_count; col++) {
       if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        FXARGB_SETDIB(dest_scan, argb);
+        FXARGB_SetDIB(dest_scan, argb);
       }
       dest_scan += 4;
     }
@@ -1069,7 +1069,7 @@
     int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
     uint8_t back_alpha = dest_scan[3];
     if (back_alpha == 0) {
-      FXARGB_SETDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
+      FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
       dest_scan += 4;
       continue;
     }
@@ -1301,9 +1301,9 @@
     uint8_t back_alpha = dest_scan[3];
     if (back_alpha == 0) {
       if (src_Bpp == 4) {
-        FXARGB_SETRGBORDERDIB(dest_scan, 0xff000000 | FXARGB_GETDIB(src_scan));
+        FXARGB_SetRGBOrderDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
       } else {
-        FXARGB_SETRGBORDERDIB(
+        FXARGB_SetRGBOrderDIB(
             dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
       }
       dest_scan += 4;
@@ -1382,9 +1382,9 @@
   const uint8_t* src_scan = src_span.data();
   for (int col = 0; col < width; col++) {
     if (src_Bpp == 4) {
-      FXARGB_SETRGBORDERDIB(dest_scan, 0xff000000 | FXARGB_GETDIB(src_scan));
+      FXARGB_SetRGBOrderDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
     } else {
-      FXARGB_SETRGBORDERDIB(
+      FXARGB_SetRGBOrderDIB(
           dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
     }
     dest_scan += 4;
@@ -1851,7 +1851,7 @@
     int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
     uint8_t back_alpha = dest_scan[3];
     if (back_alpha == 0) {
-      FXARGB_SETRGBORDERDIB(dest_scan,
+      FXARGB_SetRGBOrderDIB(dest_scan,
                             ArgbEncode(src_alpha, src_r, src_g, src_b));
       dest_scan += 4;
       continue;
@@ -1964,7 +1964,7 @@
     FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
     for (int col = 0; col < pixel_count; col++) {
       if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        FXARGB_SETRGBORDERDIB(dest_scan, argb);
+        FXARGB_SetRGBOrderDIB(dest_scan, argb);
       }
       dest_scan += 4;
     }
@@ -1978,7 +1978,7 @@
     int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
     uint8_t back_alpha = dest_scan[3];
     if (back_alpha == 0) {
-      FXARGB_SETRGBORDERDIB(dest_scan,
+      FXARGB_SetRGBOrderDIB(dest_scan,
                             ArgbEncode(src_alpha, src_r, src_g, src_b));
       dest_scan += 4;
       continue;
diff --git a/core/fxge/dib/fx_dib.h b/core/fxge/dib/fx_dib.h
index bd458f9..895b453 100644
--- a/core/fxge/dib/fx_dib.h
+++ b/core/fxge/dib/fx_dib.h
@@ -12,6 +12,8 @@
 #include <tuple>
 #include <utility>
 
+#include "third_party/base/compiler_specific.h"
+
 // Encoding:
 // - Bits-per-pixel: value & 0xFF
 // - Is mask: value & 0x100
@@ -102,24 +104,22 @@
 
 FXDIB_Format MakeRGBFormat(int bpp);
 
-constexpr FX_CMYK CmykEncode(uint32_t c, uint32_t m, uint32_t y, uint32_t k) {
-  return (c << 24) | (m << 16) | (y << 8) | k;
-}
-
 // Returns (a, r, g, b)
 std::tuple<int, int, int, int> ArgbDecode(FX_ARGB argb);
 
 // Returns (a, FX_COLORREF)
 std::pair<int, FX_COLORREF> ArgbToAlphaAndColorRef(FX_ARGB argb);
 
-// Returns FX_COLORREF.
 FX_COLORREF ArgbToColorRef(FX_ARGB argb);
+FX_ARGB AlphaAndColorRefToArgb(int a, FX_COLORREF colorref);
 
 constexpr FX_ARGB ArgbEncode(uint32_t a, uint32_t r, uint32_t g, uint32_t b) {
   return (a << 24) | (r << 16) | (g << 8) | b;
 }
 
-FX_ARGB AlphaAndColorRefToArgb(int a, FX_COLORREF colorref);
+constexpr FX_CMYK CmykEncode(uint32_t c, uint32_t m, uint32_t y, uint32_t k) {
+  return (c << 24) | (m << 16) | (y << 8) | k;
+}
 
 #define FXARGB_A(argb) ((uint8_t)((argb) >> 24))
 #define FXARGB_R(argb) ((uint8_t)((argb) >> 16))
@@ -131,19 +131,7 @@
 #define FXRGB2GRAY(r, g, b) (((b)*11 + (g)*59 + (r)*30) / 100)
 #define FXDIB_ALPHA_MERGE(backdrop, source, source_alpha) \
   (((backdrop) * (255 - (source_alpha)) + (source) * (source_alpha)) / 255)
-#define FXARGB_GETDIB(p)                              \
-  ((((uint8_t*)(p))[0]) | (((uint8_t*)(p))[1] << 8) | \
-   (((uint8_t*)(p))[2] << 16) | (((uint8_t*)(p))[3] << 24))
-#define FXARGB_SETDIB(p, argb)                  \
-  ((uint8_t*)(p))[0] = (uint8_t)(argb),         \
-  ((uint8_t*)(p))[1] = (uint8_t)((argb) >> 8),  \
-  ((uint8_t*)(p))[2] = (uint8_t)((argb) >> 16), \
-  ((uint8_t*)(p))[3] = (uint8_t)((argb) >> 24)
-#define FXARGB_SETRGBORDERDIB(p, argb)          \
-  ((uint8_t*)(p))[3] = (uint8_t)(argb >> 24),   \
-  ((uint8_t*)(p))[0] = (uint8_t)((argb) >> 16), \
-  ((uint8_t*)(p))[1] = (uint8_t)((argb) >> 8),  \
-  ((uint8_t*)(p))[2] = (uint8_t)(argb)
+
 #define FXCMYK_TODIB(cmyk)                                    \
   ((uint8_t)((cmyk) >> 24) | ((uint8_t)((cmyk) >> 16)) << 8 | \
    ((uint8_t)((cmyk) >> 8)) << 16 | ((uint8_t)(cmyk) << 24))
@@ -151,10 +139,35 @@
   ((uint8_t)(argb >> 16) | ((uint8_t)(argb >> 8)) << 8 | \
    ((uint8_t)(argb)) << 16 | ((uint8_t)(argb >> 24) << 24))
 
-inline void ReverseCopy3Bytes(uint8_t* dest, const uint8_t* src) {
-  dest[2] = src[0];
-  dest[1] = src[1];
-  dest[0] = src[2];
+// SAFETY: Caller must ensure 4 valid bytes at `p`.
+UNSAFE_BUFFER_USAGE inline FX_ARGB FXARGB_GetDIB(const uint8_t* p) {
+  return ArgbEncode(UNSAFE_BUFFERS(p[3]), UNSAFE_BUFFERS(p[2]),
+                    UNSAFE_BUFFERS(p[1]), UNSAFE_BUFFERS(p[0]));
+}
+
+// SAFETY: Caller must ensure 4 valid bytes at `p`.
+UNSAFE_BUFFER_USAGE inline void FXARGB_SetDIB(uint8_t* p, uint32_t argb) {
+  UNSAFE_BUFFERS(p[0]) = FXARGB_B(argb);
+  UNSAFE_BUFFERS(p[1]) = FXARGB_G(argb);
+  UNSAFE_BUFFERS(p[2]) = FXARGB_R(argb);
+  UNSAFE_BUFFERS(p[3]) = FXARGB_A(argb);
+}
+
+// SAFETY: Caller must ensure 4 valid bytes at `p`.
+UNSAFE_BUFFER_USAGE inline void FXARGB_SetRGBOrderDIB(uint8_t* p,
+                                                      uint32_t argb) {
+  UNSAFE_BUFFERS(p[0]) = FXARGB_R(argb);
+  UNSAFE_BUFFERS(p[1]) = FXARGB_G(argb);
+  UNSAFE_BUFFERS(p[2]) = FXARGB_B(argb);
+  UNSAFE_BUFFERS(p[3]) = FXARGB_A(argb);
+}
+
+// SAFETY: Caller must ensure 3 valid bytes at `dest` and `src`.
+UNSAFE_BUFFER_USAGE inline void ReverseCopy3Bytes(uint8_t* dest,
+                                                  const uint8_t* src) {
+  UNSAFE_BUFFERS(dest[2] = src[0]);
+  UNSAFE_BUFFERS(dest[1] = src[1]);
+  UNSAFE_BUFFERS(dest[0] = src[2]);
 }
 
 #endif  // CORE_FXGE_DIB_FX_DIB_H_