diff --git a/core/fpdfapi/page/cpdf_dib.cpp b/core/fpdfapi/page/cpdf_dib.cpp
index 3938959..ae36c08 100644
--- a/core/fpdfapi/page/cpdf_dib.cpp
+++ b/core/fpdfapi/page/cpdf_dib.cpp
@@ -727,7 +727,7 @@
       m_JpxInlineData.data.reserve(image_info.width * image_info.height);
       for (uint32_t row = 0; row < image_info.height; ++row) {
         const uint8_t* src = result_bitmap->GetScanline(row).data();
-        uint8_t* dest = rgb_bitmap->GetWritableScanline(row);
+        uint8_t* dest = rgb_bitmap->GetWritableScanline(row).data();
         for (uint32_t col = 0; col < image_info.width; ++col) {
           uint8_t a = src[3];
           m_JpxInlineData.data.push_back(a);
@@ -746,7 +746,7 @@
       // TODO(thestig): Is there existing code that does this already?
       for (uint32_t row = 0; row < image_info.height; ++row) {
         const uint8_t* src = result_bitmap->GetScanline(row).data();
-        uint8_t* dest = rgb_bitmap->GetWritableScanline(row);
+        uint8_t* dest = rgb_bitmap->GetWritableScanline(row).data();
         for (uint32_t col = 0; col < image_info.width; ++col) {
           memcpy(dest, src, 3);
           src += 4;
@@ -760,7 +760,7 @@
              m_bpc < 8) {
     int scale = 8 - m_bpc;
     for (uint32_t row = 0; row < image_info.height; ++row) {
-      uint8_t* scanline = result_bitmap->GetWritableScanline(row);
+      uint8_t* scanline = result_bitmap->GetWritableScanline(row).data();
       for (uint32_t col = 0; col < image_info.width; ++col) {
         *scanline = (*scanline) >> scale;
         ++scanline;
diff --git a/core/fpdfapi/render/cpdf_imagerenderer.cpp b/core/fpdfapi/render/cpdf_imagerenderer.cpp
index 9d71176..0881dab 100644
--- a/core/fpdfapi/render/cpdf_imagerenderer.cpp
+++ b/core/fpdfapi/render/cpdf_imagerenderer.cpp
@@ -241,7 +241,8 @@
   int matte_g = FXARGB_G(m_Loader.MatteColor());
   int matte_b = FXARGB_B(m_Loader.MatteColor());
   for (int row = 0; row < rect.Height(); row++) {
-    uint8_t* dest_scan = pBitmapDevice1->GetBitmap()->GetWritableScanline(row);
+    uint8_t* dest_scan =
+        pBitmapDevice1->GetBitmap()->GetWritableScanline(row).data();
     const uint8_t* mask_scan =
         pBitmapDevice2->GetBitmap()->GetScanline(row).data();
     for (int col = 0; col < rect.Width(); col++) {
diff --git a/core/fxcodec/progressive_decoder.cpp b/core/fxcodec/progressive_decoder.cpp
index 5842a50..4fb0bd6 100644
--- a/core/fxcodec/progressive_decoder.cpp
+++ b/core/fxcodec/progressive_decoder.cpp
@@ -411,7 +411,7 @@
   FX_ARGB argb = m_SrcPalette[pal_index];
   for (int row = 0; row < sizeY; row++) {
     uint8_t* pScanline =
-        pDevice->GetWritableScanline(row + startY) + startX * Bpp;
+        pDevice->GetWritableScanline(row + startY).data() + startX * Bpp;
     switch (m_TransMethod) {
       case 3: {
         uint8_t gray =
@@ -493,7 +493,7 @@
     int cur_row = dest_row;
     while (++cur_row < dest_bottom) {
       uint8_t* scan_des =
-          pDIBitmap->GetWritableScanline(cur_row) + dest_ScanOffet;
+          pDIBitmap->GetWritableScanline(cur_row).data() + dest_ScanOffet;
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
@@ -560,7 +560,7 @@
         pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
     while (++dest_row < dest_bottom) {
       uint8_t* scan_des =
-          pDeviceBitmap->GetWritableScanline(dest_row) + dest_ScanOffet;
+          pDeviceBitmap->GetWritableScanline(dest_row).data() + dest_ScanOffet;
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
@@ -568,7 +568,7 @@
   }
   for (; dest_row_1 > dest_row; dest_row_1--) {
     uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1) + dest_ScanOffet;
+        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
@@ -847,7 +847,7 @@
   dest_row_1 = std::max(dest_row_1, dest_top);
   for (; dest_row_1 < dest_row; dest_row_1++) {
     uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1) + dest_ScanOffet;
+        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
@@ -1063,8 +1063,8 @@
   int32_t src_left = m_clipBox.left;
   int32_t dest_left = m_startX;
   src_scan += src_left * src_Bpp;
-  uint8_t* dest_scan =
-      pDeviceBitmap->GetWritableScanline(dest_line) + dest_left * dest_Bpp;
+  uint8_t* dest_scan = pDeviceBitmap->GetWritableScanline(dest_line).data() +
+                       dest_left * dest_Bpp;
   switch (pDeviceBitmap->GetFormat()) {
     case FXDIB_Format::k1bppMask:
     case FXDIB_Format::k1bppRgb:
@@ -1335,7 +1335,7 @@
     case FXDIB_Format::k8bppMask: {
       for (int32_t row = 0; row < pClipBitmap->GetHeight(); row++) {
         const uint8_t* src_line = pClipBitmap->GetScanline(row).data();
-        uint8_t* dest_line = pFormatBitmap->GetWritableScanline(row);
+        uint8_t* dest_line = pFormatBitmap->GetWritableScanline(row).data();
         for (int32_t col = 0; col < pClipBitmap->GetWidth(); col++) {
           uint8_t _a = 255 - src_line[3];
           uint8_t b = (src_line[0] * src_line[3] + 0xFF * _a) / 255;
@@ -1352,7 +1352,7 @@
           (m_pDeviceBitmap->GetFormat() == FXDIB_Format::kRgb) ? 3 : 4;
       for (int32_t row = 0; row < pClipBitmap->GetHeight(); row++) {
         const uint8_t* src_line = pClipBitmap->GetScanline(row).data();
-        uint8_t* dest_line = pFormatBitmap->GetWritableScanline(row);
+        uint8_t* dest_line = pFormatBitmap->GetWritableScanline(row).data();
         for (int32_t col = 0; col < pClipBitmap->GetWidth(); col++) {
           uint8_t _a = 255 - src_line[3];
           uint8_t b = (src_line[0] * src_line[3] + 0xFF * _a) / 255;
@@ -1927,7 +1927,8 @@
           pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
       while (++dest_row < dest_bottom) {
         uint8_t* scan_des =
-            pDeviceBitmap->GetWritableScanline(dest_row) + dest_ScanOffet;
+            pDeviceBitmap->GetWritableScanline(dest_row).data() +
+            dest_ScanOffet;
         uint32_t size = m_sizeX * dest_Bpp;
         memmove(scan_des, scan_src, size);
       }
@@ -1936,7 +1937,7 @@
   }
   for (; dest_row_1 < dest_row; dest_row_1++) {
     uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1) + dest_ScanOffet;
+        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
@@ -2005,7 +2006,7 @@
         pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
     while (++dest_row < dest_bottom) {
       uint8_t* scan_des =
-          pDeviceBitmap->GetWritableScanline(dest_row) + dest_ScanOffet;
+          pDeviceBitmap->GetWritableScanline(dest_row).data() + dest_ScanOffet;
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
diff --git a/core/fxcodec/tiff/tiff_decoder.cpp b/core/fxcodec/tiff/tiff_decoder.cpp
index 4f57299..f66ab19 100644
--- a/core/fxcodec/tiff/tiff_decoder.cpp
+++ b/core/fxcodec/tiff/tiff_decoder.cpp
@@ -459,7 +459,7 @@
                                   (uint32*)pDIBitmap->GetBuffer(), rotation,
                                   1)) {
       for (uint32_t row = 0; row < img_height; row++) {
-        uint8_t* row_buf = pDIBitmap->GetWritableScanline(row);
+        uint8_t* row_buf = pDIBitmap->GetWritableScanline(row).data();
         TiffBGRA2RGBA(row_buf, img_width, 4);
       }
       return true;
diff --git a/core/fxge/dib/cfx_bitmapcomposer.cpp b/core/fxge/dib/cfx_bitmapcomposer.cpp
index 90a65f2..6fbf1bd 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.cpp
+++ b/core/fxge/dib/cfx_bitmapcomposer.cpp
@@ -113,7 +113,7 @@
                     m_pClipMask->GetPitch() +
                 (m_DestLeft - m_pClipRgn->GetBox().left);
   }
-  uint8_t* dest_scan = m_pBitmap->GetWritableScanline(line + m_DestTop);
+  uint8_t* dest_scan = m_pBitmap->GetWritableScanline(line + m_DestTop).data();
   if (dest_scan) {
     FX_SAFE_UINT32 offset = m_DestLeft;
     offset *= m_pBitmap->GetBPP();
diff --git a/core/fxge/dib/cfx_bitmapstorer.cpp b/core/fxge/dib/cfx_bitmapstorer.cpp
index 45a0a18..e4d0eaf 100644
--- a/core/fxge/dib/cfx_bitmapstorer.cpp
+++ b/core/fxge/dib/cfx_bitmapstorer.cpp
@@ -27,7 +27,7 @@
 void CFX_BitmapStorer::ComposeScanline(int line,
                                        const uint8_t* scanline,
                                        const uint8_t* scan_extra_alpha) {
-  uint8_t* dest_buf = m_pBitmap->GetWritableScanline(line);
+  uint8_t* dest_buf = m_pBitmap->GetWritableScanline(line).data();
   if (dest_buf)
     memcpy(dest_buf, scanline, m_pBitmap->GetPitch());
 
diff --git a/core/fxge/dib/cfx_dibbase.cpp b/core/fxge/dib/cfx_dibbase.cpp
index 66d8ce5..aabc35f 100644
--- a/core/fxge/dib/cfx_dibbase.cpp
+++ b/core/fxge/dib/cfx_dibbase.cpp
@@ -634,7 +634,7 @@
           reinterpret_cast<const uint32_t*>(GetScanline(row).data()) +
           rect.left / 32;
       uint32_t* dest_scan = reinterpret_cast<uint32_t*>(
-          pNewBitmap->GetWritableScanline(row - rect.top));
+          pNewBitmap->GetWritableScanline(row - rect.top).data());
       for (int i = 0; i < dword_count; ++i) {
         dest_scan[i] =
             (src_scan[i] << left_shift) | (src_scan[i + 1] >> right_shift);
@@ -659,7 +659,8 @@
     for (int row = rect.top; row < rect.bottom; ++row) {
       const uint8_t* src_scan =
           GetScanline(row).subspan(offset.ValueOrDie()).data();
-      uint8_t* dest_scan = pNewBitmap->GetWritableScanline(row - rect.top);
+      uint8_t* dest_scan =
+          pNewBitmap->GetWritableScanline(row - rect.top).data();
       memcpy(dest_scan, src_scan, copy_len.ValueOrDie());
     }
   }
@@ -858,7 +859,8 @@
 }
 
 uint8_t* CFX_DIBBase::GetWritableAlphaMaskScanline(int line) {
-  return m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(line) : nullptr;
+  return m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(line).data()
+                      : nullptr;
 }
 
 uint8_t* CFX_DIBBase::GetAlphaMaskBuffer() {
@@ -879,7 +881,7 @@
   for (int row = rect.top; row < rect.bottom; ++row) {
     const uint8_t* src_scan =
         GetScanline(row).subspan(rect.left * 4 + 3).data();
-    uint8_t* dest_scan = pMask->GetWritableScanline(row - rect.top);
+    uint8_t* dest_scan = pMask->GetWritableScanline(row - rect.top).data();
     for (int col = rect.left; col < rect.right; ++col) {
       *dest_scan++ = *src_scan;
       src_scan += 4;
@@ -909,7 +911,7 @@
       return false;
   }
   for (int row = 0; row < m_Height; ++row) {
-    memcpy(m_pAlphaMask->GetWritableScanline(row),
+    memcpy(m_pAlphaMask->GetWritableScanline(row).data(),
            pAlphaMask->GetScanline(row + rect.top).subspan(rect.left).data(),
            m_pAlphaMask->m_Pitch);
   }
diff --git a/core/fxge/dib/cfx_dibbase.h b/core/fxge/dib/cfx_dibbase.h
index eca8e36..d671b0c 100644
--- a/core/fxge/dib/cfx_dibbase.h
+++ b/core/fxge/dib/cfx_dibbase.h
@@ -36,8 +36,9 @@
   virtual pdfium::span<const uint8_t> GetScanline(int line) const = 0;
   virtual bool SkipToScanline(int line, PauseIndicatorIface* pPause) const;
 
-  uint8_t* GetWritableScanline(int line) {
-    return const_cast<uint8_t*>(GetScanline(line).data());
+  pdfium::span<uint8_t> GetWritableScanline(int line) {
+    pdfium::span<const uint8_t> src = GetScanline(line);
+    return {const_cast<uint8_t*>(src.data()), src.size()};
   }
   int GetWidth() const { return m_Width; }
   int GetHeight() const { return m_Height; }
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 7afe592..ccc1041 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -351,7 +351,7 @@
   int srcBytes = pSrcClone->GetBPP() / 8;
   int destBytes = pDst->GetBPP() / 8;
   for (int row = 0; row < m_Height; row++) {
-    uint8_t* dest_pos = pDst->GetWritableScanline(row) + destOffset;
+    uint8_t* dest_pos = pDst->GetWritableScanline(row).data() + destOffset;
     const uint8_t* src_pos =
         pSrcClone->GetScanline(row).subspan(srcOffset).data();
     for (int col = 0; col < m_Width; col++) {
@@ -775,7 +775,8 @@
             : nullptr;
     uint8_t* dst_scan_extra_alpha =
         m_pAlphaMask
-            ? m_pAlphaMask->GetWritableScanline(dest_top + row) + dest_left
+            ? m_pAlphaMask->GetWritableScanline(dest_top + row).data() +
+                  dest_left
             : nullptr;
     const uint8_t* clip_scan = nullptr;
     if (pClipMask) {
@@ -847,7 +848,8 @@
     const uint8_t* src_scan = pMask->GetScanline(src_top + row).data();
     uint8_t* dst_scan_extra_alpha =
         m_pAlphaMask
-            ? m_pAlphaMask->GetWritableScanline(dest_top + row) + dest_left
+            ? m_pAlphaMask->GetWritableScanline(dest_top + row).data() +
+                  dest_left
             : nullptr;
     const uint8_t* clip_scan = nullptr;
     if (pClipMask) {
@@ -917,8 +919,9 @@
       index = (static_cast<uint8_t>(color) == 0xff) ? 1 : 0;
     }
     for (int row = rect.top; row < rect.bottom; row++) {
-      uint8_t* dest_scan_top = GetWritableScanline(row) + rect.left / 8;
-      uint8_t* dest_scan_top_r = GetWritableScanline(row) + rect.right / 8;
+      uint8_t* dest_scan_top = GetWritableScanline(row).data() + rect.left / 8;
+      uint8_t* dest_scan_top_r =
+          GetWritableScanline(row).data() + rect.right / 8;
       uint8_t left_flag = *dest_scan_top & (255 << (8 - left_shift));
       uint8_t right_flag = *dest_scan_top_r & (255 >> right_shift);
       if (new_width) {
@@ -954,8 +957,9 @@
     for (int row = rect.top; row < rect.bottom; row++) {
       uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left * Bpp;
       uint8_t* dest_scan_alpha =
-          m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(row) + rect.left
-                       : nullptr;
+          m_pAlphaMask
+              ? m_pAlphaMask->GetWritableScanline(row).data() + rect.left
+              : nullptr;
       if (dest_scan_alpha)
         memset(dest_scan_alpha, 0xff, width);
 
@@ -998,7 +1002,7 @@
         }
       } else {
         uint8_t* dest_scan_alpha =
-            m_pAlphaMask->GetWritableScanline(row) + rect.left;
+            m_pAlphaMask->GetWritableScanline(row).data() + rect.left;
         for (int col = 0; col < width; col++) {
           uint8_t back_alpha = *dest_scan_alpha;
           if (back_alpha == 0) {
diff --git a/core/fxge/dib/cfx_imagetransformer.cpp b/core/fxge/dib/cfx_imagetransformer.cpp
index a942a87..3dcaf03 100644
--- a/core/fxge/dib/cfx_imagetransformer.cpp
+++ b/core/fxge/dib/cfx_imagetransformer.cpp
@@ -105,7 +105,7 @@
                     const F& func) {
   CFX_BilinearMatrix matrix_fix(calc_data.matrix);
   for (int row = 0; row < result_rect.Height(); row++) {
-    uint8_t* dest = calc_data.bitmap->GetWritableScanline(row);
+    uint8_t* dest = calc_data.bitmap->GetWritableScanline(row).data();
     for (int col = 0; col < result_rect.Width(); col++) {
       CFX_ImageTransformer::BilinearData d;
       d.res_x = 0;