Make char widths signed again.

Undo https://pdfium-review.googlesource.com/24410, because widths can be
negative for font glyphs. To fix https://crbug.com/806612, the correct
solution would have been to just delete the failing assertion. The CL
being reverted did that already, but for different reasons. (As
discussed on the code review, the assertion in question could not fail
when widths are unsigned.)

Bug: chromium:806612,chromium:1128284
Change-Id: Idca065ef9ade650613f8f39393d8513cedf31b6e
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/73770
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Hui Yingst <nigi@chromium.org>
diff --git a/core/fpdfapi/font/cpdf_cidfont.cpp b/core/fpdfapi/font/cpdf_cidfont.cpp
index f9b1e7a..200ee50 100644
--- a/core/fpdfapi/font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/font/cpdf_cidfont.cpp
@@ -201,17 +201,17 @@
     FT_Set_Charmap(face, *FXFT_Get_Face_Charmaps(face));
 }
 
-bool IsMetricForCID(const uint32_t* pEntry, uint16_t cid) {
+bool IsMetricForCID(const int* pEntry, uint16_t cid) {
   return pEntry[0] <= cid && pEntry[1] >= cid;
 }
 
 void LoadMetricsArray(const CPDF_Array* pArray,
-                      std::vector<uint32_t>* result,
+                      std::vector<int>* result,
                       int nElements) {
   int width_status = 0;
   int iCurElement = 0;
-  uint32_t first_code = 0;
-  uint32_t last_code = 0;
+  int first_code = 0;
+  int last_code = 0;
   for (size_t i = 0; i < pArray->size(); i++) {
     const CPDF_Object* pObj = pArray->GetDirectObjectAt(i);
     if (!pObj)
@@ -221,8 +221,8 @@
     if (pObjArray) {
       if (width_status != 1)
         return;
-      if (first_code >
-          std::numeric_limits<uint32_t>::max() - pObjArray->size()) {
+      if (first_code > std::numeric_limits<int>::max() -
+                           pdfium::CollectionSize<int>(*pObjArray)) {
         width_status = 0;
         continue;
       }
@@ -551,15 +551,15 @@
   return rect;
 }
 
-uint32_t CPDF_CIDFont::GetCharWidthF(uint32_t charcode) {
+int CPDF_CIDFont::GetCharWidthF(uint32_t charcode) {
   if (charcode < 0x80 && m_bAnsiWidthsFixed)
     return (charcode >= 32 && charcode < 127) ? 500 : 0;
 
   uint16_t cid = CIDFromCharCode(charcode);
   size_t size = m_WidthList.size();
-  const uint32_t* pList = m_WidthList.data();
+  const int* pList = m_WidthList.data();
   for (size_t i = 0; i < size; i += 3) {
-    const uint32_t* pEntry = pList + i;
+    const int* pEntry = pList + i;
     if (IsMetricForCID(pEntry, cid))
       return pEntry[2];
   }
@@ -569,9 +569,9 @@
 int16_t CPDF_CIDFont::GetVertWidth(uint16_t cid) const {
   size_t vertsize = m_VertMetrics.size() / 5;
   if (vertsize) {
-    const uint32_t* pTable = m_VertMetrics.data();
+    const int* pTable = m_VertMetrics.data();
     for (size_t i = 0; i < vertsize; i++) {
-      const uint32_t* pEntry = pTable + (i * 5);
+      const int* pEntry = pTable + (i * 5);
       if (IsMetricForCID(pEntry, cid))
         return static_cast<int16_t>(pEntry[2]);
     }
@@ -582,26 +582,26 @@
 CFX_Point16 CPDF_CIDFont::GetVertOrigin(uint16_t cid) const {
   size_t vertsize = m_VertMetrics.size() / 5;
   if (vertsize) {
-    const uint32_t* pTable = m_VertMetrics.data();
+    const int* pTable = m_VertMetrics.data();
     for (size_t i = 0; i < vertsize; i++) {
-      const uint32_t* pEntry = pTable + (i * 5);
+      const int* pEntry = pTable + (i * 5);
       if (IsMetricForCID(pEntry, cid)) {
         return {static_cast<int16_t>(pEntry[3]),
                 static_cast<int16_t>(pEntry[4])};
       }
     }
   }
-  uint32_t dwWidth = m_DefaultWidth;
+  int width = m_DefaultWidth;
   size_t size = m_WidthList.size();
-  const uint32_t* pList = m_WidthList.data();
+  const int* pList = m_WidthList.data();
   for (size_t i = 0; i < size; i += 3) {
-    const uint32_t* pEntry = pList + i;
+    const int* pEntry = pList + i;
     if (IsMetricForCID(pEntry, cid)) {
-      dwWidth = pEntry[2];
+      width = pEntry[2];
       break;
     }
   }
-  return {static_cast<int16_t>(dwWidth / 2), m_DefaultVY};
+  return {static_cast<int16_t>(width / 2), m_DefaultVY};
 }
 
 int CPDF_CIDFont::GetGlyphIndex(uint32_t unicode, bool* pVertGlyph) {
diff --git a/core/fpdfapi/font/cpdf_cidfont.h b/core/fpdfapi/font/cpdf_cidfont.h
index 7935999..5a51e40 100644
--- a/core/fpdfapi/font/cpdf_cidfont.h
+++ b/core/fpdfapi/font/cpdf_cidfont.h
@@ -45,7 +45,7 @@
   const CPDF_CIDFont* AsCIDFont() const override;
   CPDF_CIDFont* AsCIDFont() override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
-  uint32_t GetCharWidthF(uint32_t charcode) override;
+  int GetCharWidthF(uint32_t charcode) override;
   FX_RECT GetCharBBox(uint32_t charcode) override;
   uint32_t GetNextChar(ByteStringView pString, size_t* pOffset) const override;
   size_t CountChar(ByteStringView pString) const override;
@@ -80,11 +80,11 @@
   bool m_bAnsiWidthsFixed = false;
   bool m_bAdobeCourierStd = false;
   CIDSet m_Charset = CIDSET_UNKNOWN;
-  uint16_t m_DefaultWidth = 1000;
+  int16_t m_DefaultWidth = 1000;
   int16_t m_DefaultVY = 880;
   int16_t m_DefaultW1 = -1000;
-  std::vector<uint32_t> m_WidthList;
-  std::vector<uint32_t> m_VertMetrics;
+  std::vector<int> m_WidthList;
+  std::vector<int> m_VertMetrics;
   FX_RECT m_CharBBox[256];
 };
 
diff --git a/core/fpdfapi/font/cpdf_font.cpp b/core/fpdfapi/font/cpdf_font.cpp
index 8953350..80a3f4a 100644
--- a/core/fpdfapi/font/cpdf_font.cpp
+++ b/core/fpdfapi/font/cpdf_font.cpp
@@ -275,9 +275,9 @@
   m_pToUnicodeMap = std::make_unique<CPDF_ToUnicodeMap>(pStream);
 }
 
-uint32_t CPDF_Font::GetStringWidth(ByteStringView pString) {
+int CPDF_Font::GetStringWidth(ByteStringView pString) {
   size_t offset = 0;
-  uint32_t width = 0;
+  int width = 0;
   while (offset < pString.GetLength())
     width += GetCharWidthF(GetNextChar(pString, &offset));
   return width;
diff --git a/core/fpdfapi/font/cpdf_font.h b/core/fpdfapi/font/cpdf_font.h
index 77d763c..0bf5053 100644
--- a/core/fpdfapi/font/cpdf_font.h
+++ b/core/fpdfapi/font/cpdf_font.h
@@ -107,13 +107,13 @@
   const FX_RECT& GetFontBBox() const { return m_FontBBox; }
   int GetTypeAscent() const { return m_Ascent; }
   int GetTypeDescent() const { return m_Descent; }
-  uint32_t GetStringWidth(ByteStringView pString);
+  int GetStringWidth(ByteStringView pString);
   uint32_t FallbackFontFromCharcode(uint32_t charcode);
   int FallbackGlyphFromCharcode(int fallbackFont, uint32_t charcode);
   int GetFontFlags() const { return m_Flags; }
   int GetFontWeight() const;
 
-  virtual uint32_t GetCharWidthF(uint32_t charcode) = 0;
+  virtual int GetCharWidthF(uint32_t charcode) = 0;
   virtual FX_RECT GetCharBBox(uint32_t charcode) = 0;
 
   // Can return nullptr for stock Type1 fonts. Always returns non-null for other
diff --git a/core/fpdfapi/font/cpdf_simplefont.cpp b/core/fpdfapi/font/cpdf_simplefont.cpp
index 29f2861..b90accd 100644
--- a/core/fpdfapi/font/cpdf_simplefont.cpp
+++ b/core/fpdfapi/font/cpdf_simplefont.cpp
@@ -164,7 +164,7 @@
   }
 }
 
-uint32_t CPDF_SimpleFont::GetCharWidthF(uint32_t charcode) {
+int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode) {
   if (charcode > 0xff)
     charcode = 0;
 
diff --git a/core/fpdfapi/font/cpdf_simplefont.h b/core/fpdfapi/font/cpdf_simplefont.h
index 11359c3..0e7e9e0 100644
--- a/core/fpdfapi/font/cpdf_simplefont.h
+++ b/core/fpdfapi/font/cpdf_simplefont.h
@@ -19,7 +19,7 @@
   ~CPDF_SimpleFont() override;
 
   // CPDF_Font
-  uint32_t GetCharWidthF(uint32_t charcode) override;
+  int GetCharWidthF(uint32_t charcode) override;
   FX_RECT GetCharBBox(uint32_t charcode) override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
   bool IsUnicodeCompatible() const override;
diff --git a/core/fpdfapi/font/cpdf_type3char.h b/core/fpdfapi/font/cpdf_type3char.h
index ca83452..70fa918 100644
--- a/core/fpdfapi/font/cpdf_type3char.h
+++ b/core/fpdfapi/font/cpdf_type3char.h
@@ -35,7 +35,7 @@
   const RetainPtr<CFX_DIBitmap>& GetBitmap() const;
 
   bool colored() const { return m_bColored; }
-  uint32_t width() const { return m_Width; }
+  int width() const { return m_Width; }
   const CFX_Matrix& matrix() const { return m_ImageMatrix; }
   const FX_RECT& bbox() const { return m_BBox; }
 
@@ -46,7 +46,7 @@
   std::unique_ptr<CPDF_Font::FormIface> m_pForm;
   RetainPtr<CFX_DIBitmap> m_pBitmap;
   bool m_bColored = false;
-  uint32_t m_Width = 0;
+  int m_Width = 0;
   CFX_Matrix m_ImageMatrix;
   FX_RECT m_BBox;
 };
diff --git a/core/fpdfapi/font/cpdf_type3font.cpp b/core/fpdfapi/font/cpdf_type3font.cpp
index 124245d..ac31e20 100644
--- a/core/fpdfapi/font/cpdf_type3font.cpp
+++ b/core/fpdfapi/font/cpdf_type3font.cpp
@@ -29,7 +29,6 @@
                                FormFactoryIface* pFormFactory)
     : CPDF_SimpleFont(pDocument, pFontDict), m_pFormFactory(pFormFactory) {
   ASSERT(GetDocument());
-  memset(m_CharWidthL, 0, sizeof(m_CharWidthL));
 }
 
 CPDF_Type3Font::~CPDF_Type3Font() = default;
@@ -148,7 +147,7 @@
   return pCachedChar;
 }
 
-uint32_t CPDF_Type3Font::GetCharWidthF(uint32_t charcode) {
+int CPDF_Type3Font::GetCharWidthF(uint32_t charcode) {
   if (charcode >= pdfium::size(m_CharWidthL))
     charcode = 0;
 
diff --git a/core/fpdfapi/font/cpdf_type3font.h b/core/fpdfapi/font/cpdf_type3font.h
index 8205aa7..0db2f9f 100644
--- a/core/fpdfapi/font/cpdf_type3font.h
+++ b/core/fpdfapi/font/cpdf_type3font.h
@@ -30,7 +30,7 @@
   const CPDF_Type3Font* AsType3Font() const override;
   CPDF_Type3Font* AsType3Font() override;
   void WillBeDestroyed() override;
-  uint32_t GetCharWidthF(uint32_t charcode) override;
+  int GetCharWidthF(uint32_t charcode) override;
   FX_RECT GetCharBBox(uint32_t charcode) override;
 
   void SetPageResources(CPDF_Dictionary* pResources) {
@@ -60,7 +60,7 @@
   RetainPtr<CPDF_Dictionary> m_pPageResources;
   RetainPtr<CPDF_Dictionary> m_pFontResources;
   std::map<uint32_t, std::unique_ptr<CPDF_Type3Char>> m_CacheMap;
-  uint32_t m_CharWidthL[256];
+  int m_CharWidthL[256] = {};
 };
 
 #endif  // CORE_FPDFAPI_FONT_CPDF_TYPE3FONT_H_
diff --git a/core/fpdfapi/render/charposlist.cpp b/core/fpdfapi/render/charposlist.cpp
index b05b210..5b09f29 100644
--- a/core/fpdfapi/render/charposlist.cpp
+++ b/core/fpdfapi/render/charposlist.cpp
@@ -92,8 +92,8 @@
     float scaling_factor = 1.0f;
     if (!font->IsEmbedded() && font->HasFontWidths() && !is_vertical_writing &&
         !current_font->GetSubstFont()->m_bFlagMM) {
-      uint32_t pdf_glyph_width = font->GetCharWidthF(char_code);
-      uint32_t font_glyph_width =
+      int pdf_glyph_width = font->GetCharWidthF(char_code);
+      int font_glyph_width =
           current_font ? current_font->GetGlyphWidth(text_char_pos.m_GlyphIndex)
                        : 0;
       if (font_glyph_width && pdf_glyph_width > font_glyph_width + 1) {
diff --git a/core/fpdfdoc/cpdf_variabletext.cpp b/core/fpdfdoc/cpdf_variabletext.cpp
index fc114d4..f96f4c2 100644
--- a/core/fpdfdoc/cpdf_variabletext.cpp
+++ b/core/fpdfdoc/cpdf_variabletext.cpp
@@ -37,8 +37,8 @@
 
 CPDF_VariableText::Provider::~Provider() = default;
 
-uint32_t CPDF_VariableText::Provider::GetCharWidth(int32_t nFontIndex,
-                                                   uint16_t word) {
+int CPDF_VariableText::Provider::GetCharWidth(int32_t nFontIndex,
+                                              uint16_t word) {
   RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
   if (!pPDFFont)
     return 0;
@@ -862,9 +862,9 @@
   return rcRet;
 }
 
-uint32_t CPDF_VariableText::GetCharWidth(int32_t nFontIndex,
-                                         uint16_t Word,
-                                         uint16_t SubWord) {
+int CPDF_VariableText::GetCharWidth(int32_t nFontIndex,
+                                    uint16_t Word,
+                                    uint16_t SubWord) {
   if (!m_pVTProvider)
     return 0;
   uint16_t word = SubWord ? SubWord : Word;
diff --git a/core/fpdfdoc/cpdf_variabletext.h b/core/fpdfdoc/cpdf_variabletext.h
index aa47015..1d3fb59 100644
--- a/core/fpdfdoc/cpdf_variabletext.h
+++ b/core/fpdfdoc/cpdf_variabletext.h
@@ -53,7 +53,7 @@
     explicit Provider(IPVT_FontMap* pFontMap);
     virtual ~Provider();
 
-    virtual uint32_t GetCharWidth(int32_t nFontIndex, uint16_t word);
+    virtual int GetCharWidth(int32_t nFontIndex, uint16_t word);
     virtual int32_t GetTypeAscent(int32_t nFontIndex);
     virtual int32_t GetTypeDescent(int32_t nFontIndex);
     virtual int32_t GetWordFontIndex(uint16_t word,
@@ -163,7 +163,7 @@
   float GetLineIndent();
 
  private:
-  uint32_t GetCharWidth(int32_t nFontIndex, uint16_t Word, uint16_t SubWord);
+  int GetCharWidth(int32_t nFontIndex, uint16_t Word, uint16_t SubWord);
   int32_t GetTypeAscent(int32_t nFontIndex);
   int32_t GetTypeDescent(int32_t nFontIndex);
   int32_t GetWordFontIndex(uint16_t word, int32_t charset, int32_t nFontIndex);
diff --git a/core/fpdftext/cpdf_textpage.cpp b/core/fpdftext/cpdf_textpage.cpp
index cc901fa..b355cc9 100644
--- a/core/fpdftext/cpdf_textpage.cpp
+++ b/core/fpdftext/cpdf_textpage.cpp
@@ -157,11 +157,11 @@
   return CFX_BidiString(str).OverallDirection() == CFX_BidiChar::RIGHT;
 }
 
-uint32_t GetCharWidth(uint32_t charCode, CPDF_Font* pFont) {
+int GetCharWidth(uint32_t charCode, CPDF_Font* pFont) {
   if (charCode == CPDF_Font::kInvalidCharCode)
     return 0;
 
-  uint32_t w = pFont->GetCharWidthF(charCode);
+  int w = pFont->GetCharWidthF(charCode);
   if (w > 0)
     return w;
 
@@ -1233,11 +1233,11 @@
   }
 
   float last_pos = PrevItem.m_Origin.x;
-  uint32_t nLastWidth =
+  int nLastWidth =
       GetCharWidth(PrevItem.m_CharCode, m_pPrevTextObj->GetFont().Get());
   float last_width = nLastWidth * m_pPrevTextObj->GetFontSize() / 1000;
   last_width = fabs(last_width);
-  uint32_t nThisWidth = GetCharWidth(item.m_CharCode, pObj->GetFont().Get());
+  int nThisWidth = GetCharWidth(item.m_CharCode, pObj->GetFont().Get());
   float this_width = fabs(nThisWidth * pObj->GetFontSize() / 1000);
   float threshold = std::max(last_width, this_width) / 4;
 
diff --git a/core/fxge/apple/fx_apple_platform.cpp b/core/fxge/apple/fx_apple_platform.cpp
index b97a3b4..309afb4 100644
--- a/core/fxge/apple/fx_apple_platform.cpp
+++ b/core/fxge/apple/fx_apple_platform.cpp
@@ -173,7 +173,7 @@
     const CFX_Font* pFont,
     uint32_t glyph_index,
     const CFX_Matrix& matrix,
-    uint32_t dest_width,
+    int dest_width,
     int anti_alias) {
   return nullptr;
 }
diff --git a/core/fxge/cfx_font.cpp b/core/fxge/cfx_font.cpp
index 0c5849b..99dad64 100644
--- a/core/fxge/cfx_font.cpp
+++ b/core/fxge/cfx_font.cpp
@@ -357,7 +357,7 @@
   }
 }
 
-uint32_t CFX_Font::GetGlyphWidth(uint32_t glyph_index) {
+int CFX_Font::GetGlyphWidth(uint32_t glyph_index) {
   if (!m_Face)
     return 0;
   if (m_pSubstFont && m_pSubstFont->m_bFlagMM)
@@ -369,7 +369,7 @@
     return 0;
 
   int horiAdvance = FXFT_Get_Glyph_HoriAdvance(m_Face->GetRec());
-  if (horiAdvance < 0 || horiAdvance > kThousandthMaxInt)
+  if (horiAdvance < kThousandthMinInt || horiAdvance > kThousandthMaxInt)
     return 0;
 
   return EM_ADJUST(FXFT_Get_Face_UnitsPerEM(m_Face->GetRec()), horiAdvance);
@@ -634,7 +634,7 @@
 }
 
 CFX_PathData* CFX_Font::LoadGlyphPathImpl(uint32_t glyph_index,
-                                          uint32_t dest_width) const {
+                                          int dest_width) const {
   if (!m_Face)
     return nullptr;
 
@@ -699,7 +699,7 @@
     uint32_t glyph_index,
     bool bFontStyle,
     const CFX_Matrix& matrix,
-    uint32_t dest_width,
+    int dest_width,
     int anti_alias,
     CFX_TextRenderOptions* text_options) const {
   return GetOrCreateGlyphCache()->LoadGlyphBitmap(this, glyph_index, bFontStyle,
@@ -708,7 +708,7 @@
 }
 
 const CFX_PathData* CFX_Font::LoadGlyphPath(uint32_t glyph_index,
-                                            uint32_t dest_width) const {
+                                            int dest_width) const {
   return GetOrCreateGlyphCache()->LoadGlyphPath(this, glyph_index, dest_width);
 }
 
diff --git a/core/fxge/cfx_font.h b/core/fxge/cfx_font.h
index d421a1a..31e5c7e 100644
--- a/core/fxge/cfx_font.h
+++ b/core/fxge/cfx_font.h
@@ -73,17 +73,16 @@
       uint32_t glyph_index,
       bool bFontStyle,
       const CFX_Matrix& matrix,
-      uint32_t dest_width,
+      int dest_width,
       int anti_alias,
       CFX_TextRenderOptions* text_options) const;
-  const CFX_PathData* LoadGlyphPath(uint32_t glyph_index,
-                                    uint32_t dest_width) const;
+  const CFX_PathData* LoadGlyphPath(uint32_t glyph_index, int dest_width) const;
 
 #if defined(_SKIA_SUPPORT_) || defined(_SKIA_SUPPORT_PATHS_)
   CFX_TypeFace* GetDeviceCache() const;
 #endif
 
-  uint32_t GetGlyphWidth(uint32_t glyph_index);
+  int GetGlyphWidth(uint32_t glyph_index);
   int GetAscent() const;
   int GetDescent() const;
   bool GetGlyphBBox(uint32_t glyph_index, FX_RECT* pBBox);
@@ -105,8 +104,7 @@
   void SetSubData(uint8_t* data) { m_pGsubData.reset(data); }
   pdfium::span<uint8_t> GetFontSpan() const { return m_FontData; }
   void AdjustMMParams(int glyph_index, int dest_width, int weight) const;
-  CFX_PathData* LoadGlyphPathImpl(uint32_t glyph_index,
-                                  uint32_t dest_width) const;
+  CFX_PathData* LoadGlyphPathImpl(uint32_t glyph_index, int dest_width) const;
 #if defined(OS_APPLE)
   void* GetPlatformFont() const { return m_pPlatformFont; }
   void SetPlatformFont(void* font) { m_pPlatformFont = font; }
diff --git a/core/fxge/cfx_glyphcache.cpp b/core/fxge/cfx_glyphcache.cpp
index f51beea..0c81edc 100644
--- a/core/fxge/cfx_glyphcache.cpp
+++ b/core/fxge/cfx_glyphcache.cpp
@@ -65,7 +65,7 @@
 void GenKey(UniqueKeyGen* pKeyGen,
             const CFX_Font* pFont,
             const CFX_Matrix& matrix,
-            uint32_t dest_width,
+            int dest_width,
             int anti_alias,
             bool bNative) {
   int nMatrixA = static_cast<int>(matrix.a * 10000);
@@ -107,7 +107,7 @@
     uint32_t glyph_index,
     bool bFontStyle,
     const CFX_Matrix& matrix,
-    uint32_t dest_width,
+    int dest_width,
     int anti_alias) {
   if (!GetFaceRec())
     return nullptr;
@@ -220,7 +220,7 @@
 
 const CFX_PathData* CFX_GlyphCache::LoadGlyphPath(const CFX_Font* pFont,
                                                   uint32_t glyph_index,
-                                                  uint32_t dest_width) {
+                                                  int dest_width) {
   if (!GetFaceRec() || glyph_index == kInvalidGlyphIndex)
     return nullptr;
 
@@ -244,7 +244,7 @@
     uint32_t glyph_index,
     bool bFontStyle,
     const CFX_Matrix& matrix,
-    uint32_t dest_width,
+    int dest_width,
     int anti_alias,
     CFX_TextRenderOptions* text_options) {
   if (glyph_index == kInvalidGlyphIndex)
@@ -337,7 +337,7 @@
     const ByteString& FaceGlyphsKey,
     uint32_t glyph_index,
     bool bFontStyle,
-    uint32_t dest_width,
+    int dest_width,
     int anti_alias) {
   SizeGlyphCache* pSizeCache;
   auto it = m_SizeMap.find(FaceGlyphsKey);
diff --git a/core/fxge/cfx_glyphcache.h b/core/fxge/cfx_glyphcache.h
index 9e85fe9..565cc6e 100644
--- a/core/fxge/cfx_glyphcache.h
+++ b/core/fxge/cfx_glyphcache.h
@@ -36,12 +36,12 @@
                                          uint32_t glyph_index,
                                          bool bFontStyle,
                                          const CFX_Matrix& matrix,
-                                         uint32_t dest_width,
+                                         int dest_width,
                                          int anti_alias,
                                          CFX_TextRenderOptions* text_options);
   const CFX_PathData* LoadGlyphPath(const CFX_Font* pFont,
                                     uint32_t glyph_index,
-                                    uint32_t dest_width);
+                                    int dest_width);
 
   RetainPtr<CFX_Face> GetFace() { return m_Face; }
   FXFT_FaceRec* GetFaceRec() { return m_Face ? m_Face->GetRec() : nullptr; }
@@ -55,26 +55,26 @@
 
   using SizeGlyphCache = std::map<uint32_t, std::unique_ptr<CFX_GlyphBitmap>>;
   // <glyph_index, width, weight, angle, vertical>
-  using PathMapKey = std::tuple<uint32_t, uint32_t, int, int, bool>;
+  using PathMapKey = std::tuple<uint32_t, int, int, int, bool>;
 
   std::unique_ptr<CFX_GlyphBitmap> RenderGlyph(const CFX_Font* pFont,
                                                uint32_t glyph_index,
                                                bool bFontStyle,
                                                const CFX_Matrix& matrix,
-                                               uint32_t dest_width,
+                                               int dest_width,
                                                int anti_alias);
   std::unique_ptr<CFX_GlyphBitmap> RenderGlyph_Nativetext(
       const CFX_Font* pFont,
       uint32_t glyph_index,
       const CFX_Matrix& matrix,
-      uint32_t dest_width,
+      int dest_width,
       int anti_alias);
   CFX_GlyphBitmap* LookUpGlyphBitmap(const CFX_Font* pFont,
                                      const CFX_Matrix& matrix,
                                      const ByteString& FaceGlyphsKey,
                                      uint32_t glyph_index,
                                      bool bFontStyle,
-                                     uint32_t dest_width,
+                                     int dest_width,
                                      int anti_alias);
   void InitPlatform();
   void DestroyPlatform();
diff --git a/core/fxge/skia/fx_skia_device_embeddertest.cpp b/core/fxge/skia/fx_skia_device_embeddertest.cpp
index 136bb6b..66a3f60 100644
--- a/core/fxge/skia/fx_skia_device_embeddertest.cpp
+++ b/core/fxge/skia/fx_skia_device_embeddertest.cpp
@@ -42,7 +42,7 @@
   TextCharPos charPos[1];
   charPos[0].m_Origin = CFX_PointF(0, 1);
   charPos[0].m_GlyphIndex = 1;
-  charPos[0].m_FontCharWidth = 4u;
+  charPos[0].m_FontCharWidth = 4;
 
   CFX_Font font;
   float fontSize = 1;
diff --git a/core/fxge/text_char_pos.h b/core/fxge/text_char_pos.h
index 8d0c301..ee4e670 100644
--- a/core/fxge/text_char_pos.h
+++ b/core/fxge/text_char_pos.h
@@ -18,7 +18,7 @@
   CFX_PointF m_Origin;
   uint32_t m_Unicode = 0;
   uint32_t m_GlyphIndex = 0;
-  uint32_t m_FontCharWidth = 0;
+  int m_FontCharWidth = 0;
 #if defined(OS_APPLE)
   uint32_t m_ExtGID = 0;
 #endif
diff --git a/fpdfsdk/fpdf_edit_embeddertest.cpp b/fpdfsdk/fpdf_edit_embeddertest.cpp
index ed3aae6..c673766 100644
--- a/fpdfsdk/fpdf_edit_embeddertest.cpp
+++ b/fpdfsdk/fpdf_edit_embeddertest.cpp
@@ -165,7 +165,7 @@
         int cnt = static_cast<int>(arr->size());
         size_t inner_idx = 0;
         for (cur_cid = cid; cur_cid < cid + cnt; cur_cid++) {
-          uint32_t width = arr->GetNumberAt(inner_idx++);
+          int width = arr->GetNumberAt(inner_idx++);
           EXPECT_EQ(width, typed_font->GetCharWidthF(cur_cid))
               << " at cid " << cur_cid;
         }
@@ -176,7 +176,7 @@
       ASSERT_TRUE(next->IsNumber());
       int last_cid = next->AsNumber()->GetInteger();
       ASSERT_FALSE(++idx == widths_array->size());
-      uint32_t width = widths_array->GetNumberAt(idx);
+      int width = widths_array->GetNumberAt(idx);
       for (cur_cid = cid; cur_cid <= last_cid; cur_cid++) {
         EXPECT_EQ(width, typed_font->GetCharWidthF(cur_cid))
             << " at cid " << cur_cid;
diff --git a/fpdfsdk/fpdf_edittext.cpp b/fpdfsdk/fpdf_edittext.cpp
index fc9780a..b3815f8 100644
--- a/fpdfsdk/fpdf_edittext.cpp
+++ b/fpdfsdk/fpdf_edittext.cpp
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <algorithm>
-#include <limits>
 #include <map>
 #include <memory>
 #include <utility>
@@ -290,10 +288,7 @@
                                     static_cast<int>(dwCurrentChar));
   CPDF_Array* widthsArray = pDoc->NewIndirect<CPDF_Array>();
   while (true) {
-    uint32_t width =
-        std::min(pFont->GetGlyphWidth(dwGlyphIndex),
-                 static_cast<uint32_t>(std::numeric_limits<int>::max()));
-    widthsArray->AppendNew<CPDF_Number>(static_cast<int>(width));
+    widthsArray->AppendNew<CPDF_Number>(pFont->GetGlyphWidth(dwGlyphIndex));
     uint32_t nextChar =
         FT_Get_Next_Char(pFont->GetFaceRec(), dwCurrentChar, &dwGlyphIndex);
     // Simple fonts have 1-byte charcodes only.
diff --git a/fpdfsdk/pwl/cpwl_edit_impl.cpp b/fpdfsdk/pwl/cpwl_edit_impl.cpp
index 9d14e49..8db0cdf 100644
--- a/fpdfsdk/pwl/cpwl_edit_impl.cpp
+++ b/fpdfsdk/pwl/cpwl_edit_impl.cpp
@@ -110,8 +110,7 @@
   return m_pFontMap;
 }
 
-uint32_t CPWL_EditImpl_Provider::GetCharWidth(int32_t nFontIndex,
-                                              uint16_t word) {
+int CPWL_EditImpl_Provider::GetCharWidth(int32_t nFontIndex, uint16_t word) {
   RetainPtr<CPDF_Font> pPDFFont = m_pFontMap->GetPDFFont(nFontIndex);
   if (!pPDFFont)
     return 0;
diff --git a/fpdfsdk/pwl/cpwl_edit_impl.h b/fpdfsdk/pwl/cpwl_edit_impl.h
index f16be7e..9bba4f0 100644
--- a/fpdfsdk/pwl/cpwl_edit_impl.h
+++ b/fpdfsdk/pwl/cpwl_edit_impl.h
@@ -448,7 +448,7 @@
   IPVT_FontMap* GetFontMap() const;
 
   // CPDF_VariableText::Provider:
-  uint32_t GetCharWidth(int32_t nFontIndex, uint16_t word) override;
+  int GetCharWidth(int32_t nFontIndex, uint16_t word) override;
   int32_t GetTypeAscent(int32_t nFontIndex) override;
   int32_t GetTypeDescent(int32_t nFontIndex) override;
   int32_t GetWordFontIndex(uint16_t word,
diff --git a/fxbarcode/oned/BC_OneDimWriter.cpp b/fxbarcode/oned/BC_OneDimWriter.cpp
index 1e2b2a5..b4db093 100644
--- a/fxbarcode/oned/BC_OneDimWriter.cpp
+++ b/fxbarcode/oned/BC_OneDimWriter.cpp
@@ -130,7 +130,7 @@
   for (size_t i = 0; i < length; ++i) {
     charcodes[i] = encoding->CharCodeFromUnicode(text[i]);
     int32_t glyph_code = encoding->GlyphFromCharCode(charcodes[i]);
-    uint32_t glyph_value = cFont->GetGlyphWidth(glyph_code);
+    int glyph_value = cFont->GetGlyphWidth(glyph_code);
     float temp = glyph_value * fontSize / 1000.0;
     charWidth += temp;
   }
diff --git a/testing/resources/pixel/bug_1128284_expected.pdf.0.png b/testing/resources/pixel/bug_1128284_expected.pdf.0.png
index 5405729..6a0df39 100644
--- a/testing/resources/pixel/bug_1128284_expected.pdf.0.png
+++ b/testing/resources/pixel/bug_1128284_expected.pdf.0.png
Binary files differ
diff --git a/xfa/fgas/layout/cfx_rtfbreak.cpp b/xfa/fgas/layout/cfx_rtfbreak.cpp
index 5b290b9..3523c63 100644
--- a/xfa/fgas/layout/cfx_rtfbreak.cpp
+++ b/xfa/fgas/layout/cfx_rtfbreak.cpp
@@ -758,7 +758,7 @@
       continue;
     }
 
-    uint32_t iCharWidth = abs(iWidth);
+    int iCharWidth = abs(iWidth);
     const bool bEmptyChar = (dwCharType >= FX_CHARTYPE::kTab &&
                              dwCharType <= FX_CHARTYPE::kControl);
     if (!bEmptyChar)
diff --git a/xfa/fgas/layout/cfx_txtbreak.cpp b/xfa/fgas/layout/cfx_txtbreak.cpp
index 139e0a3..496b851 100644
--- a/xfa/fgas/layout/cfx_txtbreak.cpp
+++ b/xfa/fgas/layout/cfx_txtbreak.cpp
@@ -847,8 +847,6 @@
 #if defined(OS_APPLE)
         pCharPos->m_ExtGID = pCharPos->m_GlyphIndex;
 #endif
-        // TODO(npm): change widths in this method to unsigned to avoid implicit
-        // cast in the following line.
         pCharPos->m_FontCharWidth = iCharWidth;
       }