diff --git a/core/fxge/dib/cfx_bitmapcomposer.cpp b/core/fxge/dib/cfx_bitmapcomposer.cpp
index 4aa97dd..baa9e06 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.cpp
+++ b/core/fxge/dib/cfx_bitmapcomposer.cpp
@@ -69,21 +69,20 @@
   return true;
 }
 
-void CFX_BitmapComposer::DoCompose(uint8_t* dest_scan,
+void CFX_BitmapComposer::DoCompose(pdfium::span<uint8_t> dest_scan,
                                    pdfium::span<const uint8_t> src_scan,
                                    int dest_width,
-                                   const uint8_t* clip_scan,
+                                   pdfium::span<const uint8_t> clip_scan,
                                    pdfium::span<const uint8_t> src_extra_alpha,
                                    pdfium::span<uint8_t> dst_extra_alpha) {
-  uint8_t* pAddClipScan = m_pAddClipScan.data();
   if (m_BitmapAlpha < 255) {
-    if (clip_scan) {
+    if (!clip_scan.empty()) {
       for (int i = 0; i < dest_width; ++i)
-        pAddClipScan[i] = clip_scan[i] * m_BitmapAlpha / 255;
+        m_pAddClipScan[i] = clip_scan[i] * m_BitmapAlpha / 255;
     } else {
-      memset(pAddClipScan, m_BitmapAlpha, dest_width);
+      memset(m_pAddClipScan.data(), m_BitmapAlpha, dest_width);
     }
-    clip_scan = pAddClipScan;
+    clip_scan = m_pAddClipScan;
   }
   if (m_SrcFormat == FXDIB_Format::k8bppMask) {
     m_Compositor.CompositeByteMaskLine(dest_scan, src_scan, dest_width,
@@ -107,24 +106,23 @@
     ComposeScanlineV(line, scanline, scan_extra_alpha);
     return;
   }
-  const uint8_t* clip_scan = nullptr;
+  pdfium::span<const uint8_t> clip_scan;
   if (m_pClipMask) {
     clip_scan =
         m_pClipMask
             ->GetWritableScanline(m_DestTop + line - m_pClipRgn->GetBox().top)
-            .subspan(m_DestLeft - m_pClipRgn->GetBox().left)
-            .data();
+            .subspan(m_DestLeft - m_pClipRgn->GetBox().left);
   }
-  uint8_t* dest_scan = m_pBitmap->GetWritableScanline(line + m_DestTop).data();
-  if (dest_scan) {
+  pdfium::span<uint8_t> dest_scan =
+      m_pBitmap->GetWritableScanline(line + m_DestTop);
+  if (!dest_scan.empty()) {
     FX_SAFE_UINT32 offset = m_DestLeft;
     offset *= m_pBitmap->GetBPP();
     offset /= 8;
     if (!offset.IsValid())
       return;
 
-    // Help some compilers perform pointer arithmetic against safe numerics.
-    dest_scan += static_cast<uint32_t>(offset.ValueOrDie());
+    dest_scan = dest_scan.subspan(offset.ValueOrDie());
   }
   pdfium::span<uint8_t> dest_alpha_scan =
       m_pBitmap->GetWritableAlphaMaskScanline(line + m_DestTop);
@@ -176,9 +174,9 @@
       dest_alpha_scan += y_alpha_step;
     }
   }
-  uint8_t* clip_scan = nullptr;
+  pdfium::span<uint8_t> clip_scan;
   if (m_pClipMask) {
-    clip_scan = m_pClipScanV.data();
+    clip_scan = m_pClipScanV;
     int clip_pitch = m_pClipMask->GetPitch();
     const uint8_t* src_clip =
         m_pClipMask->GetScanline(m_DestTop - m_pClipRgn->GetBox().top)
@@ -193,8 +191,8 @@
       src_clip += clip_pitch;
     }
   }
-  DoCompose(m_pScanlineV.data(), scanline, m_DestHeight, clip_scan,
-            scan_extra_alpha, m_pScanlineAlphaV);
+  DoCompose(m_pScanlineV, scanline, m_DestHeight, clip_scan, scan_extra_alpha,
+            m_pScanlineAlphaV);
   src_scan = m_pScanlineV.data();
   dest_scan = dest_buf;
   for (int i = 0; i < m_DestHeight; ++i) {
diff --git a/core/fxge/dib/cfx_bitmapcomposer.h b/core/fxge/dib/cfx_bitmapcomposer.h
index f38297d..c25850d 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.h
+++ b/core/fxge/dib/cfx_bitmapcomposer.h
@@ -47,10 +47,10 @@
                        pdfium::span<const uint8_t> scan_extra_alpha) override;
 
  private:
-  void DoCompose(uint8_t* dest_scan,
+  void DoCompose(pdfium::span<uint8_t> dest_scan,
                  pdfium::span<const uint8_t> src_scan,
                  int dest_width,
-                 const uint8_t* clip_scan,
+                 pdfium::span<const uint8_t> clip_scan,
                  pdfium::span<const uint8_t> src_extra_alpha,
                  pdfium::span<uint8_t> dst_extra_alpha);
   void ComposeScanlineV(int line,
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index d39f7f9..29419e5 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -777,8 +777,8 @@
 
   RetainPtr<CFX_DIBitmap> pSrcAlphaMask = pSrcBitmap->GetAlphaMask();
   for (int row = 0; row < height; row++) {
-    uint8_t* dest_scan =
-        m_pBuffer.Get() + (dest_top + row) * m_Pitch + dest_left * dest_Bpp;
+    pdfium::span<uint8_t> dest_scan =
+        GetWritableScanline(dest_top + row).subspan(dest_left * dest_Bpp);
     pdfium::span<const uint8_t> src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left * src_Bpp);
     pdfium::span<const uint8_t> src_scan_extra_alpha =
@@ -789,11 +789,10 @@
         m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(dest_top + row)
                            .subspan(dest_left)
                      : pdfium::span<uint8_t>();
-    const uint8_t* clip_scan = nullptr;
+    pdfium::span<const uint8_t> clip_scan;
     if (pClipMask) {
-      clip_scan = pClipMask->m_pBuffer.Get() +
-                  (dest_top + row - clip_box.top) * pClipMask->m_Pitch +
-                  (dest_left - clip_box.left);
+      clip_scan = pClipMask->GetWritableScanline(dest_top + row - clip_box.top)
+                      .subspan(dest_left - clip_box.left);
     }
     if (bRgb) {
       compositor.CompositeRgbBitmapLine(dest_scan, src_scan, width, clip_scan,
@@ -854,18 +853,17 @@
     return false;
   }
   for (int row = 0; row < height; row++) {
-    uint8_t* dest_scan =
-        m_pBuffer.Get() + (dest_top + row) * m_Pitch + dest_left * Bpp;
+    pdfium::span<uint8_t> dest_scan =
+        GetWritableScanline(dest_top + row).subspan(dest_left * Bpp);
     pdfium::span<const uint8_t> src_scan = pMask->GetScanline(src_top + row);
     pdfium::span<uint8_t> dst_scan_extra_alpha =
         m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(dest_top + row)
                            .subspan(dest_left)
                      : pdfium::span<uint8_t>();
-    const uint8_t* clip_scan = nullptr;
+    pdfium::span<const uint8_t> clip_scan;
     if (pClipMask) {
-      clip_scan = pClipMask->m_pBuffer.Get() +
-                  (dest_top + row - clip_box.top) * pClipMask->m_Pitch +
-                  (dest_left - clip_box.left);
+      clip_scan = pClipMask->GetScanline(dest_top + row - clip_box.top)
+                      .subspan(dest_left - clip_box.left);
     }
     if (src_bpp == 1) {
       compositor.CompositeBitMaskLine(dest_scan, src_scan, src_left, width,
diff --git a/core/fxge/dib/cfx_scanlinecompositor.cpp b/core/fxge/dib/cfx_scanlinecompositor.cpp
index 858176c..50add9a 100644
--- a/core/fxge/dib/cfx_scanlinecompositor.cpp
+++ b/core/fxge/dib/cfx_scanlinecompositor.cpp
@@ -2772,10 +2772,10 @@
 }
 
 void CFX_ScanlineCompositor::CompositeRgbBitmapLine(
-    uint8_t* dest_scan,
+    pdfium::span<uint8_t> dest_scan,
     pdfium::span<const uint8_t> src_scan,
     int width,
-    const uint8_t* clip_scan,
+    pdfium::span<const uint8_t> clip_scan,
     pdfium::span<const uint8_t> src_extra_alpha,
     pdfium::span<uint8_t> dst_extra_alpha) {
   int src_Bpp = GetCompsFromFormat(m_SrcFormat);
@@ -2786,52 +2786,58 @@
       case 4:
       case 8:
       case 12:
-        CompositeRow_Argb2Argb_RgbByteOrder(dest_scan, src_scan.data(), width,
-                                            m_BlendType, clip_scan);
+        CompositeRow_Argb2Argb_RgbByteOrder(dest_scan.data(), src_scan.data(),
+                                            width, m_BlendType,
+                                            clip_scan.data());
         break;
       case 1:
         CompositeRow_Rgb2Argb_Blend_NoClip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, m_BlendType, src_Bpp);
+            dest_scan.data(), src_scan.data(), width, m_BlendType, src_Bpp);
         break;
       case 2:
       case 10:
-        CompositeRow_Argb2Rgb_Blend_RgbByteOrder(dest_scan, src_scan.data(),
-                                                 width, m_BlendType, dest_Bpp,
-                                                 clip_scan);
+        CompositeRow_Argb2Rgb_Blend_RgbByteOrder(
+            dest_scan.data(), src_scan.data(), width, m_BlendType, dest_Bpp,
+            clip_scan.data());
         break;
       case 3:
         CompositeRow_Rgb2Rgb_Blend_NoClip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, m_BlendType, dest_Bpp, src_Bpp);
+            dest_scan.data(), src_scan.data(), width, m_BlendType, dest_Bpp,
+            src_Bpp);
         break;
       case 5:
         CompositeRow_Rgb2Argb_NoBlend_NoClip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, src_Bpp);
+            dest_scan.data(), src_scan.data(), width, src_Bpp);
         break;
       case 6:
       case 14:
-        CompositeRow_Argb2Rgb_NoBlend_RgbByteOrder(dest_scan, src_scan.data(),
-                                                   width, dest_Bpp, clip_scan);
+        CompositeRow_Argb2Rgb_NoBlend_RgbByteOrder(dest_scan.data(),
+                                                   src_scan.data(), width,
+                                                   dest_Bpp, clip_scan.data());
         break;
       case 7:
         CompositeRow_Rgb2Rgb_NoBlend_NoClip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, dest_Bpp, src_Bpp);
+            dest_scan.data(), src_scan.data(), width, dest_Bpp, src_Bpp);
         break;
       case 9:
         CompositeRow_Rgb2Argb_Blend_Clip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, m_BlendType, src_Bpp, clip_scan);
+            dest_scan.data(), src_scan.data(), width, m_BlendType, src_Bpp,
+            clip_scan.data());
         break;
       case 11:
         CompositeRow_Rgb2Rgb_Blend_Clip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, m_BlendType, dest_Bpp, src_Bpp,
-            clip_scan);
+            dest_scan.data(), src_scan.data(), width, m_BlendType, dest_Bpp,
+            src_Bpp, clip_scan.data());
         break;
       case 13:
         CompositeRow_Rgb2Argb_NoBlend_Clip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, src_Bpp, clip_scan);
+            dest_scan.data(), src_scan.data(), width, src_Bpp,
+            clip_scan.data());
         break;
       case 15:
         CompositeRow_Rgb2Rgb_NoBlend_Clip_RgbByteOrder(
-            dest_scan, src_scan.data(), width, dest_Bpp, src_Bpp, clip_scan);
+            dest_scan.data(), src_scan.data(), width, dest_Bpp, src_Bpp,
+            clip_scan.data());
         break;
     }
     return;
@@ -2839,32 +2845,35 @@
   if (m_DestFormat == FXDIB_Format::k8bppMask) {
     if (GetIsAlphaFromFormat(m_SrcFormat)) {
       if (m_SrcFormat == FXDIB_Format::kArgb) {
-        CompositeRow_AlphaToMask(dest_scan, src_scan.data(), width, clip_scan,
-                                 4);
+        CompositeRow_AlphaToMask(dest_scan.data(), src_scan.data(), width,
+                                 clip_scan.data(), 4);
       } else {
-        CompositeRow_AlphaToMask(dest_scan, src_extra_alpha.data(), width,
-                                 clip_scan, 1);
+        CompositeRow_AlphaToMask(dest_scan.data(), src_extra_alpha.data(),
+                                 width, clip_scan.data(), 1);
       }
     } else {
-      CompositeRow_Rgb2Mask(dest_scan, src_scan.data(), width, clip_scan);
+      CompositeRow_Rgb2Mask(dest_scan.data(), src_scan.data(), width,
+                            clip_scan.data());
     }
   } else if (GetBppFromFormat(m_DestFormat) == 8) {
     if (GetIsAlphaFromFormat(m_SrcFormat)) {
       if (GetIsAlphaFromFormat(m_DestFormat)) {
-        CompositeRow_Argb2Graya(dest_scan, src_scan.data(), width, m_BlendType,
-                                clip_scan, src_extra_alpha.data(),
-                                dst_extra_alpha.data());
+        CompositeRow_Argb2Graya(dest_scan.data(), src_scan.data(), width,
+                                m_BlendType, clip_scan.data(),
+                                src_extra_alpha.data(), dst_extra_alpha.data());
       } else {
-        CompositeRow_Argb2Gray(dest_scan, src_scan.data(), width, m_BlendType,
-                               clip_scan, src_extra_alpha.data());
+        CompositeRow_Argb2Gray(dest_scan.data(), src_scan.data(), width,
+                               m_BlendType, clip_scan.data(),
+                               src_extra_alpha.data());
       }
     } else {
       if (GetIsAlphaFromFormat(m_DestFormat)) {
-        CompositeRow_Rgb2Graya(dest_scan, src_scan.data(), src_Bpp, width,
-                               m_BlendType, clip_scan, dst_extra_alpha.data());
+        CompositeRow_Rgb2Graya(dest_scan.data(), src_scan.data(), src_Bpp,
+                               width, m_BlendType, clip_scan.data(),
+                               dst_extra_alpha.data());
       } else {
-        CompositeRow_Rgb2Gray(dest_scan, src_scan.data(), src_Bpp, width,
-                              m_BlendType, clip_scan);
+        CompositeRow_Rgb2Gray(dest_scan.data(), src_scan.data(), src_Bpp, width,
+                              m_BlendType, clip_scan.data());
       }
     }
   } else {
@@ -2873,68 +2882,71 @@
       case 4:
       case 8:
       case 4 + 8: {
-        CompositeRow_Argb2Argb(dest_scan, src_scan.data(), width, m_BlendType,
-                               clip_scan, dst_extra_alpha.data(),
-                               src_extra_alpha.data());
+        CompositeRow_Argb2Argb(dest_scan.data(), src_scan.data(), width,
+                               m_BlendType, clip_scan.data(),
+                               dst_extra_alpha.data(), src_extra_alpha.data());
       } break;
       case 1:
-        CompositeRow_Rgb2Argb_Blend_NoClip(dest_scan, src_scan.data(), width,
-                                           m_BlendType, src_Bpp,
+        CompositeRow_Rgb2Argb_Blend_NoClip(dest_scan.data(), src_scan.data(),
+                                           width, m_BlendType, src_Bpp,
                                            dst_extra_alpha.data());
         break;
       case 1 + 8:
-        CompositeRow_Rgb2Argb_Blend_Clip(dest_scan, src_scan.data(), width,
-                                         m_BlendType, src_Bpp, clip_scan,
-                                         dst_extra_alpha.data());
+        CompositeRow_Rgb2Argb_Blend_Clip(
+            dest_scan.data(), src_scan.data(), width, m_BlendType, src_Bpp,
+            clip_scan.data(), dst_extra_alpha.data());
         break;
       case 1 + 4:
-        CompositeRow_Rgb2Argb_NoBlend_NoClip(dest_scan, src_scan.data(), width,
-                                             src_Bpp, dst_extra_alpha.data());
+        CompositeRow_Rgb2Argb_NoBlend_NoClip(dest_scan.data(), src_scan.data(),
+                                             width, src_Bpp,
+                                             dst_extra_alpha.data());
         break;
       case 1 + 4 + 8:
-        CompositeRow_Rgb2Argb_NoBlend_Clip(dest_scan, src_scan.data(), width,
-                                           src_Bpp, clip_scan,
+        CompositeRow_Rgb2Argb_NoBlend_Clip(dest_scan.data(), src_scan.data(),
+                                           width, src_Bpp, clip_scan.data(),
                                            dst_extra_alpha.data());
         break;
       case 2:
       case 2 + 8:
-        CompositeRow_Argb2Rgb_Blend(dest_scan, src_scan.data(), width,
-                                    m_BlendType, dest_Bpp, clip_scan,
+        CompositeRow_Argb2Rgb_Blend(dest_scan.data(), src_scan.data(), width,
+                                    m_BlendType, dest_Bpp, clip_scan.data(),
                                     src_extra_alpha.data());
         break;
       case 2 + 4:
       case 2 + 4 + 8:
-        CompositeRow_Argb2Rgb_NoBlend(dest_scan, src_scan.data(), width,
-                                      dest_Bpp, clip_scan,
+        CompositeRow_Argb2Rgb_NoBlend(dest_scan.data(), src_scan.data(), width,
+                                      dest_Bpp, clip_scan.data(),
                                       src_extra_alpha.data());
         break;
       case 1 + 2:
-        CompositeRow_Rgb2Rgb_Blend_NoClip(dest_scan, src_scan.data(), width,
-                                          m_BlendType, dest_Bpp, src_Bpp);
+        CompositeRow_Rgb2Rgb_Blend_NoClip(dest_scan.data(), src_scan.data(),
+                                          width, m_BlendType, dest_Bpp,
+                                          src_Bpp);
         break;
       case 1 + 2 + 8:
-        CompositeRow_Rgb2Rgb_Blend_Clip(dest_scan, src_scan.data(), width,
-                                        m_BlendType, dest_Bpp, src_Bpp,
-                                        clip_scan);
+        CompositeRow_Rgb2Rgb_Blend_Clip(dest_scan.data(), src_scan.data(),
+                                        width, m_BlendType, dest_Bpp, src_Bpp,
+                                        clip_scan.data());
         break;
       case 1 + 2 + 4:
-        CompositeRow_Rgb2Rgb_NoBlend_NoClip(dest_scan, src_scan.data(), width,
-                                            dest_Bpp, src_Bpp);
+        CompositeRow_Rgb2Rgb_NoBlend_NoClip(dest_scan.data(), src_scan.data(),
+                                            width, dest_Bpp, src_Bpp);
         break;
       case 1 + 2 + 4 + 8:
-        CompositeRow_Rgb2Rgb_NoBlend_Clip(dest_scan, src_scan.data(), width,
-                                          dest_Bpp, src_Bpp, clip_scan);
+        CompositeRow_Rgb2Rgb_NoBlend_Clip(dest_scan.data(), src_scan.data(),
+                                          width, dest_Bpp, src_Bpp,
+                                          clip_scan.data());
         break;
     }
   }
 }
 
 void CFX_ScanlineCompositor::CompositePalBitmapLine(
-    uint8_t* dest_scan,
+    pdfium::span<uint8_t> dest_scan,
     pdfium::span<const uint8_t> src_scan,
     int src_left,
     int width,
-    const uint8_t* clip_scan,
+    pdfium::span<const uint8_t> clip_scan,
     pdfium::span<const uint8_t> src_extra_alpha,
     pdfium::span<uint8_t> dst_extra_alpha) {
   if (m_bRgbByteOrder) {
@@ -2944,13 +2956,13 @@
       }
       if (m_DestFormat == FXDIB_Format::kArgb) {
         CompositeRow_1bppRgb2Argb_NoBlend_RgbByteOrder(
-            dest_scan, src_scan.data(), src_left, width,
-            m_SrcPalette.Get32BitPalette(), clip_scan);
+            dest_scan.data(), src_scan.data(), src_left, width,
+            m_SrcPalette.Get32BitPalette(), clip_scan.data());
       } else {
         CompositeRow_1bppRgb2Rgb_NoBlend_RgbByteOrder(
-            dest_scan, src_scan.data(), src_left,
+            dest_scan.data(), src_scan.data(), src_left,
             m_SrcPalette.Get32BitPalette(), width,
-            GetCompsFromFormat(m_DestFormat), clip_scan);
+            GetCompsFromFormat(m_DestFormat), clip_scan.data());
       }
     } else {
       if (m_DestFormat == FXDIB_Format::k8bppRgb) {
@@ -2958,164 +2970,173 @@
       }
       if (m_DestFormat == FXDIB_Format::kArgb) {
         CompositeRow_8bppRgb2Argb_NoBlend_RgbByteOrder(
-            dest_scan, src_scan.data(), width,
-            m_SrcPalette.Get32BitPalette().data(), clip_scan);
+            dest_scan.data(), src_scan.data(), width,
+            m_SrcPalette.Get32BitPalette().data(), clip_scan.data());
       } else {
         CompositeRow_8bppRgb2Rgb_NoBlend_RgbByteOrder(
-            dest_scan, src_scan.data(), m_SrcPalette.Get32BitPalette().data(),
-            width, GetCompsFromFormat(m_DestFormat), clip_scan);
+            dest_scan.data(), src_scan.data(),
+            m_SrcPalette.Get32BitPalette().data(), width,
+            GetCompsFromFormat(m_DestFormat), clip_scan.data());
       }
     }
     return;
   }
   if (m_DestFormat == FXDIB_Format::k8bppMask) {
-    CompositeRow_Rgb2Mask(dest_scan, src_scan.data(), width, clip_scan);
+    CompositeRow_Rgb2Mask(dest_scan.data(), src_scan.data(), width,
+                          clip_scan.data());
     return;
   }
   if (GetBppFromFormat(m_DestFormat) == 8) {
     if (m_iTransparency & 8) {
       if (GetIsAlphaFromFormat(m_DestFormat)) {
-        CompositeRow_1bppPal2Graya(
-            dest_scan, src_scan.data(), src_left, m_SrcPalette.Get8BitPalette(),
-            width, m_BlendType, clip_scan, dst_extra_alpha.data());
+        CompositeRow_1bppPal2Graya(dest_scan.data(), src_scan.data(), src_left,
+                                   m_SrcPalette.Get8BitPalette(), width,
+                                   m_BlendType, clip_scan.data(),
+                                   dst_extra_alpha.data());
       } else {
-        CompositeRow_1bppPal2Gray(dest_scan, src_scan.data(), src_left,
+        CompositeRow_1bppPal2Gray(dest_scan.data(), src_scan.data(), src_left,
                                   m_SrcPalette.Get8BitPalette(), width,
-                                  m_BlendType, clip_scan);
+                                  m_BlendType, clip_scan.data());
       }
     } else {
       if (GetIsAlphaFromFormat(m_DestFormat)) {
         CompositeRow_8bppPal2Graya(
-            dest_scan, src_scan.data(), m_SrcPalette.Get8BitPalette().data(),
-            width, m_BlendType, clip_scan, dst_extra_alpha.data(),
-            src_extra_alpha.data());
+            dest_scan.data(), src_scan.data(),
+            m_SrcPalette.Get8BitPalette().data(), width, m_BlendType,
+            clip_scan.data(), dst_extra_alpha.data(), src_extra_alpha.data());
       } else {
-        CompositeRow_8bppPal2Gray(
-            dest_scan, src_scan.data(), m_SrcPalette.Get8BitPalette().data(),
-            width, m_BlendType, clip_scan, src_extra_alpha.data());
+        CompositeRow_8bppPal2Gray(dest_scan.data(), src_scan.data(),
+                                  m_SrcPalette.Get8BitPalette().data(), width,
+                                  m_BlendType, clip_scan.data(),
+                                  src_extra_alpha.data());
       }
     }
   } else {
     switch (m_iTransparency) {
       case 1 + 2:
-        CompositeRow_8bppRgb2Argb_NoBlend(dest_scan, src_scan.data(), width,
-                                          m_SrcPalette.Get32BitPalette().data(),
-                                          clip_scan, src_extra_alpha.data());
+        CompositeRow_8bppRgb2Argb_NoBlend(
+            dest_scan.data(), src_scan.data(), width,
+            m_SrcPalette.Get32BitPalette().data(), clip_scan.data(),
+            src_extra_alpha.data());
         break;
       case 1 + 2 + 8:
-        CompositeRow_1bppRgb2Argb_NoBlend(dest_scan, src_scan.data(), src_left,
-                                          width, m_SrcPalette.Get32BitPalette(),
-                                          clip_scan);
+        CompositeRow_1bppRgb2Argb_NoBlend(
+            dest_scan.data(), src_scan.data(), src_left, width,
+            m_SrcPalette.Get32BitPalette(), clip_scan.data());
         break;
       case 0:
         CompositeRow_8bppRgb2Rgb_NoBlend(
-            dest_scan, src_scan.data(), m_SrcPalette.Get32BitPalette().data(),
-            width, GetCompsFromFormat(m_DestFormat), clip_scan,
+            dest_scan.data(), src_scan.data(),
+            m_SrcPalette.Get32BitPalette().data(), width,
+            GetCompsFromFormat(m_DestFormat), clip_scan.data(),
             src_extra_alpha.data());
         break;
       case 0 + 8:
-        CompositeRow_1bppRgb2Rgb_NoBlend(dest_scan, src_scan.data(), src_left,
-                                         m_SrcPalette.Get32BitPalette(), width,
-                                         GetCompsFromFormat(m_DestFormat),
-                                         clip_scan);
+        CompositeRow_1bppRgb2Rgb_NoBlend(
+            dest_scan.data(), src_scan.data(), src_left,
+            m_SrcPalette.Get32BitPalette(), width,
+            GetCompsFromFormat(m_DestFormat), clip_scan.data());
         break;
       case 0 + 2:
         CompositeRow_8bppRgb2Rgb_NoBlend(
-            dest_scan, src_scan.data(), m_SrcPalette.Get32BitPalette().data(),
-            width, GetCompsFromFormat(m_DestFormat), clip_scan,
+            dest_scan.data(), src_scan.data(),
+            m_SrcPalette.Get32BitPalette().data(), width,
+            GetCompsFromFormat(m_DestFormat), clip_scan.data(),
             src_extra_alpha.data());
         break;
       case 0 + 2 + 8:
-        CompositeRow_1bppRgb2Rgba_NoBlend(dest_scan, src_scan.data(), src_left,
-                                          width, m_SrcPalette.Get32BitPalette(),
-                                          clip_scan, dst_extra_alpha.data());
+        CompositeRow_1bppRgb2Rgba_NoBlend(
+            dest_scan.data(), src_scan.data(), src_left, width,
+            m_SrcPalette.Get32BitPalette(), clip_scan.data(),
+            dst_extra_alpha.data());
         break;
     }
   }
 }
 
 void CFX_ScanlineCompositor::CompositeByteMaskLine(
-    uint8_t* dest_scan,
+    pdfium::span<uint8_t> dest_scan,
     pdfium::span<const uint8_t> src_scan,
     int width,
-    const uint8_t* clip_scan,
+    pdfium::span<const uint8_t> clip_scan,
     pdfium::span<uint8_t> dst_extra_alpha) {
   if (m_DestFormat == FXDIB_Format::k8bppMask) {
-    CompositeRow_ByteMask2Mask(dest_scan, src_scan.data(), m_MaskAlpha, width,
-                               clip_scan);
+    CompositeRow_ByteMask2Mask(dest_scan.data(), src_scan.data(), m_MaskAlpha,
+                               width, clip_scan.data());
   } else if (GetBppFromFormat(m_DestFormat) == 8) {
     if (GetIsAlphaFromFormat(m_DestFormat)) {
-      CompositeRow_ByteMask2Graya(dest_scan, src_scan.data(), m_MaskAlpha,
-                                  m_MaskRed, width, clip_scan,
-                                  dst_extra_alpha.data());
+      CompositeRow_ByteMask2Graya(dest_scan.data(), src_scan.data(),
+                                  m_MaskAlpha, m_MaskRed, width,
+                                  clip_scan.data(), dst_extra_alpha.data());
     } else {
-      CompositeRow_ByteMask2Gray(dest_scan, src_scan.data(), m_MaskAlpha,
-                                 m_MaskRed, width, clip_scan);
+      CompositeRow_ByteMask2Gray(dest_scan.data(), src_scan.data(), m_MaskAlpha,
+                                 m_MaskRed, width, clip_scan.data());
     }
   } else if (m_bRgbByteOrder) {
     if (m_DestFormat == FXDIB_Format::kArgb) {
       CompositeRow_ByteMask2Argb_RgbByteOrder(
-          dest_scan, src_scan.data(), m_MaskAlpha, m_MaskRed, m_MaskGreen,
-          m_MaskBlue, width, m_BlendType, clip_scan);
+          dest_scan.data(), src_scan.data(), m_MaskAlpha, m_MaskRed,
+          m_MaskGreen, m_MaskBlue, width, m_BlendType, clip_scan.data());
     } else {
       CompositeRow_ByteMask2Rgb_RgbByteOrder(
-          dest_scan, src_scan.data(), m_MaskAlpha, m_MaskRed, m_MaskGreen,
-          m_MaskBlue, width, m_BlendType, GetCompsFromFormat(m_DestFormat),
-          clip_scan);
+          dest_scan.data(), src_scan.data(), m_MaskAlpha, m_MaskRed,
+          m_MaskGreen, m_MaskBlue, width, m_BlendType,
+          GetCompsFromFormat(m_DestFormat), clip_scan.data());
     }
   } else if (m_DestFormat == FXDIB_Format::kArgb) {
-    CompositeRow_ByteMask2Argb(dest_scan, src_scan.data(), m_MaskAlpha,
+    CompositeRow_ByteMask2Argb(dest_scan.data(), src_scan.data(), m_MaskAlpha,
                                m_MaskRed, m_MaskGreen, m_MaskBlue, width,
-                               m_BlendType, clip_scan);
+                               m_BlendType, clip_scan.data());
   } else if (m_DestFormat == FXDIB_Format::kRgb ||
              m_DestFormat == FXDIB_Format::kRgb32) {
-    CompositeRow_ByteMask2Rgb(dest_scan, src_scan.data(), m_MaskAlpha,
+    CompositeRow_ByteMask2Rgb(dest_scan.data(), src_scan.data(), m_MaskAlpha,
                               m_MaskRed, m_MaskGreen, m_MaskBlue, width,
                               m_BlendType, GetCompsFromFormat(m_DestFormat),
-                              clip_scan);
+                              clip_scan.data());
   }
 }
 
 void CFX_ScanlineCompositor::CompositeBitMaskLine(
-    uint8_t* dest_scan,
+    pdfium::span<uint8_t> dest_scan,
     pdfium::span<const uint8_t> src_scan,
     int src_left,
     int width,
-    const uint8_t* clip_scan,
+    pdfium::span<const uint8_t> clip_scan,
     pdfium::span<uint8_t> dst_extra_alpha) {
   if (m_DestFormat == FXDIB_Format::k8bppMask) {
-    CompositeRow_BitMask2Mask(dest_scan, src_scan.data(), m_MaskAlpha, src_left,
-                              width, clip_scan);
+    CompositeRow_BitMask2Mask(dest_scan.data(), src_scan.data(), m_MaskAlpha,
+                              src_left, width, clip_scan.data());
   } else if (GetBppFromFormat(m_DestFormat) == 8) {
     if (GetIsAlphaFromFormat(m_DestFormat)) {
-      CompositeRow_BitMask2Graya(dest_scan, src_scan.data(), m_MaskAlpha,
-                                 m_MaskRed, src_left, width, clip_scan,
+      CompositeRow_BitMask2Graya(dest_scan.data(), src_scan.data(), m_MaskAlpha,
+                                 m_MaskRed, src_left, width, clip_scan.data(),
                                  dst_extra_alpha.data());
     } else {
-      CompositeRow_BitMask2Gray(dest_scan, src_scan.data(), m_MaskAlpha,
-                                m_MaskRed, src_left, width, clip_scan);
+      CompositeRow_BitMask2Gray(dest_scan.data(), src_scan.data(), m_MaskAlpha,
+                                m_MaskRed, src_left, width, clip_scan.data());
     }
   } else if (m_bRgbByteOrder) {
     if (m_DestFormat == FXDIB_Format::kArgb) {
       CompositeRow_BitMask2Argb_RgbByteOrder(
-          dest_scan, src_scan.data(), m_MaskAlpha, m_MaskRed, m_MaskGreen,
-          m_MaskBlue, src_left, width, m_BlendType, clip_scan);
+          dest_scan.data(), src_scan.data(), m_MaskAlpha, m_MaskRed,
+          m_MaskGreen, m_MaskBlue, src_left, width, m_BlendType,
+          clip_scan.data());
     } else {
       CompositeRow_BitMask2Rgb_RgbByteOrder(
-          dest_scan, src_scan.data(), m_MaskAlpha, m_MaskRed, m_MaskGreen,
-          m_MaskBlue, src_left, width, m_BlendType,
-          GetCompsFromFormat(m_DestFormat), clip_scan);
+          dest_scan.data(), src_scan.data(), m_MaskAlpha, m_MaskRed,
+          m_MaskGreen, m_MaskBlue, src_left, width, m_BlendType,
+          GetCompsFromFormat(m_DestFormat), clip_scan.data());
     }
   } else if (m_DestFormat == FXDIB_Format::kArgb) {
-    CompositeRow_BitMask2Argb(dest_scan, src_scan.data(), m_MaskAlpha,
+    CompositeRow_BitMask2Argb(dest_scan.data(), src_scan.data(), m_MaskAlpha,
                               m_MaskRed, m_MaskGreen, m_MaskBlue, src_left,
-                              width, m_BlendType, clip_scan);
+                              width, m_BlendType, clip_scan.data());
   } else if (m_DestFormat == FXDIB_Format::kRgb ||
              m_DestFormat == FXDIB_Format::kRgb32) {
-    CompositeRow_BitMask2Rgb(dest_scan, src_scan.data(), m_MaskAlpha, m_MaskRed,
-                             m_MaskGreen, m_MaskBlue, src_left, width,
-                             m_BlendType, GetCompsFromFormat(m_DestFormat),
-                             clip_scan);
+    CompositeRow_BitMask2Rgb(
+        dest_scan.data(), src_scan.data(), m_MaskAlpha, m_MaskRed, m_MaskGreen,
+        m_MaskBlue, src_left, width, m_BlendType,
+        GetCompsFromFormat(m_DestFormat), clip_scan.data());
   }
 }
 
diff --git a/core/fxge/dib/cfx_scanlinecompositor.h b/core/fxge/dib/cfx_scanlinecompositor.h
index 0017f1c..73a54f3 100644
--- a/core/fxge/dib/cfx_scanlinecompositor.h
+++ b/core/fxge/dib/cfx_scanlinecompositor.h
@@ -27,32 +27,32 @@
             bool bClip,
             bool bRgbByteOrder);
 
-  void CompositeRgbBitmapLine(uint8_t* dest_scan,
+  void CompositeRgbBitmapLine(pdfium::span<uint8_t> dest_scan,
                               pdfium::span<const uint8_t> src_scan,
                               int width,
-                              const uint8_t* clip_scan,
+                              pdfium::span<const uint8_t> clip_scan,
                               pdfium::span<const uint8_t> src_extra_alpha,
                               pdfium::span<uint8_t> dst_extra_alpha);
 
-  void CompositePalBitmapLine(uint8_t* dest_scan,
+  void CompositePalBitmapLine(pdfium::span<uint8_t> dest_scan,
                               pdfium::span<const uint8_t> src_scan,
                               int src_left,
                               int width,
-                              const uint8_t* clip_scan,
+                              pdfium::span<const uint8_t> clip_scan,
                               pdfium::span<const uint8_t> src_extra_alpha,
                               pdfium::span<uint8_t> dst_extra_alpha);
 
-  void CompositeByteMaskLine(uint8_t* dest_scan,
+  void CompositeByteMaskLine(pdfium::span<uint8_t> dest_scan,
                              pdfium::span<const uint8_t> src_scan,
                              int width,
-                             const uint8_t* clip_scan,
+                             pdfium::span<const uint8_t> clip_scan,
                              pdfium::span<uint8_t> dst_extra_alpha);
 
-  void CompositeBitMaskLine(uint8_t* dest_scan,
+  void CompositeBitMaskLine(pdfium::span<uint8_t> dest_scan,
                             pdfium::span<const uint8_t> src_scan,
                             int src_left,
                             int width,
-                            const uint8_t* clip_scan,
+                            pdfium::span<const uint8_t> clip_scan,
                             pdfium::span<uint8_t> dst_extra_alpha);
 
  private: