Mass suppress unsafe buffers in fxge/dib.

Alas, much of this is unsafe, but at least remove the file-wide
allow_unsafe_buffers.

Change-Id: I79c14514a867ed2c11563ec80f0aaf6075b891a6
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/120177
Reviewed-by: Thomas Sepez <tsepez@google.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fxge/dib/cfx_bitmapcomposer.cpp b/core/fxge/dib/cfx_bitmapcomposer.cpp
index 8c21d4f..37a5cfe 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.cpp
+++ b/core/fxge/dib/cfx_bitmapcomposer.cpp
@@ -4,16 +4,12 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cfx_bitmapcomposer.h"
 
 #include <stddef.h>
 
 #include "core/fxcrt/check_op.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_2d_size.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_safe_types.h"
@@ -152,34 +148,38 @@
   const int y_step = m_bFlipY ? -dest_pitch : dest_pitch;
   uint8_t* src_scan = m_pScanlineV.data();
   uint8_t* dest_scan = dest_buf;
-  for (int i = 0; i < m_DestHeight; ++i) {
-    for (int j = 0; j < Bpp; ++j)
-      *src_scan++ = dest_scan[j];
-    dest_scan += y_step;
-  }
-  pdfium::span<uint8_t> clip_scan;
-  if (m_pClipMask) {
-    clip_scan = m_pClipScanV;
-    int clip_pitch = m_pClipMask->GetPitch();
-    const uint8_t* src_clip =
-        m_pClipMask->GetScanline(m_DestTop - m_pClipRgn->GetBox().top)
-            .subspan(dest_x - m_pClipRgn->GetBox().left)
-            .data();
-    if (m_bFlipY) {
-      src_clip += Fx2DSizeOrDie(clip_pitch, m_DestHeight - 1);
-      clip_pitch = -clip_pitch;
-    }
+  UNSAFE_TODO({
     for (int i = 0; i < m_DestHeight; ++i) {
-      clip_scan[i] = *src_clip;
-      src_clip += clip_pitch;
+      for (int j = 0; j < Bpp; ++j) {
+        *src_scan++ = dest_scan[j];
+      }
+      dest_scan += y_step;
     }
-  }
-  DoCompose(m_pScanlineV, scanline, m_DestHeight, clip_scan);
-  src_scan = m_pScanlineV.data();
-  dest_scan = dest_buf;
-  for (int i = 0; i < m_DestHeight; ++i) {
-    for (int j = 0; j < Bpp; ++j)
-      dest_scan[j] = *src_scan++;
-    dest_scan += y_step;
-  }
+    pdfium::span<uint8_t> clip_scan;
+    if (m_pClipMask) {
+      clip_scan = m_pClipScanV;
+      int clip_pitch = m_pClipMask->GetPitch();
+      const uint8_t* src_clip =
+          m_pClipMask->GetScanline(m_DestTop - m_pClipRgn->GetBox().top)
+              .subspan(dest_x - m_pClipRgn->GetBox().left)
+              .data();
+      if (m_bFlipY) {
+        src_clip += Fx2DSizeOrDie(clip_pitch, m_DestHeight - 1);
+        clip_pitch = -clip_pitch;
+      }
+      for (int i = 0; i < m_DestHeight; ++i) {
+        clip_scan[i] = *src_clip;
+        src_clip += clip_pitch;
+      }
+    }
+    DoCompose(m_pScanlineV, scanline, m_DestHeight, clip_scan);
+    src_scan = m_pScanlineV.data();
+    dest_scan = dest_buf;
+    for (int i = 0; i < m_DestHeight; ++i) {
+      for (int j = 0; j < Bpp; ++j) {
+        dest_scan[j] = *src_scan++;
+      }
+      dest_scan += y_step;
+    }
+  });
 }
diff --git a/core/fxge/dib/cfx_dibbase.cpp b/core/fxge/dib/cfx_dibbase.cpp
index 7e83a1f..94f956e 100644
--- a/core/fxge/dib/cfx_dibbase.cpp
+++ b/core/fxge/dib/cfx_dibbase.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cfx_dibbase.h"
 
 #include <algorithm>
@@ -67,31 +62,33 @@
   int bpp = pBitmap->GetBPP() / 8;
   int width = pBitmap->GetWidth();
   int height = pBitmap->GetHeight();
-  for (int row = 0; row < height; ++row) {
-    pdfium::span<const uint8_t> scan_line = pBitmap->GetScanline(row);
-    for (int col = 0; col < width; ++col) {
-      const uint8_t* src_port =
-          scan_line.subspan(Fx2DSizeOrDie(col, bpp)).data();
-      uint32_t b = src_port[0] & 0xf0;
-      uint32_t g = src_port[1] & 0xf0;
-      uint32_t r = src_port[2] & 0xf0;
-      uint32_t index = (r << 4) + g + (b >> 4);
-      ++m_Luts[index].first;
+  UNSAFE_TODO({
+    for (int row = 0; row < height; ++row) {
+      pdfium::span<const uint8_t> scan_line = pBitmap->GetScanline(row);
+      for (int col = 0; col < width; ++col) {
+        const uint8_t* src_port =
+            scan_line.subspan(Fx2DSizeOrDie(col, bpp)).data();
+        uint32_t b = src_port[0] & 0xf0;
+        uint32_t g = src_port[1] & 0xf0;
+        uint32_t r = src_port[2] & 0xf0;
+        uint32_t index = (r << 4) + g + (b >> 4);
+        ++m_Luts[index].first;
+      }
     }
-  }
-  // Move non-zeros to the front and count them
-  for (uint32_t row = 0; row < m_Luts.size(); ++row) {
-    if (m_Luts[row].first != 0) {
-      m_Luts[m_lut].first = m_Luts[row].first;
-      m_Luts[m_lut].second = row;
-      ++m_lut;
+    // Move non-zeros to the front and count them
+    for (uint32_t row = 0; row < m_Luts.size(); ++row) {
+      if (m_Luts[row].first != 0) {
+        m_Luts[m_lut].first = m_Luts[row].first;
+        m_Luts[m_lut].second = row;
+        ++m_lut;
+      }
     }
-  }
-  pdfium::span<LutsData> lut_span = pdfium::make_span(m_Luts).first(m_lut);
-  std::sort(lut_span.begin(), lut_span.end(),
-            [](const LutsData& arg1, const LutsData& arg2) {
-              return arg1.first < arg2.first;
-            });
+    pdfium::span<LutsData> lut_span = pdfium::make_span(m_Luts).first(m_lut);
+    std::sort(lut_span.begin(), lut_span.end(),
+              [](const LutsData& arg1, const LutsData& arg2) {
+                return arg1.first < arg2.first;
+              });
+  });
   ObtainPalette();
 }
 
@@ -153,11 +150,14 @@
     fxcrt::spanset(dest_span.first(width), kResetGray);
     uint8_t* dest_scan = dest_span.data();
     const uint8_t* src_scan = src_span.data();
-    for (int col = src_left; col < src_left + width; ++col) {
-      if (src_scan[col / 8] & (1 << (7 - col % 8)))
-        *dest_scan = kSetGray;
-      ++dest_scan;
-    }
+    UNSAFE_TODO({
+      for (int col = src_left; col < src_left + width; ++col) {
+        if (src_scan[col / 8] & (1 << (7 - col % 8))) {
+          *dest_scan = kSetGray;
+        }
+        ++dest_scan;
+      }
+    });
   }
 }
 
@@ -198,11 +198,14 @@
     fxcrt::spanset(dest_span.first(width), gray0);
     uint8_t* dest_scan = dest_span.data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
-    for (int col = src_left; col < src_left + width; ++col) {
-      if (src_scan[col / 8] & (1 << (7 - col % 8)))
-        *dest_scan = gray1;
-      ++dest_scan;
-    }
+    UNSAFE_TODO({
+      for (int col = src_left; col < src_left + width; ++col) {
+        if (src_scan[col / 8] & (1 << (7 - col % 8))) {
+          *dest_scan = gray1;
+        }
+        ++dest_scan;
+      }
+    });
   }
 }
 
@@ -215,19 +218,21 @@
                                 int src_top) {
   pdfium::span<const uint32_t> src_palette = pSrcBitmap->GetPaletteSpan();
   uint8_t gray[256];
-  for (size_t i = 0; i < std::size(gray); ++i) {
-    gray[i] = FXRGB2GRAY(FXARGB_R(src_palette[i]), FXARGB_G(src_palette[i]),
-                         FXARGB_B(src_palette[i]));
-  }
-
-  for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan =
-        dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
-    const uint8_t* src_scan =
-        pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-    for (int col = 0; col < width; ++col)
-      *dest_scan++ = gray[*src_scan++];
-  }
+  UNSAFE_TODO({
+    for (size_t i = 0; i < std::size(gray); ++i) {
+      gray[i] = FXRGB2GRAY(FXARGB_R(src_palette[i]), FXARGB_G(src_palette[i]),
+                           FXARGB_B(src_palette[i]));
+    }
+    for (int row = 0; row < height; ++row) {
+      uint8_t* dest_scan =
+          dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
+      const uint8_t* src_scan =
+          pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
+      for (int col = 0; col < width; ++col) {
+        *dest_scan++ = gray[*src_scan++];
+      }
+    }
+  });
 }
 
 void ConvertBuffer_Rgb2Gray(pdfium::span<uint8_t> dest_buf,
@@ -244,10 +249,12 @@
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(x_offset).data();
-    for (int col = 0; col < width; ++col) {
-      *dest_scan++ = FXRGB2GRAY(src_scan[2], src_scan[1], src_scan[0]);
-      src_scan += Bpp;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < width; ++col) {
+        *dest_scan++ = FXRGB2GRAY(src_scan[2], src_scan[1], src_scan[0]);
+        src_scan += Bpp;
+      }
+    });
   }
 }
 
@@ -266,13 +273,17 @@
       fxcrt::spanset(dest_span.first(width), 255);
       uint8_t* dest_scan = dest_span.data();
       const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
-      for (int col = src_left; col < src_left + width; ++col) {
-        // If the source bit is set, then set the destination pixel to be black.
-        if (src_scan[col / 8] & (1 << (7 - col % 8)))
-          *dest_scan = 0;
+      UNSAFE_TODO({
+        for (int col = src_left; col < src_left + width; ++col) {
+          // If the source bit is set, then set the destination pixel to be
+          // black.
+          if (src_scan[col / 8] & (1 << (7 - col % 8))) {
+            *dest_scan = 0;
+          }
 
-        ++dest_scan;
-      }
+          ++dest_scan;
+        }
+      });
     }
   } else {
     for (int row = 0; row < height; ++row) {
@@ -318,20 +329,22 @@
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left);
     uint8_t* dest_scan =
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
-    for (int col = 0; col < width; ++col) {
-      const uint8_t* src_port =
-          src_span.subspan(Fx2DSizeOrDie(col, bpp)).data();
-      int r = src_port[2] & 0xf0;
-      int g = src_port[1] & 0xf0;
-      int b = src_port[0] & 0xf0;
-      uint32_t clrindex = (r << 4) + g + (b >> 4);
-      for (size_t i = luts.size(); i > 0; --i) {
-        if (clrindex == luts[i - 1].second) {
-          *(dest_scan + col) = static_cast<uint8_t>(luts[i - 1].first);
-          break;
+    UNSAFE_TODO({
+      for (int col = 0; col < width; ++col) {
+        const uint8_t* src_port =
+            src_span.subspan(Fx2DSizeOrDie(col, bpp)).data();
+        int r = src_port[2] & 0xf0;
+        int g = src_port[1] & 0xf0;
+        int b = src_port[0] & 0xf0;
+        uint32_t clrindex = (r << 4) + g + (b >> 4);
+        for (size_t i = luts.size(); i > 0; --i) {
+          if (clrindex == luts[i - 1].second) {
+            *(dest_scan + col) = static_cast<uint8_t>(luts[i - 1].first);
+            break;
+          }
         }
       }
-    }
+    });
   }
 
   pdfium::span<const uint32_t> src_palette_span = src_palette.GetPalette();
@@ -353,12 +366,14 @@
     uint8_t* dest_scan =
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
-    for (int col = src_left; col < src_left + width; ++col) {
-      uint8_t value =
-          (src_scan[col / 8] & (1 << (7 - col % 8))) ? kSetGray : kResetGray;
-      FXSYS_memset(dest_scan, value, 3);
-      dest_scan += comps;
-    }
+    UNSAFE_TODO({
+      for (int col = src_left; col < src_left + width; ++col) {
+        uint8_t value =
+            (src_scan[col / 8] & (1 << (7 - col % 8))) ? kSetGray : kResetGray;
+        FXSYS_memset(dest_scan, value, 3);
+        dest_scan += comps;
+      }
+    });
   }
 }
 
@@ -376,11 +391,13 @@
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-    for (int col = 0; col < width; ++col) {
-      FXSYS_memset(dest_scan, *src_scan, 3);
-      dest_scan += comps;
-      ++src_scan;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < width; ++col) {
+        FXSYS_memset(dest_scan, *src_scan, 3);
+        dest_scan += comps;
+        ++src_scan;
+      }
+    });
   }
 }
 
@@ -402,11 +419,13 @@
     uint8_t* dest_scan =
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
-    for (int col = src_left; col < src_left + width; ++col) {
-      size_t offset = (src_scan[col / 8] & (1 << (7 - col % 8))) ? 3 : 0;
-      FXSYS_memcpy(dest_scan, dst_palette + offset, 3);
-      dest_scan += comps;
-    }
+    UNSAFE_TODO({
+      for (int col = src_left; col < src_left + width; ++col) {
+        size_t offset = (src_scan[col / 8] & (1 << (7 - col % 8))) ? 3 : 0;
+        FXSYS_memcpy(dest_scan, dst_palette + offset, 3);
+        dest_scan += comps;
+      }
+    });
   }
 }
 
@@ -420,23 +439,25 @@
                                int src_top) {
   pdfium::span<const uint32_t> src_palette = pSrcBitmap->GetPaletteSpan();
   uint8_t dst_palette[768];
-  for (int i = 0; i < 256; ++i) {
-    dst_palette[3 * i] = FXARGB_B(src_palette[i]);
-    dst_palette[3 * i + 1] = FXARGB_G(src_palette[i]);
-    dst_palette[3 * i + 2] = FXARGB_R(src_palette[i]);
-  }
-  int comps = GetCompsFromFormat(dest_format);
-  for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan =
-        dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
-    const uint8_t* src_scan =
-        pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-    for (int col = 0; col < width; ++col) {
-      uint8_t* src_pixel = dst_palette + 3 * (*src_scan++);
-      FXSYS_memcpy(dest_scan, src_pixel, 3);
-      dest_scan += comps;
+  UNSAFE_TODO({
+    for (int i = 0; i < 256; ++i) {
+      dst_palette[3 * i] = FXARGB_B(src_palette[i]);
+      dst_palette[3 * i + 1] = FXARGB_G(src_palette[i]);
+      dst_palette[3 * i + 2] = FXARGB_R(src_palette[i]);
     }
-  }
+    int comps = GetCompsFromFormat(dest_format);
+    for (int row = 0; row < height; ++row) {
+      uint8_t* dest_scan =
+          dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
+      const uint8_t* src_scan =
+          pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
+      for (int col = 0; col < width; ++col) {
+        uint8_t* src_pixel = dst_palette + 3 * (*src_scan++);
+        FXSYS_memcpy(dest_scan, src_pixel, 3);
+        dest_scan += comps;
+      }
+    }
+  });
 }
 
 void ConvertBuffer_24bppRgb2Rgb24(
@@ -470,11 +491,13 @@
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(x_offset).data();
-    for (int col = 0; col < width; ++col) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-      dest_scan += 3;
-      src_scan += 4;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < width; ++col) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+        dest_scan += 3;
+        src_scan += 4;
+      }
+    });
   }
 }
 
@@ -492,11 +515,13 @@
         dest_buf.subspan(Fx2DSizeOrDie(row, dest_pitch)).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(x_offset).data();
-    for (int col = 0; col < width; ++col) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-      dest_scan += 4;
-      src_scan += comps;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < width; ++col) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+        dest_scan += 4;
+        src_scan += comps;
+      }
+    });
   }
 }
 
@@ -669,10 +694,12 @@
       const uint32_t* src_scan =
           src_span.subspan(rect.left / 32, dword_count + 1).data();
       uint32_t* dst_scan = dst_span.first(dword_count).data();
-      for (int i = 0; i < dword_count; ++i) {
-        dst_scan[i] =
-            (src_scan[i] << left_shift) | (src_scan[i + 1] >> right_shift);
-      }
+      UNSAFE_TODO({
+        for (int i = 0; i < dword_count; ++i) {
+          dst_scan[i] =
+              (src_scan[i] << left_shift) | (src_scan[i + 1] >> right_shift);
+        }
+      });
     }
   } else {
     std::optional<uint32_t> copy_len = fxge::CalculatePitch8(
@@ -694,7 +721,7 @@
           GetScanline(row).subspan(offset.ValueOrDie()).data();
       uint8_t* dest_scan =
           pNewBitmap->GetWritableScanline(row - rect.top).data();
-      FXSYS_memcpy(dest_scan, src_scan, copy_len.value());
+      UNSAFE_TODO(FXSYS_memcpy(dest_scan, src_scan, copy_len.value()));
     }
   }
   return pNewBitmap;
@@ -880,10 +907,12 @@
   for (int row = 0; row < m_Height; ++row) {
     const uint8_t* src_scan = GetScanline(row).subspan(3).data();
     uint8_t* dest_scan = pMask->GetWritableScanline(row).data();
-    for (int col = 0; col < m_Width; ++col) {
-      *dest_scan++ = *src_scan;
-      src_scan += 4;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < m_Width; ++col) {
+        *dest_scan++ = *src_scan;
+        src_scan += 4;
+      }
+    });
   }
   return pMask;
 }
@@ -895,49 +924,52 @@
 
   pFlipped->SetPalette(GetPaletteSpan());
   int Bpp = GetBppFromFormat(m_Format) / 8;
-  for (int row = 0; row < m_Height; ++row) {
-    const uint8_t* src_scan = GetScanline(row).data();
-    uint8_t* dest_scan =
-        pFlipped->GetWritableScanline(bYFlip ? m_Height - row - 1 : row).data();
-    if (!bXFlip) {
-      FXSYS_memcpy(dest_scan, src_scan, m_Pitch);
-      continue;
-    }
-    if (GetBppFromFormat(m_Format) == 1) {
-      FXSYS_memset(dest_scan, 0, m_Pitch);
-      for (int col = 0; col < m_Width; ++col) {
-        if (src_scan[col / 8] & (1 << (7 - col % 8))) {
-          int dest_col = m_Width - col - 1;
-          dest_scan[dest_col / 8] |= (1 << (7 - dest_col % 8));
+  UNSAFE_TODO({
+    for (int row = 0; row < m_Height; ++row) {
+      const uint8_t* src_scan = GetScanline(row).data();
+      uint8_t* dest_scan =
+          pFlipped->GetWritableScanline(bYFlip ? m_Height - row - 1 : row)
+              .data();
+      if (!bXFlip) {
+        FXSYS_memcpy(dest_scan, src_scan, m_Pitch);
+        continue;
+      }
+      if (GetBppFromFormat(m_Format) == 1) {
+        FXSYS_memset(dest_scan, 0, m_Pitch);
+        for (int col = 0; col < m_Width; ++col) {
+          if (src_scan[col / 8] & (1 << (7 - col % 8))) {
+            int dest_col = m_Width - col - 1;
+            dest_scan[dest_col / 8] |= (1 << (7 - dest_col % 8));
+          }
+        }
+        continue;
+      }
+
+      dest_scan += (m_Width - 1) * Bpp;
+      if (Bpp == 1) {
+        for (int col = 0; col < m_Width; ++col) {
+          *dest_scan = *src_scan;
+          --dest_scan;
+          ++src_scan;
+        }
+      } else if (Bpp == 3) {
+        for (int col = 0; col < m_Width; ++col) {
+          FXSYS_memcpy(dest_scan, src_scan, 3);
+          dest_scan -= 3;
+          src_scan += 3;
+        }
+      } else {
+        DCHECK_EQ(Bpp, 4);
+        for (int col = 0; col < m_Width; ++col) {
+          const auto* src_scan32 = reinterpret_cast<const uint32_t*>(src_scan);
+          uint32_t* dest_scan32 = reinterpret_cast<uint32_t*>(dest_scan);
+          *dest_scan32 = *src_scan32;
+          dest_scan -= 4;
+          src_scan += 4;
         }
       }
-      continue;
     }
-
-    dest_scan += (m_Width - 1) * Bpp;
-    if (Bpp == 1) {
-      for (int col = 0; col < m_Width; ++col) {
-        *dest_scan = *src_scan;
-        --dest_scan;
-        ++src_scan;
-      }
-    } else if (Bpp == 3) {
-      for (int col = 0; col < m_Width; ++col) {
-        FXSYS_memcpy(dest_scan, src_scan, 3);
-        dest_scan -= 3;
-        src_scan += 3;
-      }
-    } else {
-      DCHECK_EQ(Bpp, 4);
-      for (int col = 0; col < m_Width; ++col) {
-        const auto* src_scan32 = reinterpret_cast<const uint32_t*>(src_scan);
-        uint32_t* dest_scan32 = reinterpret_cast<uint32_t*>(dest_scan);
-        *dest_scan32 = *src_scan32;
-        dest_scan -= 4;
-        src_scan += 4;
-      }
-    }
-  }
+  });
   return pFlipped;
 }
 
@@ -986,63 +1018,71 @@
   const int row_end = bXFlip ? m_Height - dest_clip.left : dest_clip.right;
   const int col_start = bYFlip ? m_Width - dest_clip.bottom : dest_clip.top;
   const int col_end = bYFlip ? m_Width - dest_clip.top : dest_clip.bottom;
-  if (GetBPP() == 1) {
-    fxcrt::spanset(dest_span, 0xff);
-    if (bYFlip)
-      dest_span = dest_span.subspan(dest_last_row_offset);
-    const int dest_step = bYFlip ? -dest_pitch : dest_pitch;
-    for (int row = row_start; row < row_end; ++row) {
-      const uint8_t* src_scan = GetScanline(row).data();
-      int dest_col = (bXFlip ? dest_clip.right - (row - row_start) - 1 : row) -
-                     dest_clip.left;
-      uint8_t* dest_scan = dest_span.data();
-      for (int col = col_start; col < col_end; ++col) {
-        if (!(src_scan[col / 8] & (1 << (7 - col % 8))))
-          dest_scan[dest_col / 8] &= ~(1 << (7 - dest_col % 8));
-        dest_scan += dest_step;
+  UNSAFE_TODO({
+    if (GetBPP() == 1) {
+      fxcrt::spanset(dest_span, 0xff);
+      if (bYFlip) {
+        dest_span = dest_span.subspan(dest_last_row_offset);
       }
-    }
-  } else {
-    int nBytes = GetBPP() / 8;
-    int dest_step = bYFlip ? -dest_pitch : dest_pitch;
-    if (nBytes == 3)
-      dest_step -= 2;
-    if (bYFlip)
-      dest_span = dest_span.subspan(dest_last_row_offset);
-    for (int row = row_start; row < row_end; ++row) {
-      int dest_col = (bXFlip ? dest_clip.right - (row - row_start) - 1 : row) -
-                     dest_clip.left;
-      size_t dest_offset = Fx2DSizeOrDie(dest_col, nBytes);
-      uint8_t* dest_scan = dest_span.subspan(dest_offset).data();
-      if (nBytes == 4) {
-        const uint32_t* src_scan =
-            fxcrt::reinterpret_span<const uint32_t>(GetScanline(row))
-                .subspan(col_start)
-                .data();
+      const int dest_step = bYFlip ? -dest_pitch : dest_pitch;
+      for (int row = row_start; row < row_end; ++row) {
+        const uint8_t* src_scan = GetScanline(row).data();
+        int dest_col =
+            (bXFlip ? dest_clip.right - (row - row_start) - 1 : row) -
+            dest_clip.left;
+        uint8_t* dest_scan = dest_span.data();
         for (int col = col_start; col < col_end; ++col) {
-          uint32_t* dest_scan32 = reinterpret_cast<uint32_t*>(dest_scan);
-          *dest_scan32 = *src_scan++;
+          if (!(src_scan[col / 8] & (1 << (7 - col % 8)))) {
+            dest_scan[dest_col / 8] &= ~(1 << (7 - dest_col % 8));
+          }
           dest_scan += dest_step;
         }
-      } else {
-        const uint8_t* src_scan =
-            GetScanline(row).subspan(col_start * nBytes).data();
-        if (nBytes == 1) {
+      }
+    } else {
+      int nBytes = GetBPP() / 8;
+      int dest_step = bYFlip ? -dest_pitch : dest_pitch;
+      if (nBytes == 3) {
+        dest_step -= 2;
+      }
+      if (bYFlip) {
+        dest_span = dest_span.subspan(dest_last_row_offset);
+      }
+      for (int row = row_start; row < row_end; ++row) {
+        int dest_col =
+            (bXFlip ? dest_clip.right - (row - row_start) - 1 : row) -
+            dest_clip.left;
+        size_t dest_offset = Fx2DSizeOrDie(dest_col, nBytes);
+        uint8_t* dest_scan = dest_span.subspan(dest_offset).data();
+        if (nBytes == 4) {
+          const uint32_t* src_scan =
+              fxcrt::reinterpret_span<const uint32_t>(GetScanline(row))
+                  .subspan(col_start)
+                  .data();
           for (int col = col_start; col < col_end; ++col) {
-            *dest_scan = *src_scan++;
+            uint32_t* dest_scan32 = reinterpret_cast<uint32_t*>(dest_scan);
+            *dest_scan32 = *src_scan++;
             dest_scan += dest_step;
           }
         } else {
-          for (int col = col_start; col < col_end; ++col) {
-            FXSYS_memcpy(dest_scan, src_scan, 3);
-            dest_scan += 2 + dest_step;
-            src_scan += 3;
+          const uint8_t* src_scan =
+              GetScanline(row).subspan(col_start * nBytes).data();
+          if (nBytes == 1) {
+            for (int col = col_start; col < col_end; ++col) {
+              *dest_scan = *src_scan++;
+              dest_scan += dest_step;
+            }
+          } else {
+            for (int col = col_start; col < col_end; ++col) {
+              FXSYS_memcpy(dest_scan, src_scan, 3);
+              dest_scan += 2 + dest_step;
+              src_scan += 3;
+            }
           }
         }
       }
     }
-  }
-  return pTransBitmap;
+    return pTransBitmap;
+  });
 }
 
 RetainPtr<CFX_DIBitmap> CFX_DIBBase::TransformTo(const CFX_Matrix& mtDest,
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 83a63eb..e119d2c 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cfx_dibitmap.h"
 
 #include <limits>
@@ -83,8 +78,8 @@
 
   SetPalette(source->GetPaletteSpan());
   for (int row = 0; row < source->GetHeight(); row++) {
-    FXSYS_memcpy(m_pBuffer.Get() + row * m_Pitch,
-                 source->GetScanline(row).data(), m_Pitch);
+    UNSAFE_TODO(FXSYS_memcpy(m_pBuffer.Get() + row * m_Pitch,
+                             source->GetScanline(row).data(), m_Pitch));
   }
   return true;
 }
@@ -140,62 +135,66 @@
     return;
 
   uint8_t* pBuffer = m_pBuffer.Get();
-  switch (GetFormat()) {
-    case FXDIB_Format::k1bppMask:
-      FXSYS_memset(pBuffer, (color & 0xff000000) ? 0xff : 0,
-                   m_Pitch * m_Height);
-      break;
-    case FXDIB_Format::k1bppRgb: {
-      int index = FindPalette(color);
-      FXSYS_memset(pBuffer, index ? 0xff : 0, m_Pitch * m_Height);
-      break;
-    }
-    case FXDIB_Format::k8bppMask:
-      FXSYS_memset(pBuffer, color >> 24, m_Pitch * m_Height);
-      break;
-    case FXDIB_Format::k8bppRgb: {
-      int index = FindPalette(color);
-      FXSYS_memset(pBuffer, index, m_Pitch * m_Height);
-      break;
-    }
-    case FXDIB_Format::kRgb: {
-      int a;
-      int r;
-      int g;
-      int b;
-      std::tie(a, r, g, b) = ArgbDecode(color);
-      if (r == g && g == b) {
-        FXSYS_memset(pBuffer, r, m_Pitch * m_Height);
-      } else {
-        int byte_pos = 0;
-        for (int col = 0; col < m_Width; col++) {
-          pBuffer[byte_pos++] = b;
-          pBuffer[byte_pos++] = g;
-          pBuffer[byte_pos++] = r;
+  UNSAFE_TODO({
+    switch (GetFormat()) {
+      case FXDIB_Format::k1bppMask:
+        FXSYS_memset(pBuffer, (color & 0xff000000) ? 0xff : 0,
+                     m_Pitch * m_Height);
+        break;
+      case FXDIB_Format::k1bppRgb: {
+        int index = FindPalette(color);
+        FXSYS_memset(pBuffer, index ? 0xff : 0, m_Pitch * m_Height);
+        break;
+      }
+      case FXDIB_Format::k8bppMask:
+        FXSYS_memset(pBuffer, color >> 24, m_Pitch * m_Height);
+        break;
+      case FXDIB_Format::k8bppRgb: {
+        int index = FindPalette(color);
+        FXSYS_memset(pBuffer, index, m_Pitch * m_Height);
+        break;
+      }
+      case FXDIB_Format::kRgb: {
+        int a;
+        int r;
+        int g;
+        int b;
+        std::tie(a, r, g, b) = ArgbDecode(color);
+        if (r == g && g == b) {
+          FXSYS_memset(pBuffer, r, m_Pitch * m_Height);
+        } else {
+          int byte_pos = 0;
+          for (int col = 0; col < m_Width; col++) {
+            pBuffer[byte_pos++] = b;
+            pBuffer[byte_pos++] = g;
+            pBuffer[byte_pos++] = r;
+          }
+          for (int row = 1; row < m_Height; row++) {
+            FXSYS_memcpy(pBuffer + row * m_Pitch, pBuffer, m_Pitch);
+          }
+        }
+        break;
+      }
+      case FXDIB_Format::kRgb32:
+      case FXDIB_Format::kArgb: {
+        if (CFX_DefaultRenderDevice::UseSkiaRenderer() &&
+            FXDIB_Format::kRgb32 == GetFormat()) {
+          // TODO(crbug.com/pdfium/2016): This is not reliable because alpha may
+          // be modified outside of this operation.
+          color |= 0xFF000000;
+        }
+        for (int i = 0; i < m_Width; i++) {
+          reinterpret_cast<uint32_t*>(pBuffer)[i] = color;
         }
         for (int row = 1; row < m_Height; row++) {
           FXSYS_memcpy(pBuffer + row * m_Pitch, pBuffer, m_Pitch);
         }
+        break;
       }
-      break;
+      default:
+        break;
     }
-    case FXDIB_Format::kRgb32:
-    case FXDIB_Format::kArgb: {
-      if (CFX_DefaultRenderDevice::UseSkiaRenderer() &&
-          FXDIB_Format::kRgb32 == GetFormat()) {
-        // TODO(crbug.com/pdfium/2016): This is not reliable because alpha may
-        // be modified outside of this operation.
-        color |= 0xFF000000;
-      }
-      for (int i = 0; i < m_Width; i++)
-        reinterpret_cast<uint32_t*>(pBuffer)[i] = color;
-      for (int row = 1; row < m_Height; row++)
-        FXSYS_memcpy(pBuffer + row * m_Pitch, pBuffer, m_Pitch);
-      break;
-    }
-    default:
-      break;
-  }
+  });
 }
 
 bool CFX_DIBitmap::TransferBitmap(int dest_left,
@@ -269,13 +268,15 @@
                                            int src_left,
                                            int src_top) {
   int Bpp = GetBPP() / 8;
-  for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan =
-        m_pBuffer.Get() + (dest_top + row) * m_Pitch + dest_left * Bpp;
-    const uint8_t* src_scan =
-        source->GetScanline(src_top + row).subspan(src_left * Bpp).data();
-    FXSYS_memcpy(dest_scan, src_scan, width * Bpp);
-  }
+  UNSAFE_TODO({
+    for (int row = 0; row < height; ++row) {
+      uint8_t* dest_scan =
+          m_pBuffer.Get() + (dest_top + row) * m_Pitch + dest_left * Bpp;
+      const uint8_t* src_scan =
+          source->GetScanline(src_top + row).subspan(src_left * Bpp).data();
+      FXSYS_memcpy(dest_scan, src_scan, width * Bpp);
+    }
+  });
 }
 
 void CFX_DIBitmap::TransferEqualFormatsOneBPP(
@@ -286,18 +287,21 @@
     RetainPtr<const CFX_DIBBase> source,
     int src_left,
     int src_top) {
-  for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = m_pBuffer.Get() + (dest_top + row) * m_Pitch;
-    const uint8_t* src_scan = source->GetScanline(src_top + row).data();
-    for (int col = 0; col < width; ++col) {
-      int src_idx = src_left + col;
-      int dest_idx = dest_left + col;
-      if (src_scan[(src_idx) / 8] & (1 << (7 - (src_idx) % 8)))
-        dest_scan[(dest_idx) / 8] |= 1 << (7 - (dest_idx) % 8);
-      else
-        dest_scan[(dest_idx) / 8] &= ~(1 << (7 - (dest_idx) % 8));
+  UNSAFE_TODO({
+    for (int row = 0; row < height; ++row) {
+      uint8_t* dest_scan = m_pBuffer.Get() + (dest_top + row) * m_Pitch;
+      const uint8_t* src_scan = source->GetScanline(src_top + row).data();
+      for (int col = 0; col < width; ++col) {
+        int src_idx = src_left + col;
+        int dest_idx = dest_left + col;
+        if (src_scan[(src_idx) / 8] & (1 << (7 - (src_idx) % 8))) {
+          dest_scan[(dest_idx) / 8] |= 1 << (7 - (dest_idx) % 8);
+        } else {
+          dest_scan[(dest_idx) / 8] &= ~(1 << (7 - (dest_idx) % 8));
+        }
+      }
     }
-  }
+  });
 }
 
 void CFX_DIBitmap::SetRedFromAlpha() {
@@ -310,11 +314,13 @@
     constexpr int kBytes = 4;
     uint8_t* dest_pos = GetWritableScanline(row).subspan(kDestOffset).data();
     const uint8_t* src_pos = GetScanline(row).subspan(kSrcOffset).data();
-    for (int col = 0; col < m_Width; col++) {
-      *dest_pos = *src_pos;
-      dest_pos += kBytes;
-      src_pos += kBytes;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < m_Width; col++) {
+        *dest_pos = *src_pos;
+        dest_pos += kBytes;
+        src_pos += kBytes;
+      }
+    });
   }
 }
 
@@ -328,10 +334,12 @@
     constexpr int kDestOffset = 3;
     constexpr int kDestBytes = 4;
     uint8_t* dest_pos = GetWritableScanline(row).subspan(kDestOffset).data();
-    for (int col = 0; col < m_Width; col++) {
-      *dest_pos = 0xff;
-      dest_pos += kDestBytes;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < m_Width; col++) {
+        *dest_pos = 0xff;
+        dest_pos += kDestBytes;
+      }
+    });
   }
   return true;
 }
@@ -352,12 +360,14 @@
     for (int row = 0; row < m_Height; row++) {
       uint8_t* dest_pos = GetWritableScanline(row).subspan(kDestOffset).data();
       const uint8_t* mask_scan = mask->GetScanline(row).data();
-      for (int col = 0; col < m_Width; col++) {
-        // Since the `dest_pos` value always starts out as 255 in this case,
-        // simplify 255 * x / 255.
-        *dest_pos = mask_scan[col];
-        dest_pos += kDestBytes;
-      }
+      UNSAFE_TODO({
+        for (int col = 0; col < m_Width; col++) {
+          // Since the `dest_pos` value always starts out as 255 in this case,
+          // simplify 255 * x / 255.
+          *dest_pos = mask_scan[col];
+          dest_pos += kDestBytes;
+        }
+      });
     }
     return true;
   }
@@ -366,10 +376,12 @@
   for (int row = 0; row < m_Height; row++) {
     uint8_t* dest_pos = GetWritableScanline(row).subspan(kDestOffset).data();
     const uint8_t* mask_scan = mask->GetScanline(row).data();
-    for (int col = 0; col < m_Width; col++) {
-      *dest_pos = (*dest_pos) * mask_scan[col] / 255;
-      dest_pos += kDestBytes;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < m_Width; col++) {
+        *dest_pos = (*dest_pos) * mask_scan[col] / 255;
+        dest_pos += kDestBytes;
+      }
+    });
   }
   return true;
 }
@@ -396,10 +408,12 @@
     constexpr int kDestOffset = 3;
     constexpr int kDestBytes = 4;
     uint8_t* dest_pos = GetWritableScanline(row).subspan(kDestOffset).data();
-    for (int col = 0; col < m_Width; col++) {
-      *dest_pos = (*dest_pos) * bitmap_alpha / 255;
-      dest_pos += kDestBytes;
-    }
+    UNSAFE_TODO({
+      for (int col = 0; col < m_Width; col++) {
+        *dest_pos = (*dest_pos) * bitmap_alpha / 255;
+        dest_pos += kDestBytes;
+      }
+    });
   }
   return true;
 }
@@ -415,7 +429,8 @@
   if (!offset.IsValid())
     return 0;
 
-  uint8_t* pos = m_pBuffer.Get() + y * m_Pitch + offset.ValueOrDie();
+  uint8_t* pos =
+      UNSAFE_TODO(m_pBuffer.Get() + y * m_Pitch + offset.ValueOrDie());
   switch (GetFormat()) {
     case FXDIB_Format::k1bppMask: {
       if ((*pos) & (1 << (7 - x % 8))) {
@@ -436,9 +451,9 @@
                           : ArgbEncode(0xff, *pos, *pos, *pos);
     case FXDIB_Format::kRgb:
     case FXDIB_Format::kRgb32:
-      return FXARGB_GetDIB(pos) | 0xff000000;
+      return UNSAFE_TODO(FXARGB_GetDIB(pos) | 0xff000000);
     case FXDIB_Format::kArgb:
-      return FXARGB_GetDIB(pos);
+      return UNSAFE_TODO(FXARGB_GetDIB(pos));
     default:
       break;
   }
@@ -469,31 +484,33 @@
     }
     return;
   }
-  if (forecolor == 0 && backcolor == 0xffffff) {
+  UNSAFE_TODO({
+    if (forecolor == 0 && backcolor == 0xffffff) {
+      for (int row = 0; row < m_Height; ++row) {
+        uint8_t* scanline = m_pBuffer.Get() + row * m_Pitch;
+        int gap = GetBppFromFormat(m_Format) / 8 - 2;
+        for (int col = 0; col < m_Width; ++col) {
+          int gray = FXRGB2GRAY(scanline[2], scanline[1], scanline[0]);
+          *scanline++ = gray;
+          *scanline++ = gray;
+          *scanline = gray;
+          scanline += gap;
+        }
+      }
+      return;
+    }
     for (int row = 0; row < m_Height; ++row) {
       uint8_t* scanline = m_pBuffer.Get() + row * m_Pitch;
       int gap = GetBppFromFormat(m_Format) / 8 - 2;
       for (int col = 0; col < m_Width; ++col) {
         int gray = FXRGB2GRAY(scanline[2], scanline[1], scanline[0]);
-        *scanline++ = gray;
-        *scanline++ = gray;
-        *scanline = gray;
+        *scanline++ = bb + (fb - bb) * gray / 255;
+        *scanline++ = bg + (fg - bg) * gray / 255;
+        *scanline = br + (fr - br) * gray / 255;
         scanline += gap;
       }
     }
-    return;
-  }
-  for (int row = 0; row < m_Height; ++row) {
-    uint8_t* scanline = m_pBuffer.Get() + row * m_Pitch;
-    int gap = GetBppFromFormat(m_Format) / 8 - 2;
-    for (int col = 0; col < m_Width; ++col) {
-      int gray = FXRGB2GRAY(scanline[2], scanline[1], scanline[0]);
-      *scanline++ = bb + (fb - bb) * gray / 255;
-      *scanline++ = bg + (fg - bg) * gray / 255;
-      *scanline = br + (fr - br) * gray / 255;
-      scanline += gap;
-    }
-  }
+  });
 }
 
 bool CFX_DIBitmap::ConvertColorScale(uint32_t forecolor, uint32_t backcolor) {
@@ -673,23 +690,23 @@
   if (GetBPP() != 1) {
     return;
   }
-
   if (!GetOverlapRect(dest_left, dest_top, width, height, source->GetWidth(),
                       source->GetHeight(), src_left, src_top, nullptr)) {
     return;
   }
-
-  for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = m_pBuffer.Get() + (dest_top + row) * m_Pitch;
-    const uint8_t* src_scan = source->GetScanline(src_top + row).data();
-    for (int col = 0; col < width; ++col) {
-      int src_idx = src_left + col;
-      int dest_idx = dest_left + col;
-      if (src_scan[src_idx / 8] & (1 << (7 - src_idx % 8))) {
-        dest_scan[dest_idx / 8] |= 1 << (7 - dest_idx % 8);
+  UNSAFE_TODO({
+    for (int row = 0; row < height; ++row) {
+      uint8_t* dest_scan = m_pBuffer.Get() + (dest_top + row) * m_Pitch;
+      const uint8_t* src_scan = source->GetScanline(src_top + row).data();
+      for (int col = 0; col < width; ++col) {
+        int src_idx = src_left + col;
+        int dest_idx = dest_left + col;
+        if (src_scan[src_idx / 8] & (1 << (7 - src_idx % 8))) {
+          dest_scan[dest_idx / 8] |= 1 << (7 - dest_idx % 8);
+        }
       }
     }
-  }
+  });
 }
 
 bool CFX_DIBitmap::CompositeRect(int left,
@@ -712,123 +729,129 @@
   width = rect.Width();
   uint32_t dst_color = color;
   uint8_t* color_p = reinterpret_cast<uint8_t*>(&dst_color);
-  if (GetBppFromFormat(m_Format) == 8) {
-    uint8_t gray = IsMaskFormat() ? 255
-                                  : (uint8_t)FXRGB2GRAY((int)color_p[2],
-                                                        color_p[1], color_p[0]);
-    for (int row = rect.top; row < rect.bottom; row++) {
-      uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left;
-      if (src_alpha == 255) {
-        FXSYS_memset(dest_scan, gray, width);
-      } else {
-        for (int col = 0; col < width; col++) {
-          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, src_alpha);
-          dest_scan++;
+  UNSAFE_TODO({
+    if (GetBppFromFormat(m_Format) == 8) {
+      uint8_t gray =
+          IsMaskFormat()
+              ? 255
+              : (uint8_t)FXRGB2GRAY((int)color_p[2], color_p[1], color_p[0]);
+      for (int row = rect.top; row < rect.bottom; row++) {
+        uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left;
+        if (src_alpha == 255) {
+          FXSYS_memset(dest_scan, gray, width);
+        } else {
+          for (int col = 0; col < width; col++) {
+            *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, src_alpha);
+            dest_scan++;
+          }
         }
       }
+      return true;
     }
-    return true;
-  }
-  if (GetBppFromFormat(m_Format) == 1) {
-    int left_shift = rect.left % 8;
-    int right_shift = rect.right % 8;
-    int new_width = rect.right / 8 - rect.left / 8;
-    int index = 0;
-    if (HasPalette()) {
-      for (int i = 0; i < 2; i++) {
-        if (GetPaletteSpan()[i] == color)
-          index = i;
-      }
-    } else {
-      index = (static_cast<uint8_t>(color) == 0xff) ? 1 : 0;
-    }
-    for (int row = rect.top; row < rect.bottom; row++) {
-      uint8_t* dest_scan_top =
-          GetWritableScanline(row).subspan(rect.left / 8).data();
-      uint8_t* dest_scan_top_r =
-          GetWritableScanline(row).subspan(rect.right / 8).data();
-      uint8_t left_flag = *dest_scan_top & (255 << (8 - left_shift));
-      uint8_t right_flag = *dest_scan_top_r & (255 >> right_shift);
-      if (new_width) {
-        FXSYS_memset(dest_scan_top + 1, index ? 255 : 0, new_width - 1);
-        if (!index) {
-          *dest_scan_top &= left_flag;
-          *dest_scan_top_r &= right_flag;
-        } else {
-          *dest_scan_top |= ~left_flag;
-          *dest_scan_top_r |= ~right_flag;
+    if (GetBppFromFormat(m_Format) == 1) {
+      int left_shift = rect.left % 8;
+      int right_shift = rect.right % 8;
+      int new_width = rect.right / 8 - rect.left / 8;
+      int index = 0;
+      if (HasPalette()) {
+        for (int i = 0; i < 2; i++) {
+          if (GetPaletteSpan()[i] == color) {
+            index = i;
+          }
         }
       } else {
-        if (!index) {
-          *dest_scan_top &= left_flag | right_flag;
+        index = (static_cast<uint8_t>(color) == 0xff) ? 1 : 0;
+      }
+      for (int row = rect.top; row < rect.bottom; row++) {
+        uint8_t* dest_scan_top =
+            GetWritableScanline(row).subspan(rect.left / 8).data();
+        uint8_t* dest_scan_top_r =
+            GetWritableScanline(row).subspan(rect.right / 8).data();
+        uint8_t left_flag = *dest_scan_top & (255 << (8 - left_shift));
+        uint8_t right_flag = *dest_scan_top_r & (255 >> right_shift);
+        if (new_width) {
+          FXSYS_memset(dest_scan_top + 1, index ? 255 : 0, new_width - 1);
+          if (!index) {
+            *dest_scan_top &= left_flag;
+            *dest_scan_top_r &= right_flag;
+          } else {
+            *dest_scan_top |= ~left_flag;
+            *dest_scan_top_r |= ~right_flag;
+          }
         } else {
-          *dest_scan_top |= ~(left_flag | right_flag);
+          if (!index) {
+            *dest_scan_top &= left_flag | right_flag;
+          } else {
+            *dest_scan_top |= ~(left_flag | right_flag);
+          }
         }
       }
+      return true;
     }
-    return true;
-  }
 
-  CHECK_GE(GetBppFromFormat(m_Format), 24);
-  color_p[3] = static_cast<uint8_t>(src_alpha);
-  int Bpp = GetBppFromFormat(m_Format) / 8;
-  const bool bAlpha = IsAlphaFormat();
-  if (bAlpha) {
-    // Other formats with alpha have already been handled above.
-    DCHECK_EQ(GetFormat(), FXDIB_Format::kArgb);
-  }
-  if (src_alpha == 255) {
+    CHECK_GE(GetBppFromFormat(m_Format), 24);
+    color_p[3] = static_cast<uint8_t>(src_alpha);
+    int Bpp = GetBppFromFormat(m_Format) / 8;
+    const bool bAlpha = IsAlphaFormat();
+    if (bAlpha) {
+      // Other formats with alpha have already been handled above.
+      DCHECK_EQ(GetFormat(), FXDIB_Format::kArgb);
+    }
+    if (src_alpha == 255) {
+      for (int row = rect.top; row < rect.bottom; row++) {
+        uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left * Bpp;
+        if (Bpp == 4) {
+          uint32_t* scan = reinterpret_cast<uint32_t*>(dest_scan);
+          for (int col = 0; col < width; col++) {
+            *scan++ = dst_color;
+          }
+        } else {
+          for (int col = 0; col < width; col++) {
+            *dest_scan++ = color_p[0];
+            *dest_scan++ = color_p[1];
+            *dest_scan++ = color_p[2];
+          }
+        }
+      }
+      return true;
+    }
     for (int row = rect.top; row < rect.bottom; row++) {
       uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left * Bpp;
-      if (Bpp == 4) {
-        uint32_t* scan = reinterpret_cast<uint32_t*>(dest_scan);
-        for (int col = 0; col < width; col++)
-          *scan++ = dst_color;
-      } else {
+      if (bAlpha) {
         for (int col = 0; col < width; col++) {
-          *dest_scan++ = color_p[0];
-          *dest_scan++ = color_p[1];
-          *dest_scan++ = color_p[2];
-        }
-      }
-    }
-    return true;
-  }
-  for (int row = rect.top; row < rect.bottom; row++) {
-    uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left * Bpp;
-    if (bAlpha) {
-      for (int col = 0; col < width; col++) {
-        uint8_t back_alpha = dest_scan[3];
-        if (back_alpha == 0) {
-          FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, color_p[2], color_p[1],
-                                              color_p[0]));
-          dest_scan += 4;
-          continue;
-        }
-        uint8_t dest_alpha =
-            back_alpha + src_alpha - back_alpha * src_alpha / 255;
-        int alpha_ratio = src_alpha * 255 / dest_alpha;
-        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[0], alpha_ratio);
-        dest_scan++;
-        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[1], alpha_ratio);
-        dest_scan++;
-        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[2], alpha_ratio);
-        dest_scan++;
-        *dest_scan++ = dest_alpha;
-      }
-    } else {
-      for (int col = 0; col < width; col++) {
-        for (int comps = 0; comps < Bpp; comps++) {
-          if (comps == 3) {
-            *dest_scan++ = 255;
+          uint8_t back_alpha = dest_scan[3];
+          if (back_alpha == 0) {
+            FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, color_p[2],
+                                                color_p[1], color_p[0]));
+            dest_scan += 4;
             continue;
           }
-          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[comps], src_alpha);
+          uint8_t dest_alpha =
+              back_alpha + src_alpha - back_alpha * src_alpha / 255;
+          int alpha_ratio = src_alpha * 255 / dest_alpha;
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[0], alpha_ratio);
           dest_scan++;
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[1], alpha_ratio);
+          dest_scan++;
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, color_p[2], alpha_ratio);
+          dest_scan++;
+          *dest_scan++ = dest_alpha;
+        }
+      } else {
+        for (int col = 0; col < width; col++) {
+          for (int comps = 0; comps < Bpp; comps++) {
+            if (comps == 3) {
+              *dest_scan++ = 255;
+              continue;
+            }
+            *dest_scan =
+                FXDIB_ALPHA_MERGE(*dest_scan, color_p[comps], src_alpha);
+            dest_scan++;
+          }
         }
       }
     }
-  }
+  });
   return true;
 }
 
@@ -848,13 +871,15 @@
   }
   if (dest_format == FXDIB_Format::kArgb && m_Format == FXDIB_Format::kRgb32) {
     m_Format = FXDIB_Format::kArgb;
-    for (int row = 0; row < m_Height; row++) {
-      uint8_t* scanline = m_pBuffer.Get() + row * m_Pitch + 3;
-      for (int col = 0; col < m_Width; col++) {
-        *scanline = 0xff;
-        scanline += 4;
+    UNSAFE_TODO({
+      for (int row = 0; row < m_Height; row++) {
+        uint8_t* scanline = m_pBuffer.Get() + row * m_Pitch + 3;
+        for (int col = 0; col < m_Width; col++) {
+          *scanline = 0xff;
+          scanline += 4;
+        }
       }
-    }
+    });
     return true;
   }
   int dest_bpp = GetBppFromFormat(dest_format);
@@ -866,7 +891,7 @@
     return false;
 
   if (dest_format == FXDIB_Format::kArgb) {
-    FXSYS_memset(dest_buf.get(), 0xff, dest_buf_size);
+    UNSAFE_TODO(FXSYS_memset(dest_buf.get(), 0xff, dest_buf_size));
   }
   RetainPtr<CFX_DIBBase> holder(this);
   // SAFETY: `dest_buf` allocated with `dest_buf_size` bytes above.
diff --git a/core/fxge/dib/cfx_imagetransformer.cpp b/core/fxge/dib/cfx_imagetransformer.cpp
index 76f7c65..5311434 100644
--- a/core/fxge/dib/cfx_imagetransformer.cpp
+++ b/core/fxge/dib/cfx_imagetransformer.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cfx_imagetransformer.h"
 
 #include <math.h>
@@ -41,15 +36,17 @@
   int i_resx = 255 - data.res_x;
   int col_bpp_l = data.src_col_l * bpp;
   int col_bpp_r = data.src_col_r * bpp;
-  const uint8_t* buf_u = buf + data.row_offset_l + c_offset;
-  const uint8_t* buf_d = buf + data.row_offset_r + c_offset;
-  const uint8_t* src_pos0 = buf_u + col_bpp_l;
-  const uint8_t* src_pos1 = buf_u + col_bpp_r;
-  const uint8_t* src_pos2 = buf_d + col_bpp_l;
-  const uint8_t* src_pos3 = buf_d + col_bpp_r;
-  uint8_t r_pos_0 = (*src_pos0 * i_resx + *src_pos1 * data.res_x) >> 8;
-  uint8_t r_pos_1 = (*src_pos2 * i_resx + *src_pos3 * data.res_x) >> 8;
-  return (r_pos_0 * (255 - data.res_y) + r_pos_1 * data.res_y) >> 8;
+  UNSAFE_TODO({
+    const uint8_t* buf_u = buf + data.row_offset_l + c_offset;
+    const uint8_t* buf_d = buf + data.row_offset_r + c_offset;
+    const uint8_t* src_pos0 = buf_u + col_bpp_l;
+    const uint8_t* src_pos1 = buf_u + col_bpp_r;
+    const uint8_t* src_pos2 = buf_d + col_bpp_l;
+    const uint8_t* src_pos3 = buf_d + col_bpp_r;
+    uint8_t r_pos_0 = (*src_pos0 * i_resx + *src_pos1 * data.res_x) >> 8;
+    uint8_t r_pos_1 = (*src_pos2 * i_resx + *src_pos3 * data.res_x) >> 8;
+    return (r_pos_0 * (255 - data.res_y) + r_pos_1 * data.res_y) >> 8;
+  });
 }
 
 class CFX_BilinearMatrix {
@@ -130,7 +127,7 @@
         d.row_offset_r = d.src_row_r * calc_data.pitch;
         func(d, dest);
       }
-      dest += increment;
+      UNSAFE_TODO(dest += increment);
     }
   }
 }
diff --git a/core/fxge/dib/cfx_scanlinecompositor.cpp b/core/fxge/dib/cfx_scanlinecompositor.cpp
index 5d9fa78..74a6a49 100644
--- a/core/fxge/dib/cfx_scanlinecompositor.cpp
+++ b/core/fxge/dib/cfx_scanlinecompositor.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cfx_scanlinecompositor.h"
 
 #include <algorithm>
@@ -80,46 +75,50 @@
                const uint8_t* src_scan,
                const uint8_t* dest_scan,
                int results[3]) {
-  FX_RGB_STRUCT<int> result = {};
-  FX_RGB_STRUCT<int> src = {
-      .red = src_scan[2], .green = src_scan[1], .blue = src_scan[0]};
-  FX_RGB_STRUCT<int> back = {
-      .red = dest_scan[2], .green = dest_scan[1], .blue = dest_scan[0]};
-  switch (blend_mode) {
-    case BlendMode::kHue:
-      result = SetLum(SetSat(src, Sat(back)), Lum(back));
-      break;
-    case BlendMode::kSaturation:
-      result = SetLum(SetSat(back, Sat(src)), Lum(back));
-      break;
-    case BlendMode::kColor:
-      result = SetLum(src, Lum(back));
-      break;
-    case BlendMode::kLuminosity:
-      result = SetLum(back, Lum(src));
-      break;
-    default:
-      break;
-  }
-  results[0] = result.blue;
-  results[1] = result.green;
-  results[2] = result.red;
+  UNSAFE_TODO({
+    FX_RGB_STRUCT<int> result = {};
+    FX_RGB_STRUCT<int> src = {
+        .red = src_scan[2], .green = src_scan[1], .blue = src_scan[0]};
+    FX_RGB_STRUCT<int> back = {
+        .red = dest_scan[2], .green = dest_scan[1], .blue = dest_scan[0]};
+    switch (blend_mode) {
+      case BlendMode::kHue:
+        result = SetLum(SetSat(src, Sat(back)), Lum(back));
+        break;
+      case BlendMode::kSaturation:
+        result = SetLum(SetSat(back, Sat(src)), Lum(back));
+        break;
+      case BlendMode::kColor:
+        result = SetLum(src, Lum(back));
+        break;
+      case BlendMode::kLuminosity:
+        result = SetLum(back, Lum(src));
+        break;
+      default:
+        break;
+    }
+    results[0] = result.blue;
+    results[1] = result.green;
+    results[2] = result.red;
+  });
 }
 
 int GetAlpha(uint8_t src_alpha, const uint8_t* clip_scan, int col) {
-  return clip_scan ? clip_scan[col] * src_alpha / 255 : src_alpha;
+  return clip_scan ? UNSAFE_TODO(clip_scan[col]) * src_alpha / 255 : src_alpha;
 }
 
 int GetAlphaWithSrc(uint8_t src_alpha,
                     const uint8_t* clip_scan,
                     const uint8_t* src_scan,
                     int col) {
-  int result = src_alpha * src_scan[col];
-  if (clip_scan) {
-    result *= clip_scan[col];
-    result /= 255;
-  }
-  return result / 255;
+  UNSAFE_TODO({
+    int result = src_alpha * src_scan[col];
+    if (clip_scan) {
+      result *= clip_scan[col];
+      result /= 255;
+    }
+    return result / 255;
+  });
 }
 
 void CompositeRow_AlphaToMask(pdfium::span<uint8_t> dest_span,
@@ -130,17 +129,20 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  src_scan += stride - 1;
-  for (int col = 0; col < pixel_count; ++col) {
-    int src_alpha = GetAlpha(*src_scan, clip_scan, col);
-    uint8_t back_alpha = *dest_scan;
-    if (!back_alpha)
-      *dest_scan = src_alpha;
-    else if (src_alpha)
-      *dest_scan = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    ++dest_scan;
-    src_scan += stride;
-  }
+  UNSAFE_TODO({
+    src_scan += stride - 1;
+    for (int col = 0; col < pixel_count; ++col) {
+      int src_alpha = GetAlpha(*src_scan, clip_scan, col);
+      uint8_t back_alpha = *dest_scan;
+      if (!back_alpha) {
+        *dest_scan = src_alpha;
+      } else if (src_alpha) {
+        *dest_scan = back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      }
+      ++dest_scan;
+      src_scan += stride;
+    }
+  });
 }
 
 void CompositeRow_Rgb2Mask(pdfium::span<uint8_t> dest_span,
@@ -148,15 +150,17 @@
                            pdfium::span<const uint8_t> clip_span) {
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  if (!clip_scan) {
-    FXSYS_memset(dest_scan, 0xff, width);
-    return;
-  }
-  for (int i = 0; i < width; ++i) {
-    *dest_scan = FXDIB_ALPHA_UNION(*dest_scan, *clip_scan);
-    ++dest_scan;
-    ++clip_scan;
-  }
+  UNSAFE_TODO({
+    if (!clip_scan) {
+      FXSYS_memset(dest_scan, 0xff, width);
+      return;
+    }
+    for (int i = 0; i < width; ++i) {
+      *dest_scan = FXDIB_ALPHA_UNION(*dest_scan, *clip_scan);
+      ++dest_scan;
+      ++clip_scan;
+    }
+  });
 }
 
 bool IsNonSeparableBlendMode(BlendMode mode) {
@@ -172,7 +176,7 @@
 }
 
 uint8_t GetGray(const uint8_t* src_scan) {
-  return FXRGB2GRAY(src_scan[2], src_scan[1], *src_scan);
+  return UNSAFE_TODO(FXRGB2GRAY(src_scan[2], src_scan[1], *src_scan));
 }
 
 uint8_t GetGrayWithBlend(const uint8_t* src_scan,
@@ -195,15 +199,17 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   constexpr size_t kOffset = 4;
-  for (int col = 0; col < pixel_count; ++col) {
-    int src_alpha = GetAlpha(src_scan[3], clip_scan, col);
-    if (src_alpha) {
-      uint8_t gray = GetGrayWithBlend(src_scan, dest_scan, blend_type);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, src_alpha);
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; ++col) {
+      int src_alpha = GetAlpha(src_scan[3], clip_scan, col);
+      if (src_alpha) {
+        uint8_t gray = GetGrayWithBlend(src_scan, dest_scan, blend_type);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, src_alpha);
+      }
+      ++dest_scan;
+      src_scan += kOffset;
     }
-    ++dest_scan;
-    src_scan += kOffset;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Gray(pdfium::span<uint8_t> dest_span,
@@ -215,15 +221,18 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; ++col) {
-    uint8_t gray = GetGrayWithBlend(src_scan, dest_scan, blend_type);
-    if (clip_scan && clip_scan[col] < 255)
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
-    else
-      *dest_scan = gray;
-    ++dest_scan;
-    src_scan += src_Bpp;
-  }
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; ++col) {
+      uint8_t gray = GetGrayWithBlend(src_scan, dest_scan, blend_type);
+      if (clip_scan && clip_scan[col] < 255) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
+      } else {
+        *dest_scan = gray;
+      }
+      ++dest_scan;
+      src_scan += src_Bpp;
+    }
+  });
 }
 
 void CompositeRow_Argb2Argb(pdfium::span<uint8_t> dest_span,
@@ -237,46 +246,50 @@
   int blended_colors[3];
   constexpr size_t kOffset = 4;
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
-  for (int col = 0; col < pixel_count; ++col) {
-    uint8_t back_alpha = dest_scan[3];
-    uint8_t src_alpha = GetAlpha(src_scan[3], clip_scan, col);
-    if (back_alpha == 0) {
-      if (clip_scan) {
-        FXARGB_SetDIB(dest_scan,
-                      (FXARGB_GetDIB(src_scan) & 0xffffff) | (src_alpha << 24));
-      } else {
-        FXSYS_memcpy(dest_scan, src_scan, 4);
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; ++col) {
+      uint8_t back_alpha = dest_scan[3];
+      uint8_t src_alpha = GetAlpha(src_scan[3], clip_scan, col);
+      if (back_alpha == 0) {
+        if (clip_scan) {
+          FXARGB_SetDIB(dest_scan, (FXARGB_GetDIB(src_scan) & 0xffffff) |
+                                       (src_alpha << 24));
+        } else {
+          FXSYS_memcpy(dest_scan, src_scan, 4);
+        }
+        dest_scan += kOffset;
+        src_scan += kOffset;
+        continue;
       }
-      dest_scan += kOffset;
-      src_scan += kOffset;
-      continue;
-    }
-    if (src_alpha == 0) {
-      dest_scan += kOffset;
-      src_scan += kOffset;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (bNonseparableBlend)
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
-    for (int color = 0; color < 3; ++color) {
-      if (blend_type != BlendMode::kNormal) {
-        int blended = bNonseparableBlend
-                          ? blended_colors[color]
-                          : Blend(blend_type, *dest_scan, *src_scan);
-        blended = FXDIB_ALPHA_MERGE(*src_scan, blended, back_alpha);
-        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      } else {
-        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, alpha_ratio);
+      if (src_alpha == 0) {
+        dest_scan += kOffset;
+        src_scan += kOffset;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; ++color) {
+        if (blend_type != BlendMode::kNormal) {
+          int blended = bNonseparableBlend
+                            ? blended_colors[color]
+                            : Blend(blend_type, *dest_scan, *src_scan);
+          blended = FXDIB_ALPHA_MERGE(*src_scan, blended, back_alpha);
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        } else {
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, alpha_ratio);
+        }
+        ++dest_scan;
+        ++src_scan;
       }
       ++dest_scan;
       ++src_scan;
     }
-    ++dest_scan;
-    ++src_scan;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_Blend_NoClip(pdfium::span<uint8_t> dest_span,
@@ -289,35 +302,38 @@
   int blended_colors[3];
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; ++col) {
-    uint8_t* dest_alpha = &dest_scan[3];
-    uint8_t back_alpha = *dest_alpha;
-    if (back_alpha == 0) {
-      if (src_Bpp == 4) {
-        FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
-      } else {
-        FXARGB_SetDIB(dest_scan,
-                      ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+  UNSAFE_TODO({
+    for (int col = 0; col < width; ++col) {
+      uint8_t* dest_alpha = &dest_scan[3];
+      uint8_t back_alpha = *dest_alpha;
+      if (back_alpha == 0) {
+        if (src_Bpp == 4) {
+          FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
+        } else {
+          FXARGB_SetDIB(dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1],
+                                              src_scan[0]));
+        }
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
       }
-      dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
-    }
-    *dest_alpha = 0xff;
-    if (bNonseparableBlend)
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
-    for (int color = 0; color < 3; ++color) {
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, *dest_scan, src_color);
-      *dest_scan = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
+      *dest_alpha = 0xff;
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; ++color) {
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, *dest_scan, src_color);
+        *dest_scan = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
+        ++dest_scan;
+        ++src_scan;
+      }
       ++dest_scan;
-      ++src_scan;
+      src_scan += src_gap;
     }
-    ++dest_scan;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_Blend_Clip(pdfium::span<uint8_t> dest_span,
@@ -332,39 +348,43 @@
   int blended_colors[3];
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; ++col) {
-    int src_alpha = *clip_scan++;
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-      dest_scan += 3;
-      src_scan += src_Bpp;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; ++col) {
+      int src_alpha = *clip_scan++;
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+        dest_scan += 3;
+        src_scan += src_Bpp;
+        dest_scan++;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, *dest_scan, src_color);
+        blended = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        dest_scan++;
+        src_scan++;
+      }
+      src_scan += src_gap;
       dest_scan++;
-      continue;
     }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (bNonseparableBlend)
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
-    for (int color = 0; color < 3; color++) {
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, *dest_scan, src_color);
-      blended = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      dest_scan++;
-      src_scan++;
-    }
-    src_scan += src_gap;
-    dest_scan++;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_NoBlend_Clip(pdfium::span<uint8_t> dest_span,
@@ -376,32 +396,35 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 255) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-      dest_scan += 3;
-      *dest_scan++ = 255;
-      src_scan += src_Bpp;
-      continue;
-    }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
-    }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    for (int color = 0; color < 3; color++) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, alpha_ratio);
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 255) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+        dest_scan += 3;
+        *dest_scan++ = 255;
+        src_scan += src_Bpp;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      for (int color = 0; color < 3; color++) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, alpha_ratio);
+        dest_scan++;
+        src_scan++;
+      }
       dest_scan++;
-      src_scan++;
+      src_scan += src_gap;
     }
-    dest_scan++;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_NoBlend_NoClip(pdfium::span<uint8_t> dest_span,
@@ -410,16 +433,18 @@
                                           int src_Bpp) {
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
-  for (int col = 0; col < width; col++) {
-    if (src_Bpp == 4) {
-      FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
-    } else {
-      FXARGB_SetDIB(dest_scan,
-                    ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      if (src_Bpp == 4) {
+        FXARGB_SetDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
+      } else {
+        FXARGB_SetDIB(dest_scan,
+                      ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+      }
+      dest_scan += 4;
+      src_scan += src_Bpp;
     }
-    dest_scan += 4;
-    src_scan += src_Bpp;
-  }
+  });
 }
 
 void CompositeRow_Argb2Rgb_Blend(pdfium::span<uint8_t> dest_span,
@@ -434,33 +459,35 @@
   int blended_colors[3];
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int dest_gap = dest_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha;
-    if (clip_scan) {
-      src_alpha = src_scan[3] * (*clip_scan++) / 255;
-    } else {
-      src_alpha = src_scan[3];
-    }
-    if (src_alpha == 0) {
-      dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    if (bNonseparableBlend) {
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int back_color = *dest_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, *src_scan);
-      *dest_scan = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-      dest_scan++;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha;
+      if (clip_scan) {
+        src_alpha = src_scan[3] * (*clip_scan++) / 255;
+      } else {
+        src_alpha = src_scan[3];
+      }
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int back_color = *dest_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, *src_scan);
+        *dest_scan = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        dest_scan++;
+        src_scan++;
+      }
+      dest_scan += dest_gap;
       src_scan++;
     }
-    dest_scan += dest_gap;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_Argb2Rgb_NoBlend(pdfium::span<uint8_t> dest_span,
@@ -472,32 +499,34 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   int dest_gap = dest_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha;
-    if (clip_scan) {
-      src_alpha = src_scan[3] * (*clip_scan++) / 255;
-    } else {
-      src_alpha = src_scan[3];
-    }
-    if (src_alpha == 255) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-      dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    if (src_alpha == 0) {
-      dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    for (int color = 0; color < 3; color++) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
-      dest_scan++;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha;
+      if (clip_scan) {
+        src_alpha = src_scan[3] * (*clip_scan++) / 255;
+      } else {
+        src_alpha = src_scan[3];
+      }
+      if (src_alpha == 255) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      for (int color = 0; color < 3; color++) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
+        dest_scan++;
+        src_scan++;
+      }
+      dest_scan += dest_gap;
       src_scan++;
     }
-    dest_scan += dest_gap;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_Blend_NoClip(pdfium::span<uint8_t> dest_span,
@@ -512,23 +541,25 @@
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int dest_gap = dest_Bpp - 3;
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    if (bNonseparableBlend) {
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int back_color = *dest_scan;
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, src_color);
+        *dest_scan = blended;
+        dest_scan++;
+        src_scan++;
+      }
+      dest_scan += dest_gap;
+      src_scan += src_gap;
     }
-    for (int color = 0; color < 3; color++) {
-      int back_color = *dest_scan;
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, src_color);
-      *dest_scan = blended;
-      dest_scan++;
-      src_scan++;
-    }
-    dest_scan += dest_gap;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_Blend_Clip(pdfium::span<uint8_t> dest_span,
@@ -545,29 +576,31 @@
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int dest_gap = dest_Bpp - 3;
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha = *clip_scan++;
-    if (src_alpha == 0) {
-      dest_scan += dest_Bpp;
-      src_scan += src_Bpp;
-      continue;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha = *clip_scan++;
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += src_Bpp;
+        continue;
+      }
+      if (bNonseparableBlend) {
+        RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int src_color = *src_scan;
+        int back_color = *dest_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, src_color);
+        *dest_scan = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        dest_scan++;
+        src_scan++;
+      }
+      dest_scan += dest_gap;
+      src_scan += src_gap;
     }
-    if (bNonseparableBlend) {
-      RGB_Blend(blend_type, src_scan, dest_scan, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int src_color = *src_scan;
-      int back_color = *dest_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, src_color);
-      *dest_scan = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-      dest_scan++;
-      src_scan++;
-    }
-    dest_scan += dest_gap;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_NoBlend_NoClip(pdfium::span<uint8_t> dest_span,
@@ -577,15 +610,17 @@
                                          int src_Bpp) {
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
-  if (dest_Bpp == src_Bpp) {
-    FXSYS_memcpy(dest_scan, src_scan, width * dest_Bpp);
-    return;
-  }
-  for (int col = 0; col < width; col++) {
-    FXSYS_memcpy(dest_scan, src_scan, 3);
-    dest_scan += dest_Bpp;
-    src_scan += src_Bpp;
-  }
+  UNSAFE_TODO({
+    if (dest_Bpp == src_Bpp) {
+      FXSYS_memcpy(dest_scan, src_scan, width * dest_Bpp);
+      return;
+    }
+    for (int col = 0; col < width; col++) {
+      FXSYS_memcpy(dest_scan, src_scan, 3);
+      dest_scan += dest_Bpp;
+      src_scan += src_Bpp;
+    }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_NoBlend_Clip(pdfium::span<uint8_t> dest_span,
@@ -597,25 +632,27 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < width; col++) {
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 255) {
-      FXSYS_memcpy(dest_scan, src_scan, 3);
-    } else if (src_alpha) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
-      dest_scan++;
-      src_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
-      dest_scan++;
-      src_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
-      dest_scan += dest_Bpp - 2;
-      src_scan += src_Bpp - 2;
-      continue;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 255) {
+        FXSYS_memcpy(dest_scan, src_scan, 3);
+      } else if (src_alpha) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
+        dest_scan++;
+        src_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
+        dest_scan++;
+        src_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, *src_scan, src_alpha);
+        dest_scan += dest_Bpp - 2;
+        src_scan += src_Bpp - 2;
+        continue;
+      }
+      dest_scan += dest_Bpp;
+      src_scan += src_Bpp;
     }
-    dest_scan += dest_Bpp;
-    src_scan += src_Bpp;
-  }
+  });
 }
 
 void CompositeRow_8bppPal2Gray(pdfium::span<uint8_t> dest_span,
@@ -628,14 +665,28 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   const uint8_t* pPalette = palette_span.data();
-  if (blend_type != BlendMode::kNormal) {
-    bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
+  UNSAFE_TODO({
+    if (blend_type != BlendMode::kNormal) {
+      bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
+      for (int col = 0; col < pixel_count; col++) {
+        uint8_t gray = pPalette[*src_scan];
+        if (bNonseparableBlend) {
+          gray = blend_type == BlendMode::kLuminosity ? gray : *dest_scan;
+        } else {
+          gray = Blend(blend_type, *dest_scan, gray);
+        }
+        if (clip_scan && clip_scan[col] < 255) {
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
+        } else {
+          *dest_scan = gray;
+        }
+        dest_scan++;
+        src_scan++;
+      }
+      return;
+    }
     for (int col = 0; col < pixel_count; col++) {
       uint8_t gray = pPalette[*src_scan];
-      if (bNonseparableBlend)
-        gray = blend_type == BlendMode::kLuminosity ? gray : *dest_scan;
-      else
-        gray = Blend(blend_type, *dest_scan, gray);
       if (clip_scan && clip_scan[col] < 255)
         *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
       else
@@ -643,17 +694,7 @@
       dest_scan++;
       src_scan++;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    uint8_t gray = pPalette[*src_scan];
-    if (clip_scan && clip_scan[col] < 255)
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
-    else
-      *dest_scan = gray;
-    dest_scan++;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_1bppPal2Gray(pdfium::span<uint8_t> dest_span,
@@ -668,17 +709,33 @@
   const uint8_t* clip_scan = clip_span.data();
   int reset_gray = src_palette[0];
   int set_gray = src_palette[1];
-  if (blend_type != BlendMode::kNormal) {
-    bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
+  UNSAFE_TODO({
+    if (blend_type != BlendMode::kNormal) {
+      bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
+      for (int col = 0; col < pixel_count; col++) {
+        uint8_t gray =
+            (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8)))
+                ? set_gray
+                : reset_gray;
+        if (bNonseparableBlend) {
+          gray = blend_type == BlendMode::kLuminosity ? gray : *dest_scan;
+        } else {
+          gray = Blend(blend_type, *dest_scan, gray);
+        }
+        if (clip_scan && clip_scan[col] < 255) {
+          *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
+        } else {
+          *dest_scan = gray;
+        }
+        dest_scan++;
+      }
+      return;
+    }
     for (int col = 0; col < pixel_count; col++) {
       uint8_t gray =
           (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8)))
               ? set_gray
               : reset_gray;
-      if (bNonseparableBlend)
-        gray = blend_type == BlendMode::kLuminosity ? gray : *dest_scan;
-      else
-        gray = Blend(blend_type, *dest_scan, gray);
       if (clip_scan && clip_scan[col] < 255) {
         *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
       } else {
@@ -686,20 +743,7 @@
       }
       dest_scan++;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    uint8_t gray =
-        (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8)))
-            ? set_gray
-            : reset_gray;
-    if (clip_scan && clip_scan[col] < 255) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, gray, clip_scan[col]);
-    } else {
-      *dest_scan = gray;
-    }
-    dest_scan++;
-  }
+  });
 }
 
 void CompositeRow_8bppRgb2Rgb_NoBlend(pdfium::span<uint8_t> dest_span,
@@ -713,28 +757,30 @@
   const uint8_t* clip_scan = clip_span.data();
   const uint32_t* pPalette = palette_span.data();
   FX_ARGB argb = 0;
-  for (int col = 0; col < pixel_count; col++) {
-    argb = pPalette[*src_scan];
-    int src_r = FXARGB_R(argb);
-    int src_g = FXARGB_G(argb);
-    int src_b = FXARGB_B(argb);
-    if (clip_scan && clip_scan[col] < 255) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, clip_scan[col]);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, clip_scan[col]);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, clip_scan[col]);
-      dest_scan++;
-    } else {
-      *dest_scan++ = src_b;
-      *dest_scan++ = src_g;
-      *dest_scan++ = src_r;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      argb = pPalette[*src_scan];
+      int src_r = FXARGB_R(argb);
+      int src_g = FXARGB_G(argb);
+      int src_b = FXARGB_B(argb);
+      if (clip_scan && clip_scan[col] < 255) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, clip_scan[col]);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, clip_scan[col]);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, clip_scan[col]);
+        dest_scan++;
+      } else {
+        *dest_scan++ = src_b;
+        *dest_scan++ = src_g;
+        *dest_scan++ = src_r;
+      }
+      if (DestBpp == 4) {
+        dest_scan++;
+      }
+      src_scan++;
     }
-    if (DestBpp == 4) {
-      dest_scan++;
-    }
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_1bppRgb2Rgb_NoBlend(pdfium::span<uint8_t> dest_span,
@@ -753,35 +799,37 @@
   int set_r = FXARGB_R(src_palette[1]);
   int set_g = FXARGB_G(src_palette[1]);
   int set_b = FXARGB_B(src_palette[1]);
-  for (int col = 0; col < pixel_count; col++) {
-    int src_r;
-    int src_g;
-    int src_b;
-    if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
-      src_r = set_r;
-      src_g = set_g;
-      src_b = set_b;
-    } else {
-      src_r = reset_r;
-      src_g = reset_g;
-      src_b = reset_b;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_r;
+      int src_g;
+      int src_b;
+      if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
+        src_r = set_r;
+        src_g = set_g;
+        src_b = set_b;
+      } else {
+        src_r = reset_r;
+        src_g = reset_g;
+        src_b = reset_b;
+      }
+      if (clip_scan && clip_scan[col] < 255) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, clip_scan[col]);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, clip_scan[col]);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, clip_scan[col]);
+        dest_scan++;
+      } else {
+        *dest_scan++ = src_b;
+        *dest_scan++ = src_g;
+        *dest_scan++ = src_r;
+      }
+      if (DestBpp == 4) {
+        dest_scan++;
+      }
     }
-    if (clip_scan && clip_scan[col] < 255) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, clip_scan[col]);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, clip_scan[col]);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, clip_scan[col]);
-      dest_scan++;
-    } else {
-      *dest_scan++ = src_b;
-      *dest_scan++ = src_g;
-      *dest_scan++ = src_r;
-    }
-    if (DestBpp == 4) {
-      dest_scan++;
-    }
-  }
+  });
 }
 
 void CompositeRow_8bppRgb2Argb_NoBlend(
@@ -794,38 +842,41 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   const uint32_t* pPalette = palette_span.data();
-  for (int col = 0; col < width; col++) {
-    FX_ARGB argb = pPalette[*src_scan];
-    int src_r = FXARGB_R(argb);
-    int src_g = FXARGB_G(argb);
-    int src_b = FXARGB_B(argb);
-    if (!clip_scan || clip_scan[col] == 255) {
-      *dest_scan++ = src_b;
-      *dest_scan++ = src_g;
-      *dest_scan++ = src_r;
-      *dest_scan++ = 255;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      FX_ARGB argb = pPalette[*src_scan];
+      int src_r = FXARGB_R(argb);
+      int src_g = FXARGB_G(argb);
+      int src_b = FXARGB_B(argb);
+      if (!clip_scan || clip_scan[col] == 255) {
+        *dest_scan++ = src_b;
+        *dest_scan++ = src_g;
+        *dest_scan++ = src_r;
+        *dest_scan++ = 255;
+        src_scan++;
+        continue;
+      }
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan++;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
+      dest_scan++;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
+      dest_scan++;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
+      dest_scan++;
+      dest_scan++;
       src_scan++;
-      continue;
     }
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan++;
-      continue;
-    }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
-    dest_scan++;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
-    dest_scan++;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
-    dest_scan++;
-    dest_scan++;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_1bppRgb2Argb_NoBlend(pdfium::span<uint8_t> dest_span,
@@ -843,43 +894,46 @@
   int set_r = FXARGB_R(src_palette[1]);
   int set_g = FXARGB_G(src_palette[1]);
   int set_b = FXARGB_B(src_palette[1]);
-  for (int col = 0; col < width; col++) {
-    int src_r;
-    int src_g;
-    int src_b;
-    if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
-      src_r = set_r;
-      src_g = set_g;
-      src_b = set_b;
-    } else {
-      src_r = reset_r;
-      src_g = reset_g;
-      src_b = reset_b;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_r;
+      int src_g;
+      int src_b;
+      if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
+        src_r = set_r;
+        src_g = set_g;
+        src_b = set_b;
+      } else {
+        src_r = reset_r;
+        src_g = reset_g;
+        src_b = reset_b;
+      }
+      if (!clip_scan || clip_scan[col] == 255) {
+        *dest_scan++ = src_b;
+        *dest_scan++ = src_g;
+        *dest_scan++ = src_r;
+        *dest_scan++ = 255;
+        continue;
+      }
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
+      dest_scan++;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
+      dest_scan++;
+      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
+      dest_scan++;
+      dest_scan++;
     }
-    if (!clip_scan || clip_scan[col] == 255) {
-      *dest_scan++ = src_b;
-      *dest_scan++ = src_g;
-      *dest_scan++ = src_r;
-      *dest_scan++ = 255;
-      continue;
-    }
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      continue;
-    }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
-    dest_scan++;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
-    dest_scan++;
-    *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
-    dest_scan++;
-    dest_scan++;
-  }
+  });
 }
 
 void CompositeRow_ByteMask2Argb(pdfium::span<uint8_t> dest_span,
@@ -894,56 +948,59 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
-      dest_scan += 4;
-      continue;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
+        dest_scan += 4;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        RGB_Blend(blend_type, scan, dest_scan, blended_colors);
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], alpha_ratio);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], alpha_ratio);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], alpha_ratio);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, *dest_scan, src_b);
+        blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_g);
+        blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_r);
+        blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+      } else {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
+      }
+      dest_scan += 2;
     }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      RGB_Blend(blend_type, scan, dest_scan, blended_colors);
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], alpha_ratio);
-      dest_scan++;
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], alpha_ratio);
-      dest_scan++;
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], alpha_ratio);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, *dest_scan, src_b);
-      blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_g);
-      blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_r);
-      blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-    } else {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
-    }
-    dest_scan += 2;
-  }
+  });
 }
 
 void CompositeRow_ByteMask2Rgb(pdfium::span<uint8_t> dest_span,
@@ -959,41 +1016,46 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
-    if (src_alpha == 0) {
-      dest_scan += Bpp;
-      continue;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
+      if (src_alpha == 0) {
+        dest_scan += Bpp;
+        continue;
+      }
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        RGB_Blend(blend_type, scan, dest_scan, blended_colors);
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], src_alpha);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], src_alpha);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], src_alpha);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, *dest_scan, src_b);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_g);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_r);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+      } else {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, src_alpha);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, src_alpha);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, src_alpha);
+      }
+      dest_scan += Bpp - 2;
     }
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      RGB_Blend(blend_type, scan, dest_scan, blended_colors);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], src_alpha);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, *dest_scan, src_b);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_g);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_r);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-    } else {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, src_alpha);
-    }
-    dest_scan += Bpp - 2;
-  }
+  });
 }
 
 void CompositeRow_ByteMask2Mask(pdfium::span<uint8_t> dest_span,
@@ -1012,7 +1074,7 @@
     } else if (src_alpha) {
       *dest_scan = back_alpha + src_alpha - back_alpha * src_alpha / 255;
     }
-    dest_scan++;
+    UNSAFE_TODO(dest_scan++);
   }
 }
 
@@ -1030,7 +1092,7 @@
     if (src_alpha) {
       *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_gray, src_alpha);
     }
-    dest_scan++;
+    UNSAFE_TODO(dest_scan++);
   }
 }
 
@@ -1047,66 +1109,71 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
-    FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
-    for (int col = 0; col < pixel_count; col++) {
-      if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        FXARGB_SetDIB(dest_scan, argb);
+  UNSAFE_TODO({
+    if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
+      FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
+      for (int col = 0; col < pixel_count; col++) {
+        if (src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8))) {
+          FXARGB_SetDIB(dest_scan, argb);
+        }
+        dest_scan += 4;
       }
-      dest_scan += 4;
+      return;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
-      dest_scan += 4;
-      continue;
+    for (int col = 0; col < pixel_count; col++) {
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan += 4;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
+        dest_scan += 4;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        RGB_Blend(blend_type, scan, dest_scan, blended_colors);
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], alpha_ratio);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], alpha_ratio);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], alpha_ratio);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, *dest_scan, src_b);
+        blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_g);
+        blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_r);
+        blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
+      } else {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
+      }
+      dest_scan += 2;
     }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      FXARGB_SetDIB(dest_scan, ArgbEncode(src_alpha, src_r, src_g, src_b));
-      dest_scan += 4;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      RGB_Blend(blend_type, scan, dest_scan, blended_colors);
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], alpha_ratio);
-      dest_scan++;
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], alpha_ratio);
-      dest_scan++;
-      *dest_scan =
-          FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], alpha_ratio);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, *dest_scan, src_b);
-      blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_g);
-      blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_r);
-      blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, alpha_ratio);
-    } else {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, alpha_ratio);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, alpha_ratio);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, alpha_ratio);
-    }
-    dest_scan += 2;
-  }
+  });
 }
 
 void CompositeRow_BitMask2Rgb(pdfium::span<uint8_t> dest_span,
@@ -1123,56 +1190,63 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
-    for (int col = 0; col < pixel_count; col++) {
-      if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        dest_scan[2] = src_r;
-        dest_scan[1] = src_g;
-        dest_scan[0] = src_b;
+  UNSAFE_TODO({
+    if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
+      for (int col = 0; col < pixel_count; col++) {
+        if (src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8))) {
+          dest_scan[2] = src_r;
+          dest_scan[1] = src_g;
+          dest_scan[0] = src_b;
+        }
+        dest_scan += Bpp;
       }
-      dest_scan += Bpp;
+      return;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
-      dest_scan += Bpp;
-      continue;
+    for (int col = 0; col < pixel_count; col++) {
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan += Bpp;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      if (src_alpha == 0) {
+        dest_scan += Bpp;
+        continue;
+      }
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        RGB_Blend(blend_type, scan, dest_scan, blended_colors);
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], src_alpha);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], src_alpha);
+        dest_scan++;
+        *dest_scan =
+            FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], src_alpha);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, *dest_scan, src_b);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_g);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+        dest_scan++;
+        blended = Blend(blend_type, *dest_scan, src_r);
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
+      } else {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, src_alpha);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, src_alpha);
+        dest_scan++;
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, src_alpha);
+      }
+      dest_scan += Bpp - 2;
     }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    if (src_alpha == 0) {
-      dest_scan += Bpp;
-      continue;
-    }
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      RGB_Blend(blend_type, scan, dest_scan, blended_colors);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[0], src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[1], src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended_colors[2], src_alpha);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, *dest_scan, src_b);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_g);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-      dest_scan++;
-      blended = Blend(blend_type, *dest_scan, src_r);
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, blended, src_alpha);
-    } else {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_b, src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_g, src_alpha);
-      dest_scan++;
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_r, src_alpha);
-    }
-    dest_scan += Bpp - 2;
-  }
+  });
 }
 
 void CompositeRow_BitMask2Mask(pdfium::span<uint8_t> dest_span,
@@ -1184,20 +1258,23 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan++;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      uint8_t back_alpha = *dest_scan;
+      if (!back_alpha) {
+        *dest_scan = src_alpha;
+      } else if (src_alpha) {
+        *dest_scan = back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      }
       dest_scan++;
-      continue;
     }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    uint8_t back_alpha = *dest_scan;
-    if (!back_alpha) {
-      *dest_scan = src_alpha;
-    } else if (src_alpha) {
-      *dest_scan = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    }
-    dest_scan++;
-  }
+  });
 }
 
 void CompositeRow_BitMask2Gray(pdfium::span<uint8_t> dest_span,
@@ -1210,17 +1287,20 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan++;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      if (src_alpha) {
+        *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_gray, src_alpha);
+      }
       dest_scan++;
-      continue;
     }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    if (src_alpha) {
-      *dest_scan = FXDIB_ALPHA_MERGE(*dest_scan, src_gray, src_alpha);
-    }
-    dest_scan++;
-  }
+  });
 }
 
 void CompositeRow_Argb2Argb_RgbByteOrder(
@@ -1234,52 +1314,55 @@
   const uint8_t* clip_scan = clip_span.data();
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int blended_colors[3];
-  for (int col = 0; col < pixel_count; col++) {
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      if (clip_scan) {
-        int src_alpha = clip_scan[col] * src_scan[3] / 255;
-        ReverseCopy3Bytes(dest_scan, src_scan);
-        dest_scan[3] = src_alpha;
-      } else {
-        FXARGB_RGBORDERCOPY(dest_scan, src_scan);
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        if (clip_scan) {
+          int src_alpha = clip_scan[col] * src_scan[3] / 255;
+          ReverseCopy3Bytes(dest_scan, src_scan);
+          dest_scan[3] = src_alpha;
+        } else {
+          FXARGB_RGBORDERCOPY(dest_scan, src_scan);
+        }
+        dest_scan += 4;
+        src_scan += 4;
+        continue;
+      }
+      uint8_t src_alpha = GetAlpha(src_scan[3], clip_scan, col);
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan += 4;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        if (blend_type != BlendMode::kNormal) {
+          int blended = bNonseparableBlend
+                            ? blended_colors[color]
+                            : Blend(blend_type, dest_scan[index], *src_scan);
+          blended = FXDIB_ALPHA_MERGE(*src_scan, blended, back_alpha);
+          dest_scan[index] =
+              FXDIB_ALPHA_MERGE(dest_scan[index], blended, alpha_ratio);
+        } else {
+          dest_scan[index] =
+              FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, alpha_ratio);
+        }
+        src_scan++;
       }
       dest_scan += 4;
-      src_scan += 4;
-      continue;
-    }
-    uint8_t src_alpha = GetAlpha(src_scan[3], clip_scan, col);
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan += 4;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      if (blend_type != BlendMode::kNormal) {
-        int blended = bNonseparableBlend
-                          ? blended_colors[color]
-                          : Blend(blend_type, dest_scan[index], *src_scan);
-        blended = FXDIB_ALPHA_MERGE(*src_scan, blended, back_alpha);
-        dest_scan[index] =
-            FXDIB_ALPHA_MERGE(dest_scan[index], blended, alpha_ratio);
-      } else {
-        dest_scan[index] =
-            FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, alpha_ratio);
-      }
       src_scan++;
     }
-    dest_scan += 4;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_Blend_NoClip_RgbByteOrder(
@@ -1293,37 +1376,41 @@
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int src_gap = src_Bpp - 3;
   int blended_colors[3];
-  for (int col = 0; col < width; col++) {
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      if (src_Bpp == 4) {
-        FXARGB_SetRGBOrderDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
-      } else {
-        FXARGB_SetRGBOrderDIB(
-            dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        if (src_Bpp == 4) {
+          FXARGB_SetRGBOrderDIB(dest_scan,
+                                0xff000000 | FXARGB_GetDIB(src_scan));
+        } else {
+          FXARGB_SetRGBOrderDIB(
+              dest_scan,
+              ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+        }
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      dest_scan[3] = 0xff;
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, dest_scan[index], src_color);
+        dest_scan[index] = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
+        src_scan++;
       }
       dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
+      src_scan += src_gap;
     }
-    dest_scan[3] = 0xff;
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, dest_scan[index], src_color);
-      dest_scan[index] = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
-      src_scan++;
-    }
-    dest_scan += 4;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Argb2Rgb_Blend_RgbByteOrder(
@@ -1338,35 +1425,37 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha;
-    if (clip_scan) {
-      src_alpha = src_scan[3] * (*clip_scan++) / 255;
-    } else {
-      src_alpha = src_scan[3];
-    }
-    if (src_alpha == 0) {
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha;
+      if (clip_scan) {
+        src_alpha = src_scan[3] * (*clip_scan++) / 255;
+      } else {
+        src_alpha = src_scan[3];
+      }
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        int back_color = dest_scan[index];
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, *src_scan);
+        dest_scan[index] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        src_scan++;
+      }
       dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      int back_color = dest_scan[index];
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, *src_scan);
-      dest_scan[index] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
       src_scan++;
     }
-    dest_scan += dest_Bpp;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_NoBlend_NoClip_RgbByteOrder(
@@ -1376,16 +1465,18 @@
     int src_Bpp) {
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
-  for (int col = 0; col < width; col++) {
-    if (src_Bpp == 4) {
-      FXARGB_SetRGBOrderDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
-    } else {
-      FXARGB_SetRGBOrderDIB(
-          dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      if (src_Bpp == 4) {
+        FXARGB_SetRGBOrderDIB(dest_scan, 0xff000000 | FXARGB_GetDIB(src_scan));
+      } else {
+        FXARGB_SetRGBOrderDIB(
+            dest_scan, ArgbEncode(0xff, src_scan[2], src_scan[1], src_scan[0]));
+      }
+      dest_scan += 4;
+      src_scan += src_Bpp;
     }
-    dest_scan += 4;
-    src_scan += src_Bpp;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_Blend_NoClip_RgbByteOrder(
@@ -1400,25 +1491,27 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        int back_color = dest_scan[index];
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, src_color);
+        dest_scan[index] = blended;
+        src_scan++;
+      }
+      dest_scan += dest_Bpp;
+      src_scan += src_gap;
     }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      int back_color = dest_scan[index];
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, src_color);
-      dest_scan[index] = blended;
-      src_scan++;
-    }
-    dest_scan += dest_Bpp;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Argb2Rgb_NoBlend_RgbByteOrder(
@@ -1430,33 +1523,35 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha;
-    if (clip_scan) {
-      src_alpha = src_scan[3] * (*clip_scan++) / 255;
-    } else {
-      src_alpha = src_scan[3];
-    }
-    if (src_alpha == 255) {
-      ReverseCopy3Bytes(dest_scan, src_scan);
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha;
+      if (clip_scan) {
+        src_alpha = src_scan[3] * (*clip_scan++) / 255;
+      } else {
+        src_alpha = src_scan[3];
+      }
+      if (src_alpha == 255) {
+        ReverseCopy3Bytes(dest_scan, src_scan);
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += 4;
+        continue;
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        dest_scan[index] =
+            FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, src_alpha);
+        src_scan++;
+      }
       dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    if (src_alpha == 0) {
-      dest_scan += dest_Bpp;
-      src_scan += 4;
-      continue;
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      dest_scan[index] =
-          FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, src_alpha);
       src_scan++;
     }
-    dest_scan += dest_Bpp;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_NoBlend_NoClip_RgbByteOrder(
@@ -1467,11 +1562,13 @@
     int src_Bpp) {
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
-  for (int col = 0; col < width; col++) {
-    ReverseCopy3Bytes(dest_scan, src_scan);
-    dest_scan += dest_Bpp;
-    src_scan += src_Bpp;
-  }
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      ReverseCopy3Bytes(dest_scan, src_scan);
+      dest_scan += dest_Bpp;
+      src_scan += src_Bpp;
+    }
+  });
 }
 
 void CompositeRow_Rgb2Argb_Blend_Clip_RgbByteOrder(
@@ -1487,42 +1584,45 @@
   int blended_colors[3];
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    int src_alpha = *clip_scan++;
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      ReverseCopy3Bytes(dest_scan, src_scan);
-      src_scan += src_Bpp;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_alpha = *clip_scan++;
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        ReverseCopy3Bytes(dest_scan, src_scan);
+        src_scan += src_Bpp;
+        dest_scan += 4;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        int src_color = *src_scan;
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, dest_scan[index], src_color);
+        blended = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
+        dest_scan[index] =
+            FXDIB_ALPHA_MERGE(dest_scan[index], blended, alpha_ratio);
+        src_scan++;
+      }
       dest_scan += 4;
-      continue;
+      src_scan += src_gap;
     }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      int src_color = *src_scan;
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, dest_scan[index], src_color);
-      blended = FXDIB_ALPHA_MERGE(src_color, blended, back_alpha);
-      dest_scan[index] =
-          FXDIB_ALPHA_MERGE(dest_scan[index], blended, alpha_ratio);
-      src_scan++;
-    }
-    dest_scan += 4;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_Blend_Clip_RgbByteOrder(
@@ -1539,31 +1639,33 @@
   int blended_colors[3];
   bool bNonseparableBlend = IsNonSeparableBlendMode(blend_type);
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    uint8_t src_alpha = *clip_scan++;
-    if (src_alpha == 0) {
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      uint8_t src_alpha = *clip_scan++;
+      if (src_alpha == 0) {
+        dest_scan += dest_Bpp;
+        src_scan += src_Bpp;
+        continue;
+      }
+      if (bNonseparableBlend) {
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
+      }
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        int src_color = *src_scan;
+        int back_color = dest_scan[index];
+        int blended = bNonseparableBlend
+                          ? blended_colors[color]
+                          : Blend(blend_type, back_color, src_color);
+        dest_scan[index] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        src_scan++;
+      }
       dest_scan += dest_Bpp;
-      src_scan += src_Bpp;
-      continue;
+      src_scan += src_gap;
     }
-    if (bNonseparableBlend) {
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, src_scan, dest_scan_o, blended_colors);
-    }
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      int src_color = *src_scan;
-      int back_color = dest_scan[index];
-      int blended = bNonseparableBlend
-                        ? blended_colors[color]
-                        : Blend(blend_type, back_color, src_color);
-      dest_scan[index] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-      src_scan++;
-    }
-    dest_scan += dest_Bpp;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Argb_NoBlend_Clip_RgbByteOrder(
@@ -1576,33 +1678,36 @@
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
   int src_gap = src_Bpp - 3;
-  for (int col = 0; col < width; col++) {
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 255) {
-      ReverseCopy3Bytes(dest_scan, src_scan);
-      dest_scan[3] = 255;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 255) {
+        ReverseCopy3Bytes(dest_scan, src_scan);
+        dest_scan[3] = 255;
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan += src_Bpp;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      for (int color = 0; color < 3; color++) {
+        int index = 2 - color;
+        dest_scan[index] =
+            FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, alpha_ratio);
+        src_scan++;
+      }
       dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
+      src_scan += src_gap;
     }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      src_scan += src_Bpp;
-      continue;
-    }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    for (int color = 0; color < 3; color++) {
-      int index = 2 - color;
-      dest_scan[index] =
-          FXDIB_ALPHA_MERGE(dest_scan[index], *src_scan, alpha_ratio);
-      src_scan++;
-    }
-    dest_scan += 4;
-    src_scan += src_gap;
-  }
+  });
 }
 
 void CompositeRow_Rgb2Rgb_NoBlend_Clip_RgbByteOrder(
@@ -1615,23 +1720,25 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < width; col++) {
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 255) {
-      ReverseCopy3Bytes(dest_scan, src_scan);
-    } else if (src_alpha) {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], *src_scan, src_alpha);
-      src_scan++;
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], *src_scan, src_alpha);
-      src_scan++;
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], *src_scan, src_alpha);
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 255) {
+        ReverseCopy3Bytes(dest_scan, src_scan);
+      } else if (src_alpha) {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], *src_scan, src_alpha);
+        src_scan++;
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], *src_scan, src_alpha);
+        src_scan++;
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], *src_scan, src_alpha);
+        dest_scan += dest_Bpp;
+        src_scan += src_Bpp - 2;
+        continue;
+      }
       dest_scan += dest_Bpp;
-      src_scan += src_Bpp - 2;
-      continue;
+      src_scan += src_Bpp;
     }
-    dest_scan += dest_Bpp;
-    src_scan += src_Bpp;
-  }
+  });
 }
 
 void CompositeRow_8bppRgb2Rgb_NoBlend_RgbByteOrder(
@@ -1644,24 +1751,26 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    FX_ARGB argb = pPalette ? pPalette[*src_scan]
-                            : ArgbEncode(0, *src_scan, *src_scan, *src_scan);
-    int src_r = FXARGB_R(argb);
-    int src_g = FXARGB_G(argb);
-    int src_b = FXARGB_B(argb);
-    if (clip_scan && clip_scan[col] < 255) {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, clip_scan[col]);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, clip_scan[col]);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, clip_scan[col]);
-    } else {
-      dest_scan[2] = src_b;
-      dest_scan[1] = src_g;
-      dest_scan[0] = src_r;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      FX_ARGB argb = pPalette ? pPalette[*src_scan]
+                              : ArgbEncode(0, *src_scan, *src_scan, *src_scan);
+      int src_r = FXARGB_R(argb);
+      int src_g = FXARGB_G(argb);
+      int src_b = FXARGB_B(argb);
+      if (clip_scan && clip_scan[col] < 255) {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, clip_scan[col]);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, clip_scan[col]);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, clip_scan[col]);
+      } else {
+        dest_scan[2] = src_b;
+        dest_scan[1] = src_g;
+        dest_scan[0] = src_r;
+      }
+      dest_scan += DestBpp;
+      src_scan++;
     }
-    dest_scan += DestBpp;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_1bppRgb2Rgb_NoBlend_RgbByteOrder(
@@ -1692,30 +1801,32 @@
     reset_r = reset_g = reset_b = 0;
     set_r = set_g = set_b = 255;
   }
-  for (int col = 0; col < pixel_count; col++) {
-    int src_r;
-    int src_g;
-    int src_b;
-    if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
-      src_r = set_r;
-      src_g = set_g;
-      src_b = set_b;
-    } else {
-      src_r = reset_r;
-      src_g = reset_g;
-      src_b = reset_b;
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_r;
+      int src_g;
+      int src_b;
+      if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
+        src_r = set_r;
+        src_g = set_g;
+        src_b = set_b;
+      } else {
+        src_r = reset_r;
+        src_g = reset_g;
+        src_b = reset_b;
+      }
+      if (clip_scan && clip_scan[col] < 255) {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, clip_scan[col]);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, clip_scan[col]);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, clip_scan[col]);
+      } else {
+        dest_scan[2] = src_b;
+        dest_scan[1] = src_g;
+        dest_scan[0] = src_r;
+      }
+      dest_scan += DestBpp;
     }
-    if (clip_scan && clip_scan[col] < 255) {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, clip_scan[col]);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, clip_scan[col]);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, clip_scan[col]);
-    } else {
-      dest_scan[2] = src_b;
-      dest_scan[1] = src_g;
-      dest_scan[0] = src_r;
-    }
-    dest_scan += DestBpp;
-  }
+  });
 }
 
 void CompositeRow_8bppRgb2Argb_NoBlend_RgbByteOrder(
@@ -1727,43 +1838,46 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < width; col++) {
-    int src_r;
-    int src_g;
-    int src_b;
-    if (pPalette) {
-      FX_ARGB argb = pPalette[*src_scan];
-      src_r = FXARGB_R(argb);
-      src_g = FXARGB_G(argb);
-      src_b = FXARGB_B(argb);
-    } else {
-      src_r = src_g = src_b = *src_scan;
-    }
-    if (!clip_scan || clip_scan[col] == 255) {
-      dest_scan[2] = src_b;
-      dest_scan[1] = src_g;
-      dest_scan[0] = src_r;
-      dest_scan[3] = 255;
-      src_scan++;
-      dest_scan += 4;
-      continue;
-    }
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 0) {
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_r;
+      int src_g;
+      int src_b;
+      if (pPalette) {
+        FX_ARGB argb = pPalette[*src_scan];
+        src_r = FXARGB_R(argb);
+        src_g = FXARGB_G(argb);
+        src_b = FXARGB_B(argb);
+      } else {
+        src_r = src_g = src_b = *src_scan;
+      }
+      if (!clip_scan || clip_scan[col] == 255) {
+        dest_scan[2] = src_b;
+        dest_scan[1] = src_g;
+        dest_scan[0] = src_r;
+        dest_scan[3] = 255;
+        src_scan++;
+        dest_scan += 4;
+        continue;
+      }
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        src_scan++;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
+      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
+      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
       dest_scan += 4;
       src_scan++;
-      continue;
     }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
-    dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
-    dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
-    dest_scan += 4;
-    src_scan++;
-  }
+  });
 }
 
 void CompositeRow_1bppRgb2Argb_NoBlend_RgbByteOrder(
@@ -1793,41 +1907,44 @@
     reset_r = reset_g = reset_b = 0;
     set_r = set_g = set_b = 255;
   }
-  for (int col = 0; col < width; col++) {
-    int src_r;
-    int src_g;
-    int src_b;
-    if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
-      src_r = set_r;
-      src_g = set_g;
-      src_b = set_b;
-    } else {
-      src_r = reset_r;
-      src_g = reset_g;
-      src_b = reset_b;
-    }
-    if (!clip_scan || clip_scan[col] == 255) {
-      dest_scan[2] = src_b;
-      dest_scan[1] = src_g;
-      dest_scan[0] = src_r;
-      dest_scan[3] = 255;
+  UNSAFE_TODO({
+    for (int col = 0; col < width; col++) {
+      int src_r;
+      int src_g;
+      int src_b;
+      if (src_scan[(col + src_left) / 8] & (1 << (7 - (col + src_left) % 8))) {
+        src_r = set_r;
+        src_g = set_g;
+        src_b = set_b;
+      } else {
+        src_r = reset_r;
+        src_g = reset_g;
+        src_b = reset_b;
+      }
+      if (!clip_scan || clip_scan[col] == 255) {
+        dest_scan[2] = src_b;
+        dest_scan[1] = src_g;
+        dest_scan[0] = src_r;
+        dest_scan[3] = 255;
+        dest_scan += 4;
+        continue;
+      }
+      int src_alpha = clip_scan[col];
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        continue;
+      }
+      int back_alpha = dest_scan[3];
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
+      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
+      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
       dest_scan += 4;
-      continue;
     }
-    int src_alpha = clip_scan[col];
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      continue;
-    }
-    int back_alpha = dest_scan[3];
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
-    dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
-    dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
-    dest_scan += 4;
-  }
+  });
 }
 
 void CompositeRow_ByteMask2Argb_RgbByteOrder(
@@ -1843,53 +1960,56 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      FXARGB_SetRGBOrderDIB(dest_scan,
-                            ArgbEncode(src_alpha, src_r, src_g, src_b));
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        FXARGB_SetRGBOrderDIB(dest_scan,
+                              ArgbEncode(src_alpha, src_r, src_g, src_b));
+        dest_scan += 4;
+        continue;
+      }
+      if (src_alpha == 0) {
+        dest_scan += 4;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
+        dest_scan[2] =
+            FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], alpha_ratio);
+        dest_scan[1] =
+            FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], alpha_ratio);
+        dest_scan[0] =
+            FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], alpha_ratio);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, dest_scan[2], src_b);
+        blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, alpha_ratio);
+        blended = Blend(blend_type, dest_scan[1], src_g);
+        blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, alpha_ratio);
+        blended = Blend(blend_type, dest_scan[0], src_r);
+        blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, alpha_ratio);
+      } else {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
+      }
       dest_scan += 4;
-      continue;
     }
-    if (src_alpha == 0) {
-      dest_scan += 4;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
-      dest_scan[2] =
-          FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], alpha_ratio);
-      dest_scan[1] =
-          FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], alpha_ratio);
-      dest_scan[0] =
-          FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], alpha_ratio);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, dest_scan[2], src_b);
-      blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, alpha_ratio);
-      blended = Blend(blend_type, dest_scan[1], src_g);
-      blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, alpha_ratio);
-      blended = Blend(blend_type, dest_scan[0], src_r);
-      blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, alpha_ratio);
-    } else {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
-    }
-    dest_scan += 4;
-  }
+  });
 }
 
 void CompositeRow_ByteMask2Rgb_RgbByteOrder(
@@ -1906,40 +2026,42 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  for (int col = 0; col < pixel_count; col++) {
-    int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
-    if (src_alpha == 0) {
+  UNSAFE_TODO({
+    for (int col = 0; col < pixel_count; col++) {
+      int src_alpha = GetAlphaWithSrc(mask_alpha, clip_scan, src_scan, col);
+      if (src_alpha == 0) {
+        dest_scan += Bpp;
+        continue;
+      }
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
+        dest_scan[2] =
+            FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], src_alpha);
+        dest_scan[1] =
+            FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], src_alpha);
+        dest_scan[0] =
+            FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], src_alpha);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, dest_scan[2], src_b);
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, src_alpha);
+        blended = Blend(blend_type, dest_scan[1], src_g);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, src_alpha);
+        blended = Blend(blend_type, dest_scan[0], src_r);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, src_alpha);
+      } else {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, src_alpha);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, src_alpha);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, src_alpha);
+      }
       dest_scan += Bpp;
-      continue;
     }
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
-      dest_scan[2] =
-          FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], src_alpha);
-      dest_scan[1] =
-          FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], src_alpha);
-      dest_scan[0] =
-          FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], src_alpha);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, dest_scan[2], src_b);
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, src_alpha);
-      blended = Blend(blend_type, dest_scan[1], src_g);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, src_alpha);
-      blended = Blend(blend_type, dest_scan[0], src_r);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, src_alpha);
-    } else {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, src_alpha);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, src_alpha);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, src_alpha);
-    }
-    dest_scan += Bpp;
-  }
+  });
 }
 
 void CompositeRow_BitMask2Argb_RgbByteOrder(
@@ -1956,63 +2078,68 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
-    FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
+  UNSAFE_TODO({
+    if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
+      FX_ARGB argb = ArgbEncode(0xff, src_r, src_g, src_b);
+      for (int col = 0; col < pixel_count; col++) {
+        if (src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8))) {
+          FXARGB_SetRGBOrderDIB(dest_scan, argb);
+        }
+        dest_scan += 4;
+      }
+      return;
+    }
     for (int col = 0; col < pixel_count; col++) {
-      if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        FXARGB_SetRGBOrderDIB(dest_scan, argb);
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan += 4;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      uint8_t back_alpha = dest_scan[3];
+      if (back_alpha == 0) {
+        FXARGB_SetRGBOrderDIB(dest_scan,
+                              ArgbEncode(src_alpha, src_r, src_g, src_b));
+        dest_scan += 4;
+        continue;
+      }
+      uint8_t dest_alpha =
+          back_alpha + src_alpha - back_alpha * src_alpha / 255;
+      dest_scan[3] = dest_alpha;
+      int alpha_ratio = src_alpha * 255 / dest_alpha;
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
+        dest_scan[2] =
+            FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], alpha_ratio);
+        dest_scan[1] =
+            FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], alpha_ratio);
+        dest_scan[0] =
+            FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], alpha_ratio);
+      } else if (blend_type != BlendMode::kNormal) {
+        int blended = Blend(blend_type, dest_scan[2], src_b);
+        blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, alpha_ratio);
+        blended = Blend(blend_type, dest_scan[1], src_g);
+        blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, alpha_ratio);
+        blended = Blend(blend_type, dest_scan[0], src_r);
+        blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, alpha_ratio);
+      } else {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
       }
       dest_scan += 4;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
-      dest_scan += 4;
-      continue;
-    }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    uint8_t back_alpha = dest_scan[3];
-    if (back_alpha == 0) {
-      FXARGB_SetRGBOrderDIB(dest_scan,
-                            ArgbEncode(src_alpha, src_r, src_g, src_b));
-      dest_scan += 4;
-      continue;
-    }
-    uint8_t dest_alpha = back_alpha + src_alpha - back_alpha * src_alpha / 255;
-    dest_scan[3] = dest_alpha;
-    int alpha_ratio = src_alpha * 255 / dest_alpha;
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
-      dest_scan[2] =
-          FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], alpha_ratio);
-      dest_scan[1] =
-          FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], alpha_ratio);
-      dest_scan[0] =
-          FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], alpha_ratio);
-    } else if (blend_type != BlendMode::kNormal) {
-      int blended = Blend(blend_type, dest_scan[2], src_b);
-      blended = FXDIB_ALPHA_MERGE(src_b, blended, back_alpha);
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], blended, alpha_ratio);
-      blended = Blend(blend_type, dest_scan[1], src_g);
-      blended = FXDIB_ALPHA_MERGE(src_g, blended, back_alpha);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], blended, alpha_ratio);
-      blended = Blend(blend_type, dest_scan[0], src_r);
-      blended = FXDIB_ALPHA_MERGE(src_r, blended, back_alpha);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], blended, alpha_ratio);
-    } else {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, alpha_ratio);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, alpha_ratio);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, alpha_ratio);
-    }
-    dest_scan += 4;
-  }
+  });
 }
 
 void CompositeRow_BitMask2Rgb_RgbByteOrder(
@@ -2030,58 +2157,62 @@
   uint8_t* dest_scan = dest_span.data();
   const uint8_t* src_scan = src_span.data();
   const uint8_t* clip_scan = clip_span.data();
-  if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
+  UNSAFE_TODO({
+    if (blend_type == BlendMode::kNormal && !clip_scan && mask_alpha == 255) {
+      for (int col = 0; col < pixel_count; col++) {
+        if (src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8))) {
+          dest_scan[2] = src_b;
+          dest_scan[1] = src_g;
+          dest_scan[0] = src_r;
+        }
+        dest_scan += Bpp;
+      }
+      return;
+    }
     for (int col = 0; col < pixel_count; col++) {
-      if (src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8))) {
-        dest_scan[2] = src_b;
-        dest_scan[1] = src_g;
-        dest_scan[0] = src_r;
+      if (!(src_scan[(src_left + col) / 8] &
+            (1 << (7 - (src_left + col) % 8)))) {
+        dest_scan += Bpp;
+        continue;
+      }
+      int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
+      if (src_alpha == 0) {
+        dest_scan += Bpp;
+        continue;
+      }
+      if (IsNonSeparableBlendMode(blend_type)) {
+        int blended_colors[3];
+        uint8_t scan[3] = {static_cast<uint8_t>(src_b),
+                           static_cast<uint8_t>(src_g),
+                           static_cast<uint8_t>(src_r)};
+        uint8_t dest_scan_o[3];
+        ReverseCopy3Bytes(dest_scan_o, dest_scan);
+        RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
+        dest_scan[2] =
+            FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], src_alpha);
+        dest_scan[1] =
+            FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], src_alpha);
+        dest_scan[0] =
+            FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], src_alpha);
+      } else if (blend_type != BlendMode::kNormal) {
+        int back_color = dest_scan[2];
+        int blended = Blend(blend_type, back_color, src_b);
+        dest_scan[2] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        back_color = dest_scan[1];
+        blended = Blend(blend_type, back_color, src_g);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+        back_color = dest_scan[0];
+        blended = Blend(blend_type, back_color, src_r);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
+      } else {
+        dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, src_alpha);
+        dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, src_alpha);
+        dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, src_alpha);
       }
       dest_scan += Bpp;
     }
-    return;
-  }
-  for (int col = 0; col < pixel_count; col++) {
-    if (!(src_scan[(src_left + col) / 8] & (1 << (7 - (src_left + col) % 8)))) {
-      dest_scan += Bpp;
-      continue;
-    }
-    int src_alpha = GetAlpha(mask_alpha, clip_scan, col);
-    if (src_alpha == 0) {
-      dest_scan += Bpp;
-      continue;
-    }
-    if (IsNonSeparableBlendMode(blend_type)) {
-      int blended_colors[3];
-      uint8_t scan[3] = {static_cast<uint8_t>(src_b),
-                         static_cast<uint8_t>(src_g),
-                         static_cast<uint8_t>(src_r)};
-      uint8_t dest_scan_o[3];
-      ReverseCopy3Bytes(dest_scan_o, dest_scan);
-      RGB_Blend(blend_type, scan, dest_scan_o, blended_colors);
-      dest_scan[2] =
-          FXDIB_ALPHA_MERGE(dest_scan[2], blended_colors[0], src_alpha);
-      dest_scan[1] =
-          FXDIB_ALPHA_MERGE(dest_scan[1], blended_colors[1], src_alpha);
-      dest_scan[0] =
-          FXDIB_ALPHA_MERGE(dest_scan[0], blended_colors[2], src_alpha);
-    } else if (blend_type != BlendMode::kNormal) {
-      int back_color = dest_scan[2];
-      int blended = Blend(blend_type, back_color, src_b);
-      dest_scan[2] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-      back_color = dest_scan[1];
-      blended = Blend(blend_type, back_color, src_g);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-      back_color = dest_scan[0];
-      blended = Blend(blend_type, back_color, src_r);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(back_color, blended, src_alpha);
-    } else {
-      dest_scan[2] = FXDIB_ALPHA_MERGE(dest_scan[2], src_b, src_alpha);
-      dest_scan[1] = FXDIB_ALPHA_MERGE(dest_scan[1], src_g, src_alpha);
-      dest_scan[0] = FXDIB_ALPHA_MERGE(dest_scan[0], src_r, src_alpha);
-    }
-    dest_scan += Bpp;
-  }
+  });
 }
 
 }  // namespace
diff --git a/core/fxge/dib/cstretchengine.cpp b/core/fxge/dib/cstretchengine.cpp
index 6c1f29e..312acd6 100644
--- a/core/fxge/dib/cstretchengine.cpp
+++ b/core/fxge/dib/cstretchengine.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxge/dib/cstretchengine.h"
 
 #include <math.h>
@@ -99,74 +94,79 @@
 
   m_WeightTablesSizeBytes = dest_range * m_ItemSizeBytes;
   m_WeightTables.resize(m_WeightTablesSizeBytes);
-  if (options.bNoSmoothing || fabs(scale) < 1.0f) {
+  UNSAFE_TODO({
+    if (options.bNoSmoothing || fabs(scale) < 1.0f) {
+      for (int dest_pixel = dest_min; dest_pixel < dest_max; ++dest_pixel) {
+        PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
+        double src_pos = dest_pixel * scale + scale / 2 + base;
+        if (bilinear) {
+          int src_start = static_cast<int>(floor(src_pos - 0.5));
+          int src_end = static_cast<int>(floor(src_pos + 0.5));
+          src_start = std::max(src_start, src_min);
+          src_end = std::min(src_end, src_max - 1);
+          pixel_weights.SetStartEnd(src_start, src_end, weight_count);
+          if (pixel_weights.m_SrcStart >= pixel_weights.m_SrcEnd) {
+            // Always room for one weight per size calculation.
+            pixel_weights.m_Weights[0] = kFixedPointOne;
+          } else {
+            pixel_weights.m_Weights[1] =
+                FixedFromDouble(src_pos - pixel_weights.m_SrcStart - 0.5f);
+            pixel_weights.m_Weights[0] =
+                kFixedPointOne - pixel_weights.m_Weights[1];
+          }
+        } else {
+          int pixel_pos = static_cast<int>(floor(src_pos));
+          int src_start = std::max(pixel_pos, src_min);
+          int src_end = std::min(pixel_pos, src_max - 1);
+          pixel_weights.SetStartEnd(src_start, src_end, weight_count);
+          pixel_weights.m_Weights[0] = kFixedPointOne;
+        }
+      }
+      return true;
+    }
+
     for (int dest_pixel = dest_min; dest_pixel < dest_max; ++dest_pixel) {
       PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
-      double src_pos = dest_pixel * scale + scale / 2 + base;
-      if (bilinear) {
-        int src_start = static_cast<int>(floor(src_pos - 0.5));
-        int src_end = static_cast<int>(floor(src_pos + 0.5));
-        src_start = std::max(src_start, src_min);
-        src_end = std::min(src_end, src_max - 1);
-        pixel_weights.SetStartEnd(src_start, src_end, weight_count);
-        if (pixel_weights.m_SrcStart >= pixel_weights.m_SrcEnd) {
-          // Always room for one weight per size calculation.
-          pixel_weights.m_Weights[0] = kFixedPointOne;
-        } else {
-          pixel_weights.m_Weights[1] =
-              FixedFromDouble(src_pos - pixel_weights.m_SrcStart - 0.5f);
-          pixel_weights.m_Weights[0] =
-              kFixedPointOne - pixel_weights.m_Weights[1];
+      double src_start = dest_pixel * scale + base;
+      double src_end = src_start + scale;
+      int start_i = floor(std::min(src_start, src_end));
+      int end_i = floor(std::max(src_start, src_end));
+      start_i = std::max(start_i, src_min);
+      end_i = std::min(end_i, src_max - 1);
+      if (start_i > end_i) {
+        start_i = std::min(start_i, src_max - 1);
+        pixel_weights.SetStartEnd(start_i, start_i, weight_count);
+        continue;
+      }
+      pixel_weights.SetStartEnd(start_i, end_i, weight_count);
+      uint32_t remaining = kFixedPointOne;
+      double rounding_error = 0.0;
+      for (int j = start_i; j < end_i; ++j) {
+        double dest_start = (j - base) / scale;
+        double dest_end = (j + 1 - base) / scale;
+        if (dest_start > dest_end) {
+          std::swap(dest_start, dest_end);
         }
+        double area_start =
+            std::max(dest_start, static_cast<double>(dest_pixel));
+        double area_end =
+            std::min(dest_end, static_cast<double>(dest_pixel + 1));
+        double weight = std::max(0.0, area_end - area_start);
+        uint32_t fixed_weight = FixedFromDouble(weight + rounding_error);
+        pixel_weights.SetWeightForPosition(j, fixed_weight);
+        remaining -= fixed_weight;
+        rounding_error =
+            weight - static_cast<double>(fixed_weight) / kFixedPointOne;
+      }
+      // Note: underflow is defined behaviour for unsigned types and will
+      // result in an out-of-range value.
+      if (remaining && remaining <= kFixedPointOne) {
+        pixel_weights.SetWeightForPosition(end_i, remaining);
       } else {
-        int pixel_pos = static_cast<int>(floor(src_pos));
-        int src_start = std::max(pixel_pos, src_min);
-        int src_end = std::min(pixel_pos, src_max - 1);
-        pixel_weights.SetStartEnd(src_start, src_end, weight_count);
-        pixel_weights.m_Weights[0] = kFixedPointOne;
+        pixel_weights.RemoveLastWeightAndAdjust(remaining);
       }
     }
-    return true;
-  }
-
-  for (int dest_pixel = dest_min; dest_pixel < dest_max; ++dest_pixel) {
-    PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
-    double src_start = dest_pixel * scale + base;
-    double src_end = src_start + scale;
-    int start_i = floor(std::min(src_start, src_end));
-    int end_i = floor(std::max(src_start, src_end));
-    start_i = std::max(start_i, src_min);
-    end_i = std::min(end_i, src_max - 1);
-    if (start_i > end_i) {
-      start_i = std::min(start_i, src_max - 1);
-      pixel_weights.SetStartEnd(start_i, start_i, weight_count);
-      continue;
-    }
-    pixel_weights.SetStartEnd(start_i, end_i, weight_count);
-    uint32_t remaining = kFixedPointOne;
-    double rounding_error = 0.0;
-    for (int j = start_i; j < end_i; ++j) {
-      double dest_start = (j - base) / scale;
-      double dest_end = (j + 1 - base) / scale;
-      if (dest_start > dest_end)
-        std::swap(dest_start, dest_end);
-      double area_start = std::max(dest_start, static_cast<double>(dest_pixel));
-      double area_end = std::min(dest_end, static_cast<double>(dest_pixel + 1));
-      double weight = std::max(0.0, area_end - area_start);
-      uint32_t fixed_weight = FixedFromDouble(weight + rounding_error);
-      pixel_weights.SetWeightForPosition(j, fixed_weight);
-      remaining -= fixed_weight;
-      rounding_error =
-          weight - static_cast<double>(fixed_weight) / kFixedPointOne;
-    }
-    // Note: underflow is defined behaviour for unsigned types and will
-    // result in an out-of-range value.
-    if (remaining && remaining <= kFixedPointOne) {
-      pixel_weights.SetWeightForPosition(end_i, remaining);
-    } else {
-      pixel_weights.RemoveLastWeightAndAdjust(remaining);
-    }
-  }
+  });
   return true;
 }
 
@@ -322,104 +322,107 @@
         (m_CurRow - m_SrcClip.top) * m_InterPitch, m_InterPitch);
     size_t dest_span_index = 0;
     // TODO(npm): reduce duplicated code here
-    switch (m_TransMethod) {
-      case TransformMethod::k1BppTo8Bpp:
-      case TransformMethod::k1BppToManyBpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
-          uint32_t dest_a = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            if (src_scan[j / 8] & (1 << (7 - j % 8)))
-              dest_a += pixel_weight * 255;
-          }
-          dest_span[dest_span_index++] = PixelFromFixed(dest_a);
-        }
-        break;
-      }
-      case TransformMethod::k8BppTo8Bpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
-          uint32_t dest_a = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            dest_a += pixel_weight * src_scan[j];
-          }
-          dest_span[dest_span_index++] = PixelFromFixed(dest_a);
-        }
-        break;
-      }
-      case TransformMethod::k8BppToManyBpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
-          uint32_t dest_r = 0;
-          uint32_t dest_g = 0;
-          uint32_t dest_b = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            unsigned long argb = m_pSrcPalette[src_scan[j]];
-            if (m_DestFormat == FXDIB_Format::kRgb) {
-              dest_r += pixel_weight * static_cast<uint8_t>(argb >> 16);
-              dest_g += pixel_weight * static_cast<uint8_t>(argb >> 8);
-              dest_b += pixel_weight * static_cast<uint8_t>(argb);
-            } else {
-              dest_b += pixel_weight * static_cast<uint8_t>(argb >> 24);
-              dest_g += pixel_weight * static_cast<uint8_t>(argb >> 16);
-              dest_r += pixel_weight * static_cast<uint8_t>(argb >> 8);
+    UNSAFE_TODO({
+      switch (m_TransMethod) {
+        case TransformMethod::k1BppTo8Bpp:
+        case TransformMethod::k1BppToManyBpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
+            uint32_t dest_a = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              if (src_scan[j / 8] & (1 << (7 - j % 8))) {
+                dest_a += pixel_weight * 255;
+              }
             }
+            dest_span[dest_span_index++] = PixelFromFixed(dest_a);
           }
-          dest_span[dest_span_index++] = PixelFromFixed(dest_b);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_g);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_r);
+          break;
         }
-        break;
-      }
-      case TransformMethod::kManyBpptoManyBpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
-          uint32_t dest_r = 0;
-          uint32_t dest_g = 0;
-          uint32_t dest_b = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            const uint8_t* src_pixel = src_scan + j * Bpp;
-            dest_b += pixel_weight * (*src_pixel++);
-            dest_g += pixel_weight * (*src_pixel++);
-            dest_r += pixel_weight * (*src_pixel);
+        case TransformMethod::k8BppTo8Bpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
+            uint32_t dest_a = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              dest_a += pixel_weight * src_scan[j];
+            }
+            dest_span[dest_span_index++] = PixelFromFixed(dest_a);
           }
-          dest_span[dest_span_index++] = PixelFromFixed(dest_b);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_g);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_r);
-          dest_span_index += Bpp - 3;
+          break;
         }
-        break;
-      }
-      case TransformMethod::kManyBpptoManyBppWithAlpha: {
-        DCHECK(m_bHasAlpha);
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
-          uint32_t dest_a = 0;
-          uint32_t dest_r = 0;
-          uint32_t dest_g = 0;
-          uint32_t dest_b = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            const uint8_t* src_pixel = src_scan + j * Bpp;
-            uint32_t pixel_weight =
-                pWeights->GetWeightForPosition(j) * src_pixel[3] / 255;
-            dest_b += pixel_weight * (*src_pixel++);
-            dest_g += pixel_weight * (*src_pixel++);
-            dest_r += pixel_weight * (*src_pixel);
-            dest_a += pixel_weight;
+        case TransformMethod::k8BppToManyBpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
+            uint32_t dest_r = 0;
+            uint32_t dest_g = 0;
+            uint32_t dest_b = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              unsigned long argb = m_pSrcPalette[src_scan[j]];
+              if (m_DestFormat == FXDIB_Format::kRgb) {
+                dest_r += pixel_weight * static_cast<uint8_t>(argb >> 16);
+                dest_g += pixel_weight * static_cast<uint8_t>(argb >> 8);
+                dest_b += pixel_weight * static_cast<uint8_t>(argb);
+              } else {
+                dest_b += pixel_weight * static_cast<uint8_t>(argb >> 24);
+                dest_g += pixel_weight * static_cast<uint8_t>(argb >> 16);
+                dest_r += pixel_weight * static_cast<uint8_t>(argb >> 8);
+              }
+            }
+            dest_span[dest_span_index++] = PixelFromFixed(dest_b);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_g);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_r);
           }
-          dest_span[dest_span_index++] = PixelFromFixed(dest_b);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_g);
-          dest_span[dest_span_index++] = PixelFromFixed(dest_r);
-          dest_span[dest_span_index] = PixelFromFixed(255 * dest_a);
-          dest_span_index += Bpp - 3;
+          break;
         }
-        break;
+        case TransformMethod::kManyBpptoManyBpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
+            uint32_t dest_r = 0;
+            uint32_t dest_g = 0;
+            uint32_t dest_b = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              const uint8_t* src_pixel = src_scan + j * Bpp;
+              dest_b += pixel_weight * (*src_pixel++);
+              dest_g += pixel_weight * (*src_pixel++);
+              dest_r += pixel_weight * (*src_pixel);
+            }
+            dest_span[dest_span_index++] = PixelFromFixed(dest_b);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_g);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_r);
+            dest_span_index += Bpp - 3;
+          }
+          break;
+        }
+        case TransformMethod::kManyBpptoManyBppWithAlpha: {
+          DCHECK(m_bHasAlpha);
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            PixelWeight* pWeights = m_WeightTable.GetPixelWeight(col);
+            uint32_t dest_a = 0;
+            uint32_t dest_r = 0;
+            uint32_t dest_g = 0;
+            uint32_t dest_b = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              const uint8_t* src_pixel = src_scan + j * Bpp;
+              uint32_t pixel_weight =
+                  pWeights->GetWeightForPosition(j) * src_pixel[3] / 255;
+              dest_b += pixel_weight * (*src_pixel++);
+              dest_g += pixel_weight * (*src_pixel++);
+              dest_r += pixel_weight * (*src_pixel);
+              dest_a += pixel_weight;
+            }
+            dest_span[dest_span_index++] = PixelFromFixed(dest_b);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_g);
+            dest_span[dest_span_index++] = PixelFromFixed(dest_r);
+            dest_span[dest_span_index] = PixelFromFixed(255 * dest_a);
+            dest_span_index += Bpp - 3;
+          }
+          break;
+        }
       }
-    }
+    });
     rows_to_go--;
   }
   return false;
@@ -437,83 +440,85 @@
   }
 
   const int DestBpp = m_DestBpp / 8;
-  for (int row = m_DestClip.top; row < m_DestClip.bottom; ++row) {
-    unsigned char* dest_scan = m_DestScanline.data();
-    PixelWeight* pWeights = table.GetPixelWeight(row);
-    switch (m_TransMethod) {
-      case TransformMethod::k1BppTo8Bpp:
-      case TransformMethod::k1BppToManyBpp:
-      case TransformMethod::k8BppTo8Bpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          pdfium::span<const uint8_t> src_span =
-              m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
-          uint32_t dest_a = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            dest_a +=
-                pixel_weight * src_span[(j - m_SrcClip.top) * m_InterPitch];
+  UNSAFE_TODO({
+    for (int row = m_DestClip.top; row < m_DestClip.bottom; ++row) {
+      unsigned char* dest_scan = m_DestScanline.data();
+      PixelWeight* pWeights = table.GetPixelWeight(row);
+      switch (m_TransMethod) {
+        case TransformMethod::k1BppTo8Bpp:
+        case TransformMethod::k1BppToManyBpp:
+        case TransformMethod::k8BppTo8Bpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            pdfium::span<const uint8_t> src_span =
+                m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
+            uint32_t dest_a = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              dest_a +=
+                  pixel_weight * src_span[(j - m_SrcClip.top) * m_InterPitch];
+            }
+            *dest_scan = PixelFromFixed(dest_a);
+            dest_scan += DestBpp;
           }
-          *dest_scan = PixelFromFixed(dest_a);
-          dest_scan += DestBpp;
+          break;
         }
-        break;
-      }
-      case TransformMethod::k8BppToManyBpp:
-      case TransformMethod::kManyBpptoManyBpp: {
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          pdfium::span<const uint8_t> src_span =
-              m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
-          uint32_t dest_r = 0;
-          uint32_t dest_g = 0;
-          uint32_t dest_b = 0;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            pdfium::span<const uint8_t> src_pixel =
-                src_span.subspan((j - m_SrcClip.top) * m_InterPitch, 3);
-            dest_b += pixel_weight * src_pixel[0];
-            dest_g += pixel_weight * src_pixel[1];
-            dest_r += pixel_weight * src_pixel[2];
+        case TransformMethod::k8BppToManyBpp:
+        case TransformMethod::kManyBpptoManyBpp: {
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            pdfium::span<const uint8_t> src_span =
+                m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
+            uint32_t dest_r = 0;
+            uint32_t dest_g = 0;
+            uint32_t dest_b = 0;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              pdfium::span<const uint8_t> src_pixel =
+                  src_span.subspan((j - m_SrcClip.top) * m_InterPitch, 3);
+              dest_b += pixel_weight * src_pixel[0];
+              dest_g += pixel_weight * src_pixel[1];
+              dest_r += pixel_weight * src_pixel[2];
+            }
+            dest_scan[0] = PixelFromFixed(dest_b);
+            dest_scan[1] = PixelFromFixed(dest_g);
+            dest_scan[2] = PixelFromFixed(dest_r);
+            dest_scan += DestBpp;
           }
-          dest_scan[0] = PixelFromFixed(dest_b);
-          dest_scan[1] = PixelFromFixed(dest_g);
-          dest_scan[2] = PixelFromFixed(dest_r);
-          dest_scan += DestBpp;
+          break;
         }
-        break;
-      }
-      case TransformMethod::kManyBpptoManyBppWithAlpha: {
-        DCHECK(m_bHasAlpha);
-        for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
-          pdfium::span<const uint8_t> src_span =
-              m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
-          uint32_t dest_a = 0;
-          uint32_t dest_r = 0;
-          uint32_t dest_g = 0;
-          uint32_t dest_b = 0;
-          constexpr size_t kPixelBytes = 4;
-          for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
-            uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
-            pdfium::span<const uint8_t> src_pixel = src_span.subspan(
-                (j - m_SrcClip.top) * m_InterPitch, kPixelBytes);
-            dest_b += pixel_weight * src_pixel[0];
-            dest_g += pixel_weight * src_pixel[1];
-            dest_r += pixel_weight * src_pixel[2];
-            dest_a += pixel_weight * src_pixel[3];
+        case TransformMethod::kManyBpptoManyBppWithAlpha: {
+          DCHECK(m_bHasAlpha);
+          for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
+            pdfium::span<const uint8_t> src_span =
+                m_InterBuf.subspan((col - m_DestClip.left) * DestBpp);
+            uint32_t dest_a = 0;
+            uint32_t dest_r = 0;
+            uint32_t dest_g = 0;
+            uint32_t dest_b = 0;
+            constexpr size_t kPixelBytes = 4;
+            for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
+              uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
+              pdfium::span<const uint8_t> src_pixel = src_span.subspan(
+                  (j - m_SrcClip.top) * m_InterPitch, kPixelBytes);
+              dest_b += pixel_weight * src_pixel[0];
+              dest_g += pixel_weight * src_pixel[1];
+              dest_r += pixel_weight * src_pixel[2];
+              dest_a += pixel_weight * src_pixel[3];
+            }
+            if (dest_a) {
+              int r = static_cast<uint32_t>(dest_r) * 255 / dest_a;
+              int g = static_cast<uint32_t>(dest_g) * 255 / dest_a;
+              int b = static_cast<uint32_t>(dest_b) * 255 / dest_a;
+              dest_scan[0] = std::clamp(b, 0, 255);
+              dest_scan[1] = std::clamp(g, 0, 255);
+              dest_scan[2] = std::clamp(r, 0, 255);
+            }
+            dest_scan[3] = PixelFromFixed(dest_a);
+            dest_scan += DestBpp;
           }
-          if (dest_a) {
-            int r = static_cast<uint32_t>(dest_r) * 255 / dest_a;
-            int g = static_cast<uint32_t>(dest_g) * 255 / dest_a;
-            int b = static_cast<uint32_t>(dest_b) * 255 / dest_a;
-            dest_scan[0] = std::clamp(b, 0, 255);
-            dest_scan[1] = std::clamp(g, 0, 255);
-            dest_scan[2] = std::clamp(r, 0, 255);
-          }
-          dest_scan[3] = PixelFromFixed(dest_a);
-          dest_scan += DestBpp;
+          break;
         }
-        break;
       }
+      m_pDestBitmap->ComposeScanline(row - m_DestClip.top, m_DestScanline);
     }
-    m_pDestBitmap->ComposeScanline(row - m_DestClip.top, m_DestScanline);
-  }
+  });
 }