Native glyph clipping
HPDFRenderHeadlessPagePNG rasterises filled glyph coverage before applying the active PDF clip
A separate alpha surface captures the existing clip within integer device-space glyph bounds and multiplies that coverage with the glyph mask before the original source and blend operator are applied
This avoids lost glyph rows at fractional clip boundaries whilst retaining W/W*, even-odd holes, curved paths, transformed text, alpha, soft masks and patterned colours
Drawing keeps the caller's PDF path and graphics state, including nested text and Form rendering state
Resource accounting
Both alpha buffers and the glyph raster estimate enter the working-memory budget before allocation, and the raw glyph raster enters the pixel budget even when only a small part is visible on the page
The raw glyph pixel count is multiplied safely as an Int64 and compared exactly with the configured pixel limit before any alpha surface is allocated
The byte estimate checks the remaining Int64 capacity before multiplying the raw glyph-pixel count, including when callers raise the configurable pixel and memory limits
Cancellation is polled around coverage generation and final composition, and failures leave the destination unchanged until successful rendering completes
Precision and verification
Rectangular clips are checked against exact independent pixel areas with a maximum channel difference of two
Polygon and curve tests compare glyph composition against a separate solid-fill clip companion with the same limit
The underlying Cairo clip rasterisation can differ from exact polygon area, including the retained triangle case with a maximum difference of six at four pixels at scale two
Separate MuPDF and Poppler images record their own font and clip rasterisation rather than defining the native formula