fix(android): stop a runtime Zoom change from crashing pdfium, and unify Zoom across platforms

[michaelstonis]

Fixes the reported Android crash where setting Zoom at runtime and then tapping the page kills the process with SIGSEGV, and brings the Zoom lifecycle into line across Android and iOS.

The crash

PDFView.zoomTo(float) in ahmer-pdfviewer 2.0.1 is a bare field assignment — the whole method body is this._zoom = value. It doesn't re-clamp the scroll offsets, doesn't reload the rendered parts, doesn't invalidate. That's why the document visibly failed to re-render at the new level.

The control is then left holding offsets that describe the previous zoom. The next tap runs DragPinchManager.checkLinkTapped unconditionally, which does:

page = pdfFile.getPageAtOffset(-currentYOffset + tapY, zoom)   // stale offset x new zoom
pdfFile.getPageLinks(page, ...)                                 // -> PdfiumCore.getPageLinks

That resolves a page the renderer never opened. In ahmer-pdfium 1.9.2:

private long pagePtr(int index) {
    PageCount pc = doc.getPageCache().get(index);
    return pc != null ? pc.getPagePtr() : -1L;   // unguarded sentinel
}

getPageLinks passes that -1 to nativeGetPageLinks(long) with no check, pdfium dereferences (FPDF_PAGE)-1, and the process dies. Confirmed on device:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00ffffffffffffff
#00 libpdfium.so
#01 FPDFLink_Enumerate
#02 Java_com_ahmer_pdfium_PdfiumCore_nativeGetPageLinks

(The fault address is -1 with the top byte stripped by ARM64 pointer tagging.)

zoomWithAnimation — the workaround in the report — avoids this because its animation listener calls zoomCenteredTo() per frame and loadPages() + performPageSnap() at the end.

Correction to the repro steps: the zoom must decrease. A larger zoom makes getPageAtOffset resolve a lower page, which is always already open. Zooming in from the top of a document does not crash.

The fix

Apply zoom the way the library applies its own — ZoomCenteredTo() to recompute and clamp the offsets around a pivot, then LoadPages() and PerformPageSnap().

Plus a guard for the wider hazard: the unguarded -1 is reachable by any tap on a page pdfium hasn't opened yet, not just after a zoom (e.g. a fling to a distant page, tapped before the background render thread gets there). The wrapper now pre-opens exactly the pages a touch inside the viewport could resolve to, computed from the library's own getPageAtOffset. PdfFile.OpenPage takes the same lock PdfiumCore holds for the whole of a native page render, so the sweep memoizes what it has covered to stay off that lock on the UI thread.

Residual gap: a page that genuinely fails to open is recorded as failed by the library and will still crash on tap. That page can't render either, so it's a corrupt-document case rather than a timing one. No iOS counterpart — PdfKit has no equivalent sentinel.

Zoom consistency

Zoom had drifted into different lifecycles per platform. One contract is now documented on IPdfView.Zoom and both implementations share the same state machine behind it. Three inconsistencies close:

• A reload dropped the zoom on both platforms. Android's recycle() resets the native zoom to 1; iOS re-fits on a new Document. Both now capture and restore. Assigning a new Source is the deliberate exception and starts fitted.
• ApplyFitPolicy silently reset the zoom on iOS, because SetManualScale writes ScaleFactor directly.
• Rotation reset the zoom on iOS but not Android. PdfKit re-fits inside LayoutSubviews, so the pre-fit scale is only readable before base runs; added a WillLayoutSubviewsAction hook to capture there.

MinZoom/MaxZoom now re-clamp the current level on both platforms, and the iOS layout hooks are cleared on Dispose.

Verification

Built clean for net10.0-android and net10.0-ios; each of the three commits builds independently.

Android emulator (API 35, arm64) — reverted just the library to confirm the repro was valid, got the tombstone above, then reapplied:

• Original repro (zoom in, scroll, zoom out, tap): crashes before, survives after
• 4 rounds of hard flings with immediate taps plus full zoom cycles: 0 crashes
• Reload via Fit Policy preserves zoom and page; document switch lands fitted

iOS simulator (iPhone 17 Pro, iOS 26.2) — zoom applies, fit-policy change preserves the level, document switch lands fitted.

Rotation could not be exercised on the simulator (simctl has no rotate command), so that branch of the iOS layout hook is reasoned-correct but unverified.

Worth doing separately

The upstream pagePtr() should return early rather than pass a sentinel into JNI — worth an issue against AhmerPdfium.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes an Android crash in AhmerPdfViewer when Zoom is changed at runtime (and then the user taps), and standardizes IPdfView.Zoom semantics across Android and iOS so zoom persists consistently through reload/fit/resize events (except when switching Source, which intentionally resets to fitted).

Changes:

• Android: apply zoom via ZoomCenteredTo() + LoadPages() + PerformPageSnap() and proactively open pages that a tap inside the viewport could resolve to.
• iOS: introduce a stored zoom state machine that survives PdfKit re-fitting (layout/rotation), reloads, and fit-policy changes.
• Samples: add a Zoom toggle UI to exercise the Android regression scenario.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/MauiNativePdfView/Platforms/iOS/PdfViewiOS.cs	Reworks zoom handling to store/restore relative zoom across PdfKit re-fit/reload/layout events.
src/MauiNativePdfView/Platforms/Android/PdfViewAndroid.cs	Reworks zoom application to avoid pdfium crash and adds visible-page pre-open sweep to prevent tapping unopened pages.
src/MauiNativePdfView/Abstractions/IPdfView.cs	Documents a unified cross-platform Zoom contract (relative to fit scale, persisted across reload/resize).
samples/MauiPdfViewerSample/PdfTestPage.xaml.cs	Adds a regression-oriented “Zoom then tap” button handler for Android.
samples/MauiPdfViewerSample/PdfTestPage.xaml	Adds the Zoom toggle UI row/button to the sample page.

Suppressed comments (1)

src/MauiNativePdfView/Platforms/Android/PdfViewAndroid.cs:223

• EnsureVisiblePagesOpen() can be reached via callbacks/posted work; after Dispose() runs, accessing members on the disposed Java peer can throw (e.g., ObjectDisposedException). Adding a cheap Handle==IntPtr.Zero guard at the start makes this method safe if it runs late.

    private void EnsureVisiblePagesOpen()
    {
        var pdfFile = _pdfView.PdfFile;
        if (pdfFile == null)
            return;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

src/MauiNativePdfView/Platforms/Android/PdfViewAndroid.cs:524

• LoadDocument returns immediately when _source is null, which means setting Source = null leaves the previous document visible and keeps _pageCount / _currentPage / _openedPages state from the prior document. Since IPdfView.Source is nullable (and iOS clears _pdfView.Document when _source is null), Android should also unload/reset state when the source is cleared.

    private void LoadDocument(bool preserveZoom = true)
    {
        if (_source == null)
            return;

src/MauiNativePdfView/Platforms/Android/PdfViewAndroid.cs:526

• LoadDocument(preserveZoom: false) is used when switching to a different Source, but the method still uses the previous document’s _currentPage as pageToRestore. That value can be out of range for the new document and is also passed into configurator.DefaultPage(...) before any bounds check. Consider only restoring the page when doing an internal reload (i.e., when preserveZoom is true), and otherwise fall back to DefaultPage.

        // Store current page to restore after reload
        int pageToRestore = _currentPage;