Issue pdfium:1180  has been merged into this issue.

I tried Chromium 40 from several years ago and it does this as well. Happens on Linux too.

Attached is a minimal repro for this bug.

Deleted: bug_896366_minimal.pdf 678 bytes

bug_896366_minimal.pdf 678 bytes Download

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/0233af4f241c712b41a5d5dfc337cdfce8c63bc9

commit 0233af4f241c712b41a5d5dfc337cdfce8c63bc9
Author: Lei Zhang <thestig@chromium.org>
Date: Thu Oct 18 17:46:52 2018

Push/pop the graphics state stack when flattening.

When FPDFPage_Flatten() manipulates a content stream, it replaces the
content stream with a content stream array. The first element in the
array is the original content stream and the second element in the array
is the flattened annotations content. To make sure the original content
stream's graphics state stack does not affect the flattened annotations,
FPDFPage_Flatten() rewrites the original content stream to be:

q
$contents
Q

When FPDFPage_Flatten() manipulates a content stream array, it just
appends the flattened annotations as a new element in the array. This
may result in graphics state stack leaking out.

To fix this, wrap the content stream array to be:

["q", $content1, ..., $contentN, "Q"]

And then append the flattened annotations.

BUG= chromium:896366 

Change-Id: Ic6499e39eb4c9f1fe45d037622bf02be724b6cae
Reviewed-on: https://pdfium-review.googlesource.com/c/44252
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

[add] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/testing/resources/bug_896366.in
[modify] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/fpdfsdk/fpdf_flatten.cpp
[add] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/testing/resources/bug_896366.pdf
[modify] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/fpdfsdk/fpdf_flatten_embeddertest.cpp
[modify] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/testing/resources/bug_890322.pdf
[modify] https://crrev.com/0233af4f241c712b41a5d5dfc337cdfce8c63bc9/testing/resources/bug_890322.in

Will be fixed in tomorrow's Canary.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/eb4f089ef766860917e7e38e34a20b0b17eed920

commit eb4f089ef766860917e7e38e34a20b0b17eed920
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Thu Oct 18 21:49:31 2018

Roll src/third_party/pdfium ec885bad72ef..4754adaf70d8 (14 commits)

https://pdfium.googlesource.com/pdfium.git/+log/ec885bad72ef..4754adaf70d8


git log ec885bad72ef..4754adaf70d8 --date=short --no-merges --format='%ad %ae %s'
2018-10-18 thestig@chromium.org Add unit tests for CFX_Matrix::TransformRect().
2018-10-18 thestig@chromium.org Forward declare some fxjs/ classes.
2018-10-18 thestig@chromium.org Remove a few V8 includes from header files.
2018-10-18 thestig@chromium.org Change CXFA_LoaderContext::dwFlags to bFilterSpace.
2018-10-18 thestig@chromium.org Avoid pass by value in FPDFPage_Flatten()'s GetMatrix() helper.
2018-10-18 thestig@chromium.org Push/pop the graphics state stack when flattening.
2018-10-18 thestig@chromium.org Convert CXFA_LoaderContext to a struct.
2018-10-18 thestig@chromium.org Clean up CXFA_TextLayout.
2018-10-18 tsepez@chromium.org Add JavaScript tests for event API.
2018-10-18 thestig@chromium.org Cache CFGAS_FontMgr::GetFontByUnicode() failures on Windows.
2018-10-18 thestig@chromium.org Shuffle platform-specifc code in CFGAS_FontMgr::GetFontByUnicode().
2018-10-18 tsepez@chromium.org De-dup some static string tables in cjs_publicmethods.cpp
2018-10-18 tsepez@chromium.org Add JavaScript public methods tests.
2018-10-18 tsepez@chromium.org Repack CPDFSDK_FieldAction.


Created with:
  gclient setdep -r src/third_party/pdfium@4754adaf70d8

The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:896366 , chromium:895469 
TBR=dsinclair@chromium.org

Change-Id: I1ed6f308d1b8f8606e7d90d0cf2794e1ed929ae8
Reviewed-on: https://chromium-review.googlesource.com/c/1289649
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#600925}
[modify] https://crrev.com/eb4f089ef766860917e7e38e34a20b0b17eed920/DEPS

Awesome! That was quick - thank you!!!