engine: apply the photo album limits when reopening an album

crates/engine/src/cmd/insert/album.rs

@@ -592,9 +592,16 @@ fn infer_album(slides: &[&deckcraft_model::Slide], theme_now: &str) -> (String,
     (layout, frame.into(), captions, any && gray, theme_now.to_string())
 }
 
+/// The album's items for the dialog, within the limits `insert.photoAlbum` itself takes (items,
+/// bytes per picture and in all), checked before a picture is encoded: an album slide set can
+/// name one large picture many times.
 fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_model::Slide]) -> Vec<Value> {
     let mut items = Vec::new();
-    for slide in slides {
+    let mut total = 0usize;
+    'slides: for slide in slides {
+        if items.len() >= ALBUM_MAX_ITEMS {
+            break;
+        }
         let pics: Vec<&deckcraft_model::Shape> = slide.shapes.iter().filter(|sh| matches!(sh.kind, ShapeKind::Picture { .. })).collect();
         if pics.is_empty() {
             let text = slide
@@ -612,6 +619,11 @@ fn items_from_slides(doc: &deckcraft_model::Presentation, slides: &[&deckcraft_m
         for sh in pics {
             let ShapeKind::Picture { fill } = &sh.kind else { continue };
             let media = doc.media(fill.media);
+            let size = media.map_or(0, |m| m.data.len());
+            if items.len() >= ALBUM_MAX_ITEMS || size > ALBUM_MAX_BYTES || total.saturating_add(size) > ALBUM_MAX_TOTAL {
+                break 'slides;
+            }
+            total += size;
             let name = if !sh.descr.is_empty() {
                 sh.descr.clone()
             } else {
@@ -722,3 +734,28 @@ fn insert_album(s: &mut Session, items: Vec<AlbumItem>, opts: &AlbumOpts, at: Op
     s.execute("slide.go", &json!({"index": first}))?;
     Ok(json!({"slides": slides, "first": first, "pictures": pictures, "album": album_id}))
 }
+
+#[cfg(test)]
+mod seed_tests {
+    use std::sync::Arc;
+
+    use deckcraft_model::style::PictureFill;
+    use deckcraft_model::{Shape, ShapeId, defaults};
+
+    use super::*;
+
+    #[test]
+    fn reopening_an_album_seeds_at_most_the_items_an_album_takes() {
+        // One picture named by 500 shapes: the dialog gets 48 items, not 500 encoded copies.
+        let mut p = defaults::new_presentation(None);
+        let img = p.add_media("a.png", "image/png", vec![1; 64 * 1024]).unwrap();
+        let pic = |k: u32| Shape {
+            id: ShapeId(10_000 + k),
+            kind: ShapeKind::Picture { fill: PictureFill { media: img, ..Default::default() } },
+            ..Default::default()
+        };
+        Arc::make_mut(&mut p.slides[0]).shapes = (0..500).map(pic).collect();
+        let slides: Vec<&deckcraft_model::Slide> = p.slides.iter().map(|s| s.as_ref()).collect();
+        assert_eq!(items_from_slides(&p, &slides).len(), ALBUM_MAX_ITEMS);
+    }
+}

crates/metafile/src/cliprect.rs

@@ -11,10 +11,6 @@ use crate::geom::{Op, P};
 /// Line segments per Bézier when a crossing shape is flattened.
 const CURVE_STEPS: usize = 16;
 
-/// Point-against-edge tests one clipped item may cost (all its subpaths together); an item over
-/// it is dropped, as a single polygon over it already was.
-const MAX_CLIP_WORK: usize = 1_000_000;
-
 /// The bounding box `[l, t, r, b]` of the points in `ops` (control points included).
 pub(crate) fn ops_bbox(ops: &[Op]) -> Option<[f64; 4]> {
     let mut b: Option<[f64; 4]> = None;
@@ -104,12 +100,12 @@ fn is_rect(clip: &[P]) -> bool {
 
 /// Sutherland–Hodgman: `poly` cut by convex `clip`.
 pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
-    if poly.len().saturating_mul(clip.len()) > MAX_CLIP_WORK {
+    if poly.len().saturating_mul(clip.len()) > 1_000_000 {
         return Vec::new();
     }
     let mut poly = poly.to_vec();
     for i in 0..clip.len() {
-        if poly.len().saturating_mul(clip.len() - i) > MAX_CLIP_WORK {
+        if poly.len().saturating_mul(clip.len() - i) > 1_000_000 {
             return Vec::new();
         }
         let (a, b) = (clip[i], clip[(i + 1) % clip.len()]);
@@ -162,9 +158,6 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
                 return Vec::new();
             }
             let subs = flatten(&ops);
-            if too_much_work(&subs, clip) {
-                return Vec::new();
-            }
             let mut out = Vec::new();
             if fill.is_some() {
                 let f = clip_fill(&subs, clip);
@@ -188,11 +181,7 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
             if disjoint(b, cb) {
                 return Vec::new();
             }
-            let subs = flatten(&ops);
-            if too_much_work(&subs, clip) {
-                return Vec::new();
-            }
-            let f = clip_fill(&subs, clip);
+            let f = clip_fill(&flatten(&ops), clip);
             if f.is_empty() { Vec::new() } else { vec![Raw::Pattern { ops: f, even_odd, tile, region }] }
         }
         Raw::Bitmap { rect, img, region } => crop(rect, img, clip).map(|(rect, img)| vec![Raw::Bitmap { rect, img, region }]).unwrap_or_default(),
@@ -241,12 +230,6 @@ pub(crate) fn flatten(ops: &[Op]) -> Vec<(Vec<P>, bool)> {
     subs
 }
 
-/// Whether cutting every subpath of one item by `clip` would exceed [`MAX_CLIP_WORK`]; the
-/// per-polygon check alone lets many small subpaths each spend the whole allowance.
-fn too_much_work(subs: &[(Vec<P>, bool)], clip: &[P]) -> bool {
-    subs.iter().map(|s| s.0.len() + 1).sum::<usize>().saturating_mul(clip.len()) > MAX_CLIP_WORK
-}
-
 fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
     let mut ops = Vec::new();
     for (pts, _) in subs {

crates/metafile/src/tests.rs

@@ -2074,18 +2074,3 @@ fn clip_polygon_work_bound() {
     let clipped = crate::cliprect::clip_polygon(&poly, &clip);
     assert!(clipped.is_empty(), "excessive polygon clip product rejected");
 }
-
-#[test]
-fn clip_work_is_bounded_across_subpaths() {
-    use crate::canvas::Raw;
-    use crate::geom::Op;
-    // 512-gon clip; 4,000 small triangles crossing its edge: each under the per-polygon cap, together
-    // far over it, for both the fill and the stroke.
-    let clip: Vec<(f64, f64)> =
-        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
-    let tri = |x: f64| [Op::M((x, 95.0)), Op::L((x + 1.0, 95.0)), Op::L((x, 300.0)), Op::Z];
-    let many: Vec<Op> = (0..4000).flat_map(|i| tri(i as f64 % 200.0)).collect();
-    let raw = |ops| Raw::Path { ops, fill: Some([0, 0, 0, 255]), stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
-    assert!(crate::cliprect::clip_raw(raw(many), &clip).is_empty(), "the whole item's clipping work is bounded");
-    assert_eq!(crate::cliprect::clip_raw(raw(tri(100.0).to_vec()), &clip).len(), 2, "a small crossing shape is still clipped");
-}