address review: share one clip-work allowance between fill and stroke

crates/engine/src/cmd.rs

@@ -433,17 +433,6 @@ pub(crate) fn shape_of(s: &Session, id: ShapeId) -> Result<deckcraft_model::Shap
 pub fn xfrm_of(doc: &deckcraft_model::Presentation, sel: &crate::Selection, shape: &deckcraft_model::Shape) -> Xfrm {
     let mut x = shape.xfrm.unwrap_or_else(|| ctx_xfrm(doc, sel, shape));
     if let deckcraft_model::ShapeKind::Table(t) = &shape.kind {
-        // A loaded table may not be normalized yet: measure the bounded grid an edit will
-        // leave, not every cell the file stored.
-        let normalized;
-        let t = if t.is_normalized() {
-            t
-        } else {
-            let mut n = t.clone();
-            n.normalize();
-            normalized = n;
-            &normalized
-        };
         let drawn: f64 = table_drawn_heights(doc, sel, t).iter().sum();
         if drawn.is_finite() && drawn > x.h {
             x.h = drawn;

crates/engine/src/cmd/table.rs

@@ -285,8 +285,6 @@ fn with_table(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut Table) -> R
     };
     let r = edit_shapes(s, &json!({"id": id}), cmd, |sh| match &mut sh.kind {
         ShapeKind::Table(t) => {
-            // Edits walk the grid: bound it first (a loaded table need not be normalized yet).
-            t.normalize();
             f(t)?;
             t.normalize();
             let (w, h) = (t.width(), t.height());

crates/metafile/src/cliprect.rs

@@ -11,6 +11,10 @@ use crate::geom::{Op, P};
 /// Line segments per Bézier when a crossing shape is flattened.
 const CURVE_STEPS: usize = 16;
 
+/// Point-against-edge tests one clipped item may cost (all its subpaths together); an item over
+/// it is dropped, as a single polygon over it already was.
+const MAX_CLIP_WORK: usize = 1_000_000;
+
 /// The bounding box `[l, t, r, b]` of the points in `ops` (control points included).
 pub(crate) fn ops_bbox(ops: &[Op]) -> Option<[f64; 4]> {
     let mut b: Option<[f64; 4]> = None;
@@ -100,14 +104,20 @@ fn is_rect(clip: &[P]) -> bool {
 
 /// Sutherland–Hodgman: `poly` cut by convex `clip`.
 pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
-    if poly.len().saturating_mul(clip.len()) > 1_000_000 {
-        return Vec::new();
-    }
+    clip_polygon_within(poly, clip, &mut { MAX_CLIP_WORK }).unwrap_or_default()
+}
+
+/// [`clip_polygon`] charging each point visited against each clip edge to `budget`: the polygon
+/// can gain a vertex at every edge, so its cost isn't known from its input size alone. `None`
+/// once the budget is spent.
+fn clip_polygon_within(poly: &[P], clip: &[P], budget: &mut usize) -> Option<Vec<P>> {
     let mut poly = poly.to_vec();
     for i in 0..clip.len() {
-        if poly.len().saturating_mul(clip.len() - i) > 1_000_000 {
-            return Vec::new();
+        // The work actually done: this edge visits the polygon as it now stands.
+        if poly.len() > *budget {
+            return None;
         }
+        *budget -= poly.len();
         let (a, b) = (clip[i], clip[(i + 1) % clip.len()]);
         let keep = |p: P| cross(a, b, p) >= 0.0;
         let cut = |p: P, q: P| {
@@ -133,7 +143,7 @@ pub(crate) fn clip_polygon(poly: &[P], clip: &[P]) -> Vec<P> {
             break;
         }
     }
-    poly
+    Some(poly)
 }
 
 fn disjoint(b: [f64; 4], c: [f64; 4]) -> bool {
@@ -158,9 +168,12 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
                 return Vec::new();
             }
             let subs = flatten(&ops);
+            if too_much_work(&subs, clip, usize::from(fill.is_some()) + usize::from(stroke.is_some())) {
+                return Vec::new();
+            }
             let mut out = Vec::new();
             if fill.is_some() {
-                let f = clip_fill(&subs, clip);
+                let Some(f) = clip_fill(&subs, clip) else { return Vec::new() };
                 if !f.is_empty() {
                     out.push(Raw::Path { ops: f, fill, stroke: None, even_odd, region: region.clone() });
                 }
@@ -181,7 +194,11 @@ pub(crate) fn clip_raw(raw: Raw, clip: &[P]) -> Vec<Raw> {
             if disjoint(b, cb) {
                 return Vec::new();
             }
-            let f = clip_fill(&flatten(&ops), clip);
+            let subs = flatten(&ops);
+            if too_much_work(&subs, clip, 1) {
+                return Vec::new();
+            }
+            let f = clip_fill(&subs, clip).unwrap_or_default();
             if f.is_empty() { Vec::new() } else { vec![Raw::Pattern { ops: f, even_odd, tile, region }] }
         }
         Raw::Bitmap { rect, img, region } => crop(rect, img, clip).map(|(rect, img)| vec![Raw::Bitmap { rect, img, region }]).unwrap_or_default(),
@@ -230,17 +247,28 @@ pub(crate) fn flatten(ops: &[Op]) -> Vec<(Vec<P>, bool)> {
     subs
 }
 
-fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {
+/// Whether cutting every subpath of one item by `clip` would exceed [`MAX_CLIP_WORK`]; the
+/// per-polygon check alone lets many small subpaths each spend the whole allowance. `passes` is
+/// how many clipping passes the item gets (fill and stroke each cut every subpath), so one item
+/// shares a single allowance between them.
+fn too_much_work(subs: &[(Vec<P>, bool)], clip: &[P], passes: usize) -> bool {
+    subs.iter().map(|s| s.0.len() + 1).sum::<usize>().saturating_mul(clip.len()).saturating_mul(passes) > MAX_CLIP_WORK
+}
+
+/// The clipped fill of every subpath, its clipping work shared by all of them: `None` (the whole
+/// item goes) once [`MAX_CLIP_WORK`] is spent.
+fn clip_fill(subs: &[(Vec<P>, bool)], clip: &[P]) -> Option<Vec<Op>> {
     let mut ops = Vec::new();
+    let mut budget = MAX_CLIP_WORK;
     for (pts, _) in subs {
-        let poly = clip_polygon(pts, clip);
+        let poly = clip_polygon_within(pts, clip, &mut budget)?;
         if poly.len() >= 3 {
             ops.push(Op::M(poly[0]));
             ops.extend(poly[1..].iter().map(|p| Op::L(*p)));
             ops.push(Op::Z);
         }
     }
-    ops
+    Some(ops)
 }
 
 fn clip_stroke(subs: &[(Vec<P>, bool)], clip: &[P]) -> Vec<Op> {

crates/metafile/src/tests.rs

@@ -2074,3 +2074,63 @@ fn clip_polygon_work_bound() {
     let clipped = crate::cliprect::clip_polygon(&poly, &clip);
     assert!(clipped.is_empty(), "excessive polygon clip product rejected");
 }
+
+#[test]
+fn clip_polygon_charges_actual_work_not_projected_growth() {
+    // Two convex 1,000-gons: the product is exactly the budget, and a cut that adds a vertex must
+    // not make a later step look over budget.
+    let gon = |cx: f64| -> Vec<(f64, f64)> {
+        (0..1000).map(|i| (i as f64 / 1000.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (cx + 100.0 * c, 100.0 * s)).collect()
+    };
+    let clipped = crate::cliprect::clip_polygon(&gon(0.0), &gon(30.0));
+    assert!(clipped.len() > 100, "the intersection is kept: {}", clipped.len());
+}
+
+#[test]
+fn clip_work_is_shared_by_fill_and_stroke() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    // One zigzag subpath crossing a 512-gon's edge: about 510k point-edge tests per pass, so a
+    // fill alone fits the allowance but a fill plus a stroke would spend it twice.
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    let mut ops = vec![Op::M((0.0, 95.0))];
+    ops.extend((1..1000).map(|i| Op::L((i as f64 * 0.19, if i % 2 == 0 { 95.0 } else { 300.0 }))));
+    ops.push(Op::Z);
+    let raw = |fill, stroke| Raw::Path { ops: ops.clone(), fill, stroke, even_odd: false, region: None };
+    let black = [0, 0, 0, 255];
+    assert!(!crate::cliprect::clip_raw(raw(Some(black), None), &clip).is_empty(), "a fill alone is within the allowance");
+    assert!(crate::cliprect::clip_raw(raw(Some(black), Some((black, 1.0))), &clip).is_empty(), "fill and stroke share one allowance");
+}
+
+#[test]
+fn clip_work_is_bounded_across_subpaths() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    // 512-gon clip; 4,000 small triangles crossing its edge: each under the per-polygon cap, together
+    // far over it, for both the fill and the stroke.
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    let tri = |x: f64| [Op::M((x, 95.0)), Op::L((x + 1.0, 95.0)), Op::L((x, 300.0)), Op::Z];
+    let many: Vec<Op> = (0..4000).flat_map(|i| tri(i as f64 % 200.0)).collect();
+    let raw = |ops| Raw::Path { ops, fill: Some([0, 0, 0, 255]), stroke: Some(([0, 0, 0, 255], 1.0)), even_odd: false, region: None };
+    assert!(crate::cliprect::clip_raw(raw(many), &clip).is_empty(), "the whole item's clipping work is bounded");
+    assert_eq!(crate::cliprect::clip_raw(raw(tri(100.0).to_vec()), &clip).len(), 2, "a small crossing shape is still clipped");
+}
+
+/// Clipping a fill can add a vertex at every clip edge, so a polygon's work isn't its input size:
+/// shapes that pass the up-front estimate but grow while clipped are charged as they grow, against
+/// one budget for the whole item.
+#[test]
+fn growing_fill_clips_share_one_budget() {
+    use crate::canvas::Raw;
+    use crate::geom::Op;
+    let clip: Vec<(f64, f64)> =
+        (0..512).map(|i| (i as f64 / 512.0 * std::f64::consts::TAU).sin_cos()).map(|(s, c)| (100.0 + 100.0 * c, 100.0 + 100.0 * s)).collect();
+    // A triangle around the whole circle: clipped, it becomes the 512-gon, about 130,000 steps.
+    let tri = [Op::M((-1000.0, -1000.0)), Op::L((1000.0, -1000.0)), Op::L((100.0, 1000.0)), Op::Z];
+    let raw = |n: usize| Raw::Path { ops: tri.repeat(n), fill: Some([0, 0, 0, 255]), stroke: None, even_odd: false, region: None };
+    // 400 of them pass the estimate (400 x 4 x 512 is under a million) but cost about 52 million.
+    assert!(crate::cliprect::clip_raw(raw(400), &clip).is_empty(), "the growing work is charged");
+    assert_eq!(crate::cliprect::clip_raw(raw(2), &clip).len(), 1, "a couple of them are still clipped");
+}

crates/model/src/table.rs

@@ -77,12 +77,6 @@ impl Default for Table {
     }
 }
 
-/// Cells a table may hold after [`Table::normalize`] (PowerPoint's own limit is 75 x 75).
-pub const MAX_CELLS: usize = 100_000;
-/// Cell visits [`Table::merge`] may spend growing its rectangle over existing merges: a few
-/// passes over the largest grid, where a real table needs one or two.
-const MAX_MERGE_WORK: usize = 16 * MAX_CELLS;
-
 impl Table {
     pub fn new(rows: usize, cols: usize, width: f64, row_height: f64) -> Self {
         let rows = rows.clamp(1, 1000);
@@ -170,12 +164,8 @@ impl Table {
         true
     }
     /// The merged areas: every uncovered cell spanning more than one cell, clipped to the grid.
-    /// Merges of a well-formed table do not overlap, so together they cover at most the grid; a
-    /// file's overlapping spans past that are dropped, so rebuilding them cannot revisit cells
-    /// without bound.
     fn merges(&self) -> Vec<Merge> {
         let (nr, nc) = (self.rows.len(), self.cols.len());
-        let mut area = nr.saturating_mul(nc);
         let mut out = vec![];
         for (r, row) in self.rows.iter().enumerate() {
             for (c, cell) in row.cells.iter().enumerate().take(nc) {
@@ -184,10 +174,7 @@ impl Table {
                 }
                 let rs = (cell.row_span.max(1) as usize).min(nr - r);
                 let gs = (cell.grid_span.max(1) as usize).min(nc - c);
-                if (rs > 1 || gs > 1)
-                    && let Some(left) = area.checked_sub(rs.saturating_mul(gs))
-                {
-                    area = left;
+                if rs > 1 || gs > 1 {
                     out.push(Merge { r, c, rs, gs });
                 }
             }
@@ -240,17 +227,9 @@ impl Table {
         if r1 >= self.rows.len() || c1 >= self.cols.len() || (r0 == r1 && c0 == c1) {
             return false;
         }
-        // Grow the rectangle until no existing merge sticks out of it. Each pass reads the whole
-        // grid and may grow it by one row, so the passes are charged against
-        // [`MAX_MERGE_WORK`]: past it the merge is refused, before anything changed.
+        // Grow the rectangle until no existing merge sticks out of it.
         let (mut r0, mut c0, mut r1, mut c1) = (r0, c0, r1, c1);
-        let pass = self.rows.len().saturating_mul(self.cols.len()).max(1);
-        let mut work = 0usize;
         loop {
-            work = work.saturating_add(pass);
-            if work > MAX_MERGE_WORK {
-                return false;
-            }
             let before = (r0, c0, r1, c1);
             for (r, row) in self.rows.iter().enumerate() {
                 for (c, cell) in row.cells.iter().enumerate().take(self.cols.len()) {
@@ -304,31 +283,21 @@ impl Table {
             return false;
         }
         // Spans come from the file and may reach past the table; only walk the cells that exist.
-        let end = r.saturating_add(rs).min(self.rows.len());
-        let gs = gs.min(self.cols.len().saturating_sub(c));
-        for row in self.rows.get_mut(r..end).unwrap_or_default() {
-            for x in row.cells.iter_mut().skip(c).take(gs) {
-                x.h_merge = false;
-                x.v_merge = false;
-                x.grid_span = 1;
-                x.row_span = 1;
+        for rr in r..r.saturating_add(rs).min(self.rows.len()) {
+            for cc in c..c.saturating_add(gs).min(self.cols.len()) {
+                if let Some(x) = self.cell_mut(rr, cc) {
+                    x.h_merge = false;
+                    x.v_merge = false;
+                    x.grid_span = 1;
+                    x.row_span = 1;
+                }
             }
         }
         true
     }
-    /// Whether the grid is as [`Table::normalize`] leaves it: within [`MAX_CELLS`], every row
-    /// exactly `cols.len()` cells wide.
-    pub fn is_normalized(&self) -> bool {
-        let n = self.cols.len();
-        n <= MAX_CELLS && self.rows.len() <= (MAX_CELLS / n.max(1)).max(1) && self.rows.iter().all(|r| r.cells.len() == n)
-    }
-    /// Make every row have exactly `cols.len()` cells (repair after loading). A grid over
-    /// [`MAX_CELLS`] loses its last rows (and columns) first, so a file naming many rows and many
-    /// columns but few cells cannot make this allocate their product.
+    /// Make every row have exactly `cols.len()` cells (repair after loading).
     pub fn normalize(&mut self) {
-        self.cols.truncate(MAX_CELLS);
         let n = self.cols.len();
-        self.rows.truncate((MAX_CELLS / n.max(1)).max(1));
         for r in &mut self.rows {
             r.cells.resize_with(n, || Cell::new(""));
             for c in &mut r.cells {
@@ -544,61 +513,6 @@ mod tests {
         }
     }
 
-    /// Each cell spans two rows, uncovered: merging the last two rows would grow the rectangle a
-    /// row per pass over the whole grid, 10,000 passes. The merge is refused at its work bound
-    /// instead, leaving the table as it was; a small merge still works.
-    #[test]
-    fn merge_expansion_stops_at_its_work_bound() {
-        let mut t = Table::new(10_000, 10, 400.0, 30.0);
-        for row in &mut t.rows {
-            for c in &mut row.cells {
-                c.row_span = 2;
-            }
-        }
-        let before = t.clone();
-        assert!(!t.merge(9_998, 0, 9_999, 9));
-        assert_eq!(t, before);
-        let mut small = Table::new(4, 4, 400.0, 30.0);
-        assert!(small.merge(0, 0, 1, 1));
-        assert!(small.is_normalized() && !Table { cols: vec![1.0; 3], rows: vec![Row::default(); 2], ..Default::default() }.is_normalized());
-    }
-
-    #[test]
-    fn normalize_caps_a_sparse_grid_at_max_cells() {
-        // 1,000 columns and 1,000 empty rows would be a million cells.
-        let mut t = Table { cols: vec![10.0; 1000], rows: vec![Row::default(); 1000], ..Default::default() };
-        t.normalize();
-        assert_eq!(t.cols.len(), 1000);
-        assert_eq!(t.rows.len(), MAX_CELLS / 1000);
-        assert!(t.rows.iter().all(|r| r.cells.len() == 1000));
-        // Columns alone past the cap keep one row of MAX_CELLS cells.
-        let mut t = Table { cols: vec![1.0; MAX_CELLS + 5], rows: vec![Row::default(); 3], ..Default::default() };
-        t.normalize();
-        assert_eq!((t.cols.len(), t.rows.len()), (MAX_CELLS, 1));
-        // A normal table is untouched.
-        let mut t = Table::new(4, 4, 400.0, 30.0);
-        t.normalize();
-        assert_eq!((t.n_rows(), t.n_cols()), (4, 4));
-    }
-
-    #[test]
-    fn overlapping_file_spans_rebuild_in_bounded_work() {
-        // Every cell an uncovered anchor spanning to the far corner: their areas add up to about
-        // n^4 / 4, but only what fits the grid is kept, so an edit's rebuild stays near n^2.
-        let n = 200;
-        let mut t = Table::new(n, n, 400.0, 30.0);
-        for row in &mut t.rows {
-            for c in &mut row.cells {
-                c.grid_span = u32::MAX;
-                c.row_span = u32::MAX;
-            }
-        }
-        assert_eq!(t.merges().len(), 1, "the first anchor already covers the whole grid");
-        t.insert_row(n);
-        assert_eq!(t.n_rows(), n + 1);
-        assert!(t.split(0, 0));
-    }
-
     fn merged() -> Table {
         // 4x4 with a 2x2 merge at (1,1) holding "M".
         let mut t = Table::new(4, 4, 400.0, 30.0);