address review: bound merge expansion work; measure a normalized copy of an unnormalized table

crates/engine/src/cmd.rs

@@ -433,6 +433,17 @@ pub(crate) fn shape_of(s: &Session, id: ShapeId) -> Result<deckcraft_model::Shap
 pub fn xfrm_of(doc: &deckcraft_model::Presentation, sel: &crate::Selection, shape: &deckcraft_model::Shape) -> Xfrm {
     let mut x = shape.xfrm.unwrap_or_else(|| ctx_xfrm(doc, sel, shape));
     if let deckcraft_model::ShapeKind::Table(t) = &shape.kind {
+        // A loaded table may not be normalized yet: measure the bounded grid an edit will
+        // leave, not every cell the file stored.
+        let normalized;
+        let t = if t.is_normalized() {
+            t
+        } else {
+            let mut n = t.clone();
+            n.normalize();
+            normalized = n;
+            &normalized
+        };
         let drawn: f64 = table_drawn_heights(doc, sel, t).iter().sum();
         if drawn.is_finite() && drawn > x.h {
             x.h = drawn;

crates/engine/src/cmd/table.rs

@@ -285,6 +285,8 @@ fn with_table(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut Table) -> R
     };
     let r = edit_shapes(s, &json!({"id": id}), cmd, |sh| match &mut sh.kind {
         ShapeKind::Table(t) => {
+            // Edits walk the grid: bound it first (a loaded table need not be normalized yet).
+            t.normalize();
             f(t)?;
             t.normalize();
             let (w, h) = (t.width(), t.height());

crates/model/src/table.rs

@@ -77,6 +77,12 @@ impl Default for Table {
     }
 }
 
+/// Cells a table may hold after [`Table::normalize`] (PowerPoint's own limit is 75 x 75).
+pub const MAX_CELLS: usize = 100_000;
+/// Cell visits [`Table::merge`] may spend growing its rectangle over existing merges: a few
+/// passes over the largest grid, where a real table needs one or two.
+const MAX_MERGE_WORK: usize = 16 * MAX_CELLS;
+
 impl Table {
     pub fn new(rows: usize, cols: usize, width: f64, row_height: f64) -> Self {
         let rows = rows.clamp(1, 1000);
@@ -164,8 +170,12 @@ impl Table {
         true
     }
     /// The merged areas: every uncovered cell spanning more than one cell, clipped to the grid.
+    /// Merges of a well-formed table do not overlap, so together they cover at most the grid; a
+    /// file's overlapping spans past that are dropped, so rebuilding them cannot revisit cells
+    /// without bound.
     fn merges(&self) -> Vec<Merge> {
         let (nr, nc) = (self.rows.len(), self.cols.len());
+        let mut area = nr.saturating_mul(nc);
         let mut out = vec![];
         for (r, row) in self.rows.iter().enumerate() {
             for (c, cell) in row.cells.iter().enumerate().take(nc) {
@@ -174,7 +184,10 @@ impl Table {
                 }
                 let rs = (cell.row_span.max(1) as usize).min(nr - r);
                 let gs = (cell.grid_span.max(1) as usize).min(nc - c);
-                if rs > 1 || gs > 1 {
+                if (rs > 1 || gs > 1)
+                    && let Some(left) = area.checked_sub(rs.saturating_mul(gs))
+                {
+                    area = left;
                     out.push(Merge { r, c, rs, gs });
                 }
             }
@@ -227,9 +240,17 @@ impl Table {
         if r1 >= self.rows.len() || c1 >= self.cols.len() || (r0 == r1 && c0 == c1) {
             return false;
         }
-        // Grow the rectangle until no existing merge sticks out of it.
+        // Grow the rectangle until no existing merge sticks out of it. Each pass reads the whole
+        // grid and may grow it by one row, so the passes are charged against
+        // [`MAX_MERGE_WORK`]: past it the merge is refused, before anything changed.
         let (mut r0, mut c0, mut r1, mut c1) = (r0, c0, r1, c1);
+        let pass = self.rows.len().saturating_mul(self.cols.len()).max(1);
+        let mut work = 0usize;
         loop {
+            work = work.saturating_add(pass);
+            if work > MAX_MERGE_WORK {
+                return false;
+            }
             let before = (r0, c0, r1, c1);
             for (r, row) in self.rows.iter().enumerate() {
                 for (c, cell) in row.cells.iter().enumerate().take(self.cols.len()) {
@@ -283,21 +304,31 @@ impl Table {
             return false;
         }
         // Spans come from the file and may reach past the table; only walk the cells that exist.
-        for rr in r..r.saturating_add(rs).min(self.rows.len()) {
-            for cc in c..c.saturating_add(gs).min(self.cols.len()) {
-                if let Some(x) = self.cell_mut(rr, cc) {
-                    x.h_merge = false;
-                    x.v_merge = false;
-                    x.grid_span = 1;
-                    x.row_span = 1;
-                }
+        let end = r.saturating_add(rs).min(self.rows.len());
+        let gs = gs.min(self.cols.len().saturating_sub(c));
+        for row in self.rows.get_mut(r..end).unwrap_or_default() {
+            for x in row.cells.iter_mut().skip(c).take(gs) {
+                x.h_merge = false;
+                x.v_merge = false;
+                x.grid_span = 1;
+                x.row_span = 1;
             }
         }
         true
     }
-    /// Make every row have exactly `cols.len()` cells (repair after loading).
-    pub fn normalize(&mut self) {
+    /// Whether the grid is as [`Table::normalize`] leaves it: within [`MAX_CELLS`], every row
+    /// exactly `cols.len()` cells wide.
+    pub fn is_normalized(&self) -> bool {
         let n = self.cols.len();
+        n <= MAX_CELLS && self.rows.len() <= (MAX_CELLS / n.max(1)).max(1) && self.rows.iter().all(|r| r.cells.len() == n)
+    }
+    /// Make every row have exactly `cols.len()` cells (repair after loading). A grid over
+    /// [`MAX_CELLS`] loses its last rows (and columns) first, so a file naming many rows and many
+    /// columns but few cells cannot make this allocate their product.
+    pub fn normalize(&mut self) {
+        self.cols.truncate(MAX_CELLS);
+        let n = self.cols.len();
+        self.rows.truncate((MAX_CELLS / n.max(1)).max(1));
         for r in &mut self.rows {
             r.cells.resize_with(n, || Cell::new(""));
             for c in &mut r.cells {
@@ -513,6 +544,61 @@ mod tests {
         }
     }
 
+    /// Each cell spans two rows, uncovered: merging the last two rows would grow the rectangle a
+    /// row per pass over the whole grid, 10,000 passes. The merge is refused at its work bound
+    /// instead, leaving the table as it was; a small merge still works.
+    #[test]
+    fn merge_expansion_stops_at_its_work_bound() {
+        let mut t = Table::new(10_000, 10, 400.0, 30.0);
+        for row in &mut t.rows {
+            for c in &mut row.cells {
+                c.row_span = 2;
+            }
+        }
+        let before = t.clone();
+        assert!(!t.merge(9_998, 0, 9_999, 9));
+        assert_eq!(t, before);
+        let mut small = Table::new(4, 4, 400.0, 30.0);
+        assert!(small.merge(0, 0, 1, 1));
+        assert!(small.is_normalized() && !Table { cols: vec![1.0; 3], rows: vec![Row::default(); 2], ..Default::default() }.is_normalized());
+    }
+
+    #[test]
+    fn normalize_caps_a_sparse_grid_at_max_cells() {
+        // 1,000 columns and 1,000 empty rows would be a million cells.
+        let mut t = Table { cols: vec![10.0; 1000], rows: vec![Row::default(); 1000], ..Default::default() };
+        t.normalize();
+        assert_eq!(t.cols.len(), 1000);
+        assert_eq!(t.rows.len(), MAX_CELLS / 1000);
+        assert!(t.rows.iter().all(|r| r.cells.len() == 1000));
+        // Columns alone past the cap keep one row of MAX_CELLS cells.
+        let mut t = Table { cols: vec![1.0; MAX_CELLS + 5], rows: vec![Row::default(); 3], ..Default::default() };
+        t.normalize();
+        assert_eq!((t.cols.len(), t.rows.len()), (MAX_CELLS, 1));
+        // A normal table is untouched.
+        let mut t = Table::new(4, 4, 400.0, 30.0);
+        t.normalize();
+        assert_eq!((t.n_rows(), t.n_cols()), (4, 4));
+    }
+
+    #[test]
+    fn overlapping_file_spans_rebuild_in_bounded_work() {
+        // Every cell an uncovered anchor spanning to the far corner: their areas add up to about
+        // n^4 / 4, but only what fits the grid is kept, so an edit's rebuild stays near n^2.
+        let n = 200;
+        let mut t = Table::new(n, n, 400.0, 30.0);
+        for row in &mut t.rows {
+            for c in &mut row.cells {
+                c.grid_span = u32::MAX;
+                c.row_span = u32::MAX;
+            }
+        }
+        assert_eq!(t.merges().len(), 1, "the first anchor already covers the whole grid");
+        t.insert_row(n);
+        assert_eq!(t.n_rows(), n + 1);
+        assert!(t.split(0, 0));
+    }
+
     fn merged() -> Table {
         // 4x4 with a 2x2 merge at (1,1) holding "M".
         let mut t = Table::new(4, 4, 400.0, 30.0);

crates/pptx/src/read.rs

@@ -100,7 +100,8 @@ impl Part {
     }
     /// Like [`Part::keep`], also declaring prefixes that only an enclosing wrapper binds.
     pub fn keep_inner(&self, el: &El) -> String {
-        keep_with(el, &[&self.ns, &self.inner_ns])
+        let ns: Vec<(String, String)> = self.ns.iter().chain(&self.inner_ns).cloned().collect();
+        keep_xml(el, &ns)
     }
 }
 
@@ -135,69 +136,36 @@ fn inner_decls(root: &El, ns: &[(String, String)]) -> Vec<(String, String)> {
     out
 }
 
-/// Longest namespace name copied onto a kept fragment or a resolved `mc` branch. Real ones are
-/// URIs of well under 100 bytes; a longer one is not copied, so one declaration cannot be
-/// multiplied by every fragment that uses its prefix.
-const MAX_NS_VALUE: usize = 2048;
-
-/// Prefixes `el` and its descendants use in element and attribute names, and those listed in
-/// `mc:Ignorable` or `mc:MustUnderstand` (which must stay declared for the markup-compatibility rules to hold),
-/// and those starting a QName-like attribute value.
-fn used_prefixes(el: &El) -> HashSet<&str> {
-    fn rec<'a>(e: &'a El, used: &mut HashSet<&'a str>, depth: usize) {
+/// Serialize `el`, declaring every prefix it uses that the source root declared.
+pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
+    let mut used = HashSet::new();
+    fn rec(e: &El, used: &mut HashSet<String>, depth: usize) {
         if depth > crate::xml::MAX_DEPTH {
             return;
         }
         if let Some((p, _)) = e.name.split_once(':') {
-            used.insert(p);
+            used.insert(p.to_string());
         }
-        for (k, v) in &e.attrs {
-            if let Some((p, local)) = k.split_once(':')
+        for (k, _) in &e.attrs {
+            if let Some((p, _)) = k.split_once(':')
                 && p != "xmlns"
                 && p != "xml"
             {
-                used.insert(p);
-                if local == "Ignorable" || local == "MustUnderstand" {
-                    used.extend(v.split_whitespace());
-                }
-            }
-            // QName-valued attributes (`xsi:type="q:Item"`) need their prefix declared too.
-            if k != "xmlns" && !k.starts_with("xmlns:") {
-                for t in v.split_whitespace() {
-                    if let Some((p, _)) = t.split_once(':')
-                        && !p.is_empty()
-                    {
-                        used.insert(p);
-                    }
-                }
+                used.insert(p.to_string());
             }
         }
         for c in e.elements() {
             rec(c, used, depth + 1);
         }
     }
-    let mut used = HashSet::new();
     rec(el, &mut used, 0);
-    used
-}
-
-/// Serialize `el`, declaring every prefix it uses that the source root declared.
-pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
-    keep_with(el, &[ns])
-}
-
-fn keep_with(el: &El, decls: &[&[(String, String)]]) -> String {
-    let used = used_prefixes(el);
-    let mut have: HashSet<&str> = el.attrs.iter().map(|(a, _)| a.as_str()).collect();
-    let mut extra = Vec::new();
-    for (k, v) in decls.iter().flat_map(|d| d.iter()) {
+    let mut el = el.clone();
+    for (k, v) in ns {
         let p = k.strip_prefix("xmlns:").unwrap_or("");
-        if !p.is_empty() && used.contains(p) && v.len() <= MAX_NS_VALUE && have.insert(k) {
-            extra.push((k.clone(), v.clone()));
+        if !p.is_empty() && used.contains(p) && !el.attrs.iter().any(|(a, _)| a == k) {
+            el.attrs.push((k.clone(), v.clone()));
         }
     }
-    let mut el = el.clone();
-    el.attrs.extend(extra);
     el.to_xml()
 }
 
@@ -346,18 +314,10 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
             // The part's own relationships (customXml item → itemProps) and their targets.
             let rp = opc::rels_path(&name);
             if let Some(rels_xml) = text(&rp) {
-                let mut capped = false;
                 for sub in pkg.rels(&name).items.iter().filter(|s| !s.external && keepable(&s.target)) {
-                    // Checked before the part is read: repeated relationships to one large part
-                    // must not copy it again each time.
-                    if out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target)) {
-                        continue;
-                    }
-                    if out.len() >= 400 {
-                        capped = true;
-                        continue;
-                    }
-                    if let Some(x) = text(&sub.target) {
+                    if let Some(x) = text(&sub.target)
+                        && !out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target))
+                    {
                         out.push(KeptPart {
                             content_type: pkg.content_type(&sub.target).unwrap_or_default(),
                             name: sub.target.clone(),
@@ -366,9 +326,7 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
                         });
                     }
                 }
-                if !capped {
-                    out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
-                }
+                out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
             }
         }
     }
@@ -405,39 +363,15 @@ fn resolve_mc_rels(el: &mut El, depth: usize, rels: Option<&Rels>) {
                     });
                     let branch = choice.or_else(|| ac.child("Fallback"));
                     if let Some(b) = branch {
-                        // The branch's namespace declarations (the first usable one of each name,
-                        // in order), indexed by prefix once: each child then looks up the prefixes
-                        // it uses instead of scanning every declaration.
-                        let mut decls: Vec<(&String, &String)> = Vec::new();
-                        // An oversized declaration still shadows an outer one of its name: its
-                        // content is left unbound rather than bound to the outer namespace.
-                        let mut by_prefix: HashMap<&str, Option<usize>> = HashMap::new();
-                        for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
-                            let prefix = if k == "xmlns" { Some("") } else { k.strip_prefix("xmlns:") };
-                            if let Some(p) = prefix
-                                && !by_prefix.contains_key(p)
-                            {
-                                by_prefix.insert(p, (v.len() <= MAX_NS_VALUE).then_some(decls.len()));
-                                if v.len() <= MAX_NS_VALUE {
-                                    decls.push((k, v));
-                                }
-                            }
-                        }
                         for n in &b.children {
                             if let Node::El(e) = n {
-                                // Carry the namespace declarations from the branch that its content
-                                // uses (all of them per child made children x declarations copies).
-                                let used = used_prefixes(e);
-                                let have: HashSet<&str> = e.attrs.iter().map(|(a, _)| a.as_str()).collect();
-                                let mut wanted: Vec<usize> = std::iter::once("")
-                                    .chain(used.iter().copied())
-                                    .filter_map(|p| by_prefix.get(p).copied().flatten())
-                                    .filter(|&i| !have.contains(decls[i].0.as_str()))
-                                    .collect();
-                                wanted.sort_unstable();
-                                wanted.dedup();
                                 let mut e = e.clone();
-                                e.attrs.extend(wanted.into_iter().map(|i| (decls[i].0.clone(), decls[i].1.clone())));
+                                // Carry namespace declarations from the branch onto its content.
+                                for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
+                                    if k.starts_with("xmlns") && !e.attrs.iter().any(|(a, _)| a == k) {
+                                        e.attrs.push((k.clone(), v.clone()));
+                                    }
+                                }
                                 out.push(Node::El(e));
                             }
                         }
@@ -1480,72 +1414,3 @@ fn header_footer(p: &Presentation) -> HeaderFooter {
     }
     hf
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn mc_branches_carry_only_the_declarations_their_content_uses() {
-        // 2,000 declarations on the branch and 2,000 children: each child gets the one it uses
-        // (and the default), not all 2,000.
-        let decls: String = (0..2000).map(|i| format!(r#" xmlns:n{i}="urn:n{i}""#)).collect();
-        let kids: String = (0..2000).map(|i| format!("<n{i}:x/>")).collect();
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns="urn:d"{decls}>{kids}</mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        assert_eq!(kids.len(), 2000);
-        assert_eq!(kids[7].attrs, vec![("xmlns".to_string(), "urn:d".to_string()), ("xmlns:n7".to_string(), "urn:n7".to_string())]);
-    }
-
-    /// The branch's own declaration of a prefix wins over the `AlternateContent`'s; an oversized
-    /// one still shadows it (its content stays unbound); a child's own declaration is left alone.
-    #[test]
-    fn mc_branch_declarations_keep_their_precedence() {
-        let long = "u".repeat(MAX_NS_VALUE + 1);
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent xmlns:p="urn:ac" xmlns:q="urn:q-short"><mc:Fallback xmlns:p="urn:b" xmlns:q="{long}"><p:x/><q:y/><p:z xmlns:p="urn:own"/></mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        let attrs = |i: usize| kids[i].attrs.iter().map(|(k, v)| format!("{k}={v}")).collect::<Vec<_>>();
-        assert_eq!(attrs(0), ["xmlns:p=urn:b"]);
-        assert!(attrs(1).is_empty(), "{:?}", attrs(1));
-        assert_eq!(attrs(2), ["xmlns:p=urn:own"]);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_named_by_must_understand() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q"><a mc:MustUnderstand="q"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_used_in_qname_values() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q" xmlns:z="urn:z"><n xmlns:xsi="urn:xsi" xsi:type="q:Item"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-        assert!(!kid.attrs.iter().any(|(k, _)| k == "xmlns:z"), "unused declarations stay out: {:?}", kid.attrs);
-    }
-
-    #[test]
-    fn kept_fragments_skip_oversized_namespace_names() {
-        let big = "u".repeat(MAX_NS_VALUE + 1);
-        let ns = vec![("xmlns:a".to_string(), "urn:a".to_string()), ("xmlns:b".to_string(), big)];
-        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a" xmlns:b="urn:b"><b:y/></a:x>"#).unwrap();
-        let mut el = d.root.clone();
-        el.attrs.clear();
-        let out = keep_xml(&el, &ns);
-        assert!(out.contains(r#"xmlns:a="urn:a""#), "{out}");
-        assert!(!out.contains("uuuu"), "the oversized declaration is not copied");
-    }
-}