H.264: bound decoder work from overlapping slices, gaps and queued output

- A macroblock that an earlier slice of the same picture already decoded is
  refused, so overlapping slices cannot redo the picture's reconstruction
  once per slice.
- The memory budget check counts pictures waiting in the output queue that
  have left the DPB (one decode call may carry many access units) and the
  DPB's actual size, counting shared buffers once.
- frame_num gap concealment advances the POC state across the skipped run in
  constant time instead of once per missing frame_num.
- Storing a reference picture evicts until the DPB is under capacity, rather
  than evicting one picture and inserting regardless.

crates/anim/src/morph.rs

@@ -1,7 +1,5 @@
 //! Morph: matching shapes between two slides, interpolating their boxes and building the frames.
 
-use std::collections::{HashMap, HashSet, VecDeque};
-
 use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::{ColorRef, Fill, Geom, Presentation, Rgba, Shape, ShapeId, ShapeKind, Slide, Xfrm, walk};
 
@@ -17,66 +15,48 @@ fn text_of(s: &Shape) -> String {
 /// kind and preset geometry if neither carries text. A text box with neither a name nor its text on
 /// the other slide stays unpaired and fades in place, as in PowerPoint (#119). Each shape is used
 /// once; top-level shapes only (groups move whole).
-///
-/// Each pass compares a key of the two shapes, so the shapes of `b` are indexed by key once per
-/// pass: matching costs the sum of the two shape lists, not their product.
 pub fn morph_pairs(a: &Slide, b: &Slide) -> Vec<(ShapeId, ShapeId)> {
     let mut pairs: Vec<(ShapeId, ShapeId)> = Vec::new();
     let mut used_a = vec![false; a.shapes.len()];
     let mut used_b = vec![false; b.shapes.len()];
-    // Each shape's text, worked out once rather than inside every comparison.
-    let text_a: Vec<String> = a.shapes.iter().map(text_of).collect();
-    let text_b: Vec<String> = b.shapes.iter().map(text_of).collect();
-    let forced = |s: &Shape, _: &str| (s.name.starts_with("!!")).then(|| MorphKey::Name(s.name.clone()));
-    let named = |s: &Shape, _: &str| (!s.name.is_empty()).then(|| MorphKey::Name(s.name.clone()));
-    let same_text = |s: &Shape, t: &str| (!t.trim().is_empty()).then(|| MorphKey::Text(s.kind_name(), t.to_string()));
-    let same_geom = |s: &Shape, t: &str| match s.geom.preset_name() {
-        Some(g) if t.trim().is_empty() => Some(MorphKey::Geom(s.kind_name(), g.to_string())),
-        _ => None,
-    };
-    let passes: [&dyn Fn(&Shape, &str) -> Option<MorphKey>; 4] = [&forced, &named, &same_text, &same_geom];
-    for key in passes {
-        // Unused shapes of `b` by key, in slide order: the front of each queue is the first unused
-        // match, which is the one a search through `b` would find.
-        let mut index: HashMap<MorphKey, VecDeque<usize>> = HashMap::new();
-        for (j, sb) in b.shapes.iter().enumerate() {
-            if used_b.get(j).copied().unwrap_or(true) {
-                continue;
+    let passes: [&dyn Fn(&Shape, &Shape) -> bool; 4] = [
+        &|x, y| x.name.starts_with("!!") && x.name == y.name,
+        &|x, y| !x.name.is_empty() && x.name == y.name,
+        &|x, y| {
+            if x.kind_name() != y.kind_name() {
+                return false;
             }
-            if let Some(k) = key(sb, text_b.get(j).map_or("", String::as_str)) {
-                index.entry(k).or_default().push_back(j);
-            }
-        }
-        if index.is_empty() {
-            continue;
-        }
+            let tx = text_of(x);
+            !tx.trim().is_empty() && tx == text_of(y)
+        },
+        &|x, y| {
+            x.kind_name() == y.kind_name()
+                && x.geom.preset_name().is_some()
+                && x.geom.preset_name() == y.geom.preset_name()
+                && text_of(x).trim().is_empty()
+                && text_of(y).trim().is_empty()
+        },
+    ];
+    for pass in passes {
         for (i, sa) in a.shapes.iter().enumerate() {
             if used_a.get(i).copied().unwrap_or(true) {
                 continue;
             }
-            let Some(k) = key(sa, text_a.get(i).map_or("", String::as_str)) else { continue };
-            let Some(j) = index.get_mut(&k).and_then(VecDeque::pop_front) else { continue };
-            let Some(sb) = b.shapes.get(j) else { continue };
-            if let Some(u) = used_a.get_mut(i) {
-                *u = true;
+            let found = b.shapes.iter().enumerate().find(|(j, sb)| !used_b.get(*j).copied().unwrap_or(true) && pass(sa, sb));
+            if let Some((j, sb)) = found {
+                if let Some(u) = used_a.get_mut(i) {
+                    *u = true;
+                }
+                if let Some(u) = used_b.get_mut(j) {
+                    *u = true;
+                }
+                pairs.push((sa.id, sb.id));
             }
-            if let Some(u) = used_b.get_mut(j) {
-                *u = true;
-            }
-            pairs.push((sa.id, sb.id));
         }
     }
     pairs
 }
 
-/// What one [`morph_pairs`] pass matches shapes on.
-#[derive(Clone, Debug, PartialEq, Eq, Hash)]
-enum MorphKey {
-    Name(String),
-    Text(&'static str, String),
-    Geom(&'static str, String),
-}
-
 fn lerp(a: f64, b: f64, t: f64) -> f64 {
     let v = a + (b - a) * t;
     if v.is_finite() {
@@ -276,23 +256,13 @@ pub fn morph_frame(pres: &Presentation, a: &Slide, b: &Slide, t: f64, hidden_b:
         f.shapes.push((sh, old));
         id
     };
-    // Lookups by id, built once (the first shape or pair with an id wins, as a search would).
-    let paired_a: HashSet<ShapeId> = pairs.iter().map(|(ia, _)| *ia).collect();
-    let mut partner: HashMap<ShapeId, ShapeId> = HashMap::with_capacity(pairs.len());
-    for (ia, ib) in &pairs {
-        partner.entry(*ib).or_insert(*ia);
-    }
-    let mut a_by_id: HashMap<ShapeId, &Shape> = HashMap::with_capacity(a.shapes.len());
-    for x in &a.shapes {
-        a_by_id.entry(x.id).or_insert(x);
-    }
     for sa in &a.shapes {
-        if !paired_a.contains(&sa.id) {
+        if !pairs.iter().any(|(ia, _)| *ia == sa.id) {
             push(sa.clone(), true, 1.0 - s);
         }
     }
     for sb in &b.shapes {
-        let pair = partner.get(&sb.id).and_then(|ia| a_by_id.get(ia).copied());
+        let pair = pairs.iter().find(|(_, ib)| *ib == sb.id).and_then(|(ia, _)| a.shapes.iter().find(|x| x.id == *ia));
         let Some(sa) = pair else {
             if !hidden_b(sb.id) {
                 push(sb.clone(), false, s);

crates/anim/src/tests.rs

@@ -1155,58 +1155,3 @@ fn many_by_paragraph_animations_on_one_shape_share_paragraph_targets() {
     assert_eq!(tl.effects().len(), 6_000);
     assert_eq!(tl.paragraph_targets(ShapeId(1)), vec![0, 1, 2]);
 }
-
-#[test]
-fn morph_pairs_take_the_first_unused_match_in_slide_order() {
-    let mut a = Slide::default();
-    let mut b = Slide::default();
-    a.shapes = vec![shape(1, "Same"), shape(2, "Same"), shape(3, "Other")];
-    b.shapes = vec![shape(11, "Same"), shape(12, "Same"), shape(13, "Same")];
-    // By name first, in slide order; the shape of `a` left over pairs by kind and geometry with
-    // the shape of `b` left over.
-    assert_eq!(morph_pairs(&a, &b), [(ShapeId(1), ShapeId(11)), (ShapeId(2), ShapeId(12)), (ShapeId(3), ShapeId(13))]);
-}
-
-#[test]
-fn morph_of_large_slides_stays_linear() {
-    let n = 20_000u32;
-    let text = |i: u32, side: &str| Some(TextBody::from_text(&format!("{side} {i}")));
-    let mut a = Slide::default();
-    let mut b = Slide::default();
-    // Text no shape on the other slide shares: every pass looks for a partner and finds none.
-    a.shapes = (0..n).map(|i| Shape { text: text(i, "a"), ..shape(i + 1, "") }).collect();
-    b.shapes = (0..n).map(|i| Shape { text: text(i, "b"), ..shape(n + i + 1, "") }).collect();
-    // One named pair at opposite ends.
-    a.shapes[0].name = "Logo".into();
-    b.shapes[n as usize - 1].name = "Logo".into();
-    // No wall-clock bound (it would flake on a loaded runner): at this size a quadratic pairing
-    // takes minutes, so a regression shows as a test that hangs rather than a failed assertion.
-    assert_eq!(morph_pairs(&a, &b), [(ShapeId(1), ShapeId(2 * n))]);
-    let p = deckcraft_model::defaults::new_presentation(None);
-    let f = morph_frame(&p, &a, &b, 0.5, &|_| false);
-    // Every shape fades in place; the named pair differs in text, so it cross-fades as two.
-    assert_eq!(f.shapes.len(), 2 * n as usize);
-}
-
-#[test]
-fn paragraph_states_of_a_large_build_stay_linear() {
-    let n = 20_000usize;
-    let mut s = slide_with(vec![]);
-    let mut body = TextBody::from_text(&vec!["line"; n].join("\n"));
-    // One first-level paragraph owning every other paragraph.
-    for p in body.paragraphs.iter_mut().skip(1) {
-        p.level = 1;
-    }
-    s.shapes[0].text = Some(body);
-    let mut a = anim(1, AnimClass::Entrance, "fade", AnimStart::OnClick);
-    a.text_build = TextBuild::ByParagraph;
-    s.animations = vec![a];
-    let tl = Timeline::new(&s, W, H);
-    // No wall-clock bound, as above: a per-paragraph scan of the slide would take minutes here.
-    assert_eq!(tl.paragraph_targets(ShapeId(1)).len(), n);
-    for p in 0..n {
-        assert!(!tl.state(ShapeId(1), Some(p), 0, 0.0).visible);
-        assert!(tl.state(ShapeId(1), Some(p), 1, 0.0).visible);
-    }
-    assert_eq!(tl.animated_shapes(), [ShapeId(1)]);
-}

crates/anim/src/timeline.rs

@@ -103,41 +103,6 @@ pub struct Timeline {
     /// By-paragraph builds animate first-level paragraphs; deeper paragraphs follow their parent:
     /// (shape, member paragraph, owner paragraph).
     groups: Vec<(ShapeId, usize, usize)>,
-    /// Lookups built with the timeline, so evaluating a shape or paragraph costs its own effects
-    /// rather than a scan of every effect, group and colour on the slide.
-    index: TimelineIndex,
-}
-
-#[derive(Clone, Debug, Default)]
-struct TimelineIndex {
-    /// Effects (indices into `effects`, in order) by target shape and paragraph.
-    by_target: HashMap<(ShapeId, Option<usize>), Vec<usize>>,
-    /// Effects (indices into `effects`, in order) by target shape.
-    by_shape: HashMap<ShapeId, Vec<usize>>,
-    /// Owner paragraph of each member paragraph (the first group recorded wins).
-    owner: HashMap<(ShapeId, usize), usize>,
-    /// Groups (member, owner) by shape, in order.
-    groups_by_shape: HashMap<ShapeId, Vec<(usize, usize)>>,
-    /// Base colour by shape (the first recorded wins).
-    color: HashMap<ShapeId, Rgba>,
-}
-
-impl TimelineIndex {
-    fn build(effects: &[Effect], groups: &[(ShapeId, usize, usize)], colors: &[(ShapeId, Rgba)]) -> TimelineIndex {
-        let mut ix = TimelineIndex::default();
-        for (i, e) in effects.iter().enumerate() {
-            ix.by_target.entry((e.timing.shape, e.timing.paragraph)).or_default().push(i);
-            ix.by_shape.entry(e.timing.shape).or_default().push(i);
-        }
-        for &(shape, member, owner) in groups {
-            ix.owner.entry((shape, member)).or_insert(owner);
-            ix.groups_by_shape.entry(shape).or_default().push((member, owner));
-        }
-        for &(shape, c) in colors {
-            ix.color.entry(shape).or_insert(c);
-        }
-        ix
-    }
 }
 
 enum Status {
@@ -359,7 +324,6 @@ impl Timeline {
             };
             tl.colors.push((id, c));
         }
-        tl.index = TimelineIndex::build(&tl.effects, &tl.groups, &tl.colors);
         tl
     }
 
@@ -449,12 +413,8 @@ impl Timeline {
 
     /// Paragraph indices of `shape` animated separately (by-paragraph builds).
     pub fn paragraph_targets(&self, shape: ShapeId) -> Vec<usize> {
-        let mine = self.index.by_shape.get(&shape).map_or(&[][..], Vec::as_slice);
-        let mut v: Vec<usize> = mine.iter().filter_map(|&i| self.effects.get(i)).filter_map(|e| e.timing.paragraph).collect();
-        let owners: HashSet<usize> = v.iter().copied().collect();
-        if let Some(groups) = self.index.groups_by_shape.get(&shape) {
-            v.extend(groups.iter().filter(|(_, owner)| owners.contains(owner)).map(|(member, _)| *member));
-        }
+        let mut v: Vec<usize> = self.effects.iter().filter(|e| e.timing.shape == shape).filter_map(|e| e.timing.paragraph).collect();
+        v.extend(self.groups.iter().filter(|g| g.0 == shape && v.contains(&g.2)).map(|g| g.1).collect::<Vec<_>>());
         v.sort_unstable();
         v.dedup();
         v
@@ -462,8 +422,13 @@ impl Timeline {
 
     /// Shapes with any effect.
     pub fn animated_shapes(&self) -> Vec<ShapeId> {
-        let mut seen: HashSet<ShapeId> = HashSet::new();
-        self.effects.iter().map(|e| e.timing.shape).filter(|s| seen.insert(*s)).collect()
+        let mut v: Vec<ShapeId> = Vec::new();
+        for e in &self.effects {
+            if !v.contains(&e.timing.shape) {
+                v.push(e.timing.shape);
+            }
+        }
+        v
     }
 
     /// State of `shape` (or of one of its paragraphs, `para`) when `step` main steps have been
@@ -491,9 +456,9 @@ impl Timeline {
         triggers: &[TriggerPlay],
         stamps: &[StepStamp],
     ) -> AnimState {
-        let para = para.map(|p| self.index.owner.get(&(shape, p)).copied().unwrap_or(p));
-        let mine = self.index.by_target.get(&(shape, para)).map_or(&[][..], Vec::as_slice).iter().filter_map(|&i| self.effects.get(i));
-        let base_color = self.index.color.get(&shape).copied().unwrap_or(Rgba::rgb(0x15, 0x60, 0x82));
+        let para = para.map(|p| self.groups.iter().find(|g| g.0 == shape && g.1 == p).map(|g| g.2).unwrap_or(p));
+        let mine = self.effects.iter().filter(|e| e.timing.shape == shape && e.timing.paragraph == para);
+        let base_color = self.colors.iter().find(|(s, _)| *s == shape).map(|(_, c)| *c).unwrap_or(Rgba::rgb(0x15, 0x60, 0x82));
         let mut st = AnimState::default();
         // Initial visibility comes from the first effect in the Animation Pane order.
         let mut ordered: Vec<&Effect> = mine.collect();

crates/fonts/src/shape.rs

@@ -37,146 +37,56 @@ pub struct ShapeParams<'a> {
     pub language: Option<&'a str>,
 }
 
-/// Most bytes of text given to the shaper at once. The shaper lets one call grow its buffers to
-/// 256 glyphs per character (a font's substitutions decide how many), so a long item is shaped in
-/// pieces of this size, each with the rest of the paragraph as context.
-const MAX_SHAPE_CHUNK: usize = 1024;
-/// Most glyphs kept per character of a piece: a piece the font expands further is laid out one
-/// glyph per character from the cmap instead.
-const MAX_GLYPHS_PER_CHAR: usize = 32;
-
 /// Shape `para[range]` with `face`, the rest of `para` as context. Glyphs are in visual order
 /// (left to right) and clusters are byte offsets into `para`. `map` substitutes characters (All
 /// Caps) without moving clusters. An empty or out-of-bounds range shapes nothing.
 pub fn shape_range(face: &FontFace, para: &str, range: Range<usize>, params: &ShapeParams, map: impl Fn(char) -> char) -> Vec<ShapedGlyph> {
-    let (Some(_), Some(text), Some(_)) = (para.get(..range.start), para.get(range.clone()), para.get(range.end..)) else {
+    let (Some(pre), Some(text), Some(post)) = (para.get(..range.start), para.get(range.clone()), para.get(range.end..)) else {
         return Vec::new();
     };
-    let chunks = chunks(text, MAX_SHAPE_CHUNK);
-    let mut pieces: Vec<Vec<ShapedGlyph>> = Vec::with_capacity(chunks.len());
+    let mut out = Vec::with_capacity(text.len());
     let shaped = face.hb().map(|hb| {
         let shaper = face.shaper.shaper(&hb).instance(face.instance.as_ref()).build();
-        // Pieces of one item share the script the whole item would be guessed to have.
-        let item_script = (chunks.len() > 1 && params.script.is_none()).then(|| {
-            let mut probe = UnicodeBuffer::new();
-            for c in text.chars() {
-                probe.add(map(c), 0);
-            }
-            probe.guess_segment_properties();
-            probe.script()
-        });
-        for c in &chunks {
-            let r = (range.start + c.start)..(range.start + c.end);
-            let (Some(pre), Some(piece), Some(post)) = (para.get(..r.start), para.get(r.clone()), para.get(r.end..)) else { continue };
-            let mut buf = UnicodeBuffer::new();
-            buf.set_pre_context(pre);
-            buf.set_post_context(post);
-            for (i, c) in piece.char_indices() {
-                buf.add(map(c), (r.start + i) as u32);
-            }
-            buf.guess_segment_properties();
-            if let Some(s) = params.script.and_then(|t| Script::from_iso15924_tag(Tag::new(&t))) {
-                buf.set_script(s);
-            } else if let Some(s) = item_script {
-                buf.set_script(s);
-            }
-            if let Some(l) =
-                params.language.or_else(|| params.script.and_then(crate::script::default_language)).and_then(|l| l.parse::<Language>().ok())
-            {
-                buf.set_language(l);
-            }
-            buf.set_direction(if params.rtl { Direction::RightToLeft } else { Direction::LeftToRight });
-            let gb = shaper.shape(buf, ShapeOptions::new().features(params.features));
-            let budget = piece.chars().count().saturating_mul(MAX_GLYPHS_PER_CHAR);
-            if gb.len() > budget {
-                // Font-controlled expansion past anything real text needs: keep it bounded.
-                pieces.push(cmap_glyphs(face, para, r, params.rtl, &map));
-                continue;
-            }
-            pieces.push(
-                gb.glyph_infos()
-                    .iter()
-                    .zip(gb.glyph_positions())
-                    .map(|(info, pos)| ShapedGlyph {
-                        gid: info.glyph_id,
-                        cluster: info.cluster as usize,
-                        x_advance: pos.x_advance,
-                        x_offset: pos.x_offset,
-                        y_offset: pos.y_offset,
-                    })
-                    .collect(),
-            );
+        let mut buf = UnicodeBuffer::new();
+        buf.set_pre_context(pre);
+        buf.set_post_context(post);
+        for (i, c) in text.char_indices() {
+            buf.add(map(c), (range.start + i) as u32);
+        }
+        buf.guess_segment_properties();
+        if let Some(s) = params.script.and_then(|t| Script::from_iso15924_tag(Tag::new(&t))) {
+            buf.set_script(s);
+        }
+        if let Some(l) = params.language.or_else(|| params.script.and_then(crate::script::default_language)).and_then(|l| l.parse::<Language>().ok())
+        {
+            buf.set_language(l);
+        }
+        buf.set_direction(if params.rtl { Direction::RightToLeft } else { Direction::LeftToRight });
+        let gb = shaper.shape(buf, ShapeOptions::new().features(params.features));
+        for (info, pos) in gb.glyph_infos().iter().zip(gb.glyph_positions()) {
+            out.push(ShapedGlyph {
+                gid: info.glyph_id,
+                cluster: info.cluster as usize,
+                x_advance: pos.x_advance,
+                x_offset: pos.x_offset,
+                y_offset: pos.y_offset,
+            });
         }
     });
-    if shaped.is_none() {
+    if shaped.is_none()
+        && let Some(f) = face.skrifa()
+    {
         // No shaper for this face: one glyph per character from the cmap, in visual order.
-        return cmap_glyphs(face, para, range, params.rtl, &map);
-    }
-    // Each piece is in visual order; right to left, the later pieces come first.
-    if params.rtl {
-        pieces.reverse();
-    }
-    let mut out = Vec::with_capacity(pieces.iter().map(Vec::len).sum());
-    for p in pieces {
-        out.extend(p);
-    }
-    out
-}
-
-/// One glyph per character of `para[range]` from the cmap, in visual order.
-fn cmap_glyphs(face: &FontFace, para: &str, range: Range<usize>, rtl: bool, map: &impl Fn(char) -> char) -> Vec<ShapedGlyph> {
-    let (Some(text), Some(f)) = (para.get(range.clone()), face.skrifa()) else { return Vec::new() };
-    let cmap = f.charmap();
-    let gm = f.glyph_metrics(Size::unscaled(), face.location());
-    let mut out = Vec::with_capacity(text.len());
-    for (i, c) in text.char_indices() {
-        let g = cmap.map(map(c)).unwrap_or_default();
-        let adv = gm.advance_width(g).unwrap_or(face.upem as f32 * 0.5);
-        out.push(ShapedGlyph { gid: g.to_u32(), cluster: range.start + i, x_advance: adv.round() as i32, x_offset: 0, y_offset: 0 });
-    }
-    if rtl {
-        out.reverse();
-    }
-    out
-}
-
-/// `text` cut into byte ranges of at most `max` bytes (or one character, if longer), at the last
-/// space of a piece where there is one, else before a character that starts a cluster (not a
-/// combining mark or joiner, not after a joiner). Text that fits is one piece.
-fn chunks(text: &str, max: usize) -> Vec<Range<usize>> {
-    use unicode_bidi::BidiClass::{BN, NSM};
-    let mut out = Vec::new();
-    let mut start = 0;
-    while text.len() - start > max {
-        let window = text.get(start..).unwrap_or_default();
-        let mut space = None;
-        let mut boundary = None;
-        let mut any = None;
-        let mut prev: Option<char> = None;
-        for (i, c) in window.char_indices() {
-            if i > max {
-                break;
-            }
-            if i > 0 {
-                any = Some(i);
-                let joined = prev.is_some_and(|p| matches!(unicode_bidi::bidi_class(p), BN));
-                if !joined && !matches!(unicode_bidi::bidi_class(c), NSM | BN) {
-                    boundary = Some(i);
-                    if prev.is_some_and(char::is_whitespace) {
-                        space = Some(i);
-                    }
-                }
-            }
-            prev = Some(c);
+        let cmap = f.charmap();
+        let gm = f.glyph_metrics(Size::unscaled(), face.location());
+        for (i, c) in text.char_indices() {
+            let g = cmap.map(map(c)).unwrap_or_default();
+            let adv = gm.advance_width(g).unwrap_or(face.upem as f32 * 0.5);
+            out.push(ShapedGlyph { gid: g.to_u32(), cluster: range.start + i, x_advance: adv.round() as i32, x_offset: 0, y_offset: 0 });
+        }
+        if params.rtl {
+            out.reverse();
         }
-        // A piece always moves forward by at least one character.
-        let first = window.chars().next().map_or(window.len(), char::len_utf8);
-        let cut = space.filter(|&i| i >= max / 2).or(boundary).or(any).unwrap_or(first).max(first);
-        out.push(start..start + cut);
-        start += cut;
-    }
-    if start < text.len() || out.is_empty() {
-        out.push(start..text.len());
     }
     out
 }
@@ -211,37 +121,4 @@ mod tests {
         // Not a char boundary.
         assert!(shape_range(&face, "سنة", 1..2, &ShapeParams::default(), |c| c).is_empty());
     }
-
-    #[test]
-    fn long_items_are_shaped_in_bounded_pieces() {
-        for text in ["word ".repeat(2_000), "e\u{301}".repeat(2_000), "x".repeat(5_000), "\u{1f469}\u{200d}\u{1f4bb} ".repeat(500)] {
-            let pieces = chunks(&text, MAX_SHAPE_CHUNK);
-            assert_eq!(pieces.first().map(|r| r.start), Some(0));
-            assert_eq!(pieces.last().map(|r| r.end), Some(text.len()));
-            for w in pieces.windows(2) {
-                assert_eq!(w[0].end, w[1].start);
-            }
-            for r in &pieces {
-                assert!(!r.is_empty() && r.len() <= MAX_SHAPE_CHUNK);
-                // Never before a combining mark, never after a joiner.
-                let rest = &text[r.end..];
-                assert!(!rest.starts_with('\u{301}'));
-                assert!(!text[..r.end].ends_with('\u{200d}') || rest.is_empty());
-            }
-        }
-        assert_eq!(chunks("short", MAX_SHAPE_CHUNK), vec![0..5]);
-        assert_eq!(chunks("", MAX_SHAPE_CHUNK), vec![0..0]);
-    }
-
-    #[test]
-    fn long_items_keep_every_cluster_in_visual_order() {
-        let face = FontDb::global().face(DEFAULT_FAMILY, "Regular");
-        let text = "ab cd ".repeat(1_000);
-        let g = shape_range(&face, &text, 0..text.len(), &ShapeParams::default(), |c| c);
-        assert_eq!(g.len(), text.len());
-        assert!(g.windows(2).all(|w| w[0].cluster < w[1].cluster));
-        let rtl = shape_range(&face, &text, 0..text.len(), &ShapeParams { rtl: true, ..Default::default() }, |c| c);
-        assert_eq!(rtl.len(), text.len());
-        assert!(rtl.windows(2).all(|w| w[0].cluster > w[1].cluster));
-    }
 }

crates/h264/src/cabac_mb.rs

@@ -48,7 +48,7 @@ impl SliceDecoder<'_> {
         let intra_slice = self.sh.slice_type.is_intra();
         loop {
             ensure!(addr < total, "macroblock address {addr} out of range");
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             let skip = !intra_slice && self.decode_skip_flag(&mut c);
             if skip {
                 self.decode_skip()?;

crates/h264/src/decoder.rs

@@ -451,7 +451,11 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 1,
         };
-        let pictures = (sps.max_dpb_frames() + 1 + self.max_in_flight) as u64;
+        // Pictures waiting for output that already left the DPB are held too (one decode call may
+        // carry many access units). A buffer shared with a DPB entry is counted once.
+        let queued = self.out_queue.iter().filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame))).count();
+        let dpb = sps.max_dpb_frames().max(self.dpb.entries.len());
+        let pictures = (dpb + 1 + self.max_in_flight.max(queued)) as u64;
         ensure!(
             shape.fits(pictures, self.memory_budget),
             "{}x{} pictures with {pictures} in the decoder exceed the memory budget",

crates/h264/src/dpb.rs

@@ -139,8 +139,9 @@ impl Dpb {
         let mut unused = (prev_ref_frame_num + 1) % max_frame_num;
         // Only the last `max_num_ref_frames` "non-existing" frames can survive the sliding window, and
         // inserting more than that evicts every earlier short-term reference. Skip straight to that tail
-        // (keeping the POC state walk for every missing frame_num) so a hostile gap of up to 65535
-        // frames costs at most `max_num_ref_frames` frame allocations instead of one per missing frame.
+        // (advancing the POC state across the skipped run in constant time) so a hostile gap of up to
+        // 65535 frames costs at most `max_num_ref_frames` frame allocations and POC updates instead of
+        // one per missing frame.
         let gap = frame_num.wrapping_add(max_frame_num).wrapping_sub(unused) % max_frame_num;
         let keep = u32::try_from(max_num_ref_frames.max(1)).unwrap_or(u32::MAX);
         let skip = gap.saturating_sub(keep);
@@ -149,10 +150,17 @@ impl Dpb {
                 e.mark = RefMark::Unused;
             }
             self.prune();
-            for _ in 0..skip {
-                poc_state(unused);
-                unused = (unused + 1) % max_frame_num;
+            // The POC state only advances FrameNumOffset where frame_num decreases, so walking the
+            // skipped run is the same as visiting its first value, the wrap (if the run crosses
+            // it) and its last value: constant work however long the gap.
+            let last = (unused + (skip - 1) % max_frame_num) % max_frame_num;
+            poc_state(unused);
+            if last < unused {
+                poc_state(max_frame_num - 1);
+                poc_state(0);
             }
+            poc_state(last);
+            unused = (last + 1) % max_frame_num;
         }
         let mut guard = 0;
         while unused != frame_num && guard < max_frame_num {
@@ -438,14 +446,15 @@ impl Dpb {
                 }
             }
         } else {
-            while self.entries.len() >= self.capacity {
+            // Evict until there is room (frame_num gap concealment can leave the DPB over-full), so
+            // the store never holds more pictures than the memory budget was checked for.
+            while self.entries.len() >= self.capacity.max(1) {
                 if !self.bump(out) {
                     if let Some(pos) = self.entries.iter().position(|e| !e.needed_for_output) {
                         self.entries.remove(pos);
                     } else {
                         self.entries.remove(0);
                     }
-                    break;
                 }
             }
         }
@@ -546,6 +555,37 @@ mod tests {
         (made, walk, left)
     }
 
+    /// (FrameNumOffset, prev frame_num) after `walk`, by the rule of `PocState::update_gap_frame`.
+    fn poc_after(walk: &[u32], prev: u32, max: u32) -> (u64, u32) {
+        walk.iter().fold((0, prev), |(off, prev), &f| (if prev > f { off + u64::from(max) } else { off }, f))
+    }
+
+    #[test]
+    fn gap_walk_matches_every_frame_num_for_any_skip() {
+        for (prev, cur) in [(1, 9), (10, 3), (14, 0), (15, 14), (0, 15), (7, 6)] {
+            for refs in 1..4 {
+                let mut dpb = Dpb::new();
+                let (_, walk, _) = fill(&mut dpb, prev, cur, 16, refs);
+                let every: Vec<u32> = (1..16).map(|i| (prev + i) % 16).take_while(|&f| f != cur).collect();
+                assert_eq!(poc_after(&walk, prev, 16), poc_after(&every, prev, 16), "{prev} -> {cur}, {refs} refs");
+                assert_eq!(walk.last(), every.last(), "{prev} -> {cur}, {refs} refs");
+            }
+        }
+    }
+
+    #[test]
+    fn reference_store_evicts_down_to_capacity() {
+        let mut dpb = Dpb::new();
+        dpb.capacity = 2;
+        // Gap concealment can leave more non-output references than the capacity.
+        for i in 0..5 {
+            short(&mut dpb, i, i);
+        }
+        let mut out = Vec::new();
+        assert!(!dpb.bump_for_space(RefMark::Short, 0, &mut out));
+        assert!(dpb.entries.len() < 2, "{} pictures left before storing into a 2-picture DPB", dpb.entries.len());
+    }
+
     #[test]
     fn huge_gap_makes_only_the_frames_that_stay_referenced() {
         let mut dpb = Dpb::new();
@@ -553,8 +593,9 @@ mod tests {
         short(&mut dpb, 2, 1);
         let (made, walk, left) = fill(&mut dpb, 1, 65535, 65536, 4);
         assert_eq!(made, 4);
-        // The POC state still walks every missing frame_num, in order.
-        assert_eq!(walk.len(), 65533);
+        // The POC state ends where walking every missing frame_num would leave it, in a few steps.
+        assert_eq!(poc_after(&walk, 1, 65536), poc_after(&(2..65535).collect::<Vec<_>>(), 1, 65536));
+        assert!(walk.len() <= 8, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&2));
         assert_eq!(walk.last(), Some(&65534));
         assert_eq!(left, vec![(65531, true), (65532, true), (65533, true), (65534, true)]);
@@ -566,7 +607,9 @@ mod tests {
         short(&mut dpb, 1, 65000);
         let (made, walk, left) = fill(&mut dpb, 65000, 3, 65536, 2);
         assert_eq!(made, 2);
-        assert_eq!(walk.len(), 538);
+        let every: Vec<u32> = (65001..65536).chain(0..3).collect();
+        assert_eq!(poc_after(&walk, 65000, 65536), poc_after(&every, 65000, 65536));
+        assert!(walk.len() <= 6, "{} POC updates", walk.len());
         assert_eq!(walk.first(), Some(&65001));
         assert_eq!(walk.last(), Some(&2));
         assert_eq!(left, vec![(1, true), (2, true)]);

crates/h264/src/slicedec.rs

@@ -346,8 +346,11 @@ impl<'a> SliceDecoder<'a> {
     // Neighbour helpers
     // ------------------------------------------------------------------------------------------
 
-    /// Set up the current macroblock address and neighbour availability.
-    pub fn start_mb(&mut self, addr: usize) {
+    /// Set up the current macroblock address and neighbour availability. A macroblock an earlier
+    /// slice of this picture already decoded is refused: overlapping slices would otherwise redo
+    /// the picture's reconstruction once per slice.
+    pub fn start_mb(&mut self, addr: usize) -> Result<()> {
+        ensure!(self.pic.mbs[addr].slice_num == u32::MAX, "macroblock {addr} overlaps an earlier slice");
         self.mb_addr = addr;
         self.mb_x = addr % self.mb_w;
         self.mb_y = addr / self.mb_w;
@@ -364,6 +367,7 @@ impl<'a> SliceDecoder<'a> {
         ];
         self.mv_done = 0;
         self.pic.mbs[addr] = MbState { slice_num: sn, ..MbState::default() };
+        Ok(())
     }
 
     #[inline]
@@ -1467,7 +1471,7 @@ impl<'a> SliceDecoder<'a> {
                 let run = r.read_ue()? as usize;
                 ensure!(addr + run <= total, "mb_skip_run out of range");
                 for _ in 0..run {
-                    self.start_mb(addr);
+                    self.start_mb(addr)?;
                     self.decode_skip()?;
                     self.pic.mb_done(addr);
                     addr += 1;
@@ -1477,7 +1481,7 @@ impl<'a> SliceDecoder<'a> {
                 }
                 ensure!(addr < total, "macroblock address {addr} out of range");
             }
-            self.start_mb(addr);
+            self.start_mb(addr)?;
             self.decode_mb_cavlc(r)?;
             self.pic.mb_done(addr);
             addr += 1;

crates/h264/src/synth_tests.rs

@@ -113,6 +113,7 @@ fn avcc_rejects_a_valid_picture_slice_without_starting_a_picture() {
             poc_lsb: Some(0),
             poc_delta: None,
             wt: None,
+            first_mb: 0,
         },
         false,
     );
@@ -153,6 +154,8 @@ struct Pic {
     /// Explicit weights (luma, cb, cr) as (weight, offset) for refIdx 0 of list 0 and list 1;
     /// log2 denominators are 5 (luma) and 3 (chroma).
     wt: Option<[[(i32, i32); 3]; 2]>,
+    /// first_mb_in_slice (`mbs` then lists the slice's macroblocks from there).
+    first_mb: u32,
 }
 
 impl Pic {
@@ -165,7 +168,7 @@ impl Pic {
 }
 
 fn slice_header(w: &mut BitWriter, p: &Pic, cabac: bool) {
-    w.write_ue(0); // first_mb
+    w.write_ue(p.first_mb);
     w.write_ue(if p.b {
         6
     } else if p.is_p() {
@@ -660,3 +663,55 @@ fn frame_num_gap_is_filled_when_the_sps_allows_gaps() {
     assert_eq!(out.len(), 2);
     assert_eq!(dec.stats().frame_num_gaps, 1);
 }
+
+/// An IDR picture followed by `pictures` reference P pictures of P_Skip macroblocks.
+fn skip_stream(pictures: u32) -> (Vec<u8>, Vec<Vec<u8>>) {
+    let mut seed = 11u32;
+    let a: Vec<Option<Vec<u8>>> = (0..NMB).map(|_| Some(random_mb(&mut seed))).collect();
+    let mut head = sps(66, 2, false, PocType::T2);
+    head.extend(pps(false, false));
+    head.extend(slice_nal(&Pic { idr: true, frame_num: 0, ref_idc: 3, mbs: a, ..Default::default() }, false));
+    let ps = (1..=pictures).map(|k| slice_nal(&Pic { frame_num: k % 16, ref_idc: 2, mbs: vec![None; NMB], ..Default::default() }, false)).collect();
+    (head, ps)
+}
+
+#[test]
+fn overlapping_slices_are_not_reconstructed_twice() {
+    let (head, ps) = skip_stream(1);
+    let mut once = Decoder::with_threads(1);
+    let mut out = once.decode(&[head.clone(), ps[0].clone()].concat(), 0).unwrap();
+    out.extend(once.flush());
+    assert!(once.take_error().is_none());
+    assert_eq!(out.len(), 2);
+    // A second slice of the same picture starting at macroblock 1 covers those macroblocks again.
+    let again = slice_nal(&Pic { frame_num: 1, ref_idc: 2, mbs: vec![None; NMB - 1], first_mb: 1, ..Default::default() }, false);
+    let mut twice = Decoder::with_threads(1);
+    let result = twice.decode(&[head, ps[0].clone(), again].concat(), 0);
+    twice.flush();
+    let err = result.err().or_else(|| twice.take_error()).expect("overlapping slice refused");
+    assert!(err.to_string().contains("overlaps"), "{err}");
+}
+
+#[test]
+fn output_queue_counts_against_the_memory_budget() {
+    let (head, ps) = skip_stream(40);
+    let sps_nal = sps(66, 2, false, PocType::T2);
+    let parsed = crate::params::Sps::parse(&deckcraft_bitstream::unescape_rbsp(&sps_nal[5..])).unwrap();
+    let one = (NMB * 256 + 2 * NMB * 64) as u64;
+    let budget = (parsed.max_dpb_frames() + 1 + 3) as u64 * one;
+    // One access unit per call: output drains as it goes, and the stream fits.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let mut out = dec.decode(&head, 0).unwrap();
+    for (i, p) in ps.iter().enumerate() {
+        out.extend(dec.decode(p, i as i64 + 1).unwrap());
+    }
+    out.extend(dec.flush());
+    assert!(dec.take_error().is_none());
+    assert_eq!(out.len(), 41);
+    // Every access unit in one call: the pictures held for output stop fitting the budget.
+    let mut dec = Decoder::with_threads(1);
+    dec.set_memory_budget(budget);
+    let err = dec.decode(&[head, ps.concat()].concat(), 0).expect_err("output queue is over budget");
+    assert!(err.to_string().contains("memory budget"), "{err}");
+}

crates/text/src/breaking.rs

@@ -260,15 +260,12 @@ pub(crate) struct Tab {
     align: TabAlign,
 }
 
-/// The paragraph's tab stops in position order (a stop at no finite position is left out), so
-/// [`tab_advance`] finds the next one by binary search instead of a scan per tab.
 pub(crate) fn tabs_of(props: &ParaProps) -> Vec<Tab> {
-    let mut tabs: Vec<Tab> = props
+    props
         .tabs
         .as_ref()
         .map(|t| {
             t.iter()
-                .filter(|s| s.pos.is_finite())
                 .map(|s| Tab {
                     pos: s.pos,
                     align: match s.align.as_str() {
@@ -280,9 +277,7 @@ pub(crate) fn tabs_of(props: &ParaProps) -> Vec<Tab> {
                 })
                 .collect()
         })
-        .unwrap_or_default();
-    tabs.sort_by(|a, b| a.pos.total_cmp(&b.pos));
-    tabs
+        .unwrap_or_default()
 }
 
 /// Width of the text after the tab at cell `i` up to the next tab or line break, and the width of
@@ -306,15 +301,16 @@ pub(crate) fn tab_segment(cells: &[Cell], i: usize) -> (f64, f64) {
 /// (`seg`: its width, and its width before the decimal point) as the stop aligns it but never
 /// moving back, as PowerPoint does; past the last stop, to the next default stop.
 pub(crate) fn tab_advance(x: f64, stops: &[Tab], default_tab: f64, seg: (f64, f64)) -> f64 {
-    // `stops` is in position order (`tabs_of`): the next stop is the first past x.
-    if let Some(s) = stops.get(stops.partition_point(|s| s.pos <= x + 0.5)) {
-        let to = s.pos - x;
-        return match s.align {
-            TabAlign::Left => to,
-            TabAlign::Right => (to - seg.0).max(0.0),
-            TabAlign::Center => (to - seg.0 / 2.0).max(0.0),
-            TabAlign::Decimal => (to - seg.1).max(0.0),
-        };
+    for s in stops {
+        if s.pos > x + 0.5 {
+            let to = s.pos - x;
+            return match s.align {
+                TabAlign::Left => to,
+                TabAlign::Right => (to - seg.0).max(0.0),
+                TabAlign::Center => (to - seg.0 / 2.0).max(0.0),
+                TabAlign::Decimal => (to - seg.1).max(0.0),
+            };
+        }
     }
     let d = if default_tab > 1.0 { default_tab } else { 72.0 };
     let next = ((x / d).floor() + 1.0) * d;

crates/text/src/tests.rs

@@ -1416,16 +1416,6 @@ fn tab_stops_align_the_text_after_them() {
     assert!((l.lines[0].edges[4].0 - x0(&l) - 72.0).abs() < 0.01);
 }
 
-#[test]
-fn many_tabs_over_many_stops_lay_out_by_position() {
-    // 20,000 stops given out of order, and 2,000 tabs: each tab finds the next stop by position.
-    let mut stops: Vec<(f64, &str)> = (1..=20_000).rev().map(|k| (k as f64 * 0.05 + 30.0, "l")).collect();
-    stops.push((f64::NAN, "l"));
-    let text = "a\t".repeat(2_000);
-    let l = tabbed(&text, &stops, 1.0e6);
-    assert!((l.lines[0].edges[2].0 - l.inner.x0 - 30.05).abs() < 0.01, "{:?}", &l.lines[0].edges[..3]);
-}
-
 #[test]
 fn a_tab_past_the_end_moves_to_the_next_line() {
     // PowerPoint: "abcdefghij\tk\tl\tm…" in a narrow box puts the tab that doesn't fit on the next