fix(pptx): warn when custom geometry paths are left out for the guide-cache limits

- crates/pptx/src/custgeom.rs

.github/workflows/release.yml

@@ -1,10 +1,6 @@
 name: Release
 
 on:
-  # A nightly dry run on main: every release build except macOS, nothing signed or released
-  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
-  schedule:
-    - cron: "16 1 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -34,7 +30,6 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
-      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: deckcraft
       app-title: DeckCraft
       # Keep identical to ci.yml and freebsd.yml. The shared release workflow sets

Cargo.lock

@@ -1038,7 +1038,7 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"
 
 [[package]]
 name = "deckcraft"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "arboard",
  "chrono",
@@ -1060,7 +1060,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-anim"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-geom",
  "deckcraft-model",
@@ -1069,7 +1069,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-av1"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1078,14 +1078,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-bitstream"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-media",
 ]
 
 [[package]]
 name = "deckcraft-cli"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-mcp",
@@ -1095,14 +1095,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-color"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "deckcraft-engine"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "deckcraft-anim",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-fonts"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "epaint_default_fonts",
  "harfrust 0.13.3",
@@ -1140,7 +1140,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-format"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-model",
  "serde",
@@ -1151,7 +1151,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-geom"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "kurbo",
  "serde",
@@ -1159,7 +1159,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-h264"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1168,7 +1168,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-hevc"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1177,7 +1177,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-mcp"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-render",
@@ -1187,7 +1187,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-media"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-audio",
  "craft-media",
@@ -1203,7 +1203,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-metafile"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "image",
  "kurbo",
@@ -1212,7 +1212,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-model"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-color",
  "deckcraft-geom",
@@ -1224,7 +1224,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-pdf"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-pdf",
  "deckcraft-fonts",
@@ -1242,7 +1242,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-pptx"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-color",
  "deckcraft-engine",
@@ -1258,7 +1258,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-render"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-anim",
  "deckcraft-color",
@@ -1277,7 +1277,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-text"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "chrono",
  "deckcraft-color",
@@ -1291,7 +1291,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-ui-egui"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-ui",
  "craft-update",
@@ -1317,7 +1317,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-vp9"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1326,7 +1326,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-web"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -6311,7 +6311,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.18.1"
+version = "0.18.0"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]
 
 [workspace.package]
-version = "0.18.1"
+version = "0.18.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

crates/av1/src/decoder.rs

@@ -118,8 +118,6 @@ enum Output {
         grain: FilmGrainParams,
         apply_film_grain: bool,
         pts: i64,
-        /// What copying the picture out costs, in the reference's own format.
-        bytes: u64,
     },
 }
 
@@ -134,7 +132,7 @@ impl Output {
     fn take(self) -> Result<Picture> {
         match self {
             Output::Decoded(s) => s.wait().map(|p| Arc::try_unwrap(p).unwrap_or_else(|p| (*p).clone())),
-            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts, .. } => {
+            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts } => {
                 let rf = slot.wait()?;
                 Ok(output_picture(&seq, &rf, width, height, &grain, apply_film_grain, pts))
             }
@@ -381,8 +379,8 @@ impl Decoder {
         // Output policy (7.18.1 note): with scalability, show one frame per temporal unit, the
         // highest spatial layer present.
         let scalable = self.seq.as_ref().is_some_and(|s| s.op_idc != 0);
-        let kept: Vec<Output> = if !scalable {
-            out.into_iter().map(|(o, _, _)| o).collect()
+        if !scalable {
+            self.out.extend(out.into_iter().map(|(o, _, _)| o));
         } else {
             let mut last: Option<(usize, u32)> = None;
             let mut sel: Vec<Output> = Vec::new();
@@ -402,27 +400,8 @@ impl Decoder {
                     }
                 }
             }
-            sel
-        };
-        // Every repeat is copied out whole, so the repeats this call keeps (after the layer
-        // selection) must not queue more than half the decoder budget; the first one over it and
-        // everything after is dropped.
-        let mut r = r;
-        let mut repeat_bytes = 0u64;
-        let mut ok = Vec::with_capacity(kept.len());
-        for o in kept {
-            if let Output::Existing { bytes, .. } = &o {
-                repeat_bytes = repeat_bytes.saturating_add(*bytes);
-                if repeat_bytes > self.memory_budget / 2 {
-                    if r.is_ok() {
-                        r = Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
-                    }
-                    break;
-                }
-            }
-            ok.push(o);
+            self.out.extend(sel);
         }
-        self.out.extend(ok);
         r
     }
 
@@ -524,15 +503,6 @@ impl Decoder {
             let idx = fh.frame_to_show_map_idx;
             let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
             let info = self.refs[idx].clone();
-            // Sized in the reference's own format: a new sequence header may differ from it.
-            let shape = deckcraft_bitstream::budget::PictureShape {
-                width: u64::from(info.upscaled_width),
-                height: u64::from(info.frame_height),
-                shift_x: u32::from(info.subsampling_x),
-                shift_y: u32::from(info.subsampling_y),
-                chroma_planes: if info.mono_chrome { 0 } else { 2 },
-                bytes_per_sample: 2,
-            };
             let o = Output::Existing {
                 slot: slot.clone(),
                 seq: seq.clone(),
@@ -541,7 +511,6 @@ impl Decoder {
                 grain: fh.film_grain.clone(),
                 apply_film_grain: self.apply_film_grain,
                 pts: self.pts,
-                bytes: shape.bytes().unwrap_or(u64::MAX),
             };
             if fh.frame_type == KEY_FRAME as u8 {
                 // reference frame loading process (7.21) then refresh every slot (7.20)
@@ -660,9 +629,6 @@ impl Decoder {
                 ri.lf_deltas = fh.lf.deltas;
                 ri.seg_features = fh.seg.features;
                 ri.grain = fh.film_grain.clone();
-                ri.subsampling_x = job.seq.color.subsampling_x;
-                ri.subsampling_y = job.seq.color.subsampling_y;
-                ri.mono_chrome = job.seq.color.mono_chrome;
                 self.ref_frames[i] = Some(job.slot.clone());
             }
         }
@@ -811,14 +777,6 @@ fn decode_frame(job: &FrameJob, pool: &Pool, stats: &mut DecodeStats) -> Result<
     Ok((rf, pic))
 }
 
-/// Bytes all parallel tile states may hold of whole-frame CDEF and restoration metadata; past it
-/// the tiles decode one after another on the frame's own metadata.
-const TILE_METADATA_BUDGET: usize = 256 << 20;
-
-fn tile_metadata_fits(tiles: usize, per_tile: usize) -> bool {
-    tiles.checked_mul(per_tile).is_some_and(|n| n <= TILE_METADATA_BUDGET)
-}
-
 /// Decode the tiles of a frame (tile number, data), in parallel when several; returns the final
 /// CDFs of tile context_update_tile_id.
 fn decode_tiles(pool: &Pool, fs: &mut FrameState, cdfs: &Cdfs, tiles: &[(usize, Vec<u8>)]) -> Result<Option<Box<Cdfs>>> {
@@ -832,7 +790,7 @@ fn decode_tiles(pool: &Pool, fs: &mut FrameState, cdfs: &Cdfs, tiles: &[(usize,
     };
     // Intra block copy reads the current frame through the tile's own buffer: keep whole-frame
     // buffers (tiles one after another) for it.
-    if tiles.len() > 1 && pool.is_parallel() && !fs.fh.allow_intrabc && tile_metadata_fits(tiles.len(), fs.tile_metadata_bytes()) {
+    if tiles.len() > 1 && pool.is_parallel() && !fs.fh.allow_intrabc {
         let mut states: Vec<TileState> = tiles
             .iter()
             .map(|(num, _)| {
@@ -1117,14 +1075,6 @@ mod guard_tests {
 #[cfg(test)]
 mod budget_tests {
     use super::*;
-
-    #[test]
-    fn tile_metadata_copies_are_budgeted() {
-        assert!(tile_metadata_fits(64, 1 << 20));
-        assert!(!tile_metadata_fits(4096, 1 << 20));
-        assert!(!tile_metadata_fits(usize::MAX, 2));
-    }
-
     use deckcraft_bitstream::budget::DECODE_MEMORY_BUDGET;
 
     fn color(mono: bool) -> crate::header::ColorConfig {

crates/av1/src/header.rs

@@ -360,10 +360,6 @@ pub struct RefInfo {
     pub lf_deltas: LoopFilterDeltas,
     pub seg_features: SegmentationFeatures,
     pub grain: FilmGrainParams,
-    /// The colour format the frame was decoded in (a later sequence header may change it).
-    pub subsampling_x: u8,
-    pub subsampling_y: u8,
-    pub mono_chrome: bool,
 }
 
 /// A parsed uncompressed frame header with its derived variables.

crates/av1/src/state.rs

@@ -253,13 +253,6 @@ impl FrameState {
         self.lr = t.lr;
     }
 
-    /// Bytes of CDEF and loop-restoration metadata each parallel tile state copies whole.
-    pub fn tile_metadata_bytes(&self) -> usize {
-        let lr = &self.lr;
-        // 1 (type) + 6 (Wiener) + 1 (SGR set) + 2 (SGR weights) bytes per unit.
-        self.cdef.len() + lr.lr_type.iter().map(|v| v.len() * 10).sum::<usize>()
-    }
-
     /// Private buffers for the tile covering mode info rows [r0, r1) x columns [c0, c1); tiles
     /// on the right / bottom frame edge also cover the allocation margins.
     pub fn tile_state(&self, r0: usize, r1: usize, c0: usize, c1: usize) -> TileState {

crates/hevc/src/decoder.rs

@@ -404,36 +404,10 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 2,
         };
-        let frame_bytes = |f: &crate::picture::Frame| {
-            (f.width as u64)
-                .saturating_mul(f.height as u64)
-                .saturating_add((f.cwidth as u64).saturating_mul(f.cheight as u64).saturating_mul(2))
-                .saturating_mul(2)
-        };
-        // Output frames waiting to be returned stay allocated after they leave the DPB, at their
-        // own size: a resolution change in this call can leave pictures of the previous SPS.
-        let queued: u64 = self
-            .out_queue
-            .iter()
-            .filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame)) && !self.in_flight.iter().any(|f| Arc::ptr_eq(f, &o.frame)))
-            .map(|o| frame_bytes(&o.frame))
-            .fold(0, u64::saturating_add);
-        // Frames the DPB holds now count at their own size too (an SPS change flushes them into the
-        // queue before the new pictures are made): the DPB part is the larger of its new slots and that.
-        let held: u64 = self.dpb.entries.iter().map(|e| frame_bytes(&e.frame)).fold(0, u64::saturating_add);
-        // A queued frame still being decoded is one of the in-flight pictures already reserved, so the
-        // queue and the in-flight reservation overlap: charge the larger, not both.
         let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
-        let slots = shape.store_bytes(u64::from(sps.max_dec_pic_buffering));
-        let flight = shape.store_bytes(self.max_in_flight as u64);
-        let total = shape
-            .store_bytes(1)
-            .zip(slots)
-            .zip(flight)
-            .map(|((one, slots), flight)| slots.max(held).saturating_add(one).saturating_add(flight).saturating_add(queued));
         ensure!(
-            total.is_some_and(|b| b <= self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder and {queued} bytes queued exceed the memory budget",
+            shape.fits(pictures, self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
             sps.width,
             sps.height
         );

crates/pptx/src/custgeom.rs

@@ -15,6 +15,14 @@ use crate::xml::{A, El, W};
 
 const DEG: f64 = 60_000.0;
 
+/// Distinct path coordinate spaces whose guides are evaluated for one custom geometry; paths in
+/// further spaces are left out.
+const MAX_SPACES: usize = 16;
+
+/// Guide-name bytes all cached spaces may hold between them; the first space counts towards it but is always kept.
+/// Every space copies the names, which the XML limits bound only once.
+const MAX_SPACE_NAME_BYTES: usize = 4 << 20;
+
 /// Guide variables for one shape.
 pub struct Guides {
     vars: HashMap<String, f64>,
@@ -66,6 +74,10 @@ impl Guides {
         set("7cd8", 18_900_000.0);
         Guides { vars: v }
     }
+    /// Bytes of the guide names held.
+    fn name_bytes(&self) -> usize {
+        self.vars.keys().map(String::len).sum()
+    }
     pub fn get(&self, name: &str) -> f64 {
         let name = name.trim();
         if let Some(v) = self.vars.get(name) {
@@ -149,16 +161,51 @@ fn pt(g: &Guides, e: &El) -> (f64, f64) {
 /// Convert `a:custGeom` to custom paths. `w`/`h` is the shape size in EMU (used for guides and for
 /// paths that don't give their own coordinate space).
 pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
+    read_cust_geom_counting(cg, w_emu, h_emu).0
+}
+
+/// [`read_cust_geom`], and how many paths were left out for lack of room in the guide caches
+/// (`(too many coordinate spaces, too many guide-name bytes)`); each cause is also logged once.
+fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>, (usize, usize)) {
     let mut out = vec![];
-    let Some(pl) = cg.child("pathLst") else { return out };
+    let mut dropped = (0usize, 0usize);
+    let Some(pl) = cg.child("pathLst") else { return (out, dropped) };
+    let mut spaces: HashMap<(u64, u64), Guides> = HashMap::new();
+    let mut name_bytes = 0usize;
+    let mut budget_full = false;
+    // The cap on cached spaces saves guide evaluation: a geometry without guides has none to save.
+    let guided = ["avLst", "gdLst"].iter().any(|n| cg.child(n).is_some_and(|l| l.elements().next().is_some()));
     for p in pl.children_named("path").take(1000) {
         let pw = p.f64("w").unwrap_or(0.0);
         let ph = p.f64("h").unwrap_or(0.0);
         // Guides are evaluated in the path's own space when it has one.
         let (gw, gh) = if pw > 0.0 || ph > 0.0 { (pw, ph) } else { (w_emu, h_emu) };
-        let mut g = Guides::new(gw, gh);
-        g.eval_list(cg.child("avLst"));
-        g.eval_list(cg.child("gdLst"));
+        // The guide lists are evaluated once per coordinate space, not once per path.
+        let key = (gw.to_bits(), gh.to_bits());
+        if !spaces.contains_key(&key) {
+            if guided && (budget_full || spaces.len() >= MAX_SPACES) {
+                if budget_full {
+                    dropped.1 += 1;
+                } else {
+                    dropped.0 += 1;
+                }
+                continue;
+            }
+            let mut g = Guides::new(gw, gh);
+            g.eval_list(cg.child("avLst"));
+            g.eval_list(cg.child("gdLst"));
+            // The first space is always kept; later ones only while the cache stays within budget.
+            let bytes = g.name_bytes();
+            if guided && !spaces.is_empty() && name_bytes.saturating_add(bytes) > MAX_SPACE_NAME_BYTES {
+                // Every space holds the same names, so no later space fits either.
+                budget_full = true;
+                dropped.1 += 1;
+                continue;
+            }
+            name_bytes = name_bytes.saturating_add(bytes);
+            spaces.insert(key, g);
+        }
+        let Some(g) = spaces.get(&key) else { continue };
         let mut d = String::new();
         let mut cur = (0.0, 0.0);
         let mut start = (0.0, 0.0);
@@ -166,7 +213,7 @@ pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
             match c.local() {
                 "moveTo" => {
                     if let Some(q) = c.child("pt") {
-                        cur = pt(&g, q);
+                        cur = pt(g, q);
                         start = cur;
                         d.push_str("M ");
                         num(&mut d, cur.0);
@@ -177,7 +224,7 @@ pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
                 }
                 "lnTo" => {
                     if let Some(q) = c.child("pt") {
-                        cur = pt(&g, q);
+                        cur = pt(g, q);
                         d.push_str("L ");
                         num(&mut d, cur.0);
                         d.push(' ');
@@ -186,7 +233,7 @@ pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
                     }
                 }
                 "cubicBezTo" => {
-                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(&g, q)).collect();
+                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(g, q)).collect();
                     if let [a, b, e] = pts.as_slice() {
                         d.push_str("C ");
                         for (x, y) in [a, b, e] {
@@ -199,7 +246,7 @@ pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
                     }
                 }
                 "quadBezTo" => {
-                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(&g, q)).collect();
+                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(g, q)).collect();
                     if let [a, e] = pts.as_slice() {
                         d.push_str("Q ");
                         for (x, y) in [a, e] {
@@ -236,7 +283,16 @@ pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
         let (ow, oh) = if pw > 0.0 || ph > 0.0 { (pw, ph) } else { (w_emu.max(1.0), h_emu.max(1.0)) };
         out.push(CustomPath { w: ow, h: oh, d: d.trim_end().to_string(), fill, stroke: p.bool("stroke").unwrap_or(true) });
     }
-    out
+    if dropped.0 > 0 {
+        log::warn!("pptx: a custom geometry uses more than {MAX_SPACES} distinct path coordinate spaces; {} later path(s) are not kept", dropped.0);
+    }
+    if dropped.1 > 0 {
+        log::warn!(
+            "pptx: a custom geometry's guide names pass {MAX_SPACE_NAME_BYTES} bytes across its coordinate spaces; {} later path(s) are not kept",
+            dropped.1
+        );
+    }
+    (out, dropped)
 }
 
 /// Ellipse parametric angle for a visual angle `a` (radians).
@@ -470,6 +526,46 @@ mod tests {
         assert_eq!(paths[1].d, "M 1 1 Q 2 2 3 1");
     }
 
+    #[test]
+    fn paths_share_guides_and_distinct_spaces_are_capped() {
+        let path = |w: usize| format!(r#"<a:path w="{w}" h="10"><a:moveTo><a:pt x="mid" y="1"/></a:moveTo></a:path>"#);
+        let paths: String = (1..=40).map(|i| path(10 * i)).collect();
+        let x = format!(
+            r#"<a:custGeom xmlns:a="x"><a:gdLst><a:gd name="mid" fmla="*/ w 1 2"/></a:gdLst><a:pathLst>{paths}{}</a:pathLst></a:custGeom>"#,
+            path(10)
+        );
+        let d = parse(x.as_bytes()).unwrap();
+        let (out, dropped) = read_cust_geom_counting(&d.root, 1.0, 1.0);
+        assert_eq!(out.len(), MAX_SPACES + 1, "16 spaces plus the repeat of the first");
+        assert_eq!(dropped, (40 - MAX_SPACES, 0), "the paths of later spaces are counted, to be warned about");
+        assert!(out[0].d.starts_with("M 5 1"), "{}", out[0].d);
+        assert!(out[MAX_SPACES].d.starts_with("M 5 1"), "{}", out[MAX_SPACES].d);
+    }
+
+    #[test]
+    fn guide_name_bytes_across_spaces_are_budgeted() {
+        let name = "n".repeat(3 << 20);
+        let path = |w: usize| format!(r#"<a:path w="{w}" h="10"><a:moveTo><a:pt x="{name}" y="1"/></a:moveTo></a:path>"#);
+        let x = format!(
+            r#"<a:custGeom xmlns:a="x"><a:gdLst><a:gd name="{name}" fmla="*/ w 1 2"/></a:gdLst><a:pathLst>{}{}{}</a:pathLst></a:custGeom>"#,
+            path(10),
+            path(20),
+            path(10)
+        );
+        let d = parse(x.as_bytes()).unwrap();
+        let (out, dropped) = read_cust_geom_counting(&d.root, 1.0, 1.0);
+        assert_eq!(out.len(), 2, "the second 3 MiB space is over budget and left out; the first space's repeat stays");
+        assert_eq!(dropped, (0, 1), "the path left out is counted, to be warned about");
+    }
+
+    #[test]
+    fn guide_free_geometries_are_not_capped_by_space() {
+        let paths: String = (1..=40).map(|i| format!(r#"<a:path w="{}" h="10"><a:moveTo><a:pt x="1" y="1"/></a:moveTo></a:path>"#, 10 * i)).collect();
+        let x = format!(r#"<a:custGeom xmlns:a="x"><a:avLst/><a:gdLst/><a:pathLst>{paths}</a:pathLst></a:custGeom>"#);
+        let d = parse(x.as_bytes()).unwrap();
+        assert_eq!(read_cust_geom(&d.root, 1.0, 1.0).len(), 40);
+    }
+
     #[test]
     fn write_then_read_path() {
         let p = CustomPath { w: 100.0, h: 50.0, d: "M 0 0 L 100 0 C 100 10 90 50 50 50 Q 0 50 0 0 Z".into(), fill: FillMode::Norm, stroke: true };

crates/pptx/src/read.rs

@@ -10,7 +10,6 @@ mod timing;
 pub(crate) use chart::{chart_from as chart_from_el, read_chart_xml};
 pub(crate) use chartex::{chartex_from, read_chartex_xml};
 
-use std::cell::Cell;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
@@ -100,22 +99,21 @@ pub struct Part {
     pub ns: Vec<(String, String)>,
     /// Prefixes bound below the root only (on a wrapper such as `mc:Choice`), each to one namespace.
     pub inner_ns: Vec<(String, String)>,
-    /// Bytes of namespace declarations this part may still copy onto kept fragments.
-    ns_budget: Cell<usize>,
 }
 
 impl Part {
     pub fn new(pkg: &Package, name: &str, doc: &Doc) -> Self {
         let ns = doc.ns_decls();
-        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns, ns_budget: Cell::new(MAX_COPIED_NS_BYTES) }
+        Part { name: name.to_string(), rels: pkg.rels(name), inner_ns: inner_decls(&doc.root, &ns), ns }
     }
     /// Serialize an element with the namespace declarations it needs from the part root.
     pub fn keep(&self, el: &El) -> String {
-        keep_with(el, &[&self.ns], Some(&self.ns_budget))
+        keep_xml(el, &self.ns)
     }
     /// Like [`Part::keep`], also declaring prefixes that only an enclosing wrapper binds.
     pub fn keep_inner(&self, el: &El) -> String {
-        keep_with(el, &[&self.ns, &self.inner_ns], Some(&self.ns_budget))
+        let ns: Vec<(String, String)> = self.ns.iter().chain(&self.inner_ns).cloned().collect();
+        keep_xml(el, &ns)
     }
 }
 
@@ -150,81 +148,36 @@ fn inner_decls(root: &El, ns: &[(String, String)]) -> Vec<(String, String)> {
     out
 }
 
-/// Longest namespace name copied onto a kept fragment or a resolved `mc` branch. Real ones are
-/// URIs of well under 100 bytes; a longer one is not copied, so one declaration cannot be
-/// multiplied by every fragment that uses its prefix.
-const MAX_NS_VALUE: usize = 2048;
-
-/// Namespace declaration bytes one part may copy onto all its kept fragments together; past it a
-/// fragment keeps its markup but is not given further declarations.
-const MAX_COPIED_NS_BYTES: usize = 8 << 20;
-
-/// Prefixes `el` and its descendants use in element and attribute names, and those listed in
-/// `mc:Ignorable` or `mc:MustUnderstand` (which must stay declared for the markup-compatibility rules to hold),
-/// and those starting a QName-like attribute value.
-fn used_prefixes(el: &El) -> HashSet<&str> {
-    fn rec<'a>(e: &'a El, used: &mut HashSet<&'a str>, depth: usize) {
+/// Serialize `el`, declaring every prefix it uses that the source root declared.
+pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
+    let mut used = HashSet::new();
+    fn rec(e: &El, used: &mut HashSet<String>, depth: usize) {
         if depth > crate::xml::MAX_DEPTH {
             return;
         }
         if let Some((p, _)) = e.name.split_once(':') {
-            used.insert(p);
+            used.insert(p.to_string());
         }
-        for (k, v) in &e.attrs {
-            if let Some((p, local)) = k.split_once(':')
+        for (k, _) in &e.attrs {
+            if let Some((p, _)) = k.split_once(':')
                 && p != "xmlns"
                 && p != "xml"
             {
-                used.insert(p);
-                if local == "Ignorable" || local == "MustUnderstand" {
-                    used.extend(v.split_whitespace());
-                }
-            }
-            // QName-valued attributes (`xsi:type="q:Item"`) need their prefix declared too.
-            if k != "xmlns" && !k.starts_with("xmlns:") {
-                for t in v.split_whitespace() {
-                    if let Some((p, _)) = t.split_once(':')
-                        && !p.is_empty()
-                    {
-                        used.insert(p);
-                    }
-                }
+                used.insert(p.to_string());
             }
         }
         for c in e.elements() {
             rec(c, used, depth + 1);
         }
     }
-    let mut used = HashSet::new();
     rec(el, &mut used, 0);
-    used
-}
-
-/// Serialize `el`, declaring every prefix it uses that the source root declared.
-pub fn keep_xml(el: &El, ns: &[(String, String)]) -> String {
-    keep_with(el, &[ns], None)
-}
-
-fn keep_with(el: &El, decls: &[&[(String, String)]], budget: Option<&Cell<usize>>) -> String {
-    let used = used_prefixes(el);
-    let mut have: HashSet<&str> = el.attrs.iter().map(|(a, _)| a.as_str()).collect();
-    let mut extra = Vec::new();
-    for (k, v) in decls.iter().flat_map(|d| d.iter()) {
+    let mut el = el.clone();
+    for (k, v) in ns {
         let p = k.strip_prefix("xmlns:").unwrap_or("");
-        if !p.is_empty() && used.contains(p) && v.len() <= MAX_NS_VALUE && !have.contains(k.as_str()) {
-            let cost = k.len() + v.len();
-            if let Some(b) = budget {
-                if b.get() < cost {
-                    continue;
-                }
-                b.set(b.get() - cost);
-            }
-            have.insert(k);
-            extra.push((k.clone(), v.clone()));
+        if !p.is_empty() && used.contains(p) && !el.attrs.iter().any(|(a, _)| a == k) {
+            el.attrs.push((k.clone(), v.clone()));
         }
     }
-    let mut el = el.clone();
-    el.attrs.extend(extra);
     el.to_xml()
 }
 
@@ -373,18 +326,10 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
             // The part's own relationships (customXml item → itemProps) and their targets.
             let rp = opc::rels_path(&name);
             if let Some(rels_xml) = text(&rp) {
-                let mut capped = false;
                 for sub in pkg.rels(&name).items.iter().filter(|s| !s.external && keepable(&s.target)) {
-                    // Checked before the part is read: repeated relationships to one large part
-                    // must not copy it again each time.
-                    if out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target)) {
-                        continue;
-                    }
-                    if out.len() >= 400 {
-                        capped = true;
-                        continue;
-                    }
-                    if let Some(x) = text(&sub.target) {
+                    if let Some(x) = text(&sub.target)
+                        && !out.iter().any(|k| k.name.eq_ignore_ascii_case(&sub.target))
+                    {
                         out.push(KeptPart {
                             content_type: pkg.content_type(&sub.target).unwrap_or_default(),
                             name: sub.target.clone(),
@@ -393,9 +338,7 @@ fn kept_parts(pkg: &Package, pres_path: &str) -> Vec<deckcraft_model::KeptPart>
                         });
                     }
                 }
-                if !capped && out.len() < 400 {
-                    out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
-                }
+                out.push(KeptPart { name: rp, xml: rels_xml, ..Default::default() });
             }
         }
     }
@@ -432,39 +375,15 @@ fn resolve_mc_rels(el: &mut El, depth: usize, rels: Option<&Rels>) {
                     });
                     let branch = choice.or_else(|| ac.child("Fallback"));
                     if let Some(b) = branch {
-                        // The branch's namespace declarations (the first usable one of each name,
-                        // in order), indexed by prefix once: each child then looks up the prefixes
-                        // it uses instead of scanning every declaration.
-                        let mut decls: Vec<(&String, &String)> = Vec::new();
-                        // An oversized declaration still shadows an outer one of its name: its
-                        // content is left unbound rather than bound to the outer namespace.
-                        let mut by_prefix: HashMap<&str, Option<usize>> = HashMap::new();
-                        for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
-                            let prefix = if k == "xmlns" { Some("") } else { k.strip_prefix("xmlns:") };
-                            if let Some(p) = prefix
-                                && !by_prefix.contains_key(p)
-                            {
-                                by_prefix.insert(p, (v.len() <= MAX_NS_VALUE).then_some(decls.len()));
-                                if v.len() <= MAX_NS_VALUE {
-                                    decls.push((k, v));
-                                }
-                            }
-                        }
                         for n in &b.children {
                             if let Node::El(e) = n {
-                                // Carry the namespace declarations from the branch that its content
-                                // uses (all of them per child made children x declarations copies).
-                                let used = used_prefixes(e);
-                                let have: HashSet<&str> = e.attrs.iter().map(|(a, _)| a.as_str()).collect();
-                                let mut wanted: Vec<usize> = std::iter::once("")
-                                    .chain(used.iter().copied())
-                                    .filter_map(|p| by_prefix.get(p).copied().flatten())
-                                    .filter(|&i| !have.contains(decls[i].0.as_str()))
-                                    .collect();
-                                wanted.sort_unstable();
-                                wanted.dedup();
                                 let mut e = e.clone();
-                                e.attrs.extend(wanted.into_iter().map(|i| (decls[i].0.clone(), decls[i].1.clone())));
+                                // Carry namespace declarations from the branch onto its content.
+                                for (k, v) in b.attrs.iter().chain(ac.attrs.iter()) {
+                                    if k.starts_with("xmlns") && !e.attrs.iter().any(|(a, _)| a == k) {
+                                        e.attrs.push((k.clone(), v.clone()));
+                                    }
+                                }
                                 out.push(Node::El(e));
                             }
                         }
@@ -1526,90 +1445,3 @@ fn header_footer(p: &Presentation) -> HeaderFooter {
     }
     hf
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn mc_branches_carry_only_the_declarations_their_content_uses() {
-        // 2,000 declarations on the branch and 2,000 children: each child gets the one it uses
-        // (and the default), not all 2,000.
-        let decls: String = (0..2000).map(|i| format!(r#" xmlns:n{i}="urn:n{i}""#)).collect();
-        let kids: String = (0..2000).map(|i| format!("<n{i}:x/>")).collect();
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns="urn:d"{decls}>{kids}</mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        assert_eq!(kids.len(), 2000);
-        assert_eq!(kids[7].attrs, vec![("xmlns".to_string(), "urn:d".to_string()), ("xmlns:n7".to_string(), "urn:n7".to_string())]);
-    }
-
-    /// The branch's own declaration of a prefix wins over the `AlternateContent`'s; an oversized
-    /// one still shadows it (its content stays unbound); a child's own declaration is left alone.
-    #[test]
-    fn mc_branch_declarations_keep_their_precedence() {
-        let long = "u".repeat(MAX_NS_VALUE + 1);
-        let x = format!(
-            r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent xmlns:p="urn:ac" xmlns:q="urn:q-short"><mc:Fallback xmlns:p="urn:b" xmlns:q="{long}"><p:x/><q:y/><p:z xmlns:p="urn:own"/></mc:Fallback></mc:AlternateContent></r>"#
-        );
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kids: Vec<&El> = d.root.elements().collect();
-        let attrs = |i: usize| kids[i].attrs.iter().map(|(k, v)| format!("{k}={v}")).collect::<Vec<_>>();
-        assert_eq!(attrs(0), ["xmlns:p=urn:b"]);
-        assert!(attrs(1).is_empty(), "{:?}", attrs(1));
-        assert_eq!(attrs(2), ["xmlns:p=urn:own"]);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_named_by_must_understand() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q"><a mc:MustUnderstand="q"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-    }
-
-    #[test]
-    fn mc_branches_keep_prefixes_used_in_qname_values() {
-        let x = r#"<r xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:AlternateContent><mc:Fallback xmlns:q="urn:q" xmlns:z="urn:z"><n xmlns:xsi="urn:xsi" xsi:type="q:Item"/></mc:Fallback></mc:AlternateContent></r>"#;
-        let mut d = crate::xml::parse(x.as_bytes()).unwrap();
-        resolve_mc(&mut d.root, 0);
-        let kid = d.root.elements().next().unwrap();
-        assert!(kid.attrs.iter().any(|(k, v)| k == "xmlns:q" && v == "urn:q"), "{:?}", kid.attrs);
-        assert!(!kid.attrs.iter().any(|(k, _)| k == "xmlns:z"), "unused declarations stay out: {:?}", kid.attrs);
-    }
-
-    #[test]
-    fn kept_fragments_skip_oversized_namespace_names() {
-        let big = "u".repeat(MAX_NS_VALUE + 1);
-        let ns = vec![("xmlns:a".to_string(), "urn:a".to_string()), ("xmlns:b".to_string(), big)];
-        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a" xmlns:b="urn:b"><b:y/></a:x>"#).unwrap();
-        let mut el = d.root.clone();
-        el.attrs.clear();
-        let out = keep_xml(&el, &ns);
-        assert!(out.contains(r#"xmlns:a="urn:a""#), "{out}");
-        assert!(!out.contains("uuuu"), "the oversized declaration is not copied");
-    }
-
-    #[test]
-    fn copied_namespace_bytes_are_budgeted_per_part() {
-        let d = crate::xml::parse(br#"<a:x xmlns:a="urn:a"><a:y/></a:x>"#).unwrap();
-        let mut el = d.root.clone();
-        el.attrs.clear();
-        let part = Part {
-            name: String::new(),
-            rels: Default::default(),
-            ns: vec![("xmlns:a".to_string(), "urn:a".to_string())],
-            inner_ns: vec![],
-            ns_budget: Cell::new(15),
-        };
-        assert!(part.keep(&el).contains(r#"xmlns:a="urn:a""#), "within budget");
-        assert!(part.ns_budget.get() < 15);
-        let again = part.keep(&el);
-        assert!(!again.contains("xmlns:a"), "budget spent, no further declarations: {again}");
-    }
-}

crates/pptx/src/read/dml.rs

@@ -741,13 +741,7 @@ mod tests {
         // 200 `m:t` nested in each other around one word: the word, not 200 copies of it.
         let x = format!(r#"<a14:m xmlns:a14="a" xmlns:m="m"><m:oMath>{}word{}</m:oMath></a14:m>"#, "<m:t>".repeat(200), "</m:t>".repeat(200));
         let d = parse(x.as_bytes()).unwrap();
-        let part = Part {
-            name: "ppt/slides/slide1.xml".into(),
-            rels: Default::default(),
-            ns: vec![],
-            inner_ns: vec![],
-            ns_budget: std::cell::Cell::new(1 << 20),
-        };
+        let part = Part { name: "ppt/slides/slide1.xml".into(), rels: Default::default(), ns: vec![], inner_ns: vec![] };
         let mut para = Paragraph::default();
         push_math_run(&mut para, &part, &d.root);
         assert_eq!(para.runs[0].text, "word");

crates/pptx/src/write/chart.rs

@@ -132,20 +132,7 @@ fn title(w: &mut W, text: &str, c: &Chart) {
     w.close("c:title");
 }
 
-/// Points one cache writes. Excel and PowerPoint hold 32,000 points per series, so this is far
-/// above any chart they make; a longer vector is cut here with a warning, not refused.
-const MAX_CACHE_POINTS: usize = 1_000_000;
-
-/// `vals` cut to [`MAX_CACHE_POINTS`].
-fn capped<T>(vals: &[T]) -> &[T] {
-    if vals.len() > MAX_CACHE_POINTS {
-        log::warn!("pptx: chart data cache cut from {} to {MAX_CACHE_POINTS} points", vals.len());
-    }
-    &vals[..vals.len().min(MAX_CACHE_POINTS)]
-}
-
 fn str_cache(w: &mut W, f: &str, vals: &[String]) {
-    let vals = capped(vals);
     w.open0("c:strRef");
     w.elt("c:f", f);
     w.open0("c:strCache");
@@ -160,7 +147,6 @@ fn str_cache(w: &mut W, f: &str, vals: &[String]) {
 }
 
 fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
-    let vals = capped(vals);
     w.open0("c:numRef");
     w.elt("c:f", f);
     w.open0("c:numCache");
@@ -179,7 +165,6 @@ fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
 
 /// Numbers written into the chart itself (`c:numLit`), with no worksheet range behind them.
 fn num_lit(w: &mut W, vals: &[Option<f64>]) {
-    let vals = capped(vals);
     w.open0("c:numLit");
     w.val("c:ptCount", vals.len());
     for (i, v) in vals.iter().enumerate() {
@@ -261,9 +246,6 @@ fn point_fills(w: &mut W, s: &Series, g: Group) {
     }
 }
 
-/// Data points (categories and values counted per series) one chart group writes to its caches.
-const MAX_EXPORT_POINTS: usize = 4_000_000;
-
 fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group) {
     w.open0("c:ser");
     w.val("c:idx", i);
@@ -323,7 +305,7 @@ fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group)
             trendline(w, t);
         }
     }
-    let n = c.categories.len().max(s.values.len()).min(MAX_CACHE_POINTS);
+    let n = c.categories.len().max(s.values.len());
     let last = n + 1;
     if let Some(e) = &s.error_bars {
         error_bars(w, e, g);
@@ -509,24 +491,6 @@ fn axes(w: &mut W, c: &Chart, g: Group) {
     w.close("c:valAx");
 }
 
-/// Points `series` writes into its caches for group `g`, synthesized vectors included.
-fn series_points(c: &Chart, s: &Series, g: Group) -> usize {
-    let v = s.values.len();
-    if matches!(g, Group::Scatter | Group::Bubble) {
-        let xs = if s.x_values.is_empty() { v } else { s.x_values.len() };
-        let sizes = if g != Group::Bubble {
-            0
-        } else if s.sizes.is_empty() {
-            v
-        } else {
-            s.sizes.len()
-        };
-        xs.saturating_add(v).saturating_add(sizes)
-    } else {
-        c.categories.len().saturating_add(v)
-    }
-}
-
 fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)]) {
     let g = group_of(kind);
     let grouping = if kind.percent() {
@@ -565,17 +529,7 @@ fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)])
     if g != Group::Stock {
         w.val("c:varyColors", vary);
     }
-    // Each series repeats the categories in its own cache, so the output grows with series times
-    // categories: stop adding series once a group's caches pass the budget (the first is always written).
-    // The first series is always written; each of its caches is cut at MAX_CACHE_POINTS.
-    let mut left = MAX_EXPORT_POINTS;
-    for (n, (i, s)) in list.iter().enumerate() {
-        let cost = series_points(c, s, g);
-        if n > 0 && cost > left {
-            log::warn!("pptx: chart export stopped after {n} series; the data caches passed {MAX_EXPORT_POINTS} points");
-            break;
-        }
-        left = left.saturating_sub(cost);
+    for (i, s) in list {
         series(w, c, s, *i, kind, g);
     }
     if c.data_labels {
@@ -1107,21 +1061,7 @@ mod region_map_tests {
 mod tests {
     use deckcraft_color::{ColorTransform, Rgba};
     use deckcraft_model::ColorRef;
-    use deckcraft_model::chart::{Chart, ChartType, Series};
-
-    #[test]
-    fn export_cost_counts_the_caches_each_group_writes() {
-        let s = Series { values: vec![Some(1.0); 600], ..Default::default() };
-        let mut c = Chart::sample(ChartType::Column);
-        c.categories = vec!["a".into(); 1000];
-        // Category and value caches: 1,000 + 600, however the series is stored.
-        assert_eq!(super::series_points(&c, &s, super::Group::Bar), 1600);
-        // A bubble series without x values or sizes still writes three value-length caches.
-        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 1800);
-        assert_eq!(super::series_points(&c, &s, super::Group::Scatter), 1200);
-        let s = Series { values: vec![Some(1.0); 600], x_values: vec![Some(1.0); 5], sizes: vec![Some(1.0); 7], ..Default::default() };
-        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 612);
-    }
+    use deckcraft_model::chart::{Chart, ChartType};
 
     /// The chart's text colour is written where PowerPoint keeps it (`c:txPr` on the axes, legend,
     /// data labels and chart, the title's run defaults) and read back as the same colour.
@@ -1182,19 +1122,3 @@ mod tests {
         assert!(!crate::read::chart::read_chart_xml(&super::chart_xml(&c).0).unwrap().cat_reversed);
     }
 }
-
-#[cfg(test)]
-mod cache_cap_tests {
-    use super::*;
-
-    /// A cache longer than the cap is cut, never refused; anything a real chart holds (32,000
-    /// points per series) is far under it. Zero-sized elements, so the test allocates nothing.
-    #[test]
-    fn caches_are_cut_at_the_cap_not_refused() {
-        const { assert!(MAX_CACHE_POINTS >= 32_000) };
-        let over = vec![(); MAX_CACHE_POINTS + 1];
-        assert_eq!(capped(&over).len(), MAX_CACHE_POINTS);
-        let real = vec![(); 32_000];
-        assert_eq!(capped(&real).len(), 32_000);
-    }
-}

crates/vp9/src/decoder.rs

@@ -166,17 +166,11 @@ impl Decoder {
         if frames.len() > 1 {
             self.stats.superframes += 1;
         }
-        let queued = self.pending.len();
         for f in frames {
             if f.is_empty() {
                 continue;
             }
-            if let Err(e) = self.decode_frame(f, pts) {
-                // A failed sample outputs nothing: drop what its earlier subframes queued so a
-                // later drain does not expand each repeat into its own picture.
-                self.pending.truncate(queued);
-                return Err(e);
-            }
+            self.decode_frame(f, pts)?;
         }
         Ok(self.drain(false))
     }