From 2e9212d9026575aa8594c540ddf23b5b54be76d7 Mon Sep 17 00:00:00 2001 From: lileeei Date: Fri, 30 Oct 2026 16:06:46 +0800 Subject: [PATCH] M8: text style dedupe is O(spans) (#1102) shape_text deduped spans into styles by scanning the styles already collected - O(spans x styles), so a styled text's dedupe grew with the square of its runs. Now the last two styles again (spans run in blocks), then buckets keyed by a cheap fingerprint (family and style bytes, size bits with -0.0 folded onto 0.0, the enums, fill count and solid colours, variation count), each bucket resolved with the full equality: the result is the scan's, never worse than it, and O(spans) when names and sizes differ. The fingerprint seed comes from the address space, so document-supplied names can't precompute collisions; the worst an adversarial document does is fall back to the scan it started with. The font-db write lock is untouched: find() loads faces, which needs the write. layout_dedupe_tests covers blocks, excluded fields (links, style ids, gradient stops), -0.0 and pathological alternation. --- ROADMAP.md | 4 +- crates/text/src/layout.rs | 114 +++++++++++++++++++++++-- crates/text/src/layout_dedupe_tests.rs | 102 ++++++++++++++++++++++ crates/text/src/lib.rs | 2 + 4 files changed, 216 insertions(+), 6 deletions(-) create mode 100644 crates/text/src/layout_dedupe_tests.rs diff --git a/ROADMAP.md b/ROADMAP.md index 6f584593e..643e3aeda 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -2,7 +2,7 @@ **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents) -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7) FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow, native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through @@ -132,6 +132,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md). ## Progress log +- **2026-10-30** · Text style dedupe is O(spans) (M8, #1102): `shape_text` deduped spans into styles by a scan over the styles already collected — O(spans × styles), so a styled text's dedupe grew with the square of its runs (a synthetic 50k-run text with 100 alternating styles spent 7.7 ms in it). Now the last two styles again (spans run in blocks), then buckets keyed by a cheap fingerprint (family and style bytes, size bits with −0.0 folded, the enums, fill count and solid colours), each bucket resolved with the full equality: the result is the scan's, never worse than it, and O(spans) when names and sizes differ (the same synthetic text: 2.6 ms). The font-db write lock is untouched: `find()` loads faces, which needs the write. `layout_dedupe_tests`. Numbers unchanged. - **2026-10-28** · M3, #922: an instance scaled with the Scale tool (or `transform.scale`) keeps its layers' scaled size and points when its main is rebuilt. The scaled layers' new size and place were read as what constraints give (an ancestor resized in the same edit), so no override was kept, and adding a layer to the main put a 14 px icon's 24 px triangle back. The Scale tool now records them as `size` and `position` overrides on layers inside instances; strokes already kept theirs. The report's own sequence (clearing effects on the component holding the icon) no longer reproduces on main. Regressions for a scaled instance, one scaled with the tool (with undo) and a scaled icon nested in a component and its instances. Numbers unchanged. - **2026-10-28** · M6, #1059: `.fig` import copies each image carried inside the message once per blob, shared by every hash that names it, instead of once per hash: a file pointing many hashes at one large blob no longer multiplies it in memory (100 hashes on a 250 MB blob were 25 GB). Regression test. Numbers unchanged. - **2026-10-28** · M1, #1476: page ruler guides survive save and reopen. A page kept its guides in the page kind while the layer's own `guides` field (frame guides, #70) took that key when a file was read, so a reopened page's guides vanished, and saving it wrote `guides` twice, which then refused to open. Every layer now keeps its guides in the one field, and a page with two `guides` lists opens with both. Regressions in the doc and format crates. Numbers unchanged. @@ -355,6 +356,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md). | Date | Change | Summary | |---|---|---| +| 2026-10-30 | minor | Text style dedupe is O(spans) (M8, #1102): `shape_text`'s scan over collected styles replaced by a last-two cache and fingerprint buckets resolved with the full equality — same result, O(spans) for the styles that usually differ, never worse than the scan; the font-db write lock untouched (face loading needs it). `layout_dedupe_tests`. Numbers unchanged | | 2026-10-30 | minor | M9, #1130: the server key is compared by its hash. `Store::manage` hashes the presented and the kept key with SHA-256 and compares the two digests; the key on disk, `figcraft-server key` and rotation are unchanged. Regression tests in `store_tests` (`operator_key_*`). Numbers unchanged | | 2026-10-30 | minor | M8, #1097: while the Assets panel showed a file, the app asked the server of every team library the file named for updates, with the link's token and a usage report, so a file someone sent could make the app contact any server. Now only team libraries you added (`library.add`) or checked on this computer are checked by themselves (kept with the preferences as hashes of their links); another one waits in **Assets ▸ Libraries** as "Not checked yet" until you click **Check for updates** (`library.check`, which plugins can't call). Placing or applying something from it is your own action and asks its server as before. Numbers unchanged. Tests: `library_beacon_tests` (engine and UI). | | 2026-10-30 | minor | M8, #1121: client-side maps were unbounded. A hostile host or server could mint people without end: the presence waiting for the UI, the people a connection had seen and the session's list of who is here each grew with every new id; and a session server's set of deleted layer ids (kept so undo may create them again) only grew. Now a client keeps track of at most `MAX_PEERS` (4,096) others: past it, someone new is left out with a logged warning (in a welcome too), someone already here can still be renamed, and someone leaving makes room; a server's `max_people` above 4,096 is lowered to it with a startup warning (the server still starts). A session remembers at most 262,144 deleted ids, forgetting the lowest first (on restore too). Threat model in `collab-protocol.md`. Tests: `client_cap_tests.rs` (collab-net), `live_peer_cap_tests.rs` (engine), `deleted_cap_tests.rs` (collab), the server's `max_people` clamp. | diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs index ceea978ff..3ae4997ab 100644 --- a/crates/text/src/layout.rs +++ b/crates/text/src/layout.rs @@ -1,11 +1,12 @@ //! Text layout: shaping styled spans, fallback fonts, bidirectional text, line breaking, //! alignment and decorations. +use std::collections::HashMap; use std::sync::Arc; use figcraft_doc::{ - DecorationLength, DecorationStyle, LeadingTrim, ListStyle, ParaList, TextAlignH, TextAutoResize, TextCase, TextData, TextDecoration, TextStyle, - valid_feature_tag, + DecorationLength, DecorationStyle, LeadingTrim, LetterSpacing, LineHeight, ListStyle, ParaList, TextAlignH, TextAutoResize, TextCase, TextData, + TextDecoration, TextStyle, color::PaintKind, valid_feature_tag, }; use figcraft_geom::{Affine, BezPath, Rect}; use harfrust::{Direction, Feature, ShapeOptions, ShaperInstance, Tag, UnicodeBuffer, Variation}; @@ -335,6 +336,88 @@ struct ShapedText { word_breaks: Vec, } +/// Zero-sized; only its address is used: a per-process seed for style fingerprints, so +/// document-supplied names can't precompute hash collisions (ASLR varies it across runs). +struct FingerprintSeed; +static FINGERPRINT_SEED: FingerprintSeed = FingerprintSeed; + +/// `x`'s bits, with −0.0 folded onto 0.0 so the fingerprint merges what `PartialEq` does +/// (`-0.0 == 0.0` is true, their bits differ). +fn float_key(x: f64) -> u64 { + if x == 0.0 { 0 } else { x.to_bits() } +} + +/// The FNV-1a 64-bit offset basis and prime (Fowler–Noll–Vo), a published pair that spreads +/// short inputs evenly with one multiply and one xor per byte. Any well-mixed pair would do; +/// these are the standard ones, so the arithmetic is recognisable. +const FNV_OFFSET_BASIS: u64 = 0xcbf2_9ce4_8422_2325; +const FNV_PRIME: u64 = 0x0100_0000_01b3; + +/// Mix `w` into the FNV-1a state `h`. +fn mix(h: u64, w: u64) -> u64 { + (h ^ w).wrapping_mul(FNV_PRIME) +} + +/// Base for the "some other paint kind" tags below: the values mean nothing, they only differ. +const PAINT_KIND_TAG: u64 = 0x5157_0000; + +/// A cheap fingerprint of the fields that usually tell two styles apart. Only the equality run +/// after it decides matches, so this may skip any field: skipping one just sends two different +/// styles to the same bucket. Keep the cheap discriminators here so the common distinct styles +/// land in different buckets — and when `TextStyle` grows a usually-discriminating field, mix +/// it in too. +fn style_fingerprint(s: &TextStyle, seed: u64) -> u64 { + let mut h = seed ^ FNV_OFFSET_BASIS; + // A separator between the two names, so ("ab", "c") and ("a", "bc") differ; any byte a + // family or style name cannot contain would do. + const SEPARATOR: u64 = 0xff; + for b in s.font_family.bytes() { + h = mix(h, b as u64); + } + h = mix(h, SEPARATOR); + for b in s.font_style.bytes() { + h = mix(h, b as u64); + } + h = mix(h, SEPARATOR); + h = mix(h, float_key(s.font_size)); + // The enum variants below key their payload's number into disjoint ranges (Auto 0, odd, + // even) so one variant's payload never reads as another's. + h = mix( + h, + match &s.line_height { + LineHeight::Auto => 0, + LineHeight::Pixels(px) => float_key(*px).wrapping_mul(2).wrapping_add(1), + LineHeight::Percent(p) => float_key(*p).wrapping_mul(2).wrapping_add(2), + }, + ); + h = mix( + h, + match &s.letter_spacing { + LetterSpacing::Pixels(px) => float_key(*px).wrapping_mul(2).wrapping_add(1), + LetterSpacing::Percent(p) => float_key(*p).wrapping_mul(2).wrapping_add(2), + }, + ); + h = mix(h, s.case as u64); + h = mix(h, s.decoration as u64); + h = mix(h, s.fills.as_ref().map_or(0, Vec::len) as u64); + if let Some(fills) = &s.fills { + // Solid colours discriminate the everyday case; other paint kinds by their kind tag. + for p in fills { + match &p.kind { + PaintKind::Solid { color } => { + let [r, g, b, a] = color.to_rgba8(); + h = mix(h, ((r as u64) << 24) | ((g as u64) << 16) | ((b as u64) << 8) | a as u64); + } + PaintKind::Gradient(_) => h = mix(h, PAINT_KIND_TAG + 1), + PaintKind::Image(_) => h = mix(h, PAINT_KIND_TAG + 2), + PaintKind::Pattern(_) => h = mix(h, PAINT_KIND_TAG + 3), + } + } + } + h = mix(h, s.variations.len() as u64); + h +} + /// Shape `text`: each span split by paragraph, bidi run and face into glyphs (items, in logical /// order), with the grapheme cluster starts and word breaks line breaking needs. fn shape_text(text: &TextData) -> ShapedText { @@ -342,14 +425,35 @@ fn shape_text(text: &TextData) -> ShapedText { let spans = text.spans(); let mut styles: Vec = Vec::new(); let mut span_style: Vec = Vec::with_capacity(spans.len()); + // Dedupe spans into styles: the last two styles again (spans run in blocks of one style, and + // alternate between a few), then buckets keyed by a cheap fingerprint of discriminating + // fields, each bucket resolved with the full `PartialEq`. Bucketing never merges what the + // equality wouldn't (a collision only splits the scan it replaces), so the result is the + // scan's, in O(spans) for names and sizes that differ (the audit's O(spans × styles), + // #1102). The seed comes from the address space, so document-supplied + // family names can't precompute collisions; the worst an adversarial document does is fall + // back to the full scan it started with. + let seed = std::ptr::from_ref(&FINGERPRINT_SEED) as u64; + let mut last: [Option; 2] = [None, None]; + let mut buckets: HashMap> = HashMap::new(); for (_, _, s) in &spans { - let idx = match styles.iter().position(|x| x == *s) { + let idx = match last.iter().find_map(|i| i.filter(|&i| &styles[i] == *s)) { Some(i) => i, None => { - styles.push((*s).clone()); - styles.len() - 1 + let fp = style_fingerprint(s, seed); + let bucket = buckets.entry(fp).or_default(); + match bucket.iter().find(|&&i| &styles[i] == *s) { + Some(&i) => i, + None => { + styles.push((*s).clone()); + let i = styles.len() - 1; + bucket.push(i); + i + } + } } }; + last = [Some(idx), last[0]]; span_style.push(idx); } let mut dbw = db().write().unwrap_or_else(std::sync::PoisonError::into_inner); diff --git a/crates/text/src/layout_dedupe_tests.rs b/crates/text/src/layout_dedupe_tests.rs new file mode 100644 index 000000000..6ce2f0508 --- /dev/null +++ b/crates/text/src/layout_dedupe_tests.rs @@ -0,0 +1,102 @@ +//! Style dedupe in `shape_text` (#1102): equal spans share a style entry whatever their order +//! (blocks, alternation, pathological alternation), fields the fingerprint skips still split by +//! equality, and −0.0 merges like `PartialEq` does. + +use figcraft_doc::{StyleRun, TextData, TextStyle}; + +use crate::layout::layout; + +fn solid(hex: &str) -> Option> { + Some(vec![figcraft_doc::color::Paint::solid(figcraft_doc::color::Color::from_hex(hex).unwrap())]) +} + +fn style_with(fills: Option>) -> TextStyle { + TextStyle { fills, ..Default::default() } +} + +fn text_with_runs(runs: Vec<(usize, usize, TextStyle)>) -> TextData { + let mut t = TextData::new("x".repeat(runs.iter().map(|r| r.1).max().unwrap_or(0))); + t.runs = runs.into_iter().map(|(s, e, st)| StyleRun { start: s, end: e, style: st }).collect(); + t +} + +#[test] +fn equal_runs_share_one_style_entry() { + // A run styled exactly like the base style adds no second entry, in either order. + let mut t = TextData::new("Hello World"); + t.runs.push(StyleRun { start: 0, end: 5, style: TextStyle::default() }); + assert_eq!(layout(&t, None, None).styles.len(), 1); + t.runs.clear(); + t.runs.push(StyleRun { start: 6, end: 11, style: TextStyle::default() }); + assert_eq!(layout(&t, None, None).styles.len(), 1); +} + +#[test] +fn runs_of_one_fingerprint_dedupe_to_one_entry() { + // Five alternating runs of the same style: the last-style cache and the buckets merge them. + let s = style_with(solid("#00AA44")); + let t = text_with_runs(vec![(0, 1, s.clone()), (1, 2, style_with(None)), (2, 3, s.clone()), (3, 4, style_with(None)), (4, 5, s)]); + let l = layout(&t, None, None); + assert_eq!(l.styles.len(), 2); +} + +#[test] +fn fields_the_fingerprint_skips_still_split_by_equality() { + // The fingerprint skips `link` and `style_id`; equality after it must still split them. + let mut a = style_with(None); + a.link = Some("https://a".into()); + let mut b = style_with(None); + b.link = Some("https://b".into()); + let t = text_with_runs(vec![(0, 1, a), (1, 2, b)]); + assert_eq!(layout(&t, None, None).styles.len(), 2); + + let mut c = style_with(None); + c.style_id = Some("style-1".into()); + let mut d = style_with(None); + d.style_id = Some("style-2".into()); + let t = text_with_runs(vec![(0, 1, c), (1, 2, d)]); + assert_eq!(layout(&t, None, None).styles.len(), 2); + + // Two gradients hash to the same tag; their stops still split them. + let grad = |base: &str| { + Some(vec![figcraft_doc::color::Paint::gradient(figcraft_doc::color::Gradient::default_for( + figcraft_doc::color::GradientKind::Linear, + figcraft_doc::color::Color::from_hex(base).unwrap(), + ))]) + }; + let t = text_with_runs(vec![(0, 1, style_with(grad("#FF0000"))), (1, 2, style_with(grad("#00FF00")))]); + assert_eq!(layout(&t, None, None).styles.len(), 2); +} + +#[test] +fn negative_zero_merges_like_equality() { + // PartialEq merges −0.0 and 0.0; the fingerprint folds the sign of zero the same way. + let mut a = style_with(None); + a.font_size = 0.0; + let mut b = style_with(None); + b.font_size = -0.0; + let t = text_with_runs(vec![(0, 1, a), (1, 2, b)]); + assert_eq!(layout(&t, None, None).styles.len(), 1); +} + +#[test] +fn pathological_alternation_dedupes_like_the_scan() { + // 50 styles alternating twice: 100 runs dedupe to 50 entries, first-seen order kept. + let styles: Vec = (0..50) + .map(|i| { + let mut s = style_with(None); + s.font_size = 12.0 + i as f64; + s + }) + .collect(); + let runs: Vec<(usize, usize, TextStyle)> = (0..100).map(|i| (i, i + 1, styles[i % 50].clone())).collect(); + let l = layout(&text_with_runs(runs), None, None); + assert_eq!(l.styles.len(), 50, "alternating runs dedupe to the distinct styles"); + for (k, st) in l.styles.iter().enumerate() { + assert_eq!(st.font_size, 12.0 + k as f64, "first-seen order kept at {k}"); + } + // Every glyph points at the style of its run. + for (i, g) in l.glyphs.iter().enumerate() { + assert_eq!(l.styles[g.style].font_size, 12.0 + (i % 50) as f64, "glyph {i} points at its run's style"); + } +} diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs index 772e32e09..cad3e1326 100644 --- a/crates/text/src/lib.rs +++ b/crates/text/src/lib.rs @@ -151,6 +151,8 @@ mod behaviour_tests; #[cfg(test)] mod cache_tests; #[cfg(test)] +mod layout_dedupe_tests; +#[cfg(test)] mod line_separator_tests; #[cfg(test)] mod list_tests;