calc: charge each formula's evaluation against one cumulative work budget

crates/calc/src/eval.rs

@@ -39,6 +39,15 @@ const MAX_DEPTH: usize = 400;
 /// every legitimate call; hostile work that grows past one dimension (a LAMBDA that recurses
 /// or nest `MAP` into `MAP`) then stops at the same bound instead of squaring.
 const LAMBDA_FUEL: u64 = MAX_CELLS;
+/// Work one cell's formula may do: one unit per expression evaluated, per cell read from a
+/// reference, per array value handed to a function, per pair of areas intersected and per
+/// character of a defined name's formula parsed where the name is used. Each limit
+/// above bounds one kind of step, but a compact formula could still repeat bounded steps
+/// exponentially often (defined names that each use the one before twice, a computed criterion
+/// whose database function reruns it, an aggregate over a large array inside every LAMBDA call).
+/// Past this the formula is `#CALC!`. It is far above what a formula that reads every cell of a
+/// full-size array a few times needs.
+const EVAL_WORK: u64 = 16 * MAX_CELLS;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct Area {
@@ -139,6 +148,12 @@ pub struct Evaluator<'h> {
     /// runs out of work after the same number of calls that a legitimately wide one could
     /// make, instead of an amount of work that squares with array nesting (#2382).
     fuel: u64,
+    /// Work this cell still has left (see [`EVAL_WORK`]), shared by every branch of the formula
+    /// and by the formulas it computes on the way (names, computed criteria).
+    work: u64,
+    /// Computed criteria being evaluated, outermost first: one that is reached again from inside
+    /// itself counts as not met instead of repeating its work at every level.
+    active_criteria: Vec<(usize, CellRef)>,
 }
 
 struct FnCtx<'a, 'h> {
@@ -168,6 +183,9 @@ impl Ctx for FnCtx<'_, '_> {
     fn computed_criterion(&mut self, row: usize, col: usize, db: &Array, record: usize) -> Option<bool> {
         let area = self.criteria?;
         let at = area.range.start.offset(row as i64, col as i64).filter(|c| area.range.contains(*c))?;
+        if self.ev.active_criteria.contains(&(area.sheet, at)) {
+            return Some(false);
+        }
         let expr = self.ev.host.workbook().sheet(area.sheet)?.cell(at)?.formula.as_ref()?.expr_arc()?;
         let shifted = gridcraft_formula::adjust::shift_relative((*expr).clone(), record as i64 - 1, 0);
         let env = (0..db.cols)
@@ -187,10 +205,17 @@ impl Ctx for FnCtx<'_, '_> {
             calls: self.ev.calls,
             stack_top: self.ev.stack_top,
             fuel: self.ev.fuel,
+            work: self.ev.work,
+            active_criteria: std::mem::take(&mut self.ev.active_criteria),
         };
+        ev.active_criteria.push((area.sheet, at));
         let v = matches!(ev.value(&shifted).scalar().to_bool(), Ok(true));
         // The child's spend counts against this cell's budget.
         self.ev.fuel = ev.fuel;
+        self.ev.work = ev.work;
+        let mut active = std::mem::take(&mut ev.active_criteria);
+        active.pop();
+        self.ev.active_criteria = active;
         Some(v)
     }
     fn has_lambda(&self) -> bool {
@@ -210,7 +235,40 @@ impl Ctx for FnCtx<'_, '_> {
 
 impl<'h> Evaluator<'h> {
     pub fn new(host: &'h mut dyn Host, sheet: usize, at: CellRef) -> Self {
-        Evaluator { host, sheet, at, env: Vec::new(), depth: 0, calls: 0, stack_top: 0, fuel: LAMBDA_FUEL }
+        Evaluator {
+            host,
+            sheet,
+            at,
+            env: Vec::new(),
+            depth: 0,
+            calls: 0,
+            stack_top: 0,
+            fuel: LAMBDA_FUEL,
+            work: EVAL_WORK,
+            active_criteria: Vec::new(),
+        }
+    }
+
+    /// Spends `units` of this cell's work; `false` (and nothing left) when there isn't enough.
+    pub(crate) fn spend(&mut self, units: u64) -> bool {
+        match self.work.checked_sub(units) {
+            Some(w) => {
+                self.work = w;
+                true
+            }
+            None => {
+                self.work = 0;
+                false
+            }
+        }
+    }
+
+    /// Charges the values of an array (one unit per value; one for anything else).
+    pub(crate) fn spend_on(&mut self, v: &Value) -> bool {
+        match v {
+            Value::Array(a) => self.spend(a.data.len() as u64),
+            _ => self.spend(1),
+        }
     }
 
     /// Evaluates to a value (references are dereferenced; multi-cell → array).
@@ -265,6 +323,9 @@ impl<'h> Evaluator<'h> {
         if (h as u64) * (w as u64) > MAX_CELLS {
             return Value::Error(CellError::Num);
         }
+        if !self.spend((h as u64) * (w as u64)) {
+            return Value::Error(CellError::Calc);
+        }
         let data = self.host.range_values(a.sheet, range);
         Array::new(h, w, data).map(Value::from).unwrap_or(Value::Error(CellError::Value))
     }
@@ -310,6 +371,9 @@ impl<'h> Evaluator<'h> {
             self.host.stack_exhausted();
             return err(CellError::Num);
         }
+        if !self.spend(1) {
+            return err(CellError::Calc);
+        }
         self.depth += 1;
         if self.depth > MAX_DEPTH {
             self.depth -= 1;
@@ -376,6 +440,11 @@ impl<'h> Evaluator<'h> {
         if let Some(def) = wb.name(bare, scope_sheet) {
             let text = def.formula.clone();
             let scope = def.scope.unwrap_or(self.sheet);
+            // Each use parses and evaluates the definition again: names that each use the one
+            // before twice double the work per name, so it is charged.
+            if !self.spend(text.len() as u64) {
+                return err(CellError::Calc);
+            }
             return match gridcraft_formula::parse_name(&text) {
                 Ok(expr) => {
                     // Relative references in a name are relative to A1: used here, they move by
@@ -568,6 +637,10 @@ impl<'h> Evaluator<'h> {
                 let (x, y) = (self.eval(a), self.eval(b));
                 match (x, y) {
                     (Ev::R(mut xa), Ev::R(ya)) => {
+                        // A union reused through LET doubles at each step: its areas count.
+                        if !self.spend((xa.len() as u64).saturating_add(ya.len() as u64)) {
+                            return err(CellError::Calc);
+                        }
                         xa.extend(ya);
                         Ev::R(xa)
                     }
@@ -579,6 +652,11 @@ impl<'h> Evaluator<'h> {
                 let (x, y) = (self.eval(a), self.eval(b));
                 match (x, y) {
                     (Ev::R(xa), Ev::R(ya)) => {
+                        // Every pair is looked at, and each may be kept: charged before the loop,
+                        // so unions squared through LET can't build an enormous list.
+                        if !self.spend((xa.len() as u64).saturating_mul(ya.len() as u64)) {
+                            return err(CellError::Calc);
+                        }
                         let mut out = Vec::new();
                         for p in &xa {
                             for q in &ya {
@@ -672,6 +750,57 @@ mod fuel_tests {
         ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")))
     }
 
+    /// Evaluates `src` in `wb` with `work` units of work, and the work left.
+    fn eval_work(wb: Workbook, work: u64, src: &str) -> (Value, u64) {
+        let mut host = Empty { wb };
+        let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0));
+        ev.work = work;
+        let v = ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")));
+        (v, ev.work)
+    }
+
+    fn is_calc(v: &Value) -> bool {
+        matches!(v, Value::Error(CellError::Calc))
+    }
+
+    #[test]
+    fn names_that_double_at_each_step_run_out_of_work() {
+        // Step1 = Step0+Step0, Step2 = Step1+Step1, ...: Step60 would evaluate Step0 2^60 times.
+        let mut wb = Workbook::default();
+        let name = |name: String, formula: String| gridcraft_model::DefinedName { name, scope: None, formula, comment: String::new(), hidden: false };
+        wb.names.push(name("Step0".into(), "1".into()));
+        for i in 1..=60 {
+            wb.names.push(name(format!("Step{i}"), format!("Step{}+Step{}", i - 1, i - 1)));
+        }
+        let (v, _) = eval_work(wb.clone(), EVAL_WORK, "=Step5");
+        assert_eq!(v, Value::number(32.0));
+        let (v, left) = eval_work(wb, 100_000, "=Step60");
+        assert!(is_calc(&v), "{v:?}");
+        assert_eq!(left, 0);
+    }
+
+    #[test]
+    fn intersections_of_unions_are_charged_per_pair() {
+        let wb = Workbook::default();
+        // 4 x 4 pairs, 4 of which meet.
+        let src = "=AREAS((A1,B1,C1,D1) (A1,B1,C1,D1))";
+        let (v, _) = eval_work(wb.clone(), EVAL_WORK, src);
+        assert_eq!(v, Value::number(4.0));
+        let (v, _) = eval_work(wb, 20, src);
+        assert!(is_calc(&v), "{v:?}");
+    }
+
+    #[test]
+    fn an_aggregate_inside_every_lambda_call_spends_work() {
+        let wb = Workbook::default();
+        // 100 calls, each summing the 10,000 values of a captured array: about a million units.
+        let src = "=LET(big,SEQUENCE(10000),SUM(MAP(SEQUENCE(100),LAMBDA(x,SUM(big)))))";
+        let (v, _) = eval_work(wb.clone(), 2_000_000, src);
+        assert_eq!(v, Value::number(100.0 * 50_005_000.0));
+        let (v, _) = eval_work(wb, 200_000, src);
+        assert!(is_calc(&v), "{v:?}");
+    }
+
     #[test]
     fn lambda_calls_spend_fuel_and_run_out_quietly() {
         // Three applications, one charge each: 3 inside the budget. (A nested MAP wouldn't do

crates/calc/src/eval/call.rs

@@ -353,6 +353,12 @@ impl<'h> Evaluator<'h> {
             };
             evaluated.push(Arg { value, from_ref });
         }
+        // The function may go through every value it is given (a SUM inside each call of a
+        // LAMBDA over a large array): the values count against the cell's work.
+        let values = evaluated.iter().fold(0u64, |n, a| n.saturating_add(if let Value::Array(x) = &a.value { x.data.len() as u64 } else { 1 }));
+        if !self.spend(values) {
+            return err(CellError::Calc);
+        }
         let mut ctx = FnCtx { ev: self, criteria, lambda };
         gridcraft_functions::call(spec, &evaluated, &mut ctx).pipe(Ev::V)
     }
@@ -383,6 +389,12 @@ impl<'h> Evaluator<'h> {
     /// Adds one area to `acc`; `Err` is the result the function ends with.
     fn aggregate_area(&mut self, kind: Agg, a: &Area, acc: &mut Acc) -> Result<(), Ev> {
         if !a.range.is_single() {
+            // Folded without building an array, but still walked: the part inside the used
+            // range counts against the cell's work.
+            let r = self.read_range(a);
+            if !self.spend(u64::from(r.height()) * u64::from(r.width())) {
+                return Err(err(CellError::Calc));
+            }
             let mut error = None;
             let walked = self.host.visit_range(a.sheet, a.range, &mut |v| match acc.add_cell(kind, v) {
                 Ok(()) => true,
@@ -402,6 +414,9 @@ impl<'h> Evaluator<'h> {
     /// Adds one argument's value by calling `SUM` and `COUNT` on it, so coercion and error rules
     /// stay in one place (`AVERAGE` of an argument is its `SUM` over its `COUNT`).
     fn aggregate_value(&mut self, kind: Agg, value: Value, from_ref: bool, acc: &mut Acc) -> Result<(), Ev> {
+        if !from_ref && !self.spend_on(&value) {
+            return Err(err(CellError::Calc));
+        }
         let (Some(sum), Some(count)) = (gridcraft_functions::lookup("SUM"), gridcraft_functions::lookup("COUNT")) else {
             return Err(err(CellError::Name));
         };

crates/calc/src/tests.rs

@@ -2372,3 +2372,19 @@ fn formulas_read_a_dirty_python_cell_after_it_is_laid_out() {
     assert_eq!((t.num("B1"), t.num("B2")), (5.0, 6.0));
     assert_eq!((t.num("A1"), t.num("A2"), t.num("A3")), (5.0, 100.0, 111.0));
 }
+
+/// A computed criterion whose formula runs a database function over the same criteria counts as
+/// not met inside itself: before, each record's check ran the function again for every record, at
+/// every level, so the work grew exponentially with the nesting allowed.
+#[test]
+fn computed_criterion_that_reenters_itself_is_not_met() {
+    let mut t = T::new();
+    for (r, (name, age)) in [("name", "age"), ("a", "1"), ("b", "2"), ("c", "3"), ("d", "4"), ("e", "5")].iter().enumerate() {
+        t.set(&format!("F{}", r + 2), name);
+        t.set(&format!("G{}", r + 2), age);
+    }
+    t.set("N46", "Formula");
+    t.set("N47", "=DCOUNT($F$2:$G$7,\"age\",$N$46:$N$47)>0");
+    t.set("B60", "=DCOUNT($F$2:$G$7,\"age\",N46:N47)");
+    assert_eq!(t.num("B60"), 0.0);
+}