From e51a32bb46ddc87134ca48b537609138bfa41d27 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Mon, 2 Nov 2026 20:29:51 -0500 Subject: [PATCH] calc: charge each formula's evaluation against one cumulative work budget --- crates/calc/src/eval.rs | 131 ++++++++++++++++++++++++++++++++++- crates/calc/src/eval/call.rs | 15 ++++ crates/calc/src/tests.rs | 16 +++++ 3 files changed, 161 insertions(+), 1 deletion(-) diff --git a/crates/calc/src/eval.rs b/crates/calc/src/eval.rs index f55b929ee..9ed5657b7 100644 --- a/crates/calc/src/eval.rs +++ b/crates/calc/src/eval.rs @@ -39,6 +39,15 @@ const MAX_DEPTH: usize = 400; /// every legitimate call; hostile work that grows past one dimension (a LAMBDA that recurses /// or nest `MAP` into `MAP`) then stops at the same bound instead of squaring. const LAMBDA_FUEL: u64 = MAX_CELLS; +/// Work one cell's formula may do: one unit per expression evaluated, per cell read from a +/// reference, per array value handed to a function, per pair of areas intersected and per +/// character of a defined name's formula parsed where the name is used. Each limit +/// above bounds one kind of step, but a compact formula could still repeat bounded steps +/// exponentially often (defined names that each use the one before twice, a computed criterion +/// whose database function reruns it, an aggregate over a large array inside every LAMBDA call). +/// Past this the formula is `#CALC!`. It is far above what a formula that reads every cell of a +/// full-size array a few times needs. +const EVAL_WORK: u64 = 16 * MAX_CELLS; #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)] pub struct Area { @@ -139,6 +148,12 @@ pub struct Evaluator<'h> { /// runs out of work after the same number of calls that a legitimately wide one could /// make, instead of an amount of work that squares with array nesting (#2382). fuel: u64, + /// Work this cell still has left (see [`EVAL_WORK`]), shared by every branch of the formula + /// and by the formulas it computes on the way (names, computed criteria). + work: u64, + /// Computed criteria being evaluated, outermost first: one that is reached again from inside + /// itself counts as not met instead of repeating its work at every level. + active_criteria: Vec<(usize, CellRef)>, } struct FnCtx<'a, 'h> { @@ -168,6 +183,9 @@ impl Ctx for FnCtx<'_, '_> { fn computed_criterion(&mut self, row: usize, col: usize, db: &Array, record: usize) -> Option { let area = self.criteria?; let at = area.range.start.offset(row as i64, col as i64).filter(|c| area.range.contains(*c))?; + if self.ev.active_criteria.contains(&(area.sheet, at)) { + return Some(false); + } let expr = self.ev.host.workbook().sheet(area.sheet)?.cell(at)?.formula.as_ref()?.expr_arc()?; let shifted = gridcraft_formula::adjust::shift_relative((*expr).clone(), record as i64 - 1, 0); let env = (0..db.cols) @@ -187,10 +205,17 @@ impl Ctx for FnCtx<'_, '_> { calls: self.ev.calls, stack_top: self.ev.stack_top, fuel: self.ev.fuel, + work: self.ev.work, + active_criteria: std::mem::take(&mut self.ev.active_criteria), }; + ev.active_criteria.push((area.sheet, at)); let v = matches!(ev.value(&shifted).scalar().to_bool(), Ok(true)); // The child's spend counts against this cell's budget. self.ev.fuel = ev.fuel; + self.ev.work = ev.work; + let mut active = std::mem::take(&mut ev.active_criteria); + active.pop(); + self.ev.active_criteria = active; Some(v) } fn has_lambda(&self) -> bool { @@ -210,7 +235,40 @@ impl Ctx for FnCtx<'_, '_> { impl<'h> Evaluator<'h> { pub fn new(host: &'h mut dyn Host, sheet: usize, at: CellRef) -> Self { - Evaluator { host, sheet, at, env: Vec::new(), depth: 0, calls: 0, stack_top: 0, fuel: LAMBDA_FUEL } + Evaluator { + host, + sheet, + at, + env: Vec::new(), + depth: 0, + calls: 0, + stack_top: 0, + fuel: LAMBDA_FUEL, + work: EVAL_WORK, + active_criteria: Vec::new(), + } + } + + /// Spends `units` of this cell's work; `false` (and nothing left) when there isn't enough. + pub(crate) fn spend(&mut self, units: u64) -> bool { + match self.work.checked_sub(units) { + Some(w) => { + self.work = w; + true + } + None => { + self.work = 0; + false + } + } + } + + /// Charges the values of an array (one unit per value; one for anything else). + pub(crate) fn spend_on(&mut self, v: &Value) -> bool { + match v { + Value::Array(a) => self.spend(a.data.len() as u64), + _ => self.spend(1), + } } /// Evaluates to a value (references are dereferenced; multi-cell → array). @@ -265,6 +323,9 @@ impl<'h> Evaluator<'h> { if (h as u64) * (w as u64) > MAX_CELLS { return Value::Error(CellError::Num); } + if !self.spend((h as u64) * (w as u64)) { + return Value::Error(CellError::Calc); + } let data = self.host.range_values(a.sheet, range); Array::new(h, w, data).map(Value::from).unwrap_or(Value::Error(CellError::Value)) } @@ -310,6 +371,9 @@ impl<'h> Evaluator<'h> { self.host.stack_exhausted(); return err(CellError::Num); } + if !self.spend(1) { + return err(CellError::Calc); + } self.depth += 1; if self.depth > MAX_DEPTH { self.depth -= 1; @@ -376,6 +440,11 @@ impl<'h> Evaluator<'h> { if let Some(def) = wb.name(bare, scope_sheet) { let text = def.formula.clone(); let scope = def.scope.unwrap_or(self.sheet); + // Each use parses and evaluates the definition again: names that each use the one + // before twice double the work per name, so it is charged. + if !self.spend(text.len() as u64) { + return err(CellError::Calc); + } return match gridcraft_formula::parse_name(&text) { Ok(expr) => { // Relative references in a name are relative to A1: used here, they move by @@ -568,6 +637,10 @@ impl<'h> Evaluator<'h> { let (x, y) = (self.eval(a), self.eval(b)); match (x, y) { (Ev::R(mut xa), Ev::R(ya)) => { + // A union reused through LET doubles at each step: its areas count. + if !self.spend((xa.len() as u64).saturating_add(ya.len() as u64)) { + return err(CellError::Calc); + } xa.extend(ya); Ev::R(xa) } @@ -579,6 +652,11 @@ impl<'h> Evaluator<'h> { let (x, y) = (self.eval(a), self.eval(b)); match (x, y) { (Ev::R(xa), Ev::R(ya)) => { + // Every pair is looked at, and each may be kept: charged before the loop, + // so unions squared through LET can't build an enormous list. + if !self.spend((xa.len() as u64).saturating_mul(ya.len() as u64)) { + return err(CellError::Calc); + } let mut out = Vec::new(); for p in &xa { for q in &ya { @@ -672,6 +750,57 @@ mod fuel_tests { ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}"))) } + /// Evaluates `src` in `wb` with `work` units of work, and the work left. + fn eval_work(wb: Workbook, work: u64, src: &str) -> (Value, u64) { + let mut host = Empty { wb }; + let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0)); + ev.work = work; + let v = ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}"))); + (v, ev.work) + } + + fn is_calc(v: &Value) -> bool { + matches!(v, Value::Error(CellError::Calc)) + } + + #[test] + fn names_that_double_at_each_step_run_out_of_work() { + // Step1 = Step0+Step0, Step2 = Step1+Step1, ...: Step60 would evaluate Step0 2^60 times. + let mut wb = Workbook::default(); + let name = |name: String, formula: String| gridcraft_model::DefinedName { name, scope: None, formula, comment: String::new(), hidden: false }; + wb.names.push(name("Step0".into(), "1".into())); + for i in 1..=60 { + wb.names.push(name(format!("Step{i}"), format!("Step{}+Step{}", i - 1, i - 1))); + } + let (v, _) = eval_work(wb.clone(), EVAL_WORK, "=Step5"); + assert_eq!(v, Value::number(32.0)); + let (v, left) = eval_work(wb, 100_000, "=Step60"); + assert!(is_calc(&v), "{v:?}"); + assert_eq!(left, 0); + } + + #[test] + fn intersections_of_unions_are_charged_per_pair() { + let wb = Workbook::default(); + // 4 x 4 pairs, 4 of which meet. + let src = "=AREAS((A1,B1,C1,D1) (A1,B1,C1,D1))"; + let (v, _) = eval_work(wb.clone(), EVAL_WORK, src); + assert_eq!(v, Value::number(4.0)); + let (v, _) = eval_work(wb, 20, src); + assert!(is_calc(&v), "{v:?}"); + } + + #[test] + fn an_aggregate_inside_every_lambda_call_spends_work() { + let wb = Workbook::default(); + // 100 calls, each summing the 10,000 values of a captured array: about a million units. + let src = "=LET(big,SEQUENCE(10000),SUM(MAP(SEQUENCE(100),LAMBDA(x,SUM(big)))))"; + let (v, _) = eval_work(wb.clone(), 2_000_000, src); + assert_eq!(v, Value::number(100.0 * 50_005_000.0)); + let (v, _) = eval_work(wb, 200_000, src); + assert!(is_calc(&v), "{v:?}"); + } + #[test] fn lambda_calls_spend_fuel_and_run_out_quietly() { // Three applications, one charge each: 3 inside the budget. (A nested MAP wouldn't do diff --git a/crates/calc/src/eval/call.rs b/crates/calc/src/eval/call.rs index 08d563d43..4a25191ab 100644 --- a/crates/calc/src/eval/call.rs +++ b/crates/calc/src/eval/call.rs @@ -353,6 +353,12 @@ impl<'h> Evaluator<'h> { }; evaluated.push(Arg { value, from_ref }); } + // The function may go through every value it is given (a SUM inside each call of a + // LAMBDA over a large array): the values count against the cell's work. + let values = evaluated.iter().fold(0u64, |n, a| n.saturating_add(if let Value::Array(x) = &a.value { x.data.len() as u64 } else { 1 })); + if !self.spend(values) { + return err(CellError::Calc); + } let mut ctx = FnCtx { ev: self, criteria, lambda }; gridcraft_functions::call(spec, &evaluated, &mut ctx).pipe(Ev::V) } @@ -383,6 +389,12 @@ impl<'h> Evaluator<'h> { /// Adds one area to `acc`; `Err` is the result the function ends with. fn aggregate_area(&mut self, kind: Agg, a: &Area, acc: &mut Acc) -> Result<(), Ev> { if !a.range.is_single() { + // Folded without building an array, but still walked: the part inside the used + // range counts against the cell's work. + let r = self.read_range(a); + if !self.spend(u64::from(r.height()) * u64::from(r.width())) { + return Err(err(CellError::Calc)); + } let mut error = None; let walked = self.host.visit_range(a.sheet, a.range, &mut |v| match acc.add_cell(kind, v) { Ok(()) => true, @@ -402,6 +414,9 @@ impl<'h> Evaluator<'h> { /// Adds one argument's value by calling `SUM` and `COUNT` on it, so coercion and error rules /// stay in one place (`AVERAGE` of an argument is its `SUM` over its `COUNT`). fn aggregate_value(&mut self, kind: Agg, value: Value, from_ref: bool, acc: &mut Acc) -> Result<(), Ev> { + if !from_ref && !self.spend_on(&value) { + return Err(err(CellError::Calc)); + } let (Some(sum), Some(count)) = (gridcraft_functions::lookup("SUM"), gridcraft_functions::lookup("COUNT")) else { return Err(err(CellError::Name)); }; diff --git a/crates/calc/src/tests.rs b/crates/calc/src/tests.rs index d63590737..b992fde89 100644 --- a/crates/calc/src/tests.rs +++ b/crates/calc/src/tests.rs @@ -2372,3 +2372,19 @@ fn formulas_read_a_dirty_python_cell_after_it_is_laid_out() { assert_eq!((t.num("B1"), t.num("B2")), (5.0, 6.0)); assert_eq!((t.num("A1"), t.num("A2"), t.num("A3")), (5.0, 100.0, 111.0)); } + +/// A computed criterion whose formula runs a database function over the same criteria counts as +/// not met inside itself: before, each record's check ran the function again for every record, at +/// every level, so the work grew exponentially with the nesting allowed. +#[test] +fn computed_criterion_that_reenters_itself_is_not_met() { + let mut t = T::new(); + for (r, (name, age)) in [("name", "age"), ("a", "1"), ("b", "2"), ("c", "3"), ("d", "4"), ("e", "5")].iter().enumerate() { + t.set(&format!("F{}", r + 2), name); + t.set(&format!("G{}", r + 2), age); + } + t.set("N46", "Formula"); + t.set("N47", "=DCOUNT($F$2:$G$7,\"age\",$N$46:$N$47)>0"); + t.set("B60", "=DCOUNT($F$2:$G$7,\"age\",N46:N47)"); + assert_eq!(t.num("B60"), 0.0); +}