engine: index merges and bound the page in HTML export and clipboard HTML

Save as Web Page and the clipboard's HTML scanned every merge of the
sheet for every cell, counted a merge's span over all the rows the file
gave it, placed each picture by summing every custom row before it, and
grew the page without a byte limit. Merges are now indexed once over
the exported rectangle (overlapping merges past a few visits per cell
are refused), spans use prefix counts clipped to the table, anchors use
LineIndex, and the page stops at 256 MiB with an error.

crates/calc/src/eval.rs

@@ -39,15 +39,6 @@ const MAX_DEPTH: usize = 400;
 /// every legitimate call; hostile work that grows past one dimension (a LAMBDA that recurses
 /// or nest `MAP` into `MAP`) then stops at the same bound instead of squaring.
 const LAMBDA_FUEL: u64 = MAX_CELLS;
-/// Work one cell's formula may do: one unit per expression evaluated, per cell read from a
-/// reference, per array value handed to a function, per pair of areas intersected and per
-/// character of a defined name's formula parsed where the name is used. Each limit
-/// above bounds one kind of step, but a compact formula could still repeat bounded steps
-/// exponentially often (defined names that each use the one before twice, a computed criterion
-/// whose database function reruns it, an aggregate over a large array inside every LAMBDA call).
-/// Past this the formula is `#CALC!`. It is far above what a formula that reads every cell of a
-/// full-size array a few times needs.
-const EVAL_WORK: u64 = 16 * MAX_CELLS;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct Area {
@@ -148,16 +139,6 @@ pub struct Evaluator<'h> {
     /// runs out of work after the same number of calls that a legitimately wide one could
     /// make, instead of an amount of work that squares with array nesting (#2382).
     fuel: u64,
-    /// Work this cell still has left (see [`EVAL_WORK`]), shared by every branch of the formula
-    /// and by the formulas it computes on the way (names, computed criteria).
-    work: u64,
-    /// A spend found too little work left. A spend that leaves exactly nothing is fine, so this
-    /// can't be told from `work` alone; a database function checks it after its computed
-    /// criteria ran, whose failures it can't otherwise see.
-    exhausted: bool,
-    /// Computed criteria being evaluated, outermost first: one that is reached again from inside
-    /// itself counts as not met instead of repeating its work at every level.
-    active_criteria: Vec<(usize, CellRef)>,
 }
 
 struct FnCtx<'a, 'h> {
@@ -187,9 +168,6 @@ impl Ctx for FnCtx<'_, '_> {
     fn computed_criterion(&mut self, row: usize, col: usize, db: &Array, record: usize) -> Option<bool> {
         let area = self.criteria?;
         let at = area.range.start.offset(row as i64, col as i64).filter(|c| area.range.contains(*c))?;
-        if self.ev.active_criteria.contains(&(area.sheet, at)) {
-            return Some(false);
-        }
         let expr = self.ev.host.workbook().sheet(area.sheet)?.cell(at)?.formula.as_ref()?.expr_arc()?;
         let shifted = gridcraft_formula::adjust::shift_relative((*expr).clone(), record as i64 - 1, 0);
         let env = (0..db.cols)
@@ -209,19 +187,10 @@ impl Ctx for FnCtx<'_, '_> {
             calls: self.ev.calls,
             stack_top: self.ev.stack_top,
             fuel: self.ev.fuel,
-            work: self.ev.work,
-            exhausted: false,
-            active_criteria: std::mem::take(&mut self.ev.active_criteria),
         };
-        ev.active_criteria.push((area.sheet, at));
         let v = matches!(ev.value(&shifted).scalar().to_bool(), Ok(true));
         // The child's spend counts against this cell's budget.
         self.ev.fuel = ev.fuel;
-        self.ev.work = ev.work;
-        self.ev.exhausted |= ev.exhausted;
-        let mut active = std::mem::take(&mut ev.active_criteria);
-        active.pop();
-        self.ev.active_criteria = active;
         Some(v)
     }
     fn has_lambda(&self) -> bool {
@@ -241,42 +210,7 @@ impl Ctx for FnCtx<'_, '_> {
 
 impl<'h> Evaluator<'h> {
     pub fn new(host: &'h mut dyn Host, sheet: usize, at: CellRef) -> Self {
-        Evaluator {
-            host,
-            sheet,
-            at,
-            env: Vec::new(),
-            depth: 0,
-            calls: 0,
-            stack_top: 0,
-            fuel: LAMBDA_FUEL,
-            work: EVAL_WORK,
-            exhausted: false,
-            active_criteria: Vec::new(),
-        }
-    }
-
-    /// Spends `units` of this cell's work; `false` (and nothing left) when there isn't enough.
-    pub(crate) fn spend(&mut self, units: u64) -> bool {
-        match self.work.checked_sub(units) {
-            Some(w) => {
-                self.work = w;
-                true
-            }
-            None => {
-                self.work = 0;
-                self.exhausted = true;
-                false
-            }
-        }
-    }
-
-    /// Charges the values of an array (one unit per value; one for anything else).
-    pub(crate) fn spend_on(&mut self, v: &Value) -> bool {
-        match v {
-            Value::Array(a) => self.spend(a.data.len() as u64),
-            _ => self.spend(1),
-        }
+        Evaluator { host, sheet, at, env: Vec::new(), depth: 0, calls: 0, stack_top: 0, fuel: LAMBDA_FUEL }
     }
 
     /// Evaluates to a value (references are dereferenced; multi-cell → array).
@@ -326,27 +260,18 @@ impl<'h> Evaluator<'h> {
         }
         // A reference keeps its size, so the array has its shape and its blanks count
         // (`=A1:A10`, `SUMPRODUCT(--(A1:A10=""))`).
-        let range = self.read_range(a);
-        let (h, w) = (range.height() as usize, range.width() as usize);
-        if (h as u64) * (w as u64) > MAX_CELLS {
-            return Value::Error(CellError::Num);
-        }
-        if !self.spend((h as u64) * (w as u64)) {
-            return Value::Error(CellError::Calc);
-        }
-        let data = self.host.range_values(a.sheet, range);
-        Array::new(h, w, data).map(Value::from).unwrap_or(Value::Error(CellError::Value))
-    }
-
-    /// The block that reading `a` gives: `a` itself, or when it is large (or runs to the sheet's
-    /// edge) the part inside the sheet's used range.
-    pub(crate) fn read_range(&mut self, a: &Area) -> RangeRef {
         let cells = u64::from(a.range.height()) * u64::from(a.range.width());
         // `A:A`, `1:1` and `A2:A1048576` run to the edge of the sheet: they stand for "the rest of
         // the column", not for a block of a chosen size.
         let to_edge = a.range.end.row == MAX_ROWS - 1 || a.range.end.col == MAX_COLS - 1;
         let full_size = cells <= FULL_SIZE_CELLS || (!to_edge && cells <= FULL_SIZE_BOUNDED_CELLS);
-        if full_size { a.range } else { self.trim(a) }
+        let range = if full_size { a.range } else { self.trim(a) };
+        let (h, w) = (range.height() as usize, range.width() as usize);
+        if (h as u64) * (w as u64) > MAX_CELLS {
+            return Value::Error(CellError::Num);
+        }
+        let data = self.host.range_values(a.sheet, range);
+        Array::new(h, w, data).map(Value::from).unwrap_or(Value::Error(CellError::Value))
     }
 
     /// Trims the bottom/right of an area to the sheet's used range (keeps the top-left so
@@ -379,9 +304,6 @@ impl<'h> Evaluator<'h> {
             self.host.stack_exhausted();
             return err(CellError::Num);
         }
-        if !self.spend(1) {
-            return err(CellError::Calc);
-        }
         self.depth += 1;
         if self.depth > MAX_DEPTH {
             self.depth -= 1;
@@ -448,11 +370,6 @@ impl<'h> Evaluator<'h> {
         if let Some(def) = wb.name(bare, scope_sheet) {
             let text = def.formula.clone();
             let scope = def.scope.unwrap_or(self.sheet);
-            // Each use parses and evaluates the definition again: names that each use the one
-            // before twice double the work per name, so it is charged.
-            if !self.spend(text.len() as u64) {
-                return err(CellError::Calc);
-            }
             return match gridcraft_formula::parse_name(&text) {
                 Ok(expr) => {
                     // Relative references in a name are relative to A1: used here, they move by
@@ -645,10 +562,6 @@ impl<'h> Evaluator<'h> {
                 let (x, y) = (self.eval(a), self.eval(b));
                 match (x, y) {
                     (Ev::R(mut xa), Ev::R(ya)) => {
-                        // A union reused through LET doubles at each step: its areas count.
-                        if !self.spend((xa.len() as u64).saturating_add(ya.len() as u64)) {
-                            return err(CellError::Calc);
-                        }
                         xa.extend(ya);
                         Ev::R(xa)
                     }
@@ -660,11 +573,6 @@ impl<'h> Evaluator<'h> {
                 let (x, y) = (self.eval(a), self.eval(b));
                 match (x, y) {
                     (Ev::R(xa), Ev::R(ya)) => {
-                        // Every pair is looked at, and each may be kept: charged before the loop,
-                        // so unions squared through LET can't build an enormous list.
-                        if !self.spend((xa.len() as u64).saturating_mul(ya.len() as u64)) {
-                            return err(CellError::Calc);
-                        }
                         let mut out = Vec::new();
                         for p in &xa {
                             for q in &ya {
@@ -758,113 +666,6 @@ mod fuel_tests {
         ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")))
     }
 
-    /// Evaluates `src` in `wb` with `work` units of work, and the work left.
-    fn eval_work(wb: Workbook, work: u64, src: &str) -> (Value, u64) {
-        let mut host = Empty { wb };
-        let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0));
-        ev.work = work;
-        let v = ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")));
-        (v, ev.work)
-    }
-
-    fn is_calc(v: &Value) -> bool {
-        matches!(v, Value::Error(CellError::Calc))
-    }
-
-    /// Serves the workbook's stored values, for database functions to read.
-    struct Stored {
-        wb: Workbook,
-    }
-    impl Host for Stored {
-        fn workbook(&self) -> &Workbook {
-            &self.wb
-        }
-        fn cell_value(&mut self, sheet: usize, c: CellRef) -> Value {
-            self.wb.sheet(sheet).and_then(|s| s.cell(c)).map_or(Value::Empty, |cell| cell.value.clone())
-        }
-        fn now_serial(&self) -> f64 {
-            0.0
-        }
-        fn random(&mut self) -> f64 {
-            0.0
-        }
-    }
-
-    /// A computed criterion that runs out of work counts as not met for its record, which the
-    /// database function can't see: it must answer #CALC!, not a count that leaves records out.
-    #[test]
-    fn a_computed_criterion_out_of_work_makes_the_database_function_calc() {
-        use gridcraft_model::{Cell, Formula};
-        let mut wb = Workbook::new();
-        let name = |name: String, formula: String| gridcraft_model::DefinedName { name, scope: None, formula, comment: String::new(), hidden: false };
-        wb.names.push(name("Step0".into(), "1".into()));
-        for i in 1..=60 {
-            wb.names.push(name(format!("Step{i}"), format!("Step{}+Step{}", i - 1, i - 1)));
-        }
-        let at = |s: &str| CellRef::parse(s).unwrap();
-        let sheet = wb.sheet_mut(0).unwrap();
-        for (r, (n, age)) in [("name", Value::text("age")), ("a", Value::number(1.0)), ("b", Value::number(2.0))].into_iter().enumerate() {
-            sheet.cells.set(at(&format!("A{}", r + 1)), Cell::value(Value::text(n)));
-            sheet.cells.set(at(&format!("B{}", r + 1)), Cell::value(age));
-        }
-        sheet.cells.set(at("D1"), Cell::value(Value::text("Formula")));
-        let host_wb = |criterion: &str| {
-            let mut wb = wb.clone();
-            // A criteria cell is read by its value first (a blank one matches everything): give it
-            // the value a recalculation would have stored.
-            let mut cell = Cell::formula(Formula::new(criterion));
-            cell.value = Value::Bool(true);
-            wb.sheet_mut(0).unwrap().cells.set(at("D2"), cell);
-            wb
-        };
-        let run = |criterion: &str| {
-            let mut host = Stored { wb: host_wb(criterion) };
-            let mut ev = Evaluator::new(&mut host, 0, CellRef::new(9, 9));
-            ev.work = 100_000;
-            ev.value(&gridcraft_formula::parser::parse("=DCOUNT(A1:B3,\"age\",D1:D2)").unwrap())
-        };
-        assert_eq!(run("=B2>0"), Value::number(2.0), "a cheap criterion counts every record");
-        assert!(is_calc(&run("=Step60>0")), "{:?}", run("=Step60>0"));
-    }
-
-    #[test]
-    fn names_that_double_at_each_step_run_out_of_work() {
-        // Step1 = Step0+Step0, Step2 = Step1+Step1, ...: Step60 would evaluate Step0 2^60 times.
-        let mut wb = Workbook::default();
-        let name = |name: String, formula: String| gridcraft_model::DefinedName { name, scope: None, formula, comment: String::new(), hidden: false };
-        wb.names.push(name("Step0".into(), "1".into()));
-        for i in 1..=60 {
-            wb.names.push(name(format!("Step{i}"), format!("Step{}+Step{}", i - 1, i - 1)));
-        }
-        let (v, _) = eval_work(wb.clone(), EVAL_WORK, "=Step5");
-        assert_eq!(v, Value::number(32.0));
-        let (v, left) = eval_work(wb, 100_000, "=Step60");
-        assert!(is_calc(&v), "{v:?}");
-        assert_eq!(left, 0);
-    }
-
-    #[test]
-    fn intersections_of_unions_are_charged_per_pair() {
-        let wb = Workbook::default();
-        // 4 x 4 pairs, 4 of which meet.
-        let src = "=AREAS((A1,B1,C1,D1) (A1,B1,C1,D1))";
-        let (v, _) = eval_work(wb.clone(), EVAL_WORK, src);
-        assert_eq!(v, Value::number(4.0));
-        let (v, _) = eval_work(wb, 20, src);
-        assert!(is_calc(&v), "{v:?}");
-    }
-
-    #[test]
-    fn an_aggregate_inside_every_lambda_call_spends_work() {
-        let wb = Workbook::default();
-        // 100 calls, each summing the 10,000 values of a captured array: about a million units.
-        let src = "=LET(big,SEQUENCE(10000),SUM(MAP(SEQUENCE(100),LAMBDA(x,SUM(big)))))";
-        let (v, _) = eval_work(wb.clone(), 2_000_000, src);
-        assert_eq!(v, Value::number(100.0 * 50_005_000.0));
-        let (v, _) = eval_work(wb, 200_000, src);
-        assert!(is_calc(&v), "{v:?}");
-    }
-
     #[test]
     fn lambda_calls_spend_fuel_and_run_out_quietly() {
         // Three applications, one charge each: 3 inside the budget. (A nested MAP wouldn't do

crates/calc/src/eval/call.rs

@@ -353,21 +353,8 @@ impl<'h> Evaluator<'h> {
             };
             evaluated.push(Arg { value, from_ref });
         }
-        // The function may go through every value it is given (a SUM inside each call of a
-        // LAMBDA over a large array): the values count against the cell's work.
-        let values = evaluated.iter().fold(0u64, |n, a| n.saturating_add(if let Value::Array(x) = &a.value { x.data.len() as u64 } else { 1 }));
-        if !self.spend(values) {
-            return err(CellError::Calc);
-        }
-        let database = criteria.is_some();
         let mut ctx = FnCtx { ev: self, criteria, lambda };
-        let v = gridcraft_functions::call(spec, &evaluated, &mut ctx);
-        // A computed criterion that ran out of work counted as not met: the result leaves
-        // records out.
-        if database && self.exhausted {
-            return err(CellError::Calc);
-        }
-        Ev::V(v)
+        gridcraft_functions::call(spec, &evaluated, &mut ctx).pipe(Ev::V)
     }
 
     /// Performs aggregation operations without copying its ranges: blocks are folded over the stored
@@ -396,12 +383,6 @@ impl<'h> Evaluator<'h> {
     /// Adds one area to `acc`; `Err` is the result the function ends with.
     fn aggregate_area(&mut self, kind: Agg, a: &Area, acc: &mut Acc) -> Result<(), Ev> {
         if !a.range.is_single() {
-            // Folded without building an array, but still walked: the part inside the used
-            // range counts against the cell's work.
-            let r = self.read_range(a);
-            if !self.spend(u64::from(r.height()) * u64::from(r.width())) {
-                return Err(err(CellError::Calc));
-            }
             let mut error = None;
             let walked = self.host.visit_range(a.sheet, a.range, &mut |v| match acc.add_cell(kind, v) {
                 Ok(()) => true,
@@ -421,9 +402,6 @@ impl<'h> Evaluator<'h> {
     /// Adds one argument's value by calling `SUM` and `COUNT` on it, so coercion and error rules
     /// stay in one place (`AVERAGE` of an argument is its `SUM` over its `COUNT`).
     fn aggregate_value(&mut self, kind: Agg, value: Value, from_ref: bool, acc: &mut Acc) -> Result<(), Ev> {
-        if !from_ref && !self.spend_on(&value) {
-            return Err(err(CellError::Calc));
-        }
         let (Some(sum), Some(count)) = (gridcraft_functions::lookup("SUM"), gridcraft_functions::lookup("COUNT")) else {
             return Err(err(CellError::Name));
         };

crates/calc/src/eval/reference_fns.rs

@@ -118,29 +118,11 @@ impl<'h> Evaluator<'h> {
                 for c in 0..w {
                     let pos = (num(&Some(ra.get_broadcast(r, c))), num(&Some(ca.get_broadcast(r, c))));
                     let v = match pos {
-                        // A position that picks several cells is #CALC!. That is decided from the
-                        // shape: reading the block first, for every position, let a short formula
-                        // read one large range over and over only to discard it.
-                        (Ok(row), Ok(col)) if index_picks_several_values(&src, row, col, two) => Value::Error(CellError::Calc),
                         (Ok(row), Ok(col)) => {
                             let one = self.index_one(src.clone(), row, col, area_n, two);
-                            let cells = match &one {
-                                Ev::R(areas) => match areas.as_slice() {
-                                    [a] => self.area_cells(a),
-                                    _ => 0,
-                                },
-                                _ => 0,
-                            };
-                            if cells > MAX_CELLS {
-                                // As reading it would answer.
-                                Value::Error(CellError::Num)
-                            } else if cells > 1 {
-                                Value::Error(CellError::Calc)
-                            } else {
-                                match self.deref(one) {
-                                    Value::Array(a) if a.rows * a.cols > 1 => Value::Error(CellError::Calc),
-                                    v => v.scalar(),
-                                }
+                            match self.deref(one) {
+                                Value::Array(a) if a.rows * a.cols > 1 => Value::Error(CellError::Calc),
+                                v => v.scalar(),
                             }
                         }
                         (Err(e), _) | (_, Err(e)) => Value::Error(e),
@@ -157,16 +139,6 @@ impl<'h> Evaluator<'h> {
         self.index_one(src, row, col, area_n, two)
     }
 
-    /// Cells that reading `a` gives: its own size, or for a large block the part inside the
-    /// sheet's used range (what [`Evaluator::area_value`] reads).
-    fn area_cells(&mut self, a: &Area) -> u64 {
-        if a.range.is_single() {
-            return 1;
-        }
-        let r = self.read_range(a);
-        u64::from(r.height()) * u64::from(r.width())
-    }
-
     /// INDEX for one row and column position (0 = the whole column or row).
     fn index_one(&mut self, src: Ev, row: i64, col: i64, area_n: i64, two_args: bool) -> Ev {
         if row < 0 || col < 0 {
@@ -435,71 +407,3 @@ impl<'h> Evaluator<'h> {
         Ev::V(gridcraft_functions::aggregate_values(func, &values))
     }
 }
-
-/// Whether INDEX on an array picks a whole row or column of several values at position
-/// (`row`, `col`), which the array-of-positions form answers with #CALC!.
-fn index_picks_several_values(src: &Ev, row: i64, col: i64, two_args: bool) -> bool {
-    let Ev::V(Value::Array(arr)) = src else { return false };
-    let (row, col) = if two_args && arr.rows == 1 { (1, row) } else { (row, col) };
-    if row < 0 || col < 0 || row as u64 > arr.rows as u64 || col as u64 > arr.cols as u64 {
-        return false;
-    }
-    (row == 0 && arr.rows > 1) || (col == 0 && arr.cols > 1)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::Host;
-    use super::*;
-    use gridcraft_model::Workbook;
-
-    /// A sheet of blanks that counts the blocks it is asked for.
-    struct Counting {
-        wb: Workbook,
-        cells_read: usize,
-    }
-    impl Host for Counting {
-        fn workbook(&self) -> &Workbook {
-            &self.wb
-        }
-        fn cell_value(&mut self, _sheet: usize, _c: CellRef) -> Value {
-            Value::Empty
-        }
-        fn now_serial(&self) -> f64 {
-            0.0
-        }
-        fn random(&mut self) -> f64 {
-            0.0
-        }
-        fn range_values(&mut self, _sheet: usize, range: RangeRef) -> Vec<Value> {
-            self.cells_read += range.count() as usize;
-            vec![Value::Empty; range.count() as usize]
-        }
-    }
-
-    fn eval(src: &str) -> (Value, usize) {
-        let mut host = Counting { wb: Workbook::default(), cells_read: 0 };
-        let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0));
-        let v = ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")));
-        (v, host.cells_read)
-    }
-
-    fn all_calc(v: &Value, n: usize) -> bool {
-        matches!(v, Value::Array(a) if a.data.len() == n && a.data.iter().all(|x| *x == Value::Error(CellError::Calc)))
-    }
-
-    #[test]
-    fn index_positions_that_pick_several_cells_are_calc_without_reading_them() {
-        // Each zero row position picks the whole of A1:A50000: #CALC!, decided from the shape. It
-        // used to read the 50,000 cells once per position before discarding them.
-        let (v, read) = eval("=INDEX(A1:A50000,{0,0,0,0},1)");
-        assert!(all_calc(&v, 4), "{v:?}");
-        assert_eq!(read, 0);
-        // The same for an array source: a whole column of a 3x3 array.
-        let (v, _) = eval("=INDEX({1,2,3;4,5,6;7,8,9},{0,0},2)");
-        assert!(all_calc(&v, 2), "{v:?}");
-        // Single cells are still read.
-        let (v, _) = eval("=INDEX({1,2,3;4,5,6;7,8,9},{1,3},2)");
-        assert!(matches!(&v, Value::Array(a) if a.data == vec![Value::number(2.0), Value::number(8.0)]), "{v:?}");
-    }
-}

crates/calc/src/tests.rs

@@ -2372,19 +2372,3 @@ fn formulas_read_a_dirty_python_cell_after_it_is_laid_out() {
     assert_eq!((t.num("B1"), t.num("B2")), (5.0, 6.0));
     assert_eq!((t.num("A1"), t.num("A2"), t.num("A3")), (5.0, 100.0, 111.0));
 }
-
-/// A computed criterion whose formula runs a database function over the same criteria counts as
-/// not met inside itself: before, each record's check ran the function again for every record, at
-/// every level, so the work grew exponentially with the nesting allowed.
-#[test]
-fn computed_criterion_that_reenters_itself_is_not_met() {
-    let mut t = T::new();
-    for (r, (name, age)) in [("name", "age"), ("a", "1"), ("b", "2"), ("c", "3"), ("d", "4"), ("e", "5")].iter().enumerate() {
-        t.set(&format!("F{}", r + 2), name);
-        t.set(&format!("G{}", r + 2), age);
-    }
-    t.set("N46", "Formula");
-    t.set("N47", "=DCOUNT($F$2:$G$7,\"age\",$N$46:$N$47)>0");
-    t.set("B60", "=DCOUNT($F$2:$G$7,\"age\",N46:N47)");
-    assert_eq!(t.num("B60"), 0.0);
-}

crates/chart/src/render/cartesian.rs

@@ -1,6 +1,6 @@
 use super::frame::{Bx, CatAxis, ValAxis, frame, on, value_range};
 use super::legend::{cat_label, plot_kind};
-use super::lines::{decimate, draw_markers, draw_runs};
+use super::lines::{decimate_area, draw_markers, draw_runs};
 use super::trend::{draw_trend_labels, draw_trendlines, max_backward, max_forward, max_forward_slots, supports_trendline};
 use super::{
     Chart, ChartData, ChartKind, Ctx, Fmt, HAlign, LABEL_SIZE, MAX_CATS, MAX_LABELS, MAX_LINE_PTS, MAX_MARKERS, Prim, Scale, SeriesData, TEXT,
@@ -268,10 +268,7 @@ pub(super) fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx
                             base = vec![[b[0] - cw * 0.3, b[1]], [b[0] + cw * 0.3, b[1]]];
                         }
                     }
-                    let top = decimate(top, MAX_LINE_PTS * 2);
-                    let base = decimate(base, MAX_LINE_PTS * 2);
-                    let mut poly = top;
-                    poly.extend(base.into_iter().rev());
+                    let poly = decimate_area(top, base, MAX_LINE_PTS * 2);
                     if poly.len() >= 3 {
                         ctx.out.push(Prim::Polygon { pts: poly, fill: s.color, stroke: None });
                     }

crates/chart/src/render/lines.rs

@@ -54,6 +54,86 @@ pub(super) fn decimate(pts: Vec<[f32; 2]>, max: usize) -> Vec<[f32; 2]> {
     out
 }
 
+/// Decimates the top and baseline of an area chart together at the same horizontal indices so
+/// `area_mesh`'s paired vertical-strip topology (`pts[i]` ↔ `pts[2n - 1 - i]`) is preserved.
+pub(super) fn decimate_area(top: Vec<[f32; 2]>, base: Vec<[f32; 2]>, max: usize) -> Vec<[f32; 2]> {
+    let n = top.len().min(base.len());
+    if n == 0 {
+        return Vec::new();
+    }
+    if n <= max {
+        let mut poly = top;
+        poly.truncate(n);
+        poly.extend(base.into_iter().take(n).rev());
+        return poly;
+    }
+    let mut cols: Vec<[usize; 6]> = Vec::new();
+    let mut keep = Vec::with_capacity(max * 2);
+    let mut i = 0;
+    while i < n {
+        let col = top[i][0].floor();
+        let (start, mut t_mn, mut t_mx, mut b_mn, mut b_mx) = (i, i, i, i, i);
+        let mut k = i + 1;
+        while k < n && top[k][0].floor() == col {
+            if top[k][1] < top[t_mn][1] {
+                t_mn = k;
+            }
+            if top[k][1] > top[t_mx][1] {
+                t_mx = k;
+            }
+            if base[k][1] < base[b_mn][1] {
+                b_mn = k;
+            }
+            if base[k][1] > base[b_mx][1] {
+                b_mx = k;
+            }
+            k += 1;
+        }
+        let entry = [start, t_mn, t_mx, b_mn, b_mx, k - 1];
+        cols.push(entry);
+        let mut idx = entry;
+        idx.sort_unstable();
+        let mut last = usize::MAX;
+        for ix in idx {
+            if ix != last {
+                keep.push(ix);
+                last = ix;
+            }
+        }
+        i = k;
+    }
+    if keep.len() > max * 4 {
+        let max_groups = (max * 4 / 6).max(1);
+        let group_size = cols.len().div_ceil(max_groups);
+        keep.clear();
+        for ch in cols.chunks(group_size) {
+            let start = ch[0][0];
+            let end = ch.last().map_or(start, |c| c[5]);
+            let t_mn = ch.iter().map(|c| c[1]).min_by(|&a, &b| top[a][1].total_cmp(&top[b][1])).unwrap_or(start);
+            let t_mx = ch.iter().map(|c| c[2]).max_by(|&a, &b| top[a][1].total_cmp(&top[b][1])).unwrap_or(start);
+            let b_mn = ch.iter().map(|c| c[3]).min_by(|&a, &b| base[a][1].total_cmp(&base[b][1])).unwrap_or(start);
+            let b_mx = ch.iter().map(|c| c[4]).max_by(|&a, &b| base[a][1].total_cmp(&base[b][1])).unwrap_or(start);
+            let mut idx = [start, t_mn, t_mx, b_mn, b_mx, end];
+            idx.sort_unstable();
+            let mut last = usize::MAX;
+            for ix in idx {
+                if ix != last {
+                    keep.push(ix);
+                    last = ix;
+                }
+            }
+        }
+    }
+    let mut poly = Vec::with_capacity(keep.len() * 2);
+    for &ix in &keep {
+        poly.push(top[ix]);
+    }
+    for &ix in keep.iter().rev() {
+        poly.push(base[ix]);
+    }
+    poly
+}
+
 /// Draws a polyline split at gaps (`None`), decimated when long. With `smooth` (the plot box),
 /// each run is interpolated with a Catmull-Rom spline so the line curves through the data points.
 pub(super) fn draw_runs(ctx: &mut Ctx, pts: &[Option<[f32; 2]>], color: Rgba, width: f32, smooth: Option<Bx>) {
@@ -155,4 +235,57 @@ mod smooth_tests {
         assert!(out.len() > 5);
         assert!(out.iter().all(|p| (0.0..=300.0).contains(&p[0]) && (10.0..=110.0).contains(&p[1])));
     }
+
+    #[test]
+    fn decimate_area_preserves_paired_vertical_strips() {
+        let top: Vec<[f32; 2]> = (0..1000).map(|i| [i as f32 * 0.25, ((i * 37) % 100) as f32]).collect();
+        let base: Vec<[f32; 2]> = (0..1000).map(|i| [i as f32 * 0.25, 100.0]).collect();
+        let poly = decimate_area(top, base, 64);
+        assert_eq!(poly.len() % 2, 0);
+        let half = poly.len() / 2;
+        for i in 0..half {
+            assert_eq!(poly[i][0], poly[poly.len() - 1 - i][0]);
+            assert_eq!(poly[poly.len() - 1 - i][1], 100.0);
+        }
+    }
+
+    #[test]
+    fn decimate_area_preserves_extrema_across_3000_columns() {
+        // 3,000 occupied pixel columns with 6 points per column (18,000 points total),
+        // where each column has distinct top and baseline extrema so the initial per-column
+        // index list exceeds `MAX_LINE_PTS * 2 * 4` (6,400).
+        let max = MAX_LINE_PTS * 2;
+        let mut top = Vec::with_capacity(18_000);
+        let mut base = Vec::with_capacity(18_000);
+        for col in 0..3_000 {
+            let y_top = [50.0, 20.0, 80.0, 50.0, 50.0, 50.0];
+            let y_base = [150.0, 150.0, 150.0, 120.0, 180.0, 150.0];
+            for s in 0..6 {
+                let x = col as f32 + s as f32 * 0.1;
+                top.push([x, y_top[s]]);
+                base.push([x, y_base[s]]);
+            }
+        }
+        // Plant sharp spikes on both top and baseline in interior columns.
+        top[777 * 6 + 1][1] = 1.0;
+        top[1999 * 6 + 2][1] = 99.0;
+        base[1234 * 6 + 3][1] = 101.0;
+        base[2501 * 6 + 4][1] = 199.0;
+
+        let poly = decimate_area(top, base, max);
+        assert_eq!(poly.len() % 2, 0);
+        let half = poly.len() / 2;
+        assert!(half <= max * 4, "retained {half} paired vertices, limit is {}", max * 4);
+        for i in 0..half {
+            assert_eq!(poly[i][0], poly[poly.len() - 1 - i][0]);
+        }
+        let top_kept = &poly[..half];
+        let base_kept = &poly[half..];
+        assert_eq!(top_kept.first().map(|p| p[0]), Some(0.0));
+        assert_eq!(top_kept.last().map(|p| p[0]), Some(2999.5));
+        assert!(top_kept.iter().any(|p| p[1] == 1.0), "top min spike preserved");
+        assert!(top_kept.iter().any(|p| p[1] == 99.0), "top max spike preserved");
+        assert!(base_kept.iter().any(|p| p[1] == 101.0), "base min spike preserved");
+        assert!(base_kept.iter().any(|p| p[1] == 199.0), "base max spike preserved");
+    }
 }

crates/core/src/addr.rs

@@ -188,6 +188,12 @@ impl RangeRef {
             end: CellRef::new(self.end.row.max(o.end.row), self.end.col.max(o.end.col)),
         }
     }
+    /// The top-left cell of a list of areas: the lowest row and the lowest column across all of
+    /// them, whatever order they are listed in. Excel writes the relative formulas of a
+    /// multi-area validation or conditional format for this cell. `None` for no areas.
+    pub fn top_left(ranges: &[RangeRef]) -> Option<CellRef> {
+        ranges.iter().copied().reduce(|a, b| a.union(&b)).map(|r| r.start)
+    }
     /// Row-major iterator over the cells. Callers must bound huge ranges themselves.
     pub fn iter(&self) -> impl Iterator<Item = CellRef> + '_ {
         let (r0, r1, c0, c1) = (self.start.row, self.end.row, self.start.col, self.end.col);
@@ -307,6 +313,16 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn top_left_spans_every_area_in_any_order() {
+        let areas: Vec<RangeRef> = ["H62:H68", "H26:H27", "H93:H95"].iter().filter_map(|a| RangeRef::parse(a)).collect();
+        assert_eq!(RangeRef::top_left(&areas), CellRef::parse("H26"));
+        // Lowest row and lowest column, even when they come from different areas.
+        let areas: Vec<RangeRef> = ["C5:D6", "E2", "B9"].iter().filter_map(|a| RangeRef::parse(a)).collect();
+        assert_eq!(RangeRef::top_left(&areas), CellRef::parse("B2"));
+        assert_eq!(RangeRef::top_left(&[]), None);
+    }
+
     #[test]
     fn sheet_quoting_follows_excel() {
         for quoted in [

crates/engine/src/cf.rs

@@ -244,7 +244,7 @@ impl CfCache {
         let v = sh.value(c);
         let no_stats = RuleStats::default();
         for (idx, cf) in rules {
-            let first = cf.ranges.first().map(|r| r.start).unwrap_or(c);
+            let first = RangeRef::top_left(&cf.ranges).unwrap_or(c);
             let st: &RuleStats = match stats_need(&cf.rule) {
                 Some(need) => &*self.stats.entry(idx).or_insert_with(|| RuleStats::build(sh, &cf.ranges, need)),
                 None => &no_stats,

crates/engine/src/cmd/data/tests.rs

@@ -480,6 +480,45 @@ fn a_list_typed_without_quotes_is_saved_as_a_quoted_list() {
     assert_eq!(sheet_xml(&reopened), xml, "a second save writes the same rules");
 }
 
+#[test]
+fn a_relative_list_source_is_read_from_the_cell_being_checked() {
+    // As in Excel, `=$B1:$B2` on A3:A4,A1:A2 is written for A1 (the top-left cell of all the
+    // areas) and lists B4:B5 at A4. It used to list B1:B2 in every cell.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "B1:B5", "values": [["a"], ["b"], ["c"], ["d"], ["e"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A3:A4,A1:A2", "type": "list", "formula1": "=$B1:$B2"})).unwrap();
+    let wb = s.doc().unwrap().wb.clone();
+    let dv = wb.active().unwrap().validations[0].clone();
+    for (cell, items) in [("A1", ["a", "b"]), ("A2", ["b", "c"]), ("A3", ["c", "d"]), ("A4", ["d", "e"])] {
+        let at = CellRef::parse(cell).unwrap();
+        assert_eq!(list_items(&wb, 0, at, &dv), items, "{cell}");
+        for v in ["a", "b", "c", "d", "e"] {
+            assert_eq!(check_validation(&wb, 0, at, v).is_none(), items.contains(&v), "{cell} with {v}");
+        }
+    }
+}
+
+#[test]
+fn a_list_source_that_takes_in_the_cell_does_not_list_the_value_being_typed() {
+    // `=$A1:$A2` on A2:A3 is A1:A2 at A2 and A2:A3 at A3. The list is the one before the entry, as
+    // in Excel; a new value used to land in its own source and pass.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:A2", "values": [["x"], ["y"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A2:A3", "type": "list", "formula1": "=$A1:$A2"})).unwrap();
+    let wb = &s.doc().unwrap().wb;
+    for (cell, accepted, refused) in [("A2", &["x", "y"][..], &["new"][..]), ("A3", &["y"], &["x", "new"])] {
+        let at = CellRef::parse(cell).unwrap();
+        for v in accepted {
+            assert!(check_validation(wb, 0, at, v).is_none(), "{cell} refuses {v}");
+        }
+        for v in refused {
+            assert!(check_validation(wb, 0, at, v).is_some(), "{cell} accepts {v}");
+        }
+    }
+}
+
 #[test]
 fn a_rule_with_an_unknown_type_operator_or_error_style_is_refused() {
     // A typo used to give a rule that validates nothing (`type="none"`) or the wrong check,

crates/engine/src/cmd/data/validation.rs

@@ -38,11 +38,18 @@ fn subtract_range(r: RangeRef, cut: &RangeRef) -> Vec<RangeRef> {
 }
 
 /// Removes the cells of `cuts` from every validation, keeping the rest of each rule's ranges.
+/// When the rule's top-left cell goes, its relative formulas are rewritten for the new top-left
+/// cell, so the cells left keep checking the same cells.
 pub(in super::super) fn remove_validation_cells(validations: &mut Vec<Validation>, cuts: &[RangeRef]) {
     for dv in validations.iter_mut() {
+        let before = RangeRef::top_left(&dv.ranges);
         for cut in cuts {
             dv.ranges = dv.ranges.iter().flat_map(|r| subtract_range(*r, cut)).collect();
         }
+        if let (Some(from), Some(to)) = (before, RangeRef::top_left(&dv.ranges)) {
+            dv.f1 = move_rule_formula(&dv.f1, from, to);
+            dv.f2 = dv.f2.take().map(|f| move_rule_formula(&f, from, to));
+        }
     }
     validations.retain(|d| !d.ranges.is_empty());
 }
@@ -145,8 +152,10 @@ fn list_source(f: &str) -> String {
     format!("\"{}\"", t.replace('"', "\"\""))
 }
 
-/// List entries of a list validation (literal or from a range).
-pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
+/// List entries of a list validation (literal or from a range) for the cell `at`. A relative
+/// source is written for the rule's top-left cell and read from `at`, as in Excel (`=$B1:$B3` on
+/// A1:A9 lists B5:B7 at A5).
+pub fn list_items(wb: &Workbook, sheet: usize, at: CellRef, dv: &Validation) -> Vec<String> {
     let f = dv.f1.trim();
     if is_literal_list(f) {
         // A quoted list is a string literal: `""` inside stands for one `"`.
@@ -156,8 +165,8 @@ pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
         };
         return items.split(',').map(|x| x.trim().to_string()).filter(|x| !x.is_empty()).collect();
     }
-    let at = dv.ranges.first().map(|r| r.start).unwrap_or_default();
-    match gridcraft_calc::evaluate(wb, sheet, at, f) {
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    match gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at)) {
         Value::Array(a) => a.data.iter().filter(|v| !v.is_empty()).map(Value::display).collect(),
         v if !v.is_empty() && !v.is_error() => vec![v.display()],
         _ => vec![],
@@ -175,9 +184,10 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
         return None;
     }
     let v = gridcraft_core::parse::parse_input(input, wb.date_system).value;
-    // The formulas are written for the first cell of the range and see the value being entered,
+    // The formulas are written for the top-left cell of all the areas and see the value being entered,
     // as in Excel (a custom `=A1>10` on A1:A9 checks A5's new value at A5).
-    let first = dv.ranges.first().map(|r| r.start).unwrap_or(at);
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    let original = wb;
     let entered;
     let wb = if sh.value(at) == v {
         wb
@@ -193,7 +203,9 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
     let eval = |f: &str| gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at));
     let num = |f: &str| eval(f).to_number().ok();
     let ok = match dv.kind {
-        ValidationKind::List => list_items(wb, sheet, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
+        // The list is the one the dropdown showed before the entry, as in Excel: a source that takes
+        // in the cell itself (`=$A1:$A2` on A2:A3 is A2:A3 at A3) doesn't list the value being typed.
+        ValidationKind::List => list_items(original, sheet, at, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
         ValidationKind::Custom => eval(&dv.f1).to_bool().unwrap_or(false),
         ValidationKind::TextLength => {
             let n = input.chars().count() as f64;

crates/engine/src/cmd/edit/paste_special.rs

@@ -284,7 +284,7 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
                 crate::cmd::data::remove_validation_cells(&mut sh.validations, &[RangeRef::new(dest, dest)]);
                 if let Some(mut dv) = rule {
                     // Relative references move with the rule, as pasted formulas do.
-                    let first = dv.ranges.first().map_or(sc, |r| r.start);
+                    let first = RangeRef::top_left(&dv.ranges).unwrap_or(sc);
                     dv.f1 = crate::cmd::data::move_rule_formula(&dv.f1, first, dest);
                     dv.f2 = dv.f2.map(|f| crate::cmd::data::move_rule_formula(&f, first, dest));
                     dv.ranges = vec![RangeRef::new(dest, dest)];

crates/engine/src/cmd/insert.rs

@@ -1733,7 +1733,13 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
             sh.cond_formats.clear();
         } else {
             for cf in sh.cond_formats.iter_mut() {
+                let before = RangeRef::top_left(&cf.ranges);
                 cf.ranges.retain(|r| !ranges.iter().any(|x| x.intersects(r)));
+                // The relative formulas are written for the top-left cell: when it goes, they're
+                // rewritten for the new one, so the areas left keep reading the same cells.
+                if let (Some(from), Some(to)) = (before, RangeRef::top_left(&cf.ranges)) {
+                    rebase_cf_formulas(&mut cf.rule, from, to);
+                }
             }
             sh.cond_formats.retain(|c| !c.ranges.is_empty());
         }
@@ -1741,6 +1747,19 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Moves the relative references of a rule's per-cell formulas written for `from` to `to`.
+fn rebase_cf_formulas(rule: &mut CfRule, from: CellRef, to: CellRef) {
+    let mv = |f: &str| crate::cmd::data::move_rule_formula(f, from, to);
+    match rule {
+        CfRule::CellIs { a, b, .. } => {
+            *a = mv(a);
+            *b = b.as_deref().map(mv);
+        }
+        CfRule::Expression { formula, .. } => *formula = mv(formula),
+        _ => {}
+    }
+}
+
 fn manage_cf(s: &mut Session, p: &Json) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     if p.get("delete").is_none() && p.get("moveUp").is_none() && p.get("moveDown").is_none() {

crates/engine/src/io.rs

@@ -3,7 +3,7 @@
 use std::fmt::Write as _;
 
 use gridcraft_core::{CellRef, RangeRef};
-use gridcraft_model::{Sheet, Workbook};
+use gridcraft_model::{LineIndex, Sheet, Workbook};
 
 use crate::{EngineError, Result};
 
@@ -548,6 +548,23 @@ fn table_dir(sh: &Sheet) -> &'static str {
 const CLIPBOARD_HTML_MAX_BYTES: usize = 4 * 1024 * 1024;
 const CLIPBOARD_HTML_MAX_CELLS: u64 = 10_000;
 
+/// The merge covering each cell of `rect`, as `Sheet::merge_at` would find it (the first in the
+/// sheet's list), built once so a table lookup is one probe instead of a scan of every merge.
+/// `None` when overlapping merges would cost more than a few visits per cell of `rect`: a
+/// hostile file's merge list can't multiply the work of a bounded export.
+fn merge_index(sh: &Sheet, rect: RangeRef) -> Option<std::collections::HashMap<CellRef, RangeRef>> {
+    let mut map = std::collections::HashMap::new();
+    let mut left = rect.count().saturating_mul(4);
+    for m in &sh.merges {
+        let Some(part) = m.intersection(&rect) else { continue };
+        left = left.checked_sub(part.count())?;
+        for c in part.iter() {
+            map.entry(c).or_insert(*m);
+        }
+    }
+    Some(map)
+}
+
 /// An HTML fragment for the same range as `plain_text`, previously produced by
 /// `display::range_text`. Large copies keep plain text only; never return a partial table.
 pub(crate) fn range_html(wb: &Workbook, sheet: usize, r: RangeRef, plain_text: &str) -> Option<String> {
@@ -556,6 +573,7 @@ pub(crate) fn range_html(wb: &Workbook, sheet: usize, r: RangeRef, plain_text: &
         return None;
     }
     let sh = wb.sheet(sheet)?;
+    let merges = merge_index(sh, r)?;
     let mut out = ClipboardHtml(String::new());
     write!(out, "<table{} style=\"border-collapse:collapse;font-family:Calibri,Carlito,Arial,sans-serif;font-size:11pt\">", table_dir(sh)).ok()?;
     for row in r.start.row..=r.end.row {
@@ -565,7 +583,7 @@ pub(crate) fn range_html(wb: &Workbook, sheet: usize, r: RangeRef, plain_text: &
         out.write_str("<tr>").ok()?;
         for col in r.start.col..=r.end.col {
             let c = CellRef::new(row, col);
-            let span = if let Some(merged) = sh.merges.iter().find(|m| m.contains(c)).and_then(|m| m.intersection(&r)) {
+            let span = if let Some(merged) = merges.get(&c).and_then(|m| m.intersection(&r)) {
                 let first_row = (merged.start.row..=merged.end.row).find(|&row| !sh.is_row_hidden(row))?;
                 if c != CellRef::new(first_row, merged.start.col) {
                     continue;
@@ -628,6 +646,14 @@ const HTML_EXPORT_MAX_ROWS: u32 = 100_001;
 /// tall, wide one) would otherwise be gigabytes of `<td></td>` before finishing (#2387).
 const HTML_EXPORT_MAX_CELLS: u64 = 4_000_000;
 
+/// Most bytes of one web page. Every cell may hold long text (shared across many cells in the
+/// file), so the cell count alone doesn't bound the page; past this the export fails instead.
+const HTML_EXPORT_MAX_BYTES: usize = 256 * 1024 * 1024;
+
+fn html_too_big() -> EngineError {
+    EngineError::Other(format!("the web page would be over {} MiB. Save as .xlsx or CSV instead.", HTML_EXPORT_MAX_BYTES / (1024 * 1024)))
+}
+
 /// A sheet as a standalone HTML table (Save as Web Page). A sheet with pictures gets the sheet's
 /// own column widths and row heights so each picture and chart (inline SVG) can sit at its anchor.
 pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
@@ -670,6 +696,23 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
                 r.width()
             )));
         }
+        let merges = merge_index(sh, r).ok_or_else(|| EngineError::Other("the sheet's merged cells overlap too much for a web page.".into()))?;
+        // Visible rows and columns of the table before each line, so a merge's span is counted
+        // in constant time whatever the file says its size is.
+        let visible_before = |hidden: &dyn Fn(u32) -> bool, from: u32, to: u32| {
+            let mut v = Vec::with_capacity((to - from) as usize + 2);
+            v.push(0u32);
+            for line in from..=to {
+                v.push(v.last().copied().unwrap_or(0) + u32::from(!hidden(line)));
+            }
+            v
+        };
+        let rows_before = visible_before(&|y| sh.is_row_hidden(y), r.start.row, r.end.row);
+        let cols_before = visible_before(&|x| sh.is_col_hidden(x), r.start.col, r.end.col);
+        let visible = |before: &[u32], from: u32, a: u32, b: u32| {
+            let at = |line: u32| before.get((line - from) as usize).copied().unwrap_or(0);
+            at(b + 1) - at(a)
+        };
         if fixed {
             out.push_str("<colgroup>");
             for col in (r.start.col..=r.end.col).filter(|&c| !sh.is_col_hidden(c)) {
@@ -688,20 +731,19 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
             }
             for col in r.start.col..=r.end.col {
                 let c = CellRef::new(row, col);
-                if sh.merges.iter().any(|m| m.contains(c) && m.start != c) || (fixed && sh.is_col_hidden(col)) {
+                let merge = merges.get(&c);
+                if merge.is_some_and(|m| m.start != c) || (fixed && sh.is_col_hidden(col)) {
                     continue;
                 }
                 let text = crate::display::cell_text(wb, sh, c);
                 let dir = CellDir::of(sh, c, &text);
                 let css = html_cell_css(wb, sh, c, dir);
-                let span = sh
-                    .merges
-                    .iter()
-                    .find(|m| m.start == c)
+                let span = merge
                     .map(|m| {
                         if fixed {
-                            let rows = (m.start.row..=m.end.row).filter(|&y| !sh.is_row_hidden(y)).count();
-                            let cols = (m.start.col..=m.end.col).filter(|&x| !sh.is_col_hidden(x)).count();
+                            // Spans count the table's visible lines: the merge is clipped to the table.
+                            let rows = visible(&rows_before, r.start.row, m.start.row, m.end.row.min(r.end.row));
+                            let cols = visible(&cols_before, r.start.col, m.start.col, m.end.col.min(r.end.col));
                             format!(" rowspan=\"{rows}\" colspan=\"{cols}\"")
                         } else {
                             format!(" rowspan=\"{}\" colspan=\"{}\"", m.height(), m.width())
@@ -709,6 +751,9 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
                     })
                     .unwrap_or_default();
                 let _ = write!(out, "<td style=\"{css}\"{}{span}>{}</td>", dir.attr(), esc(&text));
+                if out.len() > HTML_EXPORT_MAX_BYTES {
+                    return Err(html_too_big());
+                }
             }
             out.push_str("</tr>");
         }
@@ -716,12 +761,15 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
     out.push_str("</table>");
     if fixed {
         // Sheet units are CSS pixels; the table starts at the used range, not at A1.
-        let (left, top) = used.map_or((0.0, 0.0), |r| (sh.col_left(r.start.col), sh.row_top(r.start.row)));
+        // Indexed positions: each anchor would otherwise sum every custom row and column before it.
+        let ri = LineIndex::new(&sh.rows, sh.default_row_height, gridcraft_core::MAX_ROWS);
+        let ci = LineIndex::new(&sh.cols, sh.default_col_width, gridcraft_core::MAX_COLS);
+        let (left, top) = used.map_or((0.0, 0.0), |r| (ci.start(r.start.col), ri.start(r.start.row)));
         let place = |a: &gridcraft_model::Anchor| {
             format!(
                 "position:absolute;left:{}px;top:{}px;width:{}px;height:{}px",
-                sh.col_left(a.cell.col) - left + f64::from(a.dx),
-                sh.row_top(a.cell.row) - top + f64::from(a.dy),
+                ci.start(a.cell.col) - left + f64::from(a.dx),
+                ri.start(a.cell.row) - top + f64::from(a.dy),
                 a.width.max(0.0),
                 a.height.max(0.0)
             )
@@ -735,6 +783,9 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
                 esc(&im.alt),
                 place(&im.anchor)
             );
+            if out.len() > HTML_EXPORT_MAX_BYTES {
+                return Err(html_too_big());
+            }
         }
         for ch in &sh.charts {
             if let Some(svg) = crate::chart_svg::chart_svg(wb, sheet, ch, &place(&ch.anchor)) {

crates/engine/src/io/tests.rs

@@ -604,3 +604,57 @@ fn opening_google_sheets_export_unwraps_only_formulas_gridcraft_calculates() {
     assert_eq!(text("A2").as_deref(), Some("IFERROR(__XLUDF.DUMMYFUNCTION(\"GOOGLETRANSLATE(\"\"hi\"\",\"\"en\"\",\"\"fr\"\")\"),\"salut\")"));
     assert_eq!(opened.sheets[0].cells.get(CellRef::parse("A2").unwrap()).map(|c| c.value.clone()), Some(Value::text("salut")));
 }
+
+/// Merges far from what is copied or exported, in a hostile number, are indexed once instead of
+/// being scanned for every cell; a merge running past the table is clipped to it.
+#[test]
+fn html_merge_lookups_and_spans_stay_bounded() {
+    let mut wb = book_with_picture("A1", (0, 0));
+    let sh = wb.sheet_mut(0).unwrap();
+    for i in 0..200_000u32 {
+        sh.merges.push(RangeRef::new(CellRef::new(500_000 + i * 2, 5), CellRef::new(500_000 + i * 2, 6)));
+    }
+    sh.merges.push(RangeRef::new(CellRef::new(0, 0), CellRef::new(gridcraft_core::MAX_ROWS - 1, 1)));
+    sh.set_value(CellRef::new(2, 1), gridcraft_core::Value::Number(2.0));
+    let html = copied(&wb, "A1:C50");
+    assert!(html.contains("rowspan=\"50\" colspan=\"2\""), "{html}");
+    let page = to_html(&wb, 0).unwrap();
+    // The table is A1:B3 (the used range): the whole-height merge spans its three rows only.
+    assert!(page.contains("rowspan=\"3\" colspan=\"2\""), "{page}");
+    // Merges stacked over one another past a few per cell are refused, not walked.
+    let sh = wb.sheet_mut(0).unwrap();
+    sh.merges = vec![RangeRef::new(CellRef::new(0, 0), CellRef::new(2, 1)); 100];
+    assert!(to_html(&wb, 0).is_err());
+    assert!(range_html(&wb, 0, RangeRef::parse("A1:B3").unwrap(), "").is_none());
+}
+
+/// Thousands of pictures over thousands of custom rows: each is placed through a row index.
+#[test]
+fn html_export_places_many_pictures_over_many_custom_rows() {
+    let mut wb = book_with_picture("A1", (0, 0));
+    let sh = wb.sheet_mut(0).unwrap();
+    for row in 0..50_000 {
+        sh.rows.insert(row, gridcraft_model::LineInfo { size: Some(30.0), ..Default::default() });
+    }
+    let image = sh.images[0].clone();
+    for i in 0..5_000u32 {
+        let mut im = image.clone();
+        im.anchor.cell = CellRef::new(40_000 + i, 0);
+        sh.images.push(im);
+    }
+    let page = to_html(&wb, 0).unwrap();
+    assert!(page.contains(&format!("top:{}px", 30 * 44_999)), "last picture placed by the index");
+}
+
+/// One long text shown by many cells: the page fails at its byte limit instead of growing on.
+#[test]
+fn html_export_refuses_a_page_past_its_byte_limit() {
+    let mut wb = Workbook::new();
+    let sh = wb.sheet_mut(0).unwrap();
+    let text = gridcraft_core::Value::text("x".repeat(32_000));
+    for row in 0..10_000 {
+        sh.set_value(CellRef::new(row, 0), text.clone());
+    }
+    let err = to_html(&wb, 0).unwrap_err();
+    assert!(err.to_string().contains("MiB"), "{err}");
+}

crates/engine/src/tests.rs

@@ -2743,6 +2743,78 @@ fn validation_formulas_are_relative_and_see_the_new_value() {
     assert!(!ok(&mut s, "C1", "50"));
 }
 
+#[test]
+fn multi_area_rule_formulas_are_relative_to_the_top_left_cell_of_all_areas() {
+    // Issue #3152: Excel writes the formula for the top-left cell of all the areas (H26), whatever
+    // order they are listed in, not for the first area listed (H62).
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "F26:F27", "values": [[4], [5]]})).unwrap();
+    s.execute("data.validation", json!({"range": "H62:H68,H26:H27,H93:H95", "type": "custom", "formula1": "=MOD($H26,$F26)=0"})).unwrap();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    assert!(ok(&mut s, "H26", "4"));
+    assert!(ok(&mut s, "H26", "8"));
+    assert!(!ok(&mut s, "H26", "3"));
+    assert!(ok(&mut s, "H27", "10"));
+    assert!(!ok(&mut s, "H27", "4"));
+
+    // Conditional formats anchor on the same cell: `=D2>0` on D5:D6,D2:D3 checks D2 at D2.
+    s.execute("range.setValues", json!({"range": "D2:D6", "values": [[1], [0], [0], [1], [0]]})).unwrap();
+    s.execute("home.conditionalFormat", json!({"range": "D5:D6,D2:D3", "rule": {"type": "expression", "formula": "=D2>0", "preset": "greenFill"}}))
+        .unwrap();
+    let wb = s.doc().unwrap().wb.clone();
+    let mut cache = crate::cf::CfCache::new();
+    let mut styled = |c: &str| cache.look(&wb, 0, CellRef::parse(c).unwrap()).and_then(|l| l.style).is_some();
+    assert_eq!([styled("D2"), styled("D3"), styled("D5"), styled("D6")], [true, false, true, false]);
+}
+
+#[test]
+fn removing_a_rules_top_left_cell_rewrites_its_formulas_for_the_new_one() {
+    let mut s = s();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    let f1 = |s: &Session| s.doc().unwrap().wb.active().unwrap().validations[0].f1.clone();
+
+    // One area: clearing A1 off A1:A9 leaves A2:A9, whose cells still check themselves.
+    s.execute("data.validation", json!({"range": "A1:A9", "type": "custom", "formula1": "=A1>10"})).unwrap();
+    s.execute("data.validation", json!({"range": "A1", "clear": true})).unwrap();
+    assert_eq!(f1(&s), "A2>10");
+    assert!(ok(&mut s, "A2", "20"));
+    assert!(!ok(&mut s, "A2", "5"));
+    s.execute("data.validation", json!({"range": "A1:A9", "clear": true})).unwrap();
+
+    // Several areas: clearing H26 moves the top-left cell to H27, where `$H27,$F27` is checked.
+    s.execute("range.setValues", json!({"range": "F26:F27", "values": [[4], [5]]})).unwrap();
+    s.execute("data.validation", json!({"range": "H62:H68,H26:H27", "type": "custom", "formula1": "=MOD($H26,$F26)=0"})).unwrap();
+    s.execute("data.validation", json!({"range": "H26", "clear": true})).unwrap();
+    assert_eq!(f1(&s), "MOD($H27,$F27)=0");
+    assert!(ok(&mut s, "H27", "10"));
+    assert!(!ok(&mut s, "H27", "4"));
+    // Absolute and literal formulas don't move.
+    s.execute("data.validation", json!({"range": "J1:J3", "type": "list", "formula1": "=$B$1:$B$2"})).unwrap();
+    s.execute("data.validation", json!({"range": "J1", "clear": true})).unwrap();
+    let dv = s.doc().unwrap().wb.active().unwrap().validations.iter().find(|d| d.ranges[0].a1() == "J2:J3").unwrap().f1.clone();
+    assert_eq!(dv, "$B$1:$B$2");
+
+    // Conditional formats: Clear Rules on D2 drops the D2:D3 area, and D5:D6 keeps reading itself.
+    s.execute("range.setValues", json!({"range": "D2:D6", "values": [[1], [0], [0], [0], [1]]})).unwrap();
+    s.execute("home.conditionalFormat", json!({"range": "D5:D6,D2:D3", "rule": {"type": "expression", "formula": "=D2>0", "preset": "greenFill"}}))
+        .unwrap();
+    s.execute("range.setValues", json!({"range": "E2:E6", "values": [[1], [0], [0], [0], [1]]})).unwrap();
+    s.execute("range.setValues", json!({"range": "G2:G6", "values": [[0], [9], [9], [9], [0]]})).unwrap();
+    s.execute(
+        "home.conditionalFormat",
+        json!({"range": "E5:E6,E2:E3", "rule": {"type": "cellIs", "operator": "greater", "value": "=G2", "preset": "lightRedFill"}}),
+    )
+    .unwrap();
+    s.execute("home.clearRules", json!({"range": "D2,E2"})).unwrap();
+    let rules: Vec<gridcraft_model::CfRule> = s.doc().unwrap().wb.active().unwrap().cond_formats.iter().map(|c| c.rule.clone()).collect();
+    assert!(rules.iter().any(|r| matches!(r, gridcraft_model::CfRule::Expression { formula, .. } if formula == "D5>0")), "{rules:?}");
+    assert!(rules.iter().any(|r| matches!(r, gridcraft_model::CfRule::CellIs { a, .. } if a == "G5")), "{rules:?}");
+    let wb = s.doc().unwrap().wb.clone();
+    let mut cache = crate::cf::CfCache::new();
+    let mut styled = |c: &str| cache.look(&wb, 0, CellRef::parse(c).unwrap()).and_then(|l| l.style).is_some();
+    assert_eq!([styled("D5"), styled("D6"), styled("E5"), styled("E6")], [false, true, false, true]);
+}
+
 #[test]
 fn samples_build() {
     for (name, _) in crate::sample::SAMPLES {

crates/ui-egui/src/grid/editor.rs

@@ -125,7 +125,7 @@ pub(super) fn list_picker(app: &mut SheetApp, ui: &mut egui::Ui, geo: &Geo, was_
         app.grid.list_picker = None;
         return;
     };
-    let items = gridcraft_engine::cmd::data::list_items(&wb, si, &dv);
+    let items = gridcraft_engine::cmd::data::list_items(&wb, si, c, &dv);
     let r = geo.cell_rect(sh, c);
     // Fit the popup to its rows (up to LIST_PICKER_MAX_ROWS); without a minimum the scroll area collapses to its 64 px default.
     let height = list_picker_height(items.len(), LIST_PICKER_ROW_H, ui.spacing().item_spacing.y);

crates/ui-egui/src/ribbon/home.rs

@@ -622,10 +622,13 @@ fn size_combo(app: &mut SheetApp, ui: &mut Ui, st: &Style) {
     let arrow_rect = Rect::from_min_max(egui::pos2(frame.right() - 16.0, frame.top() + 1.0), egui::pos2(frame.right() - 1.0, frame.bottom() - 1.0));
     let mut field_ui =
         ui.new_child(egui::UiBuilder::new().max_rect(text_rect.shrink2(vec2(6.0, 0.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
+    // The text edit is `interact_size.y` tall and puts its text at the top of that unless told
+    // otherwise: center it, on the Font name's baseline (#3155).
     let out = egui::TextEdit::singleline(&mut text)
         .id(field)
         .font(theme::ui_font(12.5))
         .frame(egui::Frame::NONE)
+        .align(egui::Align2::LEFT_CENTER)
         .desired_width(text_rect.width() - 12.0)
         .show(&mut field_ui);
     let resp = out.response;

crates/ui-egui/tests/it/font_size_box.rs

@@ -1,6 +1,7 @@
-//! Home ▸ Font Size is a box you type a size into, with the standard sizes behind its arrow (#932).
+//! Home ▸ Font Size is a box you type a size into, with the standard sizes behind its arrow (#932),
+//! and the size sits in the middle of that box (#3155).
 
-use egui::{Event, Key, Modifiers, accesskit::Role};
+use egui::{Event, Key, Modifiers, Rect, Shape, accesskit::Role};
 use egui_kittest::kittest::Queryable as _;
 use gridcraft_engine::Session;
 use gridcraft_engine::core::{CellRef, Value};
@@ -124,3 +125,31 @@ fn the_arrow_opens_the_plain_list_of_sizes() {
     h.run_steps(3);
     assert_eq!(size(&h, "A1"), 12.0, "Down from 11 then Enter picks 12");
 }
+
+/// The on-screen box of the painted text `text` that overlaps `within`. The grid's row headers
+/// paint "11" too, so the size has to be looked for inside its own box.
+fn painted_text(h: &Harness, text: &str, within: Rect) -> Rect {
+    h.output()
+        .shapes
+        .iter()
+        .find_map(|s| match &s.shape {
+            Shape::Text(t) if t.galley.job.text == text => {
+                let rect = t.galley.rect.translate(t.pos.to_vec2());
+                within.intersects(rect).then_some(rect)
+            }
+            _ => None,
+        })
+        .unwrap_or_else(|| panic!("{text:?} is painted inside {within:?}"))
+}
+
+#[test]
+/// A text edit aligns its text to the top of its rect unless told otherwise, which left the size
+/// 4 pt above the Font name's baseline.
+fn the_size_is_vertically_centered_in_its_box() {
+    let h = harness();
+    let field = h.get_by_role_and_label(Role::TextInput, "Font Size").rect();
+    let value = painted_text(&h, "11", field);
+    let name = painted_text(&h, "Calibri", Rect::EVERYTHING);
+    assert!((value.center().y - field.center().y).abs() <= 1.0, "the size is centered in its box: {value:?} in {field:?}");
+    assert!((value.center().y - name.center().y).abs() <= 1.0, "the size is on the Font name's baseline: {value:?} against {name:?}");
+}

crates/ui-egui/tests/it/ribbon_layout.rs

@@ -104,7 +104,10 @@ struct Clicks {
 #[test]
 /// The main button clicks once and the arrow twice separately; the tooltip keeps the platform shortcut, and the icon sits above the full-width label.
 fn big_split_button_separates_the_default_action_from_the_menu() {
-    let mut h = crate::common::builder().with_size(vec2(300.0, 200.0)).build_ui_state(
+    // The ribbon picks the shortcut by the OS egui reports, which kittest pins to Nix unless told:
+    // pin macOS, so the check is the same on every host (the other platforms' text is in
+    // `widgets::tests`).
+    let mut h = crate::common::builder().with_size(vec2(300.0, 200.0)).with_os(egui::os::OperatingSystem::Mac).build_ui_state(
         |ui, c: &mut Clicks| {
             let (main, arrow) = widgets::big_split_button(ui, Icon::Sum, "Auto\nSum", "AutoSum");
             c.main += u32::from(main.clicked());
@@ -125,8 +128,7 @@ fn big_split_button_separates_the_default_action_from_the_menu() {
     h.ctx.all_styles_mut(|s| s.interaction.tooltip_delay = 0.0);
     h.get_by_label("Auto Sum").hover();
     h.run_steps(6);
-    let shortcut = if cfg!(target_os = "macos") { "AutoSum (\u{2318}\u{21e7}T)" } else { "AutoSum (Alt+=)" };
-    assert!(h.query_by_value(shortcut).is_some(), "tooltip with the shortcut");
+    assert!(h.query_by_value("AutoSum (\u{2318}\u{21e7}T)").is_some(), "tooltip with the macOS shortcut");
     // The icon part sits above the label part, across the full width.
     let main = h.get_by_label("Auto Sum").rect();
     let arrow = h.get_by_label("Auto Sum options").rect();

crates/xlsx/src/sheet_write/rules.rs

@@ -52,8 +52,10 @@ pub(super) fn x14_cfvo(v: &CfValueKind) -> String {
     format!("<x14:cfvo type=\"{ty}\"><xm:f>{}</xm:f></x14:cfvo>", esc(&val))
 }
 
+/// One `cfRule` element. The formulas generated for text, blank, error and date rules refer to the
+/// top-left cell of all the rule's areas, the cell Excel reads relative references from.
 pub(super) fn cf_rule_xml(cf: &CondFormat, priority: u32, out: &mut Out) -> String {
-    let tl = cf.ranges.first().map(|r| r.start.a1()).unwrap_or_else(|| "A1".into());
+    let tl = RangeRef::top_left(&cf.ranges).map(|c| c.a1()).unwrap_or_else(|| "A1".into());
     let stop = if cf.stop_if_true { " stopIfTrue=\"1\"" } else { "" };
     let mut dxf = |st: &Style| dxf_id(&mut out.dxfs, st);
     let f = |x: &str| format!("<formula>{}</formula>", esc(&text_to_file(x)));

crates/xlsx/src/tests/roundtrip.rs

@@ -1678,3 +1678,21 @@ fn workbook_view_writer_clamps_out_of_range_model_values() {
         assert_eq!(back.view.tab_ratio, 1000);
     }
 }
+
+#[test]
+fn generated_rule_formulas_use_the_top_left_cell_of_every_area() {
+    // Issue #3152: the areas aren't in top-to-bottom order; the formula is written for C2, not C5.
+    let mut wb = Workbook::new();
+    let red = Box::new(Style::default());
+    wb.sheet_mut(0).unwrap().cond_formats.push(CondFormat {
+        ranges: vec![rr("C5:C6"), rr("C2:C3")],
+        rule: CfRule::ContainsText { text: "x".into(), style: red },
+        priority: 1,
+        stop_if_true: false,
+    });
+    let bytes = write_xlsx(&wb).unwrap();
+    let mut z = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
+    let mut xml = String::new();
+    z.by_name("xl/worksheets/sheet1.xml").unwrap().read_to_string(&mut xml).unwrap();
+    assert!(xml.contains("<formula>NOT(ISERROR(SEARCH(\"x\",C2)))</formula>"), "{xml}");
+}