Analysis ToolPak: stop building a report once it outgrows the output limit

Report builders filled their whole output map before write_report
checked its size, so Descriptive Statistics grouped by rows over a
tall, nearly empty column allocated about 16 entries for each of up
to a million variables before refusing the report.

Grid now tracks its extent as values are stored and keeps nothing
once the report's rows x columns pass MAX_OUTPUT_CELLS; write_report
refuses such a report. extent() no longer rescans every entry.

crates/calc/src/recalc.rs

@@ -24,7 +24,7 @@ mod pass_host;
 #[cfg(test)]
 use graph::Intervals;
 pub use graph::{FxHasher, Graph, Key};
-use graph::{HashMap, HashSet, Node, Taken};
+use graph::{HashMap, HashSet, Node};
 use pass_host::{PassHost, spills_as_before};
 
 /// Calculation state kept beside a workbook.
@@ -292,16 +292,17 @@ impl Calc {
                 }
             }
         }
-        // Spill areas of changed anchors also change. They stay rectangles: one seed per spilled
-        // cell listed the formulas reading the area once per cell.
-        let mut areas: Vec<(usize, RangeRef)> = cleared;
+        // Spill areas of changed anchors also change.
         for &k in changed {
             if let Some(r) = wb.sheet(k.0).and_then(|s| s.spill_ranges.get(&k.1)) {
-                areas.push((k.0, *r));
+                seeds.extend(r.iter().map(|c| (k.0, c)));
             }
         }
+        for (si, r) in &cleared {
+            seeds.extend(r.iter().map(|c| (*si, c)));
+        }
         let t0 = prof_now();
-        let dirty = self.dirty_closure(wb, &seeds, &areas);
+        let dirty = self.dirty_closure(wb, &seeds);
         let t1 = prof_now();
         let n = dirty.len();
         self.run(wb, dirty, false);
@@ -310,39 +311,16 @@ impl Calc {
         }
     }
 
-    /// The formulas to recalculate after `seeds` and every cell of `areas` changed: the seeds
-    /// that are formulas, and everything that reads them, directly or through other formulas.
-    fn dirty_closure(&self, wb: &Workbook, seeds: &[Key], areas: &[(usize, RangeRef)]) -> Vec<Key> {
+    fn dirty_closure(&self, _wb: &Workbook, seeds: &[Key]) -> Vec<Key> {
         let mut seen: HashSet<Key> = HashSet::default();
         let mut queue: VecDeque<Key> = VecDeque::new();
-        // Each range-index entry is listed once in the whole walk: many changed cells under one
-        // broad reference (or many formulas inside one) would otherwise list every formula reading
-        // it once per cell, which squared the work.
-        let mut taken = Taken::default();
-        let mut deps = Vec::new();
         for k in seeds {
             if self.graph.nodes.contains_key(k) && seen.insert(*k) {
                 queue.push_back(*k);
             }
-            deps.clear();
-            self.graph.dependents_untaken(k.0, k.1, &mut taken, &mut deps);
-            for d in deps.drain(..) {
-                if seen.insert(d) {
-                    queue.push_back(d);
-                }
-            }
-        }
-        for &(si, r) in areas {
-            if let Some(sh) = wb.sheet(si) {
-                for (c, _) in sh.cells.iter_range(r) {
-                    if self.graph.nodes.contains_key(&(si, c)) && seen.insert((si, c)) {
-                        queue.push_back((si, c));
-                    }
-                }
-            }
-            deps.clear();
-            self.graph.dependents_of_range(si, r, &mut deps);
-            for d in deps.drain(..) {
+            let mut deps = Vec::new();
+            self.graph.dependents(k.0, k.1, &mut deps);
+            for d in deps {
                 if seen.insert(d) {
                     queue.push_back(d);
                 }
@@ -353,9 +331,10 @@ impl Calc {
                 queue.push_back(*k);
             }
         }
+        let mut deps = Vec::new();
         while let Some(k) = queue.pop_front() {
             deps.clear();
-            self.graph.dependents_untaken(k.0, k.1, &mut taken, &mut deps);
+            self.graph.dependents(k.0, k.1, &mut deps);
             for d in deps.drain(..) {
                 if seen.insert(d) {
                     queue.push_back(d);
@@ -432,7 +411,7 @@ impl Calc {
             if spill_changes.is_empty() {
                 break;
             }
-            dirty = self.dirty_closure(wb, &spill_changes, &[]);
+            dirty = self.dirty_closure(wb, &spill_changes);
         }
         // Loops among formulas the run did not evaluate stay listed while they are still formulas.
         // Iterative calculation reports none.
@@ -712,149 +691,6 @@ pub(crate) mod tests {
         assert!(visited < 64, "visited {visited} nodes for no match");
     }
 
-    #[test]
-    fn untaken_queries_list_each_interval_once_in_all() {
-        // 1,000 ranges over every row of 5,000: point queries at every row used to list all 1,000
-        // each time (5 million matches); sharing `taken`, each range is listed once in all.
-        let n = 5_000u32;
-        let mut iv: Intervals<u32> = Intervals::default();
-        for t in 0..1_000 {
-            iv.insert(0, n, t);
-        }
-        for r in 0..n {
-            iv.insert(r, r, 10_000 + r);
-        }
-        iv.settle();
-        let mut taken = Vec::new();
-        let mut listed = Vec::new();
-        for row in 0..=n + 3 {
-            iv.query_untaken(row, row, &mut taken, &mut |t| {
-                listed.push(*t);
-                true
-            });
-        }
-        listed.sort_unstable();
-        let want: Vec<u32> = (0..1_000).chain(10_000..10_000 + n).collect();
-        assert_eq!(listed, want);
-        // An entry the caller declines is offered again.
-        let mut taken = Vec::new();
-        let mut offered = 0;
-        for _ in 0..3 {
-            iv.query_untaken(7, 7, &mut taken, &mut |t| {
-                if *t == 10_007 {
-                    offered += 1;
-                }
-                *t != 10_007
-            });
-        }
-        assert_eq!(offered, 3);
-    }
-
-    #[test]
-    fn dirty_closure_matches_a_walk_of_every_cell() {
-        // Random formulas over single cells, narrow ranges and wide (over 64 columns) ranges, some
-        // removed or left unsettled: the closure equals the one found by listing every dependent
-        // of every changed cell, area cells included, as before `taken` and areas existed.
-        use super::{HashSet, Node};
-        use crate::eval::Area;
-        use std::collections::VecDeque;
-        let mut s = 0x2545_F491_4F6C_DD1D;
-        for case in 0..40 {
-            let mut wb = Workbook::new();
-            let mut calc = Calc::new();
-            let pick = |s: &mut u64, n: u64| (rng(s) % n) as u32;
-            let mut keys: Vec<Key> = Vec::new();
-            for _ in 0..300 {
-                let k = (0, CellRef::new(pick(&mut s, 120), pick(&mut s, 150)));
-                let mut areas = Vec::new();
-                for _ in 0..1 + pick(&mut s, 3) {
-                    let start = CellRef::new(pick(&mut s, 120), pick(&mut s, 150));
-                    let end = match pick(&mut s, 3) {
-                        0 => start,
-                        1 => CellRef::new(start.row + pick(&mut s, 40), start.col + pick(&mut s, 5)),
-                        _ => CellRef::new(start.row + pick(&mut s, 20), start.col + 65 + pick(&mut s, 30)),
-                    };
-                    areas.push(Area { sheet: 0, range: RangeRef::new(start, end) });
-                }
-                if let Some(sh) = wb.sheet_mut(0) {
-                    sh.cells.set(k.1, Cell::formula(Formula::new("=1")));
-                }
-                calc.graph.insert(k, Node { areas, dynamic: false });
-                keys.push(k);
-                if rng(&mut s).is_multiple_of(7) {
-                    calc.graph.settle();
-                }
-            }
-            for _ in 0..30 {
-                let k = keys[(rng(&mut s) % keys.len() as u64) as usize];
-                calc.graph.remove(k);
-                if let Some(sh) = wb.sheet_mut(0) {
-                    sh.cells.remove(k.1);
-                }
-            }
-            if case % 2 == 0 {
-                calc.graph.settle();
-            }
-            let seeds: Vec<Key> = (0..1 + pick(&mut s, 25)).map(|_| (0, CellRef::new(pick(&mut s, 140), pick(&mut s, 220)))).collect();
-            let areas: Vec<(usize, RangeRef)> = (0..pick(&mut s, 3))
-                .map(|_| {
-                    let start = CellRef::new(pick(&mut s, 120), pick(&mut s, 150));
-                    (0, RangeRef::new(start, CellRef::new(start.row + pick(&mut s, 30), start.col + pick(&mut s, 80))))
-                })
-                .collect();
-            let got: HashSet<Key> = calc.dirty_closure(&wb, &seeds, &areas).into_iter().collect();
-            // The walk before: every area cell is a seed, and every cell lists all its dependents.
-            let mut all = seeds.clone();
-            for (si, r) in &areas {
-                all.extend(r.iter().map(|c| (*si, c)));
-            }
-            let mut want: HashSet<Key> = HashSet::default();
-            let mut queue: VecDeque<Key> = VecDeque::new();
-            let mut deps = Vec::new();
-            for k in &all {
-                if calc.graph.nodes.contains_key(k) && want.insert(*k) {
-                    queue.push_back(*k);
-                }
-                deps.clear();
-                calc.graph.dependents(k.0, k.1, &mut deps);
-                queue.extend(deps.iter().copied().filter(|d| want.insert(*d)));
-            }
-            while let Some(k) = queue.pop_front() {
-                deps.clear();
-                calc.graph.dependents(k.0, k.1, &mut deps);
-                queue.extend(deps.iter().copied().filter(|d| want.insert(*d)));
-            }
-            assert_eq!(got, want, "case {case}");
-        }
-    }
-
-    #[test]
-    fn clearing_a_spill_recalculates_formulas_reading_it_once_each() {
-        // 300 formulas read the area an anchor spills into; clearing the anchor changes all of it
-        // and every one of them is recalculated (they were listed once per spilled cell).
-        let mut wb = Workbook::new();
-        let mut calc = Calc::new();
-        let set = |wb: &mut Workbook, calc: &mut Calc, at: CellRef, input: &str| {
-            if let Some(sh) = wb.sheet_mut(0) {
-                if input.is_empty() {
-                    sh.cells.remove(at);
-                } else {
-                    sh.cells.set(at, Cell::formula(Formula::new(input)));
-                }
-            }
-            calc.cells_changed(wb, &[(0, at)]);
-        };
-        set(&mut wb, &mut calc, CellRef::new(0, 0), "=SEQUENCE(2000)");
-        for r in 0..300 {
-            set(&mut wb, &mut calc, CellRef::new(r, 2), "=COUNT(A1:A2000)");
-        }
-        assert_eq!(wb.sheet(0).map(|s| s.value(CellRef::new(299, 2))), Some(Value::Number(2000.0)));
-        set(&mut wb, &mut calc, CellRef::new(0, 0), "");
-        for r in 0..300 {
-            assert_eq!(wb.sheet(0).map(|s| s.value(CellRef::new(r, 2))), Some(Value::Number(0.0)), "row {r}");
-        }
-    }
-
     /// `rows` rows of six numbers (E:J) and `=SUM(E{r}:J{r})` in K.
     fn sum_rows(rows: u32) -> Workbook {
         let mut wb = Workbook::new();

crates/calc/src/recalc/graph.rs

@@ -151,54 +151,6 @@ impl<T: Copy + Ord> Intervals<T> {
         self.walk(1, 0, self.max_end.len() / 2, p, a, f)
     }
 
-    /// [`Intervals::query`] that skips entries an earlier call with the same `taken` already
-    /// took (and whole subtrees of them), so that a series of queries lists each interval once in
-    /// all. `f` answers whether it took the entry; one it declines is offered again later.
-    /// `taken` belongs to this index as it is now; start it empty. Pending insertions (a few at
-    /// most after [`Intervals::settle`]) are offered every time.
-    pub(super) fn query_untaken(&self, a: u32, b: u32, taken: &mut Vec<bool>, f: &mut dyn FnMut(&T) -> bool) {
-        for it in &self.pending {
-            if it.0 <= b && it.1 >= a {
-                f(&it.2);
-            }
-        }
-        let p = self.items.partition_point(|it| it.0 <= b);
-        if p == 0 {
-            return;
-        }
-        if taken.len() != self.max_end.len() {
-            *taken = vec![false; self.max_end.len()];
-        }
-        self.walk_untaken(1, 0, self.max_end.len() / 2, p, a, taken, f);
-    }
-
-    /// Returns whether everything under `node` has now been reported (or is dead).
-    #[allow(clippy::too_many_arguments)]
-    fn walk_untaken(&self, node: usize, lo: usize, hi: usize, p: usize, a: u32, taken: &mut [bool], f: &mut dyn FnMut(&T) -> bool) -> bool {
-        if taken.get(node).copied().unwrap_or(true) {
-            return true;
-        }
-        if lo >= p || self.max_end.get(node).is_none_or(|m| *m < a) {
-            return false;
-        }
-        let done = if hi - lo <= 1 {
-            match (self.items.get(lo), self.dead.get(lo)) {
-                (Some(it), Some(false)) if it.1 >= a => f(&it.2),
-                (Some(_), Some(true)) => true,
-                _ => false,
-            }
-        } else {
-            let mid = lo + (hi - lo) / 2;
-            let left = self.walk_untaken(2 * node, lo, mid, p, a, taken, f);
-            let right = self.walk_untaken(2 * node + 1, mid, hi, p, a, taken, f);
-            left && right
-        };
-        if done && let Some(slot) = taken.get_mut(node) {
-            *slot = true;
-        }
-        done
-    }
-
     fn walk(&self, node: usize, lo: usize, hi: usize, p: usize, a: u32, f: &mut dyn FnMut(&T)) -> usize {
         if lo >= p || self.max_end.get(node).is_none_or(|m| *m < a) {
             return 1;
@@ -216,13 +168,6 @@ impl<T: Copy + Ord> Intervals<T> {
     }
 }
 
-/// Range-index entries one dependency walk has already listed (see [`Graph::dependents_untaken`]).
-#[derive(Default)]
-pub(super) struct Taken {
-    cols: HashMap<(usize, u32), Vec<bool>>,
-    wide: HashMap<usize, Vec<bool>>,
-}
-
 #[derive(Clone, Debug, Default)]
 pub struct Graph {
     pub(super) nodes: HashMap<Key, Node>,
@@ -357,32 +302,6 @@ impl Graph {
         }
     }
 
-    /// [`Graph::dependents`] leaving out the formulas whose range reads an earlier call with the
-    /// same `taken` already listed. A walk over many changed cells that a few broad ranges cover
-    /// then lists those formulas once, instead of once per cell (which squared the work). The
-    /// graph must not change while `taken` is in use.
-    pub(super) fn dependents_untaken(&self, sheet: usize, c: CellRef, taken: &mut Taken, out: &mut Vec<Key>) {
-        if let Some(v) = self.cell_deps.get(&(sheet, c)) {
-            out.extend(v.iter().copied());
-        }
-        if let Some(v) = self.col_deps.get(&(sheet, c.col)) {
-            v.query_untaken(c.row, c.row, taken.cols.entry((sheet, c.col)).or_default(), &mut |k| {
-                out.push(*k);
-                true
-            });
-        }
-        if let Some(v) = self.wide_deps.get(&sheet) {
-            // A wide entry is taken once it covers the cell's column too.
-            v.query_untaken(c.row, c.row, taken.wide.entry(sheet).or_default(), &mut |(c0, c1, k)| {
-                let hit = *c0 <= c.col && c.col <= *c1;
-                if hit {
-                    out.push(*k);
-                }
-                hit
-            });
-        }
-    }
-
     /// Formulas that read any cell of `range` (a formula can be listed more than once).
     pub fn dependents_of_range(&self, sheet: usize, range: RangeRef, out: &mut Vec<Key>) {
         if range.count() <= 4096 {

crates/engine/src/cmd/analysis.rs

@@ -272,11 +272,25 @@ struct Grid {
     cells: BTreeMap<(u32, u32), Value>,
     /// Cells shown as percentages.
     pct: Vec<(u32, u32)>,
+    /// Rows and columns spanned by `cells`.
+    rows: u32,
+    cols: u32,
+    /// A cell was dropped because the report outgrew [`MAX_OUTPUT_CELLS`]: the report is refused.
+    too_large: bool,
 }
 
 impl Grid {
+    /// Stores a value. Past [`MAX_OUTPUT_CELLS`] (the most a report writes) nothing more is kept,
+    /// so a builder that would produce millions of entries stops allocating them, and
+    /// [`write_report`] refuses the report.
     fn put(&mut self, r: u32, c: u32, v: Value) {
         if !v.is_empty() {
+            let (rows, cols) = (self.rows.max(r.saturating_add(1)), self.cols.max(c.saturating_add(1)));
+            if self.too_large || u64::from(rows) * u64::from(cols) > MAX_OUTPUT_CELLS {
+                self.too_large = true;
+                return;
+            }
+            (self.rows, self.cols) = (rows, cols);
             self.cells.insert((r, c), v);
         }
     }
@@ -296,9 +310,7 @@ impl Grid {
     }
     /// (rows, cols) spanned.
     fn extent(&self) -> (u32, u32) {
-        let rows = self.cells.keys().map(|(r, _)| r + 1).max().unwrap_or(0);
-        let cols = self.cells.keys().map(|(_, c)| c + 1).max().unwrap_or(0);
-        (rows, cols)
+        (self.rows, self.cols)
     }
 }
 
@@ -1749,7 +1761,7 @@ fn sampling(s: &Session, p: &Json, seed: Option<u64>) -> Result<Grid> {
 fn write_report(s: &mut Session, p: &Json, tool: &str, g: Grid) -> Result<Json> {
     let (rows, cols) = g.extent();
     let (rows, cols) = (rows.max(1), cols.max(1));
-    if u64::from(rows) * u64::from(cols) > MAX_OUTPUT_CELLS {
+    if g.too_large || u64::from(rows) * u64::from(cols) > MAX_OUTPUT_CELLS {
         return Err(bad(CMD, "the report is too large"));
     }
     let d = s.doc()?;
@@ -1914,6 +1926,28 @@ mod tests {
         x
     }
 
+    #[test]
+    fn a_report_stops_growing_past_the_output_limit() {
+        // Entries past the limit are not kept, and the report is refused.
+        let mut g = super::Grid::default();
+        g.num(1999, 1999, 1.0);
+        assert!(!g.too_large);
+        g.num(0, 2000, 1.0);
+        assert!(g.too_large);
+        assert_eq!(g.cells.len(), 1);
+        assert_eq!(g.extent(), (2000, 2000));
+        // Row-grouped statistics of a tall, almost empty column: one variable per row would make
+        // millions of report entries; the report is refused instead of built.
+        let mut s = s();
+        s.execute("range.setValues", json!({"range": "A1", "values": [[1]]})).unwrap();
+        s.execute("range.setValues", json!({"range": "A1000000", "values": [[2]]})).unwrap();
+        let err = s
+            .execute("data.analysisToolPak", json!({"tool": "descriptive", "range": "A1:A1000000", "groupedBy": "rows", "output": "C1"}))
+            .expect_err("report too large");
+        assert!(err.to_string().contains("too large"), "{err}");
+        assert_eq!(v(&s, "C1"), Value::Empty);
+    }
+
     #[test]
     fn forecast_standard_errors_match_the_full_window_rescan() {
         // #1043: the running sum must give what re-adding every window gave, gaps included.