fix(render): refuse paths with non-finite points too

crates/formats/src/model/to_doc.rs

@@ -118,10 +118,6 @@ struct Builder<'a> {
     revs: std::collections::HashMap<(u8, RevMark), u32>,
     /// Link and font bytes given to runs so far ([`MAX_RUN_STRINGS`]).
     run_strings: usize,
-    /// The ids the next list's abstract and concrete numbering take: past every id in `doc`,
-    /// found once rather than by a scan of every numbering per list.
-    next_abstract: u32,
-    next_num: u32,
 }
 
 fn rev_key(kind: RevisionKind) -> u8 {
@@ -141,9 +137,7 @@ impl<'a> Builder<'a> {
                 revs.entry((rev_key(r.kind), mark)).or_insert(i as u32);
             }
         }
-        let next_abstract = doc.numbering.abstracts.iter().map(|a| a.id.saturating_add(1)).max().unwrap_or(0);
-        let next_num = doc.numbering.nums.iter().map(|n| n.id.saturating_add(1)).max().unwrap_or(1).max(1);
-        Builder { doc, revs, run_strings: 0, next_abstract, next_num }
+        Builder { doc, revs, run_strings: 0 }
     }
 
     /// The document revision for a tracked change, added the first time it is seen.
@@ -297,10 +291,9 @@ impl<'a> Builder<'a> {
             })
             .collect();
         let numbering = &mut self.doc.numbering;
-        let (aid, nid) = (self.next_abstract, self.next_num);
-        self.next_abstract = aid.saturating_add(1);
-        self.next_num = nid.saturating_add(1);
+        let aid = numbering.abstracts.iter().map(|a| a.id + 1).max().unwrap_or(0);
         numbering.abstracts.push(AbstractNum { id: aid, name: None, levels, ..Default::default() });
+        let nid = numbering.nums.iter().map(|n| n.id + 1).max().unwrap_or(1).max(1);
         numbering.nums.push(Num { id: nid, abstract_id: aid, ..Default::default() });
         nid
     }

crates/formats/src/tests.rs

@@ -1019,14 +1019,3 @@ fn latex_export_keeps_repeated_spaces() {
     let d = crate::import("tex", tex.as_bytes()).unwrap().unwrap();
     assert_eq!(para_texts(&d), vec!["a  b   c".to_string()]);
 }
-
-#[test]
-fn many_imported_lists_take_fresh_numbering_ids_in_turn() {
-    // Each list found its ids by scanning every numbering made before it (quadratic in lists).
-    let md: String = (0..4000).map(|i| if i % 2 == 0 { "- a\n\n" } else { "1. b\n\n" }).collect();
-    let d = import("md", md.as_bytes()).expect("handled").expect("import");
-    let ids: Vec<u32> = d.numbering.nums.iter().map(|n| n.id).collect();
-    assert_eq!(ids, (1..=4000).collect::<Vec<u32>>());
-    let abstracts: Vec<u32> = d.numbering.abstracts.iter().map(|a| a.id).collect();
-    assert_eq!(abstracts, (0..4000).collect::<Vec<u32>>());
-}

crates/render/src/lib.rs

@@ -836,10 +836,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,3 +1318,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}