fix(render): refuse paths with non-finite points too

crates/layout/src/boxes.rs

@@ -519,9 +519,7 @@ pub(crate) const BOX_INSET_Y: f32 = 3.6;
 /// The first line always stays, so even a tiny box shows the start of its text.
 pub(crate) fn fit_box(items: Vec<Placed>, height: f32) -> Vec<Placed> {
     let limit = height + 0.5;
-    // Sized to what is kept, not to `items`: a box showing a few lines of a long story keeps
-    // no room for the rest of it.
-    let mut out = Vec::new();
+    let mut out = Vec::with_capacity(items.len());
     let mut kept_line = false;
     for it in items {
         if let Some(r) = it.turned_bounds() {

crates/layout/src/tests/budget.rs

@@ -294,17 +294,3 @@ fn a_kept_outline_holds_on_to_its_pictures_allocation() {
     drop(disc);
     assert!(weak.upgrade().is_none(), "the bytes are freed with the document; only their allocation is kept");
 }
-
-#[test]
-fn a_box_keeps_room_only_for_what_it_shows() {
-    // A linked box showing a few lines of a long story kept room for all of it (each of up to
-    // 256 boxes), and copied the whole shared layout before cutting it.
-    let color = wordcraft_doc::Rgb(0, 0, 0);
-    let items: Vec<Placed> = (0..10_000).map(|i| Placed::Fill { rect: Rect::new(0.0, i as f32 * 10.0, 5.0, 10.0), color }).collect();
-    let kept = boxes::fit_box(items.clone(), 25.0);
-    assert_eq!(kept.len(), 3);
-    assert!(kept.capacity() < 100, "{}", kept.capacity());
-    let below = textbox::from_y(&items, 99_950.0);
-    assert_eq!(below.len(), 6);
-    assert!(below.capacity() < 100, "{}", below.capacity());
-}

crates/layout/src/textbox.rs

@@ -252,35 +252,22 @@ fn flow(ctx: &mut Ctx, chain: &[u32], depth: usize) -> Vec<Vec<Placed>> {
         // Past the cap the box takes the nearest layout in its direction: the widest line length
         // that fits it, else the narrowest. The first box in a direction is laid out (one more
         // layout for each of the few directions at most).
-        let near = || {
-            layouts
-                .iter()
-                .enumerate()
-                .filter(|(_, ((_, v), _))| *v == key.1)
-                .min_by_key(|(_, ((k, _), _))| (*k > key.0, k.abs_diff(key.0)))
-                .map(|(i, _)| i)
-        };
-        let kept = layouts.iter().position(|(k, _)| *k == key).or_else(|| if layouts.len() >= MAX_FLOW_WIDTHS { near() } else { None });
-        let at = match kept {
-            Some(at) => at,
+        let near = || layouts.iter().filter(|((_, v), _)| *v == key.1).min_by_key(|((k, _), _)| (*k > key.0, k.abs_diff(key.0)));
+        let kept = layouts.iter().find(|(k, _)| *k == key).or_else(|| if layouts.len() >= MAX_FLOW_WIDTHS { near() } else { None });
+        let items = match kept {
+            Some((_, items)) => items.clone(),
             None => {
                 (ctx.counters, ctx.eq_count) = (snap.0.clone(), snap.1);
                 let items = lay(ctx, head, &blocks, len, body.vert, depth);
                 after.get_or_insert_with(|| (ctx.counters.clone(), ctx.eq_count));
-                layouts.push((key, items));
-                layouts.len() - 1
+                layouts.push((key, items.clone()));
+                items
             }
         };
-        // The shared layout is read in place: a box copies only the items from its own top
-        // down, not the whole story first.
-        let Some((_, shared)) = layouts.get(at) else {
-            out.push(Vec::new());
-            continue;
-        };
         let items = match &cut {
-            None => shared.clone(),
-            Some(cut) => match cut_y(shared, cut) {
-                Some(top) => from_y(shared, top),
+            None => items,
+            Some(cut) => match cut_y(&items, cut) {
+                Some(top) => from_y(items, top),
                 None => {
                     out.push(Vec::new());
                     continue;
@@ -311,28 +298,28 @@ fn cut_y(items: &[Placed], cut: &Cut) -> Option<f32> {
 }
 
 /// The items from `top` down, moved up to start at 0.
-pub(crate) fn from_y(items: &[Placed], top: f32) -> Vec<Placed> {
+fn from_y(items: Vec<Placed>, top: f32) -> Vec<Placed> {
     let lim = top - 0.5;
-    let mut out = Vec::new();
+    let mut out = Vec::with_capacity(items.len());
     for it in items {
         if let Some(r) = it.turned_bounds() {
             if r.y >= lim {
-                out.push(it.clone());
+                out.push(it);
             }
             continue;
         }
         match it {
             Placed::Lines { story, path, para, l0, l1, x, y, turn } => {
-                let Some(first) = para.lines.get(*l0) else { continue };
-                let Some(k) = (*l0..*l1).find(|k| para.lines.get(*k).is_some_and(|l| y + l.top - first.top >= lim)) else { continue };
-                let ky = para.lines.get(k).map_or(*y, |l| y + l.top - first.top);
-                out.push(Placed::Lines { story: *story, path: path.clone(), para: para.clone(), l0: k, l1: *l1, x: *x, y: ky, turn: *turn });
+                let Some(first) = para.lines.get(l0) else { continue };
+                let Some(k) = (l0..l1).find(|k| para.lines.get(*k).is_some_and(|l| y + l.top - first.top >= lim)) else { continue };
+                let ky = para.lines.get(k).map_or(y, |l| y + l.top - first.top);
+                out.push(Placed::Lines { story, path, para, l0: k, l1, x, y: ky, turn });
             }
             Placed::Fill { rect, color } if rect.bottom() > lim => {
                 let y0 = rect.y.max(top);
-                out.push(Placed::Fill { rect: Rect::new(rect.x, y0, rect.w, rect.bottom() - y0), color: *color });
+                out.push(Placed::Fill { rect: Rect::new(rect.x, y0, rect.w, rect.bottom() - y0), color });
             }
-            Placed::Rule { y0, y1, .. } if y0.max(*y1) >= lim => out.push(it.clone()),
+            Placed::Rule { y0, y1, .. } if y0.max(y1) >= lim => out.push(it),
             Placed::Image { rect, .. }
             | Placed::Shape { rect, .. }
             | Placed::Graphic { rect, .. }
@@ -341,7 +328,7 @@ pub(crate) fn from_y(items: &[Placed], top: f32) -> Vec<Placed> {
             | Placed::Object { rect, .. }
                 if rect.y >= lim =>
             {
-                out.push(it.clone())
+                out.push(it)
             }
             _ => {}
         }

crates/render/src/lib.rs

@@ -836,10 +836,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,3 +1318,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}