fix(render): refuse paths with non-finite points too

crates/metafile/src/place.rs

@@ -136,14 +136,8 @@ impl Picture {
             match item {
                 Item::Path { segs, fill, stroke, even_odd } => {
                     let path = tf * bez(segs);
-                    let bounds = path.bounding_box();
-                    if in_range(bounds) {
-                        // A pen wider than twice the distance across the frame and the path
-                        // already covers the whole frame: wider adds nothing the frame shows, only
-                        // work for the renderer flattening its round caps (the width is file data).
-                        let u = bounds.union(r);
-                        let widest = 2.0 * u.width().hypot(u.height());
-                        let stroke = stroke.map(|(c, w)| (c, (f64::from(w) * k).min(widest)));
+                    if in_range(path.bounding_box()) {
+                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
                         out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd });
                     }
                 }

crates/metafile/src/tests.rs

@@ -891,34 +891,6 @@ fn place_fits_the_frame_scales_strokes_and_drops_far_paths() {
     assert_eq!(stroke.map(|s| s.1), Some(8.0));
 }
 
-#[test]
-fn a_huge_pen_is_held_to_what_covers_the_frame() {
-    // A pen of 1e30 units on a short path: round caps that wide took the renderer forever to
-    // flatten. Past twice the distance across the frame and the path it covers no more.
-    let path = |w: f32| crate::Picture {
-        width: 100.0,
-        height: 50.0,
-        items: vec![Item::Path {
-            segs: vec![Seg::Move(0.0, 0.0), Seg::Line(10.0, 0.0)],
-            fill: None,
-            stroke: Some(([0, 0, 0, 255], w)),
-            even_odd: true,
-        }],
-    };
-    let width = |w: f32| match pic_place(&path(w)).first() {
-        Some(crate::PlacedItem::Path { stroke, .. }) => stroke.map(|s| s.1),
-        _ => None,
-    };
-    let cap = 2.0 * 200f64.hypot(100.0);
-    assert_eq!(width(1e30), Some(cap));
-    assert_eq!(width(f32::MAX), Some(cap));
-    assert_eq!(width(4.0), Some(8.0), "an ordinary pen is untouched");
-}
-
-fn pic_place(pic: &crate::Picture) -> Vec<crate::PlacedItem> {
-    pic.place(kurbo::Rect::new(0.0, 0.0, 200.0, 100.0), [0.0; 4])
-}
-
 /// #1899: a crop keeps what the file says down to a sliver (a header's bar is 2.7% of a page-sized
 /// metafile), and junk sides give a finite part of the source with some area.
 #[test]

crates/render/src/lib.rs

@@ -836,10 +836,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,3 +1318,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}