adjust_media capped only the decoded input. The frame, shadow and
default styles then sized their bitmaps from it with unchecked u32 sums.
A thin 1 x 2,000,000 PNG of a few KB and Thick Frame asked for about
1.8 TB. The failed allocation aborted the app outside Session::run's
panic guard, so every window's unsaved work was lost.
picture.border {"width":200} on it asked for 3.2 GB.
Picture operations are now fallible. Every bitmap a style or border
draws on comes from canvas(), which refuses a size the renderer couldn't
draw either (two RGBA buffers within the 512 MB decode budget) before
allocating, and the margins are added with checked arithmetic. The edit
then fails with "picture is too large to edit" and the picture stays as
it was.
VoiceLessQ
856938d559