Clamp RenderTextWin layout length to 10,000 code points.

ui/gfx/render_text_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/render_text_win.h"
 
 #include <algorithm>
 
 #include "base/i18n/break_iterator.h"
 #include "base/i18n/rtl.h"
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/win/windows_version.h"
 #include "ui/base/text/utf16_indexing.h"
 #include "ui/gfx/canvas.h"
 #include "ui/gfx/font_fallback_win.h"
 #include "ui/gfx/font_smoothing_win.h"
 #include "ui/gfx/platform_font_win.h"
 
 namespace gfx {
 
 namespace {
 
-// The maximum supported number of Uniscribe runs; a SCRIPT_ITEM is 8 bytes.
-// TODO(msw): Review memory use/failure? Max string length? Alternate approach?
-const int kGuessItems = 100;
-const int kMaxItems = 10000;
+// The maximum length of text supported for Uniscribe layout and display.
+// This empirically chosen value should prevent major performance degradations.
+// TODO(msw): Support longer text, partial layout/painting, etc.
+const size_t kMaxUniscribeTextLength = 10000;
 
-// The maximum supported number of Uniscribe glyphs; a glyph is 1 word.
-// TODO(msw): Review memory use/failure? Max string length? Alternate approach?
-const int kMaxGlyphs = 100000;
+// The maximum supported number of text runs; an arbitrarily chosen value.
+// TODO(msw): Support more runs; see https://codereview.chromium.org/17745005
+const size_t kMaxRuns = 10000;
+
+// The maximum number of glyphs per run; ScriptShape fails on larger values.
+const size_t kMaxGlyphs = 65535;
 
 // Callback to |EnumEnhMetaFile()| to intercept font creation.
 int CALLBACK MetaFileEnumProc(HDC hdc,
                               HANDLETABLE* table,
                               CONST ENHMETARECORD* record,
                               int table_entries,
                               LPARAM log_font) {
   if (record->iType == EMR_EXTCREATEFONTINDIRECTW) {
     const EMREXTCREATEFONTINDIRECTW* create_font_record =
         reinterpret_cast<const EMREXTCREATEFONTINDIRECTW*>(record);
@@ skipping 131 matching lines @@
 // static
 HDC RenderTextWin::cached_hdc_ = NULL;
 
 // static
 std::map<std::string, Font> RenderTextWin::successful_substitute_fonts_;
 
 RenderTextWin::RenderTextWin()
     : RenderText(),
       common_baseline_(0),
       needs_layout_(false) {
+  set_truncate_length(kMaxUniscribeTextLength);
+
   memset(&script_control_, 0, sizeof(script_control_));
   memset(&script_state_, 0, sizeof(script_state_));
 
   MoveCursorTo(EdgeSelectionModel(CURSOR_LEFT));
 }
 
 RenderTextWin::~RenderTextWin() {
 }
 
 Size RenderTextWin::GetStringSize() {
   EnsureLayout();
   return string_size_;
 }
 
 int RenderTextWin::GetBaseline() {
   EnsureLayout();
   return common_baseline_;
 }
 
 SelectionModel RenderTextWin::FindCursorPosition(const Point& point) {
   if (text().empty())
     return SelectionModel();
 
   EnsureLayout();
   // Find the run that contains the point and adjust the argument location.
   int x = ToTextPoint(point).x();
   size_t run_index = GetRunContainingXCoord(x);
-  if (run_index == runs_.size())
+  if (run_index >= runs_.size())
     return EdgeSelectionModel((x < 0) ? CURSOR_LEFT : CURSOR_RIGHT);
   internal::TextRun* run = runs_[run_index];
 
   int position = 0, trailing = 0;
   HRESULT hr = ScriptXtoCP(x - run->preceding_run_widths,
                            run->range.length(),
                            run->glyph_count,
                            run->logical_clusters.get(),
                            run->visible_attributes.get(),
                            run->advance_widths.get(),
@@ skipping 116 matching lines @@
   RenderText::SetSelectionModel(model);
   // TODO(xji|msw): The text selection color is applied in ItemizeLogicalText().
   // So, the layout must be updated in order to draw the proper selection range.
   // Colors should be applied in DrawVisualText(), as done by RenderTextLinux.
   ResetLayout();
 }
 
 ui::Range RenderTextWin::GetGlyphBounds(size_t index) {
   const size_t run_index =
       GetRunContainingCaret(SelectionModel(index, CURSOR_FORWARD));
-  DCHECK_LT(run_index, runs_.size());
+  // Return edge bounds if the index is invalid or beyond the layout text size.
+  if (run_index >= runs_.size())
+    return ui::Range(string_size_.width());
   internal::TextRun* run = runs_[run_index];
   const size_t layout_index = TextIndexToLayoutIndex(index);
   return ui::Range(GetGlyphXBoundary(run, layout_index, false),
                    GetGlyphXBoundary(run, layout_index, true));
 }
 
 std::vector<Rect> RenderTextWin::GetSubstringBounds(const ui::Range& range) {
   DCHECK(!needs_layout_);
   DCHECK(ui::Range(0, text().length()).Contains(range));
   ui::Range layout_range(TextIndexToLayoutIndex(range.start()),
@@ skipping 20 matching lines @@
         rect.Union(bounds.back());
         bounds.pop_back();
       }
       bounds.push_back(rect);
     }
   }
   return bounds;
 }
 
 size_t RenderTextWin::TextIndexToLayoutIndex(size_t index) const {
-  if (!obscured())
-    return index;
-
   DCHECK_LE(index, text().length());
-  const ptrdiff_t offset = ui::UTF16IndexToOffset(text(), 0, index);
-  DCHECK_GE(offset, 0);
-  DCHECK_LE(static_cast<size_t>(offset), GetLayoutText().length());
-  return static_cast<size_t>(offset);
+  ptrdiff_t i = obscured() ? ui::UTF16IndexToOffset(text(), 0, index) : index;
+  CHECK_GE(i, 0);
+  // Clamp layout indices to the length of the text actually used for layout.
+  return std::min<size_t>(GetLayoutText().length(), i);
 }
 
 size_t RenderTextWin::LayoutIndexToTextIndex(size_t index) const {
   if (!obscured())
     return index;
 
   DCHECK_LE(index, GetLayoutText().length());
   const size_t text_index = ui::UTF16OffsetToIndex(text(), 0, index);
   DCHECK_LE(text_index, text().length());
   return text_index;
@@ skipping 82 matching lines @@
   // Set Uniscribe's base text direction.
   script_state_.uBidiLevel =
       (GetTextDirection() == base::i18n::RIGHT_TO_LEFT) ? 1 : 0;
 
   if (text().empty())
     return;
 
   HRESULT hr = E_OUTOFMEMORY;
   int script_items_count = 0;
   std::vector<SCRIPT_ITEM> script_items;
-  const size_t text_length = GetLayoutText().length();
-  for (size_t n = kGuessItems; hr == E_OUTOFMEMORY && n < kMaxItems; n *= 2) {
+
+  // Guess the run count based on string sizes; Uniscribe requires 3 at minimum.
+  const size_t layout_text_length = GetLayoutText().length();
+  size_t run_guess = std::min(kMaxRuns, std::max(3U, layout_text_length / 10));

[Alexei Svitkine (slow), 2013/06/28 15:37:02]

The old code would start at 100 whereas your new code seems like it would start
at a much lower value (e.g. either 3 or text size / 10, which is likely also
very low).

I'm concerned this will result in a lot more cases where we have to loop through
to get the right value. And looping through calling ScriptItemize() is probably
more expensive than just pre-allocating a decent-size-ish array the first time.

Note that the run_guess is only used to resize script_items, which is a
temporary vector in this function and wouldn't result in permanent memory bloat
if we pre-allocate too many entries that don't then get used.

As such, I think the old behaviour of starting with a guess of 100 is better,
since it will likely be enough for 99% of inputs and avoids multiple (expensive)
calls to ScriptItemize to find the right size for a temporary buffer.

[msw, 2013/06/28 16:31:23]

Done.

+  while (hr == E_OUTOFMEMORY && run_guess <= kMaxRuns) {
     // Derive the array of Uniscribe script items from the logical text.
-    // ScriptItemize always adds a terminal array item so that the length of the
-    // last item can be derived from the terminal SCRIPT_ITEM::iCharPos.
-    script_items.resize(n);
-    hr = ScriptItemize(GetLayoutText().c_str(),
-                       text_length,
-                       n - 1,
-                       &script_control_,
-                       &script_state_,
-                       &script_items[0],
-                       &script_items_count);
+    // ScriptItemize always adds a terminal array item so that the length of
+    // the last item can be derived from the terminal SCRIPT_ITEM::iCharPos.
+    script_items.resize(run_guess);
+    hr = ScriptItemize(GetLayoutText().c_str(), layout_text_length,
+                       run_guess - 1, &script_control_, &script_state_,
+                       &script_items[0], &script_items_count);
+    // Ensure that |kMaxRuns| is attempted and the loop terminates afterward.
+    run_guess = std::max(run_guess + 1, std::min(run_guess * 2, kMaxRuns));
   }
   DCHECK(SUCCEEDED(hr));
-
-  if (script_items_count <= 0)
+  if (!SUCCEEDED(hr) || script_items_count <= 0)
     return;
 
   // Temporarily apply composition underlines and selection colors.
   ApplyCompositionAndSelectionStyles();
 
   // Build the list of runs from the script items and ranged colors/styles.
   // TODO(msw): Only break for bold/italic, not color etc. See TextRun comment.
   internal::StyleIterator style(colors(), styles());
   SCRIPT_ITEM* script_item = &script_items[0];
-  const size_t layout_text_length = GetLayoutText().length();
+  const size_t max_run_length = kMaxGlyphs / 2;
   for (size_t run_break = 0; run_break < layout_text_length;) {
     internal::TextRun* run = new internal::TextRun();
     run->range.set_start(run_break);
     run->font = GetFont();
     run->font_style = (style.style(BOLD) ? Font::BOLD : 0) |
                       (style.style(ITALIC) ? Font::ITALIC : 0);
     DeriveFontIfNecessary(run->font.GetFontSize(), run->font.GetHeight(),
                           run->font_style, &run->font);
     run->foreground = style.color();
     run->strike = style.style(STRIKE);
     run->diagonal_strike = style.style(DIAGONAL_STRIKE);
     run->underline = style.style(UNDERLINE);
     run->script_analysis = script_item->a;
 
     // Find the next break and advance the iterators as needed.
     const size_t script_item_break = (script_item + 1)->iCharPos;
     run_break = std::min(script_item_break,
                          TextIndexToLayoutIndex(style.GetRange().end()));
+    // Clamp run lengths to avoid exceeding the maximum supported glyph count.
+    if ((run_break - run->range.start()) > max_run_length)
+      run_break = run->range.start() + max_run_length;
     style.UpdatePosition(LayoutIndexToTextIndex(run_break));
     if (script_item_break == run_break)
       script_item++;
     run->range.set_end(run_break);
     runs_.push_back(run);
   }
 
   // Undo the temporarily applied composition underlines and selection colors.
   UndoCompositionAndSelectionStyles();
 }
@@ skipping 179 matching lines @@
     DeriveFontIfNecessary(font_size, font_height, run->font_style, &run->font);
     ScriptFreeCache(&run->script_cache);
   }
 
   // Select the font desired for glyph generation.
   SelectObject(cached_hdc_, run->font.GetNativeFont());
 
   HRESULT hr = E_OUTOFMEMORY;
   const size_t run_length = run->range.length();
   const wchar_t* run_text = &(GetLayoutText()[run->range.start()]);
-  // Max glyph guess: http://msdn.microsoft.com/en-us/library/dd368564.aspx
+  // Guess the expected number of glyphs from the length of the run.
+  // MSDN suggests this at http://msdn.microsoft.com/en-us/library/dd368564.aspx
   size_t max_glyphs = static_cast<size_t>(1.5 * run_length + 16);
-  while (hr == E_OUTOFMEMORY && max_glyphs < kMaxGlyphs) {
+  while (hr == E_OUTOFMEMORY && max_glyphs <= kMaxGlyphs) {
     run->glyph_count = 0;
     run->glyphs.reset(new WORD[max_glyphs]);
     run->visible_attributes.reset(new SCRIPT_VISATTR[max_glyphs]);
-    hr = ScriptShape(cached_hdc_,
-                     &run->script_cache,
-                     run_text,
-                     run_length,
-                     max_glyphs,
-                     &run->script_analysis,
-                     run->glyphs.get(),
-                     run->logical_clusters.get(),
-                     run->visible_attributes.get(),
+    hr = ScriptShape(cached_hdc_, &run->script_cache, run_text, run_length,
+                     max_glyphs, &run->script_analysis, run->glyphs.get(),
+                     run->logical_clusters.get(), run->visible_attributes.get(),
                      &run->glyph_count);
-    max_glyphs *= 2;
+    // Ensure that |kMaxGlyphs| is attempted and the loop terminates afterward.
+    max_glyphs = std::max(max_glyphs + 1, std::min(max_glyphs * 2, kMaxGlyphs));

[Alexei Svitkine (slow), 2013/06/28 15:37:02]

How about making a helper function for this construct in the anon namespace to
avoid duplicating it and commenting it twice?

[msw, 2013/06/28 16:31:23]

I'll pass; 3 uses or real complexity constitutes a helper, but this seems ok.

   }
   return hr;
 }
 
 int RenderTextWin::CountCharsWithMissingGlyphs(internal::TextRun* run) const {
   int chars_not_missing_glyphs = 0;
   SCRIPT_FONTPROPERTIES properties;
   memset(&properties, 0, sizeof(properties));
   properties.cBytes = sizeof(properties);
   ScriptGetFontProperties(cached_hdc_, &run->script_cache, &properties);
@@ skipping 58 matching lines @@
   size_t position = LayoutIndexToTextIndex(run->range.end());
   position = IndexOfAdjacentGrapheme(position, CURSOR_BACKWARD);
   return SelectionModel(position, CURSOR_FORWARD);
 }
 
 RenderText* RenderText::CreateInstance() {
   return new RenderTextWin;
 }
 
 }  // namespace gfx