Review of #3670: with the depth limit at 50, depth was the only bound on the
form walk. A form that draws the next level twice, or a cycle of two forms,
costs 2^depth interpretations — at 12 that was 4096, at 50 it is a hang on a
file anyone can send.
The pass now also counts the forms it enters, and the budget is Edit text's own
`MAX_FORM_VISITS`, referenced rather than copied. Running out is treated as a
form that cannot be read, which is what the depth limit already did: removed in
Apply, the page left alone in Verify.
Measured with the new test:
depth 50, fan-out and a 50-deep cycle, with the budget 5.9 s
depth 22, fan-out, budget removed still running after
5 minutes
A `const` assertion ties this pass's depth limit to Edit text's, so the build
fails rather than a redaction quietly removing what a reader still shows (the
review's third point). Checked by setting the limit back to 12:
error[E0080]: evaluation panicked: assertion failed:
MAX_DEPTH >= pdfcraft_edit::text::MAX_FORM_DEPTH
Tests: a page whose forms each draw the next twice, and the same with the last
form drawing the first again — both must finish and still redact the page.
On top of #3011's page unit, the Drawing scale block gets a "1:N" field (1:50,
1/100, 50, 1:2,5 are read; zero, negative, huge and malformed values are
refused with a message) and a combo of common architect scales (1:1 to
1:1000). Either one fills the existing fields (1 mm of paper = N mm, shown in
metres) and applies the scale to the page without a second click, only when
the document allows annotation. Apply scale is unchanged.
With a fixed font size, a text field's appearance cuts a long value at
the edge of its box, but form_fill only answered "filled": n. A person
sees the cut; an agent filling forms through the CLI or MCP did not.
The text appearance builder now notes when the text it lays out does
not fit: one line wider than the box, or wrapped lines below it.
forms::appearance::value_overflow asks that for a field's widget,
Document::field_overflow for a field by name, and form_fill adds a
warning for each filled field that is cut off. The value is still saved
whole and drawn as before; auto-sized fields shrink to fit and are not
reported.
The automation tests' inline PDF builder moves to a shared pdf_of.
Fixes#4018
Conflicts:
- crates/ui-egui/src/panels.rs: main made `panel_header` pub(crate) with
`back: Option<&str>` (the Calculation order page uses it too); this branch
needs its leading button to be Expand on All tools. It now takes
`lead: Option<(&str, &str)>`, the button's icon and tooltip, and the three
callers pass theirs (calc_order_ui.rs included).
- i18n catalogues: both sides appended entries at the same place; kept both.
- ATTRIBUTION.toml: catalogue hashes recomputed.
Main added eleven catalogues since this branch was cut (ca, ckb, fi, hi, id,
ko, lo, nb, ro, sq, th), and their coverage tests require every UI literal, so
the eight All tools view strings are translated in them too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflicts:
- crates/edit/src/lib.rs: keep both `backdrop` (this branch) and main's new
`background` module (#2992, page background colour for Export to Word).
- crates/engine/src/lib.rs, crates/ui-egui/src/marks_ui.rs: union of the
imports (main added BlockKey, block_overlapping and FontFamily).
- ATTRIBUTION.toml: catalogue hashes recomputed.
Main added eleven catalogues since this branch was cut (ca, ckb, fi, hi, id,
ko, lo, nb, ro, sq, th), and their coverage tests require every UI literal, so
the six Add Background backdrop messages are translated in them too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
page_extract (and Split, which extracts each part) wrote the copied
pages without any outline, even when every page was extracted, though
the tool says bookmarks come along.
extract_pages now reads the source's bookmarks with the destinations
mapped to the copies, as Combine already does, and writes them as the
new document's outline. A bookmark whose page was left out goes, unless
a bookmark under it stays. A source without bookmarks still gets no
outline.
Fixes#4020
Resolved by the keeper:
- ATTRIBUTION.toml: upstream's copy, hashes recomputed
- crates/organize/src/tests.rs: additions from both sides, upstream's first
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Windows CI has a default printer, so the button still read Print in the
frame where the test cleared the printer; the other print tests already
run a frame first.
Each kittest harness creates its own wgpu/Vulkan instance on first render, and
lavapipe segfaults when one test creates an instance while another renders
(core dump: vkCreateSampler in libvulkan during a concurrent vkCreateInstance).
The batch tripled the rendering tests in editing.rs. editing and content take
the GPU lock view.rs and fill_sign.rs already use. Crashes over default-thread
runs: editing 11/40 before, 0/40 after; content 4/20 before, 0/20 after.
Albanian, Catalan, Finnish, Hindi, Korean, Indonesian and Romanian get all
22 text-field-table strings; Brazilian Portuguese gets the 4 limit messages
its full-union test requires. AI-assisted, marked in ATTRIBUTION.toml.
a_dead_options_read_wakes_an_idle_dialog asserted the dialog was idle after one
Harness::run. The print preview's page rasters render on the pool and ask for a
frame every 30 ms until they arrive; with kittest's 0.25 s step that is an
immediate repaint, so on a loaded machine run() exceeded its 4 steps
(canvas.rs finish_render_frame). The test now steps until no render is pending.
Under 24 parallel copies the old test failed 3 of 192 runs, the new one 0 of 72.
#3525 asked for its snapshots to be regenerated once the batch is
assembled. Each change comes from a merged PR:
- panel_compare: the Show: Text / Visual filters (#2607).
- panel_layers: the Layer options button (#2731, Reset to Initial Visibility).
- panel_pages: the thumbnail size label, buttons and slider (#3828).
#3781 draws a Fill & Sign line across the page as /Rotate displays it, so on
a page turned a quarter its rect runs along user y. #3520's test expected
the line along user x on every page and failed on the /Rotate 90 cases.
The test's points and rects are now given along the line, so each rotation
checks the same grow, shrink and release.
#2240 (on main before this round) took the Read tab out of the mode bar.
#3010 and #3022 were written against a mode bar that still had it, so
their five tests looked for a Read button that is gone. The tests now
check All tools in its place where the scrolled content reaches under it
(added text, the Fill & Sign type box). Page 1's text and the form's name
field start right of All tools, so those tests check Edit, Convert and
E-Sign, the tabs they lie under.
English fill (the "Untranslated" section of each catalogue), for keys the
coverage tests only need present:
- ca, fi, ro, pt-br: keys other catalogues gained (print, thumbnails,
layers, signature checks, Reshape comment, Remove {standard}
identification)
- sq: UI literals and the visible-signature labels
- hi, ko, id: calculation-order, rich-text and print/thumbnail literals
- pl: signature-check wordings
AI-assisted translation (noted in ATTRIBUTION.toml):
- cs: the four new signature-check wordings and Remove {standard}
identification, since Czech asserts every entry is translated
Lao's file.word_count command id said its own id; it reads as the
plain "Word count…" translation.
#3515 measures a growing non-interactive field at its text's scale but
with a widget's 4pt of padding, while the layout draws its text without
it. Once #3521 fits lines by their ink, the narrower measuring width
wrapped to one more line than the drawn text, leaving a blank line
below it. The measurement leaves out the padding the draw doesn't have.
#2609 put the Japanese faces ahead of the bundled Inter face and rewrote
the #1760 test to expect Inter, which holds only without craft-fonts.
With CRAFT_FONTS_DIR, BIZ UDPGothic has ő and draws it. The test now
expects the Japanese sans face when the build has one, Inter otherwise.
Prepare a form's arrow-key nudge (#2621) consumed Alt+↑/↓ as plain arrows,
because egui's consume_key ignores an extra Alt. Calculation order (#3733)
moves the selected field with Alt+↑/↓, so the field moved a point on the
page instead of in the order. The nudge now leaves Alt+arrow alone.
#3101's page_gap_labels_are_translated_in_every_catalog asserts that every
catalog translates its two labels. The Finnish, Albanian, Thai, Catalan,
Romanian, Lao and Central Kurdish catalogs from track t12 lack them. The
translations are AI-assisted and noted as such in ATTRIBUTION.toml.
jonathanwxh-cell
Hamza
Eric Kaden
Combiler01
Adrien Alberti
Ridzzz0Alam
alehelandClaude Opus 5.5
Osvaldo DuranandClaude Sonnet 5.5
aiongg
pr-keeperandClaude Sonnet 5.5