render: bound the blank entries in the glyph caches #450

Merged

natsukium merged 3 commits from fix/glyph-406 into main 2026-09-25 13:37:43 +09:00

Conversation 0 Commits 3 Files changed 7 +138 -27

natsukium commented 2026-09-25 13:28:45 +09:00

Owner

Copy link

Closes #406

Two client-side glyph caches grew without bound on glyphs that rasterize blank, whose keys PTY output chooses (char × OSC 66 sizing × style).

• shaping: ShapeCache counted only pixel bytes against its 16 MiB cap, and a blank bitmap has none. Each entry now also costs its key and bitmap header (size_of::<(key, GlyphBitmap)>()), so blanks count and are evicted like any other entry.
• render: GlyphIndex::slots cached blanks, and glyphs too large for an empty sheet, as None. Only an atlas recycle cleared the map, and a None takes no atlas space. The index now counts None inserts, and past BLANK_SLOT_MAX (4096) it retains only the placed slots. Lookups treat a missing key and a blank one the same way, so a sweep cannot change a frame, even for rows the incremental walk skips.

Hit paths (ensure, ShapeCache::get_or_insert_sized) are unchanged: the new work runs only on a miss, so no Criterion run was needed.

Tests written first and failing before the fix:

• glyphs::tests::distinct_blank_keys_keep_the_slot_map_under_the_blank_cap (had 4097 entries at the first overflow)
• glyphs::tests::dropping_blank_entries_keeps_placed_slots_and_the_atlas
• tests::blank_bitmaps_count_against_the_byte_cap (felis-shaping; had 2048 blank entries under a 4 KiB cap)

Docs: text-shaping.md "Cache", pipeline.md "Atlases", security-model.md "Resource exhaustion", REQ-1010, CHANGELOG (Fixed).

nix develop -c just check passes. The row_cache.rs file is not touched.

Closes #406 Two client-side glyph caches grew without bound on glyphs that rasterize blank, whose keys PTY output chooses (char × OSC 66 sizing × style). - **shaping**: `ShapeCache` counted only pixel bytes against its 16 MiB cap, and a blank bitmap has none. Each entry now also costs its key and bitmap header (`size_of::<(key, GlyphBitmap)>()`), so blanks count and are evicted like any other entry. - **render**: `GlyphIndex::slots` cached blanks, and glyphs too large for an empty sheet, as `None`. Only an atlas recycle cleared the map, and a `None` takes no atlas space. The index now counts `None` inserts, and past `BLANK_SLOT_MAX` (4096) it `retain`s only the placed slots. Lookups treat a missing key and a blank one the same way, so a sweep cannot change a frame, even for rows the incremental walk skips. Hit paths (`ensure`, `ShapeCache::get_or_insert_sized`) are unchanged: the new work runs only on a miss, so no Criterion run was needed. Tests written first and failing before the fix: - `glyphs::tests::distinct_blank_keys_keep_the_slot_map_under_the_blank_cap` (had 4097 entries at the first overflow) - `glyphs::tests::dropping_blank_entries_keeps_placed_slots_and_the_atlas` - `tests::blank_bitmaps_count_against_the_byte_cap` (felis-shaping; had 2048 blank entries under a 4 KiB cap) Docs: text-shaping.md "Cache", pipeline.md "Atlases", security-model.md "Resource exhaustion", REQ-1010, CHANGELOG (Fixed). `nix develop -c just check` passes. The row_cache.rs file is not touched.

natsukium added 3 commits 2026-09-25 13:28:45 +09:00

shaping: charge every shape-cache entry against the byte cap ... ba366c23fc

The cache evicted once the pixel bytes of its entries passed 16 MiB,
but a glyph that rasterizes blank (a space, U+2800, a charmap miss) has
no pixels, so blank entries never counted. PTY output picks the key:
OSC 66 alone allows about 1.3e5 sizings per char, times four styles,
so a producer printing blanks at walking sizings grew the map for the
life of the client.

Each entry now costs its key and bitmap header on top of its pixels.
That bounds blank entries to about three hundred thousand without a
second counter, and leaves the hit path untouched: only the miss path
computes the cost.

Assisted-by: Claude Code

render: cap the blank entries in the glyph slot map ... b61fd48ddc

The slot map caches a glyph that rasterizes blank as a `None` entry so
a screen of spaces does not rasterize every frame. Only an atlas
recycle clears the map, and a blank entry takes no atlas space, so it
never brings one on. PTY output picks the key (char, cell height, OSC
66 sizing, style), so each blank a producer displayed at a new sizing
stayed resident for the life of the client.

The map now counts its `None` entries and, past 4096, drops all of them
in one `retain`, keeping the placed slots and the atlas. Lookups read a
missing key and a blank one alike as no slot, so a sweep cannot change
a frame, even for rows the incremental walk skips. Dropping them all at
once keeps the per-insert cost a counter bump; evicting one at a time,
as the shaped-run memo does, needs a key scan per insert. Keying blanks
on the char alone was rejected: a glyph can be blank at one sizing and
not another (a tiny fractional scale), and a glyph too large for an
empty sheet is also cached as `None` by size.

The hit path in `ensure` is unchanged: the new work runs only when a
miss inserts a blank.

Assisted-by: Claude Code

docs: drop U+2800 from the shape-cache blank examples ... f0d7c8eb7a

U+2800 goes through the programmatic Braille rasterizer, never the
shape cache, and its all-zero bitmap does carry pixel bytes, so it
does not illustrate why a pixels-only budget leaves that cache
unbounded. It stays an example for the glyph slot map.

Assisted-by: Claude Code

natsukium referenced this pull request 2026-09-25 13:37:11 +09:00

render: placed glyph slots are bounded only by the atlas filling #451

natsukium merged commit 35cd16b84c into main 2026-09-25 13:37:43 +09:00

natsukium deleted branch fix/glyph-406 2026-09-25 13:37:43 +09:00

natsukium referenced this pull request from a commit 2026-09-25 13:37:44 +09:00

render: bound the blank entries in the glyph caches (#450)

natsukium referenced this pull request 2026-09-25 19:00:17 +09:00

bench: follow up the 9d1d842f cross-terminal run #405

Commenting is not possible because the repository is archived.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!450

No description provided.