Fix crash when block or text have negative sizes (#5610)

2 files changed, 36 insertions, 2 deletions

diff --git a/crates/typst-layout/src/flow/block.rs b/crates/typst-layout/src/flow/block.rs
index 71eacc1c..6c2c3923 100644
--- a/crates/typst-layout/src/flow/block.rs
+++ b/crates/typst-layout/src/flow/block.rs
@@ -364,6 +364,12 @@ fn breakable_pod<'a>(
 
 /// Distribute a fixed height spread over existing regions into a new first
 /// height and a new backlog.
+///
+/// Note that, if the given height fits within the first region, no backlog is
+/// generated and the first region's height shrinks to fit exactly the given
+/// height. In particular, negative and zero heights always fit in any region,
+/// so such heights are always directly returned as the new first region
+/// height.
 fn distribute<'a>(
     height: Abs,
     mut regions: Regions,
@@ -371,7 +377,19 @@ fn distribute<'a>(
 ) -> (Abs, &'a mut [Abs]) {
     // Build new region heights from old regions.
     let mut remaining = height;
+
+    // Negative and zero heights always fit, so just keep them.
+    // No backlog is generated.
+    if remaining <= Abs::zero() {
+        buf.push(remaining);
+        return (buf[0], &mut buf[1..]);
+    }
+
     loop {
+        // This clamp is safe (min <= max), as 'remaining' won't be negative
+        // due to the initial check above (on the first iteration) and due to
+        // stopping on 'remaining.approx_empty()' below (for the second
+        // iteration onwards).
         let limited = regions.size.y.clamp(Abs::zero(), remaining);
         buf.push(limited);
         remaining -= limited;
diff --git a/crates/typst-layout/src/flow/mod.rs b/crates/typst-layout/src/flow/mod.rs
index df716b33..2f0ec39a 100644
--- a/crates/typst-layout/src/flow/mod.rs
+++ b/crates/typst-layout/src/flow/mod.rs
@@ -203,8 +203,14 @@ pub(crate) fn layout_flow(
                 } else {
                     PageElem::width_in(shared)
                 };
-                (0.026 * width.unwrap_or_default())
-                    .clamp(Em::new(0.75).resolve(shared), Em::new(2.5).resolve(shared))
+
+                // Clamp below is safe (min <= max): if the font size is
+                // negative, we set min = max = 0; otherwise,
+                // `0.75 * size <= 2.5 * size` for zero and positive sizes.
+                (0.026 * width.unwrap_or_default()).clamp(
+                    Em::new(0.75).resolve(shared).max(Abs::zero()),
+                    Em::new(2.5).resolve(shared).max(Abs::zero()),
+                )
             },
         }),
     };
@@ -354,6 +360,16 @@ struct LineNumberConfig {
     /// Where line numbers are reset.
     scope: LineNumberingScope,
     /// The default clearance for `auto`.
+    ///
+    /// This value should be relative to the page's width, such that the
+    /// clearance between line numbers and text is small when the page is,
+    /// itself, small. However, that could cause the clearance to be too small
+    /// or too large when considering the current text size; in particular, a
+    /// larger text size would require more clearance to be able to tell line
+    /// numbers apart from text, whereas a smaller text size requires less
+    /// clearance so they aren't way too far apart. Therefore, the default
+    /// value is a percentage of the page width clamped between `0.75em` and
+    /// `2.5em`.
     default_clearance: Abs,
 }