Use f64 instead of usize for fragment widths

This changes the type used for internal width computations in the wrap
algorithms. Before, we used `usize` to represent the fragment widths
and for the line widths. This could make the optimal-fit wrapping
algorithm overflow when it tries to compute the optimal wrapping cost.
The problem is that the algorithm computes a cost using integer values
formed by

    (line_width - target_width)**2

When `line_width` is near `usize::MAX`, this computation can easily
overflow.

By using an `f64` for the cost computation, we achieve two things:

* A much larger range for the cost computation: `f64::MAX` is about
  1.8e308 whereas `u64::MAX` is only 1.8e19. Computing the cost with a
  fragment width in the range of `u64`, will thus not exceed 3e38,
  something which is easily represented with a `f64`. This means that
  wrapping fragments derived from a `&str` cannot overflow.

  Overflows can still be triggered when fragments with extreme
  proportions are formed directly. The boundary seems to be around
  1e170 with fragment widths above this limit triggering overflows.

* Applications which wrap text using proportional fonts will already
  be operating with widths measured in floating point units. Using
  such units internally makes life easier for such applications, as
  shown by the changes in the Wasm demo.

Fixes #247
Fixes #416

.github/workflows/build.yml

@@ -134,11 +134,17 @@ jobs:
       - name: Build fuzz targets
         run: cargo fuzz build
 
-      - name: Fuzz test
-        run: cargo fuzz run fill_first_fit -- -max_total_time=30
+      - name: Fuzz test wrap_first_fit
+        run: cargo fuzz run wrap_first_fit -- -max_total_time=30
 
-      - name: Minimize fuzz corpus
-        run: cargo fuzz cmin fill_first_fit
+      - name: Fuzz test wrap_optimal_fit
+        run: cargo fuzz run wrap_optimal_fit -- -max_total_time=30
+
+      - name: Minimize wrap_first_fit corpus
+        run: cargo fuzz cmin wrap_first_fit
+
+      - name: Minimize wrap_optimal_fit corpus
+        run: cargo fuzz cmin wrap_optimal_fit
 
   binary-sizes:
     name: Compute binary sizes

examples/wasm/src/lib.rs

@@ -145,22 +145,20 @@ impl<'a> CanvasWord<'a> {
     }
 }
 
-const PRECISION: usize = 10;
-
 impl textwrap::core::Fragment for CanvasWord<'_> {
     #[inline]
-    fn width(&self) -> usize {
-        (self.width * PRECISION as f64) as usize
+    fn width(&self) -> f64 {
+        self.width
     }
 
     #[inline]
-    fn whitespace_width(&self) -> usize {
-        (self.whitespace_width * PRECISION as f64) as usize
+    fn whitespace_width(&self) -> f64 {
+        self.whitespace_width
     }
 
     #[inline]
-    fn penalty_width(&self) -> usize {
-        (self.penalty_width * PRECISION as f64) as usize
+    fn penalty_width(&self) -> f64 {
+        self.penalty_width
     }
 }
 
@@ -292,7 +290,7 @@ impl Into<OptimalFit> for WasmOptimalFit {
 #[wasm_bindgen]
 #[derive(Copy, Clone, Debug)]
 pub struct WasmOptions {
-    pub width: usize,
+    pub width: f64,
     pub break_words: bool,
     pub word_separator: WasmWordSeparator,
     pub word_splitter: WasmWordSplitter,
@@ -304,7 +302,7 @@ pub struct WasmOptions {
 impl WasmOptions {
     #[wasm_bindgen(constructor)]
     pub fn new(
-        width: usize,
+        width: f64,
         break_words: bool,
         word_separator: WasmWordSeparator,
         word_splitter: WasmWordSplitter,
@@ -359,14 +357,14 @@ pub fn draw_wrapped_text(
             .flat_map(|word| {
                 let canvas_word = CanvasWord::from(ctx, word);
                 if options.break_words {
-                    canvas_word.break_apart(ctx, options.width as f64)
+                    canvas_word.break_apart(ctx, options.width)
                 } else {
                     vec![canvas_word]
                 }
             })
             .collect::<Vec<_>>();
 
-        let line_lengths = [options.width * PRECISION];
+        let line_lengths = [options.width];
         let wrapped_words = match options.wrap_algorithm {
             WasmWrapAlgorithm::FirstFit => wrap_first_fit(&canvas_words, &line_lengths),
             WasmWrapAlgorithm::OptimalFit => {

fuzz/fuzz_targets/wrap_first_fit.rs

@@ -4,21 +4,21 @@ use libfuzzer_sys::fuzz_target;
 use textwrap::core;
 use textwrap::wrap_algorithms::wrap_first_fit;
 
-#[derive(Arbitrary, Debug, Eq, PartialEq)]
+#[derive(Arbitrary, Debug, PartialEq)]
 struct Word {
-    width: usize,
-    whitespace_width: usize,
-    penalty_width: usize,
+    width: f64,
+    whitespace_width: f64,
+    penalty_width: f64,
 }
 
 #[rustfmt::skip]
 impl core::Fragment for Word {
-    fn width(&self) -> usize { self.width }
-    fn whitespace_width(&self) -> usize { self.whitespace_width }
-    fn penalty_width(&self) -> usize { self.penalty_width }
+    fn width(&self) -> f64 { self.width }
+    fn whitespace_width(&self) -> f64 { self.whitespace_width }
+    fn penalty_width(&self) -> f64 { self.penalty_width }
 }
 
-fuzz_target!(|input: (usize, Vec<Word>)| {
+fuzz_target!(|input: (f64, Vec<Word>)| {
     let width = input.0;
     let words = input.1;
     let _ = wrap_first_fit(&words, &[width]);

fuzz/fuzz_targets/wrap_optimal_fit.rs

@@ -25,23 +25,36 @@ impl Into<OptimalFit> for Penalties {
     }
 }
 
-#[derive(Arbitrary, Debug, Eq, PartialEq)]
+#[derive(Arbitrary, Debug, PartialEq)]
 struct Word {
-    width: usize,
-    whitespace_width: usize,
-    penalty_width: usize,
+    width: f64,
+    whitespace_width: f64,
+    penalty_width: f64,
 }
 
 #[rustfmt::skip]
 impl core::Fragment for Word {
-    fn width(&self) -> usize { self.width }
-    fn whitespace_width(&self) -> usize { self.whitespace_width }
-    fn penalty_width(&self) -> usize { self.penalty_width }
+    fn width(&self) -> f64 { self.width }
+    fn whitespace_width(&self) -> f64 { self.whitespace_width }
+    fn penalty_width(&self) -> f64 { self.penalty_width }
 }
 
 fuzz_target!(|input: (usize, Vec<Word>, Penalties)| {
     let width = input.0;
     let words = input.1;
+
+    // Words with infinite widths are not supported since they
+    // instantly trigger an overflow in the cost computation.
+    // Similarly for very large values. The usize::MAX bound is a
+    // conservative bound, the real bound seems to be around 1e170.
+    for word in &words {
+        for width in [word.width, word.whitespace_width, word.penalty_width] {
+            if !width.is_finite() || width.abs() > usize::MAX as f64 {
+                return;
+            }
+        }
+    }
+
     let penalties = input.2.into();
-    let _ = wrap_optimal_fit(&words, &[width], &penalties);
+    let _ = wrap_optimal_fit(&words, &[width as f64], &penalties);
 });

src/core.rs

@@ -197,15 +197,15 @@ pub fn display_width(text: &str) -> usize {
 /// the displayed width of each part, which this trait provides.
 pub trait Fragment: std::fmt::Debug {
     /// Displayed width of word represented by this fragment.
-    fn width(&self) -> usize;
+    fn width(&self) -> f64;
 
     /// Displayed width of the whitespace that must follow the word
     /// when the word is not at the end of a line.
-    fn whitespace_width(&self) -> usize;
+    fn whitespace_width(&self) -> f64;
 
     /// Displayed width of the penalty that must be inserted if the
     /// word falls at the end of a line.
-    fn penalty_width(&self) -> usize;
+    fn penalty_width(&self) -> f64;
 }
 
 /// A piece of wrappable text, including any trailing whitespace.
@@ -304,22 +304,22 @@ impl<'a> Word<'a> {
 
 impl Fragment for Word<'_> {
     #[inline]
-    fn width(&self) -> usize {
-        self.width
+    fn width(&self) -> f64 {
+        self.width as f64
     }
 
     // We assume the whitespace consist of ' ' only. This allows us to
     // compute the display width in constant time.
     #[inline]
-    fn whitespace_width(&self) -> usize {
-        self.whitespace.len()
+    fn whitespace_width(&self) -> f64 {
+        self.whitespace.len() as f64
     }
 
     // We assume the penalty is `""` or `"-"`. This allows us to
     // compute the display width in constant time.
     #[inline]
-    fn penalty_width(&self) -> usize {
-        self.penalty.len()
+    fn penalty_width(&self) -> f64 {
+        self.penalty.len() as f64
     }
 }
 
@@ -334,7 +334,7 @@ where
 {
     let mut shortened_words = Vec::new();
     for word in words {
-        if word.width() > line_width {
+        if word.width() > line_width as f64 {
             shortened_words.extend(word.break_apart(line_width));
         } else {
             shortened_words.push(word);

src/lib.rs

@@ -1075,7 +1075,7 @@ where
             split_words.collect::<Vec<_>>()
         };
 
-        let line_widths = [initial_width, subsequent_width];
+        let line_widths = [initial_width as f64, subsequent_width as f64];
         let wrapped_words = options.wrap_algorithm.wrap(&broken_words, &line_widths);
 
         let mut idx = 0;
@@ -1304,7 +1304,7 @@ pub fn fill_inplace(text: &mut String, width: usize) {
         let words = word_separators::AsciiSpace
             .find_words(line)
             .collect::<Vec<_>>();
-        let wrapped_words = wrap_algorithms::wrap_first_fit(&words, &[width]);
+        let wrapped_words = wrap_algorithms::wrap_first_fit(&words, &[width as f64]);
 
         let mut line_offset = offset;
         for words in &wrapped_words[..wrapped_words.len() - 1] {
@@ -1393,7 +1393,11 @@ mod tests {
 
     #[test]
     fn max_width() {
-        assert_eq!(wrap("foo bar", usize::max_value()), vec!["foo bar"]);
+        assert_eq!(wrap("foo bar", usize::MAX), vec!["foo bar"]);
+
+        let text = "Hello there! This is some English text. \
+                    It should not be wrapped given the extents below.";
+        assert_eq!(wrap(text, usize::MAX), vec![text]);
     }
 
     #[test]