fix(core): harden malformed display lists on WebAssembly

[FarhanAliRaza]

Motivation

• Prevent hostile/malformed display-list commands from forcing large untrusted allocations (which abort on wasm and can trigger memory-DoS on native) by ensuring capacity reservations are bounded by remaining buffer bytes.
• Make the malformed-buffer regression tests exercise every count-driven allocation path so truncation is validated across code paths.
• Avoid running an unwinding-based FFI panic sentinel test on panic-abort targets (wasm) and avoid spawning threads on threadless wasm test configurations.

Description

• Add Reader::bounded_capacity(count, item_size) to clamp untrusted element counts to the number of complete elements remaining in the unread command buffer and use it for capacity reservations in pts, gradient stop vectors, and dash vectors in src/raster.rs.
• Expand raster::tests::malformed_buffer_is_rejected_not_panicked to cover the various count-driven allocation paths (points, gradient stops, stroke dashes, smooth-stroke dashes) so truncation returns false instead of permitting oversized reservations.
• Gate the FFI panic-sentinel unit test with #[cfg(panic = "unwind")] and add a clarifying comment to ffi_guard documenting that panic-abort targets (e.g., wasm32) will abort on internal panics.
• Gate the forced multi-thread parity fuzz test with #[cfg(any(not(target_family = "wasm"), target_feature = "atomics"))] so threadless wasm targets do not attempt unsupported thread spawning.

Testing

• Ran the full unit test suite with cargo test, resulting in all tests passing (102 passed, 0 failed) on the host build.
• Ran the focused raster regression with cargo test raster::tests::malformed_buffer_is_rejected_not_panicked, which passed.
• Ran lints with cargo clippy --all-targets -- -D warnings, which completed without warnings.
• Attempted to add/check wasm targets with rustup target add wasm32-wasip1 wasm32-wasip1-threads and cargo check --target wasm32-wasip1*, but target installation/checks could not complete due to inability to download std components from static.rust-lang.org in the execution environment (network tunnel failure).

---

#142

[greptile-apps]

Greptile Summary

This PR hardens malformed display-list handling and adjusts tests for WebAssembly targets. The main changes are:

• Bounded vector reservations for untrusted point, gradient stop, and dash counts.
• Expanded malformed-buffer tests for each count-driven allocation path.
• Skipped the FFI panic sentinel test on panic-abort targets.
• Skipped the forced parallel fuzz test on wasm targets without supported threading.

Confidence Score: 5/5

Safe to merge with minimal risk.

The changes are narrow defensive fixes around allocation sizing and test configuration. The updated allocation bounds preserve malformed-buffer rejection by allowing subsequent reads to fail normally.

No files require special attention.

T-Rex Logs

What T-Rex did

• The focused proof log for malformed-buffer-01 was inspected and shows command, cwd, cargo output, test count, and EXIT_CODE: 0, with 1 passed, 0 failed, and 101 filtered out.
• The full-host-suite proof log for malformed-buffer-02 was inspected and shows command, cwd, cargo output, all host test counts, doc-test count, and EXIT_CODE: 0, with 102 passed, 0 failed, 0 ignored, 0 measured, and 0 filtered out.
• EXIT_CODE: 0 was observed in both proofs, indicating successful completion.
• Doc-tests reported 0 passed and 0 failed.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/raster.rs	Adds bounded reservation sizes for count-driven display-list parsing paths and expands malformed-buffer regression coverage.
src/lib.rs	Documents panic-abort behavior for the FFI panic guard and skips the unwinding sentinel test when unwinding is unavailable.
src/kernels.rs	Gates the forced parallel fuzz parity test off for wasm targets.

_{Reviews (2): Last reviewed commit: "fix(core): skip forced parallel test on ..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 102 untouched benchmarks
⏩ 1 skipped benchmark¹

---

_{Comparing codex/fix-memory-allocation-issue-on-wasm (4d77e8a) with main (7123396)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩