Module djot_depth 

A ceiling on how deeply nested a Djot document may be before it is parsed.

The failure this prevents

jotdown descends once per nested block container and has no depth limit of its own. A few kilobytes of prose — on the order of two thousand nested blockquote markers — exhausts the stack.

That is not a panic. A stack overflow aborts the process: it cannot be caught by catch_unwind, a panic hook does not run, and every unsaved document in every window of the embedding application dies with it. So it cannot be handled by the caller after the fact; it has to be refused before jotdown is handed the text at all.

The input is not always the author’s own. A .skrib bundle is mailed, shared on a drive and restored from someone else’s backup; an imported .docx comes from an editor. Any of those can carry prose this crate then parses.

Why a scan rather than a limit inside the parser

A depth limit belongs in the recursive descent itself, and this is not that. jotdown is an external crate and its recursion is not reachable from here, so what this module does instead is bound the input: nesting cannot exceed the number of nesting markers the text actually contains, so counting them is a conservative upper bound on how deep the parser can go.

It deliberately over-estimates. Every construct counted here may open a container and some will not — a > inside a code fence is prose. Over-counting is the safe direction: it can only flag a document that was closer to the ceiling than it looked, and the ceiling sits two orders of magnitude above anything a person writes.

What callers do with it

parse_djot keeps its signature and degrades rather than refusing: over-deep input comes back as a single plain paragraph holding the source verbatim. Nothing is lost — the text is all still there — it is simply not given a structure, which is the honest answer for a document whose structure cannot be computed without ending the process.

The limit

MAX_NESTING_DEPTH is 96. For scale, a blockquote inside a list inside a footnote inside a div is 4; CommonMark’s own reference implementations cap list nesting far below this. No real document reaches 96, and 96 is far below the ~2000 that overflows a debug build.

Constants

MAX_NESTING_DEPTH

The most nested block containers a document may declare before is_too_deep reports it.

Functions

is_too_deep

Whether text nests deeply enough to risk exhausting the stack.

nesting_depth

A conservative upper bound on the block nesting text can produce.