Say when a row was cut, instead of just stopping

Every row of the address list is an address that does not fit, cut at
whatever pixel ran out. A row that stops looks exactly like a row that
ended, so the reader has nothing telling them the value continues -
and on this list every value does.

Rows that do not fit now end in an ellipsis. It is paid for out of the
same width rather than drawn past it: the fit is recomputed against
what is left after reserving room for the dots, so a truncated row is
never wider than one that fits.

This is in the list renderer rather than at the address list, so any
row that overflows says so. In practice that is only this list -
labels_fit_a_row already holds every menu label to fitting - which is
why the change is narrow in effect while being general in the code.

The self-test checks both halves, because either alone passes while the
other is broken: that the dots stay inside the row's own column rather
than running under the scrollbar, and that they are drawn at all. The
second compares the rendered row against its own fit_row prefix - what
a silent cut would have produced - and requires them to differ.
Verified it fails when the ellipsis is removed.

Author: sandman21vs

host/origo_simulator.c

@@ -1620,6 +1620,57 @@ static bool nav_left_slot_is_drawn(void)
  * alternating ink meaningful across a break: a line ending mid-group would
  * put two same-coloured groups against each other with only the gap between
  * them, and the gap is the signal the colour is there to back up. */
+/* A truncated row has to say so, and has to pay for saying it out of the same
+ * width. Two things are checked, because either alone passes while the other
+ * is broken: that the dots stay inside the row's own column rather than
+ * running under the scrollbar, and that they are drawn at all.
+ *
+ * The second is the one worth explaining. A row drawn without the ellipsis
+ * would be exactly its own fit_row prefix, so rendering that prefix as a row
+ * in its own right and comparing the two framebuffers says whether anything
+ * extra reached the screen. Without it this test would pass on a draw_row
+ * that silently cut, which is the bug it exists for. */
+static bool truncated_rows_show_an_ellipsis(void)
+{
+    static uint16_t truncated[SEEDTOOL_DISPLAY_WIDTH * SEEDTOOL_DISPLAY_HEIGHT];
+    /* Longer than any row can hold, which is what every address row is: an
+     * index, two spaces and a full address. */
+    static const char* const row = "  0  bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4";
+    const seedtool_nav_t nav = { .selected = 0, .back = true };
+    const char* const items[] = { row };
+    seedtool_render_nav_list(&nav, "m/84'/0'/0'/0", items, 1, 0);
+    memcpy(truncated, seedtool_render_pixels(), sizeof(truncated));
+
+    int rightmost = -1;
+    for (int y = 21; y < 55; ++y) {
+        for (int x = 0; x < SEEDTOOL_DISPLAY_WIDTH; ++x) {
+            if (truncated[y * SEEDTOOL_DISPLAY_WIDTH + x] != 0x0000 && x > rightmost) {
+                rightmost = x;
+            }
+        }
+    }
+    if (rightmost < 0) {
+        return false; /* the row never reached the screen */
+    }
+    /* LIST_TEXT_X + LIST_TEXT_WIDTH in seedtool_render.c, kept in sync with
+     * the 6 + 222 below: the row's own column, which the ellipsis has to stay
+     * inside rather than run past into the scrollbar's strip. */
+    if (rightmost > 6 + 222) {
+        return false;
+    }
+
+    /* What a silent cut would have drawn. */
+    char prefix[64] = { 0 };
+    const size_t fit = seedtool_render_fit_row(row);
+    if (fit >= sizeof(prefix) || fit >= strlen(row)) {
+        return false; /* the row was meant to be too long for one */
+    }
+    memcpy(prefix, row, fit);
+    const char* const cut[] = { prefix };
+    seedtool_render_nav_list(&nav, "m/84'/0'/0'/0", cut, 1, 0);
+    return memcmp(truncated, seedtool_render_pixels(), sizeof(truncated)) != 0;
+}
+
 static bool grouped_paging_preserves_the_value(void)
 {
     static const char* const values[] = {
@@ -2284,6 +2335,10 @@ static int self_test(void)
         fputs("Origo backup confirmation screen self-test failed\n", stderr);
         return 1;
     }
+    if (!truncated_rows_show_an_ellipsis()) {
+        fputs("Origo truncated row self-test failed\n", stderr);
+        return 1;
+    }
     if (!grouped_paging_preserves_the_value()) {
         fputs("Origo grouped address paging self-test failed\n", stderr);
         return 1;

main/seedtool_render.c

@@ -463,6 +463,32 @@ size_t seedtool_render_fit_grouped(const char* text, const size_t limit)
 }
 
 
+/* A row's text, with an ellipsis when it did not all fit. A row that simply
+ * stops is indistinguishable from a row that ended - which is fine for a menu
+ * label, since those are held to fitting by a self-test, and wrong for the
+ * address list, where every row is a value cut short and the reader has no
+ * way to tell how much is missing. The three dots say "there is more" without
+ * claiming how much; the address's own page says the rest.
+ *
+ * The ellipsis is paid for out of the same width, not drawn past it: the fit
+ * is recomputed against what is left after reserving room for the dots, so a
+ * truncated row is never wider than one that fits. */
+#define ROW_ELLIPSIS "..."
+
+static void draw_row(const uint8_t* font, const char* text, const int x, const int y, const int width,
+    const uint16_t ink)
+{
+    const size_t fit = fit_in(font, text, SIZE_MAX, width);
+    if (!text[fit]) {
+        draw_line_at(font, text, fit, x, y, ink);
+        return;
+    }
+    const int dots = text_width(font, ROW_ELLIPSIS, strlen(ROW_ELLIPSIS));
+    const size_t shortened = fit_in(font, text, SIZE_MAX, width - dots);
+    draw_line_at(font, text, shortened, x, y, ink);
+    draw_line_at(font, ROW_ELLIPSIS, strlen(ROW_ELLIPSIS), x + text_width(font, text, shortened), y, ink);
+}
+
 size_t seedtool_render_fit_row(const char* text) { return fit_in(tft_Ubuntu16, text, SIZE_MAX, LIST_TEXT_WIDTH); }
 
 size_t seedtool_render_fit_tail(const char* text)
@@ -807,8 +833,8 @@ void seedtool_render_nav_list(
         if (highlighted) {
             fill_rect(LIST_BAR_X, y, LIST_BAR_WIDTH, NAV_ROW_HEIGHT - 2, COLOR_HIGHLIGHT);
         }
-        draw_line_at(tft_Ubuntu16, item, seedtool_render_fit_row(item), LIST_TEXT_X,
-            y + (NAV_ROW_HEIGHT - tft_Ubuntu16[1]) / 2, highlighted ? COLOR_BLACK : COLOR_WHITE);
+        draw_row(tft_Ubuntu16, item, LIST_TEXT_X, y + (NAV_ROW_HEIGHT - tft_Ubuntu16[1]) / 2, LIST_TEXT_WIDTH,
+            highlighted ? COLOR_BLACK : COLOR_WHITE);
     }
     if (count > SEEDTOOL_LIST_ROWS) {
         const seedtool_thumb_t thumb = seedtool_list_thumb(count, top, NAV_SCROLL_HEIGHT);