address review: the queued-instance allowance counts path segment buffers and the dedup copy

crates/xfa/src/data/write.rs

@@ -82,9 +82,9 @@ pub fn remove_data_instance(doc: &mut Document, path: &DataPath) -> Result<Datas
 /// pass, which asks for the instances again).
 const MAX_ENSURED: usize = 200_000;
 
-/// Most bytes of path text those queued instances hold together: each one owns a copy of its
-/// parent path and its name (twice, once as the path and once as its label), so a long ancestor
-/// would otherwise be multiplied by the instance count. Ordinary paths are tens of bytes.
+/// Most bytes of path those queued instances hold together: each one owns a copy of its parent
+/// path (segment buffers included, twice while duplicates are dropped) and its name, so a long
+/// ancestor would otherwise be multiplied by the instance count. Ordinary paths are tens of bytes.
 const MAX_ENSURED_BYTES: usize = 128 << 20;
 
 // Instance nodes write_data_ops has queued on this thread, for tests that bound its work.
@@ -122,7 +122,12 @@ pub fn write_data_ops(doc: &mut Document, ops: &[DataOp], reuse: Option<ObjRef>)
             }
             DataOp::Instances { parent, name, count } => {
                 let done = queued.entry((parent, name.as_str())).or_insert(0);
-                let per_instance = parent.iter().fold(name.len().saturating_mul(2), |n, (p, _)| n.saturating_add(p.len()).saturating_add(16));
+                // The path (its segments' buffers and their text) is held by the queued step and cloned
+                // again into `flush`'s dedup set, beside the label and the step itself.
+                let segment = std::mem::size_of::<(String, usize)>();
+                let path_bytes =
+                    parent.iter().fold(segment.saturating_add(name.len()), |n, (p, _)| n.saturating_add(segment).saturating_add(p.len()));
+                let per_instance = path_bytes.saturating_mul(2).saturating_add(name.len()).saturating_add(16 + std::mem::size_of::<Want>());
                 while *done < (*count).min(MAX_INDEX) {
                     if ensured >= MAX_ENSURED {
                         capped = true;