feat(egfx): composite client surface commands into pixel buffers

[Greg Lamberson (glamberson)]

Summary

• GraphicsPipelineClient decoded WireToSurface1 bitmaps but forwarded SolidFill, SurfaceToSurface, the bitmap cache, and MapSurfaceToOutput to no-op handler callbacks, so it never held the pixel state those commands operate on. Any server that uses them (grd, Windows) renders wrong.
• Adds a surface compositor to ironrdp-egfx: persistent RGBA8888 per-surface buffers plus a bitmap cache, applies every surface command, maps surfaces to the output, and accumulates the changed output regions.
• Regions are committed per EndFrame and drained via a new GraphicsPipelineClient::drain_output() -> Vec<OutputUpdate>.
• Additive: existing GraphicsPipelineHandler callbacks are retained as notifications, so current consumers are unaffected.

Resource bounds

Clipping bounds a single access, not the total, and surfaces, cache slots and per-PDU rectangle counts are all keyed or counted by u16. Three amplification paths followed from that, all now closed:

• Total pixel bytes are capped at 256 MiB across surfaces, cache and pending output. An allocation past the cap is refused, so the surface or slot simply does not exist and commands against it become no-ops.
• Output deltas record regions during a frame and copy pixels once at EndFrame. A SolidFill naming 65,535 rectangles previously retained a full pixel copy for each; it now costs one copy per distinct region, and repeated paints of one region collapse before reaching the copy. Those copies are charged against the same cap.
• CacheToSurface no longer clones the cached tile to satisfy borrowing, removing a full-tile copy and an uncharged peak from every invocation.

ResetGraphics now discards committed-but-undrained deltas along with the surfaces that produced them. A payload can carry EndFrame and ResetGraphics together, and those deltas were clipped against the previous output, so painting them into the new one repaints stale pixels and, after a shrink, addresses a region the new output no longer contains.

Reading pixels at commit also means a delta carries the frame's final state, so a region painted twice within a frame yields one update rather than two the consumer would paint over each other.

Validation

• cargo xtask check fmt/lints/tests/typos/locks all pass.
• 23 compositor unit tests: solid fill, frame atomicity, cache round-trip, oversized-destination clipping, source-rect clamping, reset, the surface/cache/queue budgets with their release and slot-replacement paths, region deferral, and the repeat filter.

Notes

• All reads and writes are clipped to their buffers; source-rect copies are clamped to the source surface so a malformed rectangle cannot drive an oversized allocation.
• OutputUpdate is #[non_exhaustive], matching BitmapUpdate and Surface; coordinates use ExclusiveRectangle.
• Independent of refactor(dvc)!: replace DVC wrappers with typed accessors #1377. The session-side render that drains this is feat(session): render the EGFX graphics pipeline output #1461.
• Part of [tracking] Client-side Graphics Pipeline (EGFX): wire the existing decode core into the connector and client stack #1464. Motivated by Client can't connect to GNOME Remote Desktop: no Graphics Pipeline (EGFX) advertised — the blocker after #1371 #1446.

[Copilot]

Pull request overview

Adds persistent EGFX surface composition and frame-scoped output updates.

Changes:

• Composites bitmap, fill, copy, cache, and mapping commands.
• Exposes completed regions through drain_output().
• Adds compositor unit tests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
crates/ironrdp-egfx/src/lib.rs	Exposes the compositor module.
crates/ironrdp-egfx/src/compositor.rs	Implements surface composition, caching, output updates, and tests.
crates/ironrdp-egfx/src/client.rs	Integrates composition into EGFX PDU processing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benoît Cortier (CBenoit)]

issue (non-blocking): My usual nitpick about tests living outside of the testsuite crates; but I don’t want to block this PR on that now. Just informational.

[Benoît Cortier (CBenoit)]

LGTM!