diff --git a/crates/engine/src/interchange/vector.rs b/crates/engine/src/interchange/vector.rs
index 324d3a82ae..183d1664cb 100644
--- a/crates/engine/src/interchange/vector.rs
+++ b/crates/engine/src/interchange/vector.rs
@@ -72,38 +72,48 @@ fn shape_items(ids: &mut Ids, s: &effectcraft_svg::Shape, m: Affine) -> Vec<Prop
     let bbox = s.geom.to_path().bounding_box();
     if let Some(st) = &s.stroke {
         let width = st.width * det_scale(m);
-        let mut g = match &st.paint {
-            Paint::Color(c) => build::shape_stroke(ids, [c[0], c[1], c[2], 1.0], width),
+        let paint = match &st.paint {
+            Paint::Color(c) => Some(build::shape_stroke(ids, [c[0], c[1], c[2], 1.0], width)),
             Paint::Gradient(gr) => {
                 let (radial, a, b) = gradient_points(gr, m, bbox);
-                build::shape_gradient_stroke(ids, radial, a, b, gradient_value(gr), width)
+                Some(build::shape_gradient_stroke(ids, radial, a, b, gradient_value(gr), width))
             }
+            // Editable shape layers do not yet have a pattern paint operator. Keep the geometry
+            // and any retained fallback as solid paint; SVG footage retains the rasterised pattern.
+            Paint::Pattern(pattern) => pattern.fallback.map(|c| build::shape_stroke(ids, [c[0], c[1], c[2], c[3]], width)),
         };
-        set(&mut g, "opacity", Value::Scalar(st.opacity * 100.0));
-        set(&mut g, "cap", Value::Enum(st.cap as u32));
-        set(&mut g, "join", Value::Enum(st.join as u32));
-        set(&mut g, "miter", Value::Scalar(st.miter));
-        if let Some((d, off)) = &st.dash
-            && let Some(dg) = g.sub_mut("dashes")
-        {
-            let k = det_scale(m);
-            set(dg, "dash", Value::Scalar(d.first().copied().unwrap_or(0.0) * k));
-            set(dg, "gap", Value::Scalar(d.get(1).or(d.first()).copied().unwrap_or(0.0) * k));
-            set(dg, "offset", Value::Scalar(off * k));
+        if let Some(mut g) = paint {
+            set(&mut g, "opacity", Value::Scalar(st.opacity * 100.0));
+            set(&mut g, "cap", Value::Enum(st.cap as u32));
+            set(&mut g, "join", Value::Enum(st.join as u32));
+            set(&mut g, "miter", Value::Scalar(st.miter));
+            if let Some((d, off)) = &st.dash
+                && let Some(dg) = g.sub_mut("dashes")
+            {
+                let k = det_scale(m);
+                set(dg, "dash", Value::Scalar(d.first().copied().unwrap_or(0.0) * k));
+                set(dg, "gap", Value::Scalar(d.get(1).or(d.first()).copied().unwrap_or(0.0) * k));
+                set(dg, "offset", Value::Scalar(off * k));
+            }
+            items.push(g);
         }
-        items.push(g);
     }
     if let Some(f) = &s.fill {
-        let mut g = match f {
-            Paint::Color(c) => build::shape_fill(ids, [c[0], c[1], c[2], 1.0]),
+        let paint = match f {
+            Paint::Color(c) => Some(build::shape_fill(ids, [c[0], c[1], c[2], 1.0])),
             Paint::Gradient(gr) => {
                 let (radial, a, b) = gradient_points(gr, m, bbox);
-                build::shape_gradient_fill(ids, radial, a, b, gradient_value(gr))
+                Some(build::shape_gradient_fill(ids, radial, a, b, gradient_value(gr)))
             }
+            // Pattern artwork is preserved in rasterised SVG footage; editable shapes keep only
+            // any retained fallback as solid paint.
+            Paint::Pattern(pattern) => pattern.fallback.map(|c| build::shape_fill(ids, [c[0], c[1], c[2], c[3]])),
         };
-        set(&mut g, "opacity", Value::Scalar(s.fill_opacity * 100.0));
-        set(&mut g, "rule", Value::Enum(u32::from(s.fill_rule == effectcraft_svg::FillRule::EvenOdd)));
-        items.push(g);
+        if let Some(mut g) = paint {
+            set(&mut g, "opacity", Value::Scalar(s.fill_opacity * 100.0));
+            set(&mut g, "rule", Value::Enum(u32::from(s.fill_rule == effectcraft_svg::FillRule::EvenOdd)));
+            items.push(g);
+        }
     }
     items
 }
diff --git a/crates/engine/src/tests/vector_import.rs b/crates/engine/src/tests/vector_import.rs
index 10c07c2adb..0b865812f1 100644
--- a/crates/engine/src/tests/vector_import.rs
+++ b/crates/engine/src/tests/vector_import.rs
@@ -320,6 +320,41 @@ fn paste_svg_markup_as_a_shape_layer() {
     assert_eq!(s.active_comp().unwrap().layers.len(), 1);
 }
 
+#[test]
+fn pasted_svg_pattern_keeps_geometry_and_editable_fallback_paint() {
+    let (mut s, _) = text_session();
+    let svg = r##"<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">
+        <defs><pattern id="p" patternUnits="userSpaceOnUse" width="4" height="4">
+            <circle cx="2" cy="2" r="1" fill="red"/>
+        </pattern></defs>
+        <rect id="patterned" width="16" height="6" fill="url(#p) rgba(255, 0, 0, 0.5)"/>
+        <path id="patterned-stroke" d="M0 8 H16" fill="none" stroke="url(#p) rgba(0, 0, 255, 0.25)" stroke-width="2"/>
+        <rect id="patterned-no-fallback" y="10" width="16" height="6" fill="url(#p)"/>
+        <path id="patterned-stroke-no-fallback" d="M0 15 H16" fill="none" stroke="url(#p)" stroke-width="2"/>
+    </svg>"##;
+    let result = s.execute_checked("edit.pasteSvg", json!({"svg": svg})).unwrap();
+    let layer_id = effectcraft_project::LayerId(result["layer"].as_u64().unwrap());
+    let layer = s.active_comp().unwrap().layer(layer_id).unwrap();
+    let shape = layer.props.sub("contents").unwrap().groups().find(|g| g.name == "patterned").unwrap();
+    let items: Vec<_> = shape.sub("contents").unwrap().groups().collect();
+    assert!(items.iter().any(|item| item.match_id == "rect"), "the editable geometry remains");
+    let fill = items.iter().find(|item| item.match_id == "fill").expect("fallback fill remains editable");
+    assert_eq!(fill.get("color").unwrap().value, KV::Color([1.0, 0.0, 0.0, 0.5]));
+    let stroke = layer.props.sub("contents").unwrap().groups().find(|g| g.name == "patterned-stroke").unwrap();
+    let items: Vec<_> = stroke.sub("contents").unwrap().groups().collect();
+    assert!(items.iter().any(|item| item.match_id == "path"), "the editable stroke path remains");
+    let stroke = items.iter().find(|item| item.match_id == "stroke").expect("fallback stroke remains editable");
+    assert_eq!(stroke.get("color").unwrap().value, KV::Color([0.0, 0.0, 1.0, 0.25]));
+    let no_fallback = layer.props.sub("contents").unwrap().groups().find(|g| g.name == "patterned-no-fallback").unwrap();
+    let items: Vec<_> = no_fallback.sub("contents").unwrap().groups().collect();
+    assert!(items.iter().any(|item| item.match_id == "rect"), "the editable geometry remains without a fallback");
+    assert!(!items.iter().any(|item| item.match_id == "fill"), "pattern paint without a fallback is omitted");
+    let no_fallback_stroke = layer.props.sub("contents").unwrap().groups().find(|g| g.name == "patterned-stroke-no-fallback").unwrap();
+    let items: Vec<_> = no_fallback_stroke.sub("contents").unwrap().groups().collect();
+    assert!(items.iter().any(|item| item.match_id == "path"), "the editable stroke geometry remains without a fallback");
+    assert!(!items.iter().any(|item| item.match_id == "stroke"), "pattern stroke without a fallback is omitted");
+}
+
 #[test]
 fn paste_svg_rejects_text_that_is_not_usable_svg() {
     let (mut s, _) = text_session();
diff --git a/crates/svg/Cargo.toml b/crates/svg/Cargo.toml
index 0e1af7719d..799c1382b7 100644
--- a/crates/svg/Cargo.toml
+++ b/crates/svg/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "effectcraft-svg"
-description = "SVG import: parses SVG 1.1 / SVG 2 static vector content (paths, basic shapes, groups, transforms, use, CSS styles, solid and gradient fills/strokes, opacity) and rasterises it at any scale"
+description = "SVG import: parses SVG 1.1 / SVG 2 static vector content (paths, basic shapes, groups, transforms, use, CSS styles, solid, gradient and pattern fills/strokes, opacity) and rasterises it at any scale"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/svg/README.md b/crates/svg/README.md
index 862bd01d0a..644a4651fb 100644
--- a/crates/svg/README.md
+++ b/crates/svg/README.md
@@ -18,9 +18,22 @@ here, plus **CSS Color Module Level 3** for colour keywords and functions:
   `stroke-opacity`, `opacity`, `display`, `visibility`, `color`/`currentColor`;
 - `linearGradient` and `radialGradient` (with `fx`/`fy` focal point), `gradientUnits`,
   `gradientTransform`, `spreadMethod`, `href` inheritance of stops and attributes;
+- static (non-animated) `<pattern>` fill/stroke with `patternUnits`, `patternContentUnits`, `patternTransform`,
+  tile `x`/`y`/`width`/`height`, local `href`/`xlink:href` inheritance and solid paints on
+  supported shape/group children;
 - styling through presentation attributes, the `style` attribute and `<style>` sheets with
   type, class, id and universal selectors (simple selectors and selector lists).
 
-Not supported (ignored): text, images, filters, clip paths, masks, patterns, markers, animation.
+Pattern `viewBox`, external pattern references, nested paint servers and non-shape pattern content
+are unsupported; invalid patterns use a `url(...)` fallback when present. Local pattern `href`
+chains are depth-limited and cycles are rejected. Tiles render once and are sampled across the
+painted area; both live surfaces and aggregate tile work are bounded. Pattern paints are
+rasterised in SVG footage; editable shape layers retain geometry and convert only a supplied
+`url(...)` fallback to solid fill/stroke.
+Path expansion and gradient resolution have per-import work limits. The rasterizer also caps live
+surface memory and cumulative pattern, clip-coverage, and source-image work. Over-budget imports
+return an error; over-budget raster operations are skipped, using a paint fallback where available.
+Other unsupported content (ignored): text, images, filters, clip paths, masks, markers and
+animation, including pattern animation.
 XML parsing uses `roxmltree` (MIT/Apache-2.0). Test fixtures are original work (see
 `tests/fixtures/*.attribution`).
diff --git a/crates/svg/src/lib.rs b/crates/svg/src/lib.rs
index 95c00a91a1..02433c200b 100644
--- a/crates/svg/src/lib.rs
+++ b/crates/svg/src/lib.rs
@@ -11,7 +11,7 @@ mod color;
 mod pathdata;
 mod raster;
 
-use std::collections::HashMap;
+use std::{collections::HashMap, sync::Arc};
 
 pub use color::parse_color;
 pub use kurbo::{Affine, BezPath};
@@ -73,6 +73,14 @@ pub enum Spread {
     Repeat,
 }
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PatternUnits {
+    /// Coordinates are fractions of the painted shape's bounding box.
+    ObjectBoundingBox,
+    /// Coordinates are expressed in the current user space.
+    UserSpaceOnUse,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub enum GradientKind {
     Linear { x1: f64, y1: f64, x2: f64, y2: f64 },
@@ -83,7 +91,7 @@ pub enum GradientKind {
 pub struct Gradient {
     pub kind: GradientKind,
     /// (offset 0..1, straight RGBA 0..1), sorted.
-    pub stops: Vec<(f64, [f64; 4])>,
+    pub stops: Arc<[(f64, [f64; 4])]>,
     /// `gradientUnits="objectBoundingBox"` (the default): coordinates are fractions of the
     /// shape's bounding box.
     pub bbox_units: bool,
@@ -91,10 +99,32 @@ pub struct Gradient {
     pub spread: Spread,
 }
 
+#[derive(Clone, Debug, PartialEq)]
+pub struct Pattern {
+    /// Tile origin and size in `pattern_units` coordinates.
+    pub x: f64,
+    pub y: f64,
+    pub width: f64,
+    pub height: f64,
+    /// Coordinate system used for the tile origin and size.
+    pub pattern_units: PatternUnits,
+    /// Coordinate system used by the tile's child shapes.
+    pub content_units: PatternUnits,
+    /// Transform applied to the repeating tile.
+    pub transform: Affine,
+    /// Immutable tile content shared by every use of the resolved pattern.
+    pub content: Arc<Group>,
+    /// Conservative shape/path traversal cost per tile pixel, charged during rasterisation.
+    pub render_complexity: usize,
+    /// The fallback from `url(#id) fallback`, used if the target bbox or tile is invalid.
+    pub fallback: Option<[f64; 4]>,
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub enum Paint {
     Color([f64; 3]),
     Gradient(Gradient),
+    Pattern(Pattern),
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -603,6 +633,23 @@ struct Parser<'a, 'i> {
     /// The `<use>` targets being expanded, outermost first: a reference back into one is a
     /// cycle and is skipped.
     using: Vec<roxmltree::NodeId>,
+    /// Pattern contents may use only solid paints; nested paint servers invalidate that pattern.
+    in_pattern_content: bool,
+    invalid_pattern_content: bool,
+    /// Work revisited while resolving patterns, bounded across all references.
+    pattern_work: usize,
+    pattern_work_budget: usize,
+    pattern_work_exceeded: bool,
+    path_data_work: usize,
+    path_element_work: usize,
+    path_work_budget: usize,
+    path_work_exceeded: bool,
+    /// Parsed pattern content is viewport-dependent because lengths may be percentages; the cache is bounded.
+    pattern_cache: HashMap<(roxmltree::NodeId, u64, u64), Option<Pattern>>,
+    /// Resolved gradients share their stop arrays across repeated paint references.
+    gradient_cache: HashMap<(roxmltree::NodeId, u64, u64), Gradient>,
+    gradient_work: usize,
+    gradient_work_exceeded: bool,
 }
 
 fn is_svg_ns(n: &roxmltree::Node) -> bool {
@@ -635,6 +682,50 @@ impl<'a, 'i> Parser<'a, 'i> {
         w <= MAX_CSS_WORK
     }
 
+    /// Charge work while resolving pattern references. Attribute bytes and each traversed child
+    /// both count so a cache miss cannot repeatedly scan an enormous descriptive-only pattern.
+    fn charge_pattern_work(&mut self, work: usize) -> bool {
+        self.pattern_work = self.pattern_work.saturating_add(work);
+        if self.pattern_work > self.pattern_work_budget {
+            self.pattern_work_exceeded = true;
+            return false;
+        }
+        true
+    }
+
+    fn charge_gradient_work(&mut self, work: usize) -> bool {
+        self.gradient_work = self.gradient_work.saturating_add(work);
+        if self.gradient_work > MAX_GRADIENT_WORK {
+            self.gradient_work_exceeded = true;
+            return false;
+        }
+        true
+    }
+
+    fn charge_path_data(&mut self, bytes: usize) -> bool {
+        self.path_data_work = self.path_data_work.saturating_add(bytes.saturating_mul(PATH_DATA_WORK_FACTOR));
+        if self.path_data_work > self.path_work_budget {
+            self.path_work_exceeded = true;
+            return false;
+        }
+        true
+    }
+
+    fn charge_path_elements(&mut self, elements: usize) -> bool {
+        self.path_element_work = self.path_element_work.saturating_add(elements);
+        if self.path_element_work > MAX_PATH_ELEMENTS_PER_IMPORT {
+            self.path_work_exceeded = true;
+            return false;
+        }
+        true
+    }
+
+    /// Charge a pattern node's attributes and traversal while resolving a pattern reference.
+    fn charge_pattern_attributes(&mut self, n: roxmltree::Node) -> bool {
+        let bytes = n.attributes().map(|attribute| attribute.name().len().saturating_add(attribute.value().len())).fold(0usize, usize::saturating_add);
+        self.charge_pattern_work(bytes.saturating_add(1))
+    }
+
     /// Apply the matching `<style>` rules to `out`, by specificity then source order.
     fn apply_rules(&self, n: roxmltree::Node, out: &mut HashMap<String, String>) {
         let css = &self.css;
@@ -691,7 +782,7 @@ impl<'a, 'i> Parser<'a, 'i> {
             unit = &s[num_end - 1..];
         }
         let v: f64 = num.parse().ok()?;
-        Some(match unit.trim() {
+        let value = match unit.trim() {
             "" | "px" => v,
             "pt" => v * 4.0 / 3.0,
             "pc" => v * 16.0,
@@ -709,7 +800,8 @@ impl<'a, 'i> Parser<'a, 'i> {
                 v / 100.0 * base
             }
             _ => v,
-        })
+        };
+        value.is_finite().then_some(value)
     }
 
     fn attr_len(&self, n: roxmltree::Node, name: &str, axis: char, st: &Style) -> f64 {
@@ -726,7 +818,8 @@ impl<'a, 'i> Parser<'a, 'i> {
         }
         if let Some(rest) = v.strip_prefix("url(") {
             let (url, fallback) = rest.split_once(')').unwrap_or((rest, ""));
-            let id = url.trim().trim_matches(['"', '\'']).trim_start_matches('#').to_string();
+            let url = url.trim().trim_matches(['"', '\'']);
+            let id = url.strip_prefix('#').filter(|id| !id.is_empty()).unwrap_or_default().to_string();
             let fb = fallback.trim();
             let fb = if fb.is_empty() || fb == "none" { None } else { parse_color(fb) };
             return Some(Some(PaintRef::Url(id, fb)));
@@ -740,8 +833,11 @@ impl<'a, 'i> Parser<'a, 'i> {
     /// Apply an element's declared inherited properties to `st`. Returns (opacity, display).
     fn cascade(&self, n: roxmltree::Node, st: &mut Style) -> (f64, bool) {
         let d = self.declared(n);
-        let num =
-            |k: &str| d.get(k).and_then(|v| v.trim().trim_end_matches('%').parse::<f64>().ok().map(|x| if v.trim().ends_with('%') { x / 100.0 } else { x }));
+        let num = |k: &str| {
+            d.get(k)
+                .and_then(|v| v.trim().trim_end_matches('%').parse::<f64>().ok().map(|x| if v.trim().ends_with('%') { x / 100.0 } else { x }))
+                .filter(|x| x.is_finite())
+        };
         if let Some(c) = d.get("color").and_then(|v| parse_color(v)) {
             st.color = c;
         }
@@ -806,29 +902,71 @@ impl<'a, 'i> Parser<'a, 'i> {
         (num("opacity").unwrap_or(1.0).clamp(0.0, 1.0), display)
     }
 
-    fn resolve_paint(&self, p: &PaintRef, st: &Style) -> Option<(Paint, f64)> {
+    /// Resolve a paint reference, retaining a per-reference fallback for patterns.
+    fn resolve_paint(&mut self, p: &PaintRef, st: &Style) -> Option<(Paint, f64)> {
+        if self.in_pattern_content && matches!(p, PaintRef::Url(..)) {
+            self.invalid_pattern_content = true;
+            return None;
+        }
         match p {
             PaintRef::Color(c) => Some((Paint::Color([c[0], c[1], c[2]]), c[3])),
             PaintRef::Current => Some((Paint::Color([st.color[0], st.color[1], st.color[2]]), st.color[3])),
-            PaintRef::Url(id, fb) => match self.gradient(id, 0) {
+            PaintRef::Url(id, fallback) => match self.gradient(id, 0) {
                 Some(g) if g.stops.len() == 1 => {
-                    let c = g.stops[0].1;
+                    let (_, c) = g.stops.first()?;
                     Some((Paint::Color([c[0], c[1], c[2]]), c[3]))
                 }
                 Some(g) if !g.stops.is_empty() => Some((Paint::Gradient(g), 1.0)),
                 Some(_) => None,
-                None => fb.map(|c| (Paint::Color([c[0], c[1], c[2]]), c[3])),
+                None => match self.pattern(id) {
+                    Some(mut pattern) => {
+                        pattern.fallback = *fallback;
+                        Some((Paint::Pattern(pattern), 1.0))
+                    }
+                    None => fallback.map(|c| (Paint::Color([c[0], c[1], c[2]]), c[3])),
+                },
             },
         }
     }
 
+    /// Read a local `href` or namespaced `xlink:href` value from an SVG element.
+    fn href_value(n: roxmltree::Node<'a, 'i>) -> Option<String> {
+        const XLINK: &str = "http://www.w3.org/1999/xlink";
+        let href = n
+            .attributes()
+            .find(|a| a.name() == "href" && a.namespace().is_none())
+            .or_else(|| n.attributes().find(|a| a.name() == "href" && a.namespace() == Some(XLINK)))?;
+        Some(href.value().to_string())
+    }
+
     fn href(&self, n: roxmltree::Node<'a, 'i>) -> Option<roxmltree::Node<'a, 'i>> {
-        let h = n.attributes().find(|a| a.name() == "href").map(|a| a.value())?;
-        self.ids.get(h.trim().trim_start_matches('#')).copied()
+        let h = Self::href_value(n)?;
+        let id = h.trim().strip_prefix('#')?;
+        if id.is_empty() {
+            return None;
+        }
+        self.ids.get(id).copied()
+    }
+
+    /// A gradient by id, with a viewport-specific cache for its resolved attributes and stops.
+    fn gradient(&mut self, id: &str, depth: usize) -> Option<Gradient> {
+        let node = *self.ids.get(id)?;
+        if !matches!(node.tag_name().name(), "linearGradient" | "radialGradient") || depth > 16 {
+            return None;
+        }
+        let key = (node.id(), self.vw.to_bits(), self.vh.to_bits());
+        if let Some(gradient) = self.gradient_cache.get(&key) {
+            return Some(gradient.clone());
+        }
+        let gradient = self.parse_gradient(id, depth)?;
+        if self.gradient_cache.len() < MAX_GRADIENT_CACHE_ENTRIES {
+            self.gradient_cache.insert(key, gradient.clone());
+        }
+        Some(gradient)
     }
 
-    /// A gradient by id, with `href` inheritance of attributes and stops.
-    fn gradient(&self, id: &str, depth: usize) -> Option<Gradient> {
+    /// Parse a gradient by id, charging reference-chain and stop work before retaining the result.
+    fn parse_gradient(&mut self, id: &str, depth: usize) -> Option<Gradient> {
         let n = *self.ids.get(id)?;
         let tag = n.tag_name().name();
         if !matches!(tag, "linearGradient" | "radialGradient") || depth > 16 {
@@ -837,24 +975,31 @@ impl<'a, 'i> Parser<'a, 'i> {
         // Chain: this element, then what it references.
         let mut chain = vec![n];
         let mut cur = n;
+        if !self.charge_gradient_work(cur.attributes().map(|a| a.name().len().saturating_add(a.value().len())).fold(1usize, usize::saturating_add)) {
+            return None;
+        }
         while let Some(next) = self.href(cur) {
             if chain.len() > 16 || chain.contains(&next) {
                 break;
             }
             chain.push(next);
             cur = next;
+            if !self.charge_gradient_work(cur.attributes().map(|a| a.name().len().saturating_add(a.value().len())).fold(1usize, usize::saturating_add)) {
+                return None;
+            }
         }
         let attr = |name: &str| chain.iter().find_map(|e| e.attribute(name));
         let bbox_units = attr("gradientUnits") != Some("userSpaceOnUse");
         let st = Style::default();
         let len = |name: &str, axis: char, def: &str| -> f64 {
             let v = attr(name).unwrap_or(def);
-            if bbox_units {
+            let value = if bbox_units {
                 let v = v.trim();
                 if let Some(p) = v.strip_suffix('%') { p.parse::<f64>().unwrap_or(0.0) / 100.0 } else { v.parse::<f64>().unwrap_or(0.0) }
             } else {
                 self.length(v, axis, st.font_size).unwrap_or(0.0)
-            }
+            };
+            if value.is_finite() { value } else { 0.0 }
         };
         let kind = if tag == "linearGradient" {
             GradientKind::Linear { x1: len("x1", 'x', "0%"), y1: len("y1", 'y', "0%"), x2: len("x2", 'x', "100%"), y2: len("y2", 'y', "0%") }
@@ -874,9 +1019,25 @@ impl<'a, 'i> Parser<'a, 'i> {
         };
         // Stops: from the first element in the chain that has any.
         let mut stops = vec![];
-        if let Some(src) = chain.iter().find(|e| e.children().any(|c| c.is_element() && c.tag_name().name() == "stop")) {
+        let mut source = None;
+        'source: for candidate in &chain {
+            for child in candidate.children().filter(|child| child.is_element()) {
+                if !self.charge_gradient_work(1) {
+                    return None;
+                }
+                if child.tag_name().name() == "stop" {
+                    source = Some(*candidate);
+                    break 'source;
+                }
+            }
+        }
+        if let Some(src) = source {
             let mut last = 0.0f64;
             for s in src.children().filter(|c| c.is_element() && c.tag_name().name() == "stop") {
+                let stop_work = s.attributes().map(|a| a.name().len().saturating_add(a.value().len())).fold(1usize, usize::saturating_add);
+                if !self.charge_gradient_work(stop_work) {
+                    return None;
+                }
                 let d = self.declared(s);
                 let off = s
                     .attribute("offset")
@@ -892,11 +1053,189 @@ impl<'a, 'i> Parser<'a, 'i> {
                     .get("stop-color")
                     .and_then(|c| if c.trim() == "currentColor" { d.get("color").and_then(|x| parse_color(x)) } else { parse_color(c) })
                     .unwrap_or([0.0, 0.0, 0.0, 1.0]);
-                let o = d.get("stop-opacity").and_then(|v| v.trim().parse::<f64>().ok()).unwrap_or(1.0).clamp(0.0, 1.0);
+                let o = d.get("stop-opacity").and_then(|v| v.trim().parse::<f64>().ok()).filter(|v| v.is_finite()).unwrap_or(1.0).clamp(0.0, 1.0);
                 stops.push((off, [c[0], c[1], c[2], c[3] * o]));
             }
         }
-        Some(Gradient { kind, stops, bbox_units, transform, spread })
+        Some(Gradient { kind, stops: Arc::from(stops.into_boxed_slice()), bbox_units, transform, spread })
+    }
+
+    /// Parse a pattern length using the coordinate system selected by its units attribute.
+    fn pattern_length(&self, value: &str, axis: char, font: f64, units: PatternUnits) -> Option<f64> {
+        let value = value.trim();
+        let length = match units {
+            PatternUnits::ObjectBoundingBox => match value.strip_suffix('%') {
+                Some(percent) => percent.trim().parse::<f64>().ok()? / 100.0,
+                None => value.parse::<f64>().ok()?,
+            },
+            PatternUnits::UserSpaceOnUse => {
+                let number_end = value.find(|c: char| !(c.is_ascii_digit() || matches!(c, '.' | '-' | '+' | 'e' | 'E'))).unwrap_or(value.len());
+                let (mut number, mut unit) = (&value[..number_end], &value[number_end..]);
+                // The length scanner admits `e` for exponents; back it off when it starts `em` or
+                // `ex`, or follows a complete exponent (for example `1e2em`).
+                if number.parse::<f64>().is_err() && (number.ends_with('e') || number.ends_with('E')) {
+                    number = &number[..number.len().saturating_sub(1)];
+                    unit = &value[number_end.saturating_sub(1)..];
+                }
+                number.parse::<f64>().ok()?;
+                let unit = unit.trim();
+                if !matches!(unit, "" | "px" | "pt" | "pc" | "mm" | "cm" | "in" | "em" | "ex" | "%") {
+                    return None;
+                }
+                self.length(value, axis, font)?
+            }
+        };
+        length.is_finite().then_some(length)
+    }
+
+    /// Resolve a local static pattern. The nearest chain member supplies each attribute;
+    /// child content comes from the first member with non-descriptive element children.
+    fn pattern(&mut self, id: &str) -> Option<Pattern> {
+        let target = *self.ids.get(id)?;
+        if target.tag_name().name() != "pattern" {
+            return None;
+        }
+        let key = (target.id(), self.vw.to_bits(), self.vh.to_bits());
+        if let Some(pattern) = self.pattern_cache.get(&key) {
+            return pattern.clone();
+        }
+        let pattern = self.parse_pattern(id);
+        if pattern.is_some() && self.pattern_cache.len() < MAX_PATTERN_CACHE_ENTRIES {
+            self.pattern_cache.insert(key, pattern.clone());
+        }
+        pattern
+    }
+
+    /// Parse one pattern and account for all work done while resolving its inheritance chain.
+    fn parse_pattern(&mut self, id: &str) -> Option<Pattern> {
+        const MAX_PATTERN_HREF_DEPTH: usize = 16;
+        let first = *self.ids.get(id)?;
+        if first.tag_name().name() != "pattern" {
+            return None;
+        }
+        let mut chain = vec![first];
+        loop {
+            let current = *chain.last()?;
+            if !self.charge_pattern_attributes(current) {
+                return None;
+            }
+            let Some(href) = Self::href_value(current) else { break };
+            if chain.len() >= MAX_PATTERN_HREF_DEPTH {
+                return None;
+            }
+            let target_id = href.trim().strip_prefix('#')?;
+            if target_id.is_empty() {
+                return None;
+            }
+            let target = *self.ids.get(target_id)?;
+            if target.tag_name().name() != "pattern" || chain.iter().any(|seen| seen.id() == target.id()) {
+                return None;
+            }
+            chain.push(target);
+        }
+        // This implementation has no viewBox mapper for pattern contents; don't silently paint
+        // them in the wrong coordinate system.
+        if chain.iter().any(|node| node.attribute("viewBox").is_some()) {
+            return None;
+        }
+
+        let attr = |name: &str| chain.iter().find_map(|node| node.attribute(name).map(str::to_string));
+        let mut content_style = Style::default();
+        let mut content_opacity = 1.0;
+        let ancestors: Vec<_> = first.ancestors().filter(|node| node.is_element()).collect();
+        for ancestor in ancestors.into_iter().rev() {
+            if ancestor.id() != first.id() && !self.charge_pattern_attributes(ancestor) {
+                return None;
+            }
+            let (opacity, _) = self.cascade(ancestor, &mut content_style);
+            if ancestor.id() == first.id() {
+                content_opacity = opacity;
+            }
+        }
+        let font_size = content_style.font_size;
+        let units = match attr("patternUnits").as_deref() {
+            None | Some("objectBoundingBox") => PatternUnits::ObjectBoundingBox,
+            Some("userSpaceOnUse") => PatternUnits::UserSpaceOnUse,
+            Some(_) => return None,
+        };
+        let content_units = match attr("patternContentUnits").as_deref() {
+            None | Some("userSpaceOnUse") => PatternUnits::UserSpaceOnUse,
+            Some("objectBoundingBox") => PatternUnits::ObjectBoundingBox,
+            Some(_) => return None,
+        };
+        let x = match attr("x").as_deref() {
+            Some(value) => self.pattern_length(value, 'x', font_size, units)?,
+            None => 0.0,
+        };
+        let y = match attr("y").as_deref() {
+            Some(value) => self.pattern_length(value, 'y', font_size, units)?,
+            None => 0.0,
+        };
+        let width = self.pattern_length(attr("width")?.as_str(), 'x', font_size, units)?;
+        let height = self.pattern_length(attr("height")?.as_str(), 'y', font_size, units)?;
+        if width <= 0.0 || height <= 0.0 {
+            return None;
+        }
+        let transform = attr("patternTransform").as_deref().map(parse_transform).unwrap_or(Affine::IDENTITY);
+        let coeffs = transform.as_coeffs();
+        let determinant = coeffs[0] * coeffs[3] - coeffs[1] * coeffs[2];
+        if !coeffs.iter().all(|v| v.is_finite())
+            || !determinant.is_finite()
+            || determinant == 0.0
+            || !transform.inverse().as_coeffs().iter().all(|v| v.is_finite())
+        {
+            return None;
+        }
+        let (old_pattern_content, old_invalid) = (self.in_pattern_content, self.invalid_pattern_content);
+        let (old_vw, old_vh) = (self.vw, self.vh);
+        self.in_pattern_content = true;
+        self.invalid_pattern_content = false;
+        if content_units == PatternUnits::ObjectBoundingBox {
+            self.vw = 1.0;
+            self.vh = 1.0;
+        }
+        let source = chain.iter().copied().find(|node| {
+            node.children().any(|child| {
+                if !self.charge_pattern_work(1) {
+                    // Stop the scan immediately; the exceeded flag below rejects this pattern.
+                    return true;
+                }
+                child.is_element() && !matches!(child.tag_name().name(), "title" | "desc" | "metadata")
+            })
+        });
+        if self.pattern_work_exceeded {
+            return None;
+        }
+        let mut children = Vec::new();
+        if let Some(source) = source {
+            for child in source.children() {
+                self.node(child, &content_style, &mut children, 1);
+                if self.pattern_work_exceeded {
+                    break;
+                }
+            }
+        }
+        let invalid = self.invalid_pattern_content;
+        self.in_pattern_content = old_pattern_content;
+        self.invalid_pattern_content = old_invalid;
+        self.vw = old_vw;
+        self.vh = old_vh;
+        if invalid || self.pattern_work_exceeded {
+            return None;
+        }
+        let render_complexity = pattern_render_complexity(&children);
+        let content = Group {
+            name: source.map_or_else(|| Self::element_name(first), Self::element_name),
+            transform: Affine::IDENTITY,
+            opacity: content_opacity,
+            children,
+            clip: vec![],
+            blend: BlendMode::Normal,
+            mask: None,
+            isolated: true,
+            knockout: false,
+        };
+        Some(Pattern { x, y, width, height, pattern_units: units, content_units, transform, content: Arc::new(content), render_complexity, fallback: None })
     }
 
     fn element_name(n: roxmltree::Node) -> String {
@@ -908,10 +1247,19 @@ impl<'a, 'i> Parser<'a, 'i> {
         if depth > 64 || !is_svg_ns(&n) || self.work > self.budget {
             return;
         }
+        if self.in_pattern_content && !self.charge_pattern_attributes(n) {
+            return;
+        }
         // Every element converted counts, each `<use>` copy again: a few references to groups
         // that reference each other several times can multiply into billions (#1236).
         self.work += 1;
         let tag = n.tag_name().name();
+        if self.in_pattern_content
+            && !matches!(tag, "g" | "rect" | "circle" | "ellipse" | "path" | "line" | "polyline" | "polygon" | "defs" | "title" | "desc" | "metadata" | "style")
+        {
+            self.invalid_pattern_content = true;
+            return;
+        }
         match tag {
             "defs" | "title" | "desc" | "metadata" | "style" | "linearGradient" | "radialGradient" | "symbol" | "clipPath" | "mask" | "pattern" | "marker"
             | "script" => return,
@@ -991,9 +1339,12 @@ impl<'a, 'i> Parser<'a, 'i> {
                     let mut inner = vec![];
                     let mut sst = st.clone();
                     let (o, _) = self.cascade(target, &mut sst);
+                    let saved_viewport = (self.vw, self.vh);
+                    (self.vw, self.vh) = viewbox(target).map_or((w, h), |(_, vw, vh)| (vw, vh));
                     for c in target.children() {
                         self.node(c, &sst, &mut inner, depth + 1);
                     }
+                    (self.vw, self.vh) = saved_viewport;
                     children.push(Node::Group(Group {
                         name: Self::element_name(target),
                         transform: vb,
@@ -1025,7 +1376,40 @@ impl<'a, 'i> Parser<'a, 'i> {
                 if !st.visible {
                     return;
                 }
-                let Some(geom) = self.geometry(n, &st) else { return };
+                let (path_data, points) = match tag {
+                    "path" => {
+                        let Some(data) = n.attribute("d") else { return };
+                        if !self.charge_path_data(data.len()) {
+                            return;
+                        }
+                        let (path, exceeded) = pathdata::parse_path_data_bounded(data, MAX_PATH_ELEMENTS_PER_IMPORT_ELEMENT);
+                        if exceeded || !self.charge_path_elements(path.elements().len()) {
+                            self.path_work_exceeded = true;
+                            return;
+                        }
+                        (Some(path), None)
+                    }
+                    "polyline" | "polygon" => {
+                        let Some(data) = n.attribute("points") else { return };
+                        if !self.charge_path_data(data.len()) {
+                            return;
+                        }
+                        let max_values = MAX_PATH_ELEMENTS_PER_IMPORT_ELEMENT.saturating_sub(1).saturating_mul(2);
+                        let (points, exceeded) = pathdata::numbers_bounded(data, max_values);
+                        if exceeded {
+                            self.path_work_exceeded = true;
+                            return;
+                        }
+                        let point_count = points.len() / 2;
+                        let elements = point_count.saturating_add(usize::from(tag == "polygon"));
+                        if points.len() >= 4 && !self.charge_path_elements(elements) {
+                            return;
+                        }
+                        (None, Some(points))
+                    }
+                    _ => (None, None),
+                };
+                let Some(geom) = self.geometry(n, &st, path_data, points) else { return };
                 let fill = if matches!(tag, "line") { None } else { st.fill.as_ref().and_then(|p| self.resolve_paint(p, &st)) };
                 let (fill, fill_alpha) = match fill {
                     Some((p, a)) => (Some(p), a),
@@ -1076,11 +1460,11 @@ impl<'a, 'i> Parser<'a, 'i> {
         }
     }
 
-    fn geometry(&self, n: roxmltree::Node, st: &Style) -> Option<Geom> {
+    fn geometry(&self, n: roxmltree::Node, st: &Style, path_data: Option<BezPath>, points: Option<Vec<f64>>) -> Option<Geom> {
         let l = |name: &str, axis: char| self.attr_len(n, name, axis, st);
         Some(match n.tag_name().name() {
             "path" => {
-                let p = parse_path_data(n.attribute("d")?);
+                let p = path_data?;
                 if p.elements().is_empty() {
                     return None;
                 }
@@ -1091,6 +1475,10 @@ impl<'a, 'i> Parser<'a, 'i> {
                 if !(w > 0.0 && h > 0.0) {
                     return None;
                 }
+                let (x, y) = (l("x", 'x'), l("y", 'y'));
+                if !(x + w).is_finite() || !(y + h).is_finite() {
+                    return None;
+                }
                 let rx_a = n.attribute("rx").and_then(|v| self.length(v, 'x', st.font_size));
                 let ry_a = n.attribute("ry").and_then(|v| self.length(v, 'y', st.font_size));
                 let (rx, ry) = match (rx_a, ry_a) {
@@ -1099,21 +1487,29 @@ impl<'a, 'i> Parser<'a, 'i> {
                     (None, Some(y)) => (y, y),
                     (None, None) => (0.0, 0.0),
                 };
-                Geom::Rect { x: l("x", 'x'), y: l("y", 'y'), w, h, rx: rx.clamp(0.0, w / 2.0), ry: ry.clamp(0.0, h / 2.0) }
+                Geom::Rect { x, y, w, h, rx: rx.clamp(0.0, w / 2.0), ry: ry.clamp(0.0, h / 2.0) }
             }
             "circle" => {
                 let r = l("r", 'o');
-                if r <= 0.0 {
+                if !(r > 0.0 && r <= MAX_ELLIPSE_RADIUS) {
                     return None;
                 }
-                Geom::Ellipse { cx: l("cx", 'x'), cy: l("cy", 'y'), rx: r, ry: r }
+                let (cx, cy) = (l("cx", 'x'), l("cy", 'y'));
+                if ![cx - r, cx + r, cy - r, cy + r].iter().all(|value| value.is_finite()) {
+                    return None;
+                }
+                Geom::Ellipse { cx, cy, rx: r, ry: r }
             }
             "ellipse" => {
                 let (rx, ry) = (l("rx", 'x'), l("ry", 'y'));
-                if rx <= 0.0 || ry <= 0.0 {
+                if !(rx > 0.0 && rx <= MAX_ELLIPSE_RADIUS && ry > 0.0 && ry <= MAX_ELLIPSE_RADIUS) {
+                    return None;
+                }
+                let (cx, cy) = (l("cx", 'x'), l("cy", 'y'));
+                if ![cx - rx, cx + rx, cy - ry, cy + ry].iter().all(|value| value.is_finite()) {
                     return None;
                 }
-                Geom::Ellipse { cx: l("cx", 'x'), cy: l("cy", 'y'), rx, ry }
+                Geom::Ellipse { cx, cy, rx, ry }
             }
             "line" => {
                 let mut p = BezPath::new();
@@ -1122,14 +1518,17 @@ impl<'a, 'i> Parser<'a, 'i> {
                 Geom::Path(p)
             }
             "polyline" | "polygon" => {
-                let nums = pathdata::numbers(n.attribute("points")?);
+                let nums = points?;
                 if nums.len() < 4 {
                     return None;
                 }
                 let mut p = BezPath::new();
-                p.move_to((nums[0], nums[1]));
-                for c in nums[2..].as_chunks::<2>().0 {
-                    p.line_to((c[0], c[1]));
+                let first_pair = nums.get(..2)?;
+                let (Some(&first_x), Some(&first_y)) = (first_pair.first(), first_pair.get(1)) else { return None };
+                p.move_to((first_x, first_y));
+                for pair in nums.get(2..).unwrap_or_default().chunks_exact(2) {
+                    let (Some(&x), Some(&y)) = (pair.first(), pair.get(1)) else { continue };
+                    p.line_to((x, y));
                 }
                 if n.tag_name().name() == "polygon" {
                     p.close_path();
@@ -1141,9 +1540,32 @@ impl<'a, 'i> Parser<'a, 'i> {
     }
 }
 
+/// Estimate tile raster work from group traversal and the shape/path operations it contains.
+fn pattern_render_complexity(nodes: &[Node]) -> usize {
+    nodes.iter().fold(0usize, |total, node| {
+        let cost = match node {
+            Node::Group(group) => 4usize.saturating_add(pattern_render_complexity(&group.children)),
+            Node::Shape(shape) => {
+                let segments = match &shape.geom {
+                    Geom::Path(path) => path.elements().len().max(1),
+                    Geom::Rect { .. } | Geom::Ellipse { .. } => 8,
+                };
+                let paints = usize::from(shape.fill.is_some()).saturating_add(usize::from(shape.stroke.is_some()));
+                1usize.saturating_add(segments.saturating_mul(paints))
+            }
+            Node::Image(_) => 1,
+        };
+        total.saturating_add(cost)
+    })
+}
+
 fn viewbox(n: roxmltree::Node) -> Option<([f64; 2], f64, f64)> {
-    let v = pathdata::numbers(n.attribute("viewBox")?);
-    (v.len() == 4 && v.iter().all(|x| x.is_finite()) && v[2] > 0.0 && v[3] > 0.0).then(|| ([v[0], v[1]], v[2], v[3]))
+    let (v, exceeded) = pathdata::numbers_bounded(n.attribute("viewBox")?, 5);
+    if exceeded || !v.iter().all(|x| x.is_finite()) {
+        return None;
+    }
+    let [x, y, width, height] = v.as_slice() else { return None };
+    (*width > 0.0 && *height > 0.0).then_some(([*x, *y], *width, *height))
 }
 
 /// The viewBox → viewport transform (`preserveAspectRatio`, default `xMidYMid meet`).
@@ -1187,19 +1609,23 @@ pub fn parse_transform(s: &str) -> Affine {
     while let Some(open) = rest.find('(') {
         let name = rest[..open].trim().trim_start_matches(',').trim();
         let Some(close) = rest[open..].find(')') else { break };
-        let a = pathdata::numbers(&rest[open + 1..open + close]);
+        let (a, too_many) = pathdata::numbers_bounded(&rest[open + 1..open + close], 6);
         rest = &rest[open + close + 1..];
-        let t = match (name, a.len()) {
-            ("matrix", 6) => Affine::new([a[0], a[1], a[2], a[3], a[4], a[5]]),
-            ("translate", 1) => Affine::translate((a[0], 0.0)),
-            ("translate", 2) => Affine::translate((a[0], a[1])),
-            ("scale", 1) => Affine::scale(a[0]),
-            ("scale", 2) => Affine::scale_non_uniform(a[0], a[1]),
-            ("rotate", 1) => Affine::rotate(a[0].to_radians()),
-            ("rotate", 3) => Affine::translate((a[1], a[2])) * Affine::rotate(a[0].to_radians()) * Affine::translate((-a[1], -a[2])),
-            ("skewX", 1) => Affine::new([1.0, 0.0, a[0].to_radians().tan(), 1.0, 0.0, 0.0]),
-            ("skewY", 1) => Affine::new([1.0, a[0].to_radians().tan(), 0.0, 1.0, 0.0, 0.0]),
-            _ => Affine::IDENTITY,
+        let t = if too_many {
+            Affine::IDENTITY
+        } else {
+            match (name, a.as_slice()) {
+                ("matrix", [a0, a1, a2, a3, a4, a5]) => Affine::new([*a0, *a1, *a2, *a3, *a4, *a5]),
+                ("translate", [x]) => Affine::translate((*x, 0.0)),
+                ("translate", [x, y]) => Affine::translate((*x, *y)),
+                ("scale", [scale]) => Affine::scale(*scale),
+                ("scale", [x, y]) => Affine::scale_non_uniform(*x, *y),
+                ("rotate", [angle]) => Affine::rotate(angle.to_radians()),
+                ("rotate", [angle, x, y]) => Affine::translate((*x, *y)) * Affine::rotate(angle.to_radians()) * Affine::translate((-*x, -*y)),
+                ("skewX", [angle]) => Affine::new([1.0, 0.0, angle.to_radians().tan(), 1.0, 0.0, 0.0]),
+                ("skewY", [angle]) => Affine::new([1.0, angle.to_radians().tan(), 0.0, 1.0, 0.0, 0.0]),
+                _ => Affine::IDENTITY,
+            }
         };
         m *= t;
     }
@@ -1213,6 +1639,23 @@ const MAX_XML_DEPTH: usize = 256;
 /// The most elements an import converts, `<use>` copies included, unless the file itself has
 /// more than half as many (#1236).
 const MAX_EXPANDED_ELEMENTS: usize = 500_000;
+/// Bound path geometry expanded from a single path or point-list element.
+const MAX_PATH_ELEMENTS_PER_IMPORT_ELEMENT: usize = pathdata::MAX_PATH_ELEMENTS;
+/// Bound the path geometry retained across all path and point-list elements, including `<use>` copies.
+const MAX_PATH_ELEMENTS_PER_IMPORT: usize = 1_000_000;
+/// Bound repeated gradient-chain and stop scanning across the import.
+const MAX_GRADIENT_WORK: usize = 64 * 1024 * 1024;
+/// Bound viewport-specific resolved gradients; stop data is shared between clones.
+const MAX_GRADIENT_CACHE_ENTRIES: usize = 256;
+/// Bound ellipse expansion before kurbo approximates it with tolerance-dependent path segments.
+const MAX_ELLIPSE_RADIUS: f64 = 1.0e9;
+const PATH_DATA_WORK_FACTOR: usize = 8;
+/// Aggregate work that pattern references may revisit, including attributes and scanned children,
+/// even when many shapes share one large pattern definition.
+const MAX_PATTERN_WORK_BYTES: usize = 256 * 1024 * 1024;
+const MIN_PATTERN_WORK_BYTES: usize = 8 * 1024 * 1024;
+/// Bound viewport-specific pattern results; uncached resolutions remain covered by the work budget.
+const MAX_PATTERN_CACHE_ENTRIES: usize = 256;
 
 /// The deepest element nesting of `text` (a quick scan that skips comments, CDATA, processing
 /// instructions, declarations and quoted attribute values).
@@ -1294,6 +1737,8 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
     let vb = viewbox(root);
     // Room for generous reuse, and always for every element of the file itself.
     let budget = MAX_EXPANDED_ELEMENTS.max(root.descendants().filter(|n| n.is_element()).count().saturating_mul(2));
+    let pattern_work_budget = bytes.len().saturating_mul(8).clamp(MIN_PATTERN_WORK_BYTES, MAX_PATTERN_WORK_BYTES);
+    let path_work_budget = pattern_work_budget;
     let mut p = Parser {
         ids,
         css,
@@ -1304,6 +1749,19 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
         work: 0,
         budget,
         using: vec![],
+        in_pattern_content: false,
+        invalid_pattern_content: false,
+        pattern_work: 0,
+        pattern_work_budget,
+        pattern_work_exceeded: false,
+        path_data_work: 0,
+        path_element_work: 0,
+        path_work_budget,
+        path_work_exceeded: false,
+        pattern_cache: HashMap::new(),
+        gradient_cache: HashMap::new(),
+        gradient_work: 0,
+        gradient_work_exceeded: false,
     };
     let st = Style::default();
     let pct_or = |name: &str, axis: char, def: f64| -> f64 {
@@ -1344,6 +1802,15 @@ pub fn parse(bytes: &[u8]) -> Result<Doc, Error> {
         // Never a silently partial drawing.
         return Err(Error::Xml(format!("its <use> references expand to more than {} elements", p.budget)));
     }
+    if p.pattern_work_exceeded {
+        return Err(Error::Xml(format!("resolving its <pattern> references scans more than {} work units", p.pattern_work_budget)));
+    }
+    if p.path_work_exceeded {
+        return Err(Error::Xml("its SVG paths expand beyond the bounded path-data work budget".to_string()));
+    }
+    if p.gradient_work_exceeded {
+        return Err(Error::Xml(format!("resolving its gradients exceeds the {MAX_GRADIENT_WORK}-unit work budget")));
+    }
     if p.css_work.get() > MAX_CSS_WORK {
         // Never a silently unstyled drawing.
         return Err(Error::Xml(format!("matching its <style> rules takes more than {MAX_CSS_WORK} steps")));
diff --git a/crates/svg/src/pathdata.rs b/crates/svg/src/pathdata.rs
index 7a2762db73..87c2e322c9 100644
--- a/crates/svg/src/pathdata.rs
+++ b/crates/svg/src/pathdata.rs
@@ -2,7 +2,10 @@
 //! coordinates, smooth curves and elliptical arcs (converted to cubics through kurbo's `SvgArc`).
 //! Parsing stops at the first error, keeping what was read (as the specification asks).
 
-use kurbo::{BezPath, Point, SvgArc, Vec2};
+use kurbo::{BezPath, PathEl, Point, SvgArc, Vec2};
+
+/// Maximum path elements retained from one SVG path or point list.
+pub(crate) const MAX_PATH_ELEMENTS: usize = 100_000;
 
 /// Tokenizer over numbers and command letters.
 struct Lex<'a> {
@@ -66,7 +69,8 @@ impl Lex<'_> {
             }
         }
         self.i = i;
-        std::str::from_utf8(&b[start..i]).ok()?.parse().ok()
+        let number = std::str::from_utf8(&b[start..i]).ok()?.parse::<f64>().ok()?;
+        number.is_finite().then_some(number)
     }
     /// Arc flags may be written without separators ("a1 1 0 00 1 1").
     fn flag(&mut self) -> Option<bool> {
@@ -81,31 +85,54 @@ impl Lex<'_> {
     }
 }
 
-/// All numbers in a list (`points`, `viewBox`, transform arguments).
-pub fn numbers(s: &str) -> Vec<f64> {
+/// Parse no more than `max_values`; the flag reports whether another valid value was present.
+pub(crate) fn numbers_bounded(s: &str, max_values: usize) -> (Vec<f64>, bool) {
     let mut l = Lex { b: s.as_bytes(), i: 0 };
     let mut v = vec![];
     while l.at_number() {
+        if v.len() >= max_values {
+            return (v, true);
+        }
         match l.number() {
             Some(x) => v.push(x),
             None => break,
         }
     }
-    v
+    (v, false)
 }
 
-/// Parse path data into a kurbo path.
+/// Parse path data into a kurbo path, retaining at most [`MAX_PATH_ELEMENTS`] elements.
+/// Malformed or overlong input returns the prefix parsed before the problem.
 pub fn parse_path_data(d: &str) -> BezPath {
+    parse_path_data_bounded(d, MAX_PATH_ELEMENTS).0
+}
+
+struct PathState {
+    current: Point,
+    start: Point,
+    last_cubic: Option<Point>,
+    last_quad: Option<Point>,
+    open: bool,
+}
+
+struct PathLimit {
+    max_elements: usize,
+    exceeded: bool,
+}
+
+/// Parse at most `max_elements`, reporting when more path geometry was present.
+pub(crate) fn parse_path_data_bounded(d: &str, max_elements: usize) -> (BezPath, bool) {
     let mut l = Lex { b: d.as_bytes(), i: 0 };
     let mut p = BezPath::new();
-    let mut cur = Point::ZERO;
-    let mut start = Point::ZERO;
-    // Last control point of the previous C/S (cubic) or Q/T (quad) command.
-    let mut last_cubic: Option<Point> = None;
-    let mut last_quad: Option<Point> = None;
+    let mut state = PathState { current: Point::ZERO, start: Point::ZERO, last_cubic: None, last_quad: None, open: false };
+    let mut limit = PathLimit { max_elements, exceeded: false };
     let mut cmd: Option<u8> = None;
-    let mut open = false;
     loop {
+        if p.elements().len() >= limit.max_elements {
+            l.skip_sep();
+            limit.exceeded = l.i < l.b.len();
+            break;
+        }
         let c = match l.command() {
             Some(c) => c,
             None => match cmd {
@@ -120,103 +147,144 @@ pub fn parse_path_data(d: &str) -> BezPath {
             },
         };
         let rel = c.is_ascii_lowercase();
-        let base = if rel { cur.to_vec2() } else { Vec2::ZERO };
+        let base = if rel { state.current.to_vec2() } else { Vec2::ZERO };
         let pt = |l: &mut Lex| -> Option<Point> { Some(Point::new(l.number()?, l.number()?) + base) };
         let ok = (|| -> Option<()> {
             match c.to_ascii_uppercase() {
                 b'M' => {
-                    cur = pt(&mut l)?;
-                    p.move_to(cur);
-                    start = cur;
-                    open = true;
-                    last_cubic = None;
-                    last_quad = None;
+                    state.current = pt(&mut l)?;
+                    if !push_element(&mut p, PathEl::MoveTo(state.current), &mut limit) {
+                        return None;
+                    }
+                    state.start = state.current;
+                    state.open = true;
+                    state.last_cubic = None;
+                    state.last_quad = None;
                 }
                 b'Z' => {
-                    if open {
-                        p.close_path();
+                    if state.open && !push_element(&mut p, PathEl::ClosePath, &mut limit) {
+                        return None;
                     }
-                    cur = start;
-                    last_cubic = None;
-                    last_quad = None;
+                    state.current = state.start;
+                    state.last_cubic = None;
+                    state.last_quad = None;
                 }
-                _ if !open => {
+                _ if !state.open => {
                     // A segment without a preceding moveto starts at the current point.
-                    p.move_to(cur);
-                    open = true;
-                    return segment(&mut l, c, base, &mut p, &mut cur, &mut last_cubic, &mut last_quad);
+                    if !push_element(&mut p, PathEl::MoveTo(state.current), &mut limit) {
+                        return None;
+                    }
+                    state.open = true;
+                    return segment(&mut l, c, base, &mut p, &mut state, &mut limit);
                 }
-                _ => return segment(&mut l, c, base, &mut p, &mut cur, &mut last_cubic, &mut last_quad),
+                _ => return segment(&mut l, c, base, &mut p, &mut state, &mut limit),
             }
             Some(())
         })();
         if ok.is_none() {
             break;
         }
+        if limit.exceeded {
+            break;
+        }
         cmd = Some(c);
         if c.eq_ignore_ascii_case(&b'z') {
             // After Z a new segment starts from the subpath start (an unused move is dropped
             // below).
-            p.move_to(start);
-            open = true;
+            if !push_element(&mut p, PathEl::MoveTo(state.start), &mut limit) {
+                break;
+            }
+            state.open = true;
         }
     }
-    strip_trailing_moves(p)
+    (strip_trailing_moves(p), limit.exceeded)
+}
+
+fn push_element(p: &mut BezPath, element: PathEl, limit: &mut PathLimit) -> bool {
+    let finite = match element {
+        PathEl::MoveTo(point) | PathEl::LineTo(point) => point.x.is_finite() && point.y.is_finite(),
+        PathEl::QuadTo(control, point) => [control.x, control.y, point.x, point.y].iter().all(|value| value.is_finite()),
+        PathEl::CurveTo(first, second, point) => [first.x, first.y, second.x, second.y, point.x, point.y].iter().all(|value| value.is_finite()),
+        PathEl::ClosePath => true,
+    };
+    if p.elements().len() >= limit.max_elements || !finite {
+        limit.exceeded = true;
+        return false;
+    }
+    p.push(element);
+    true
 }
 
-fn segment(l: &mut Lex, c: u8, base: Vec2, p: &mut BezPath, cur: &mut Point, last_cubic: &mut Option<Point>, last_quad: &mut Option<Point>) -> Option<()> {
+fn segment(l: &mut Lex, c: u8, base: Vec2, p: &mut BezPath, state: &mut PathState, limit: &mut PathLimit) -> Option<()> {
     let num = |l: &mut Lex| l.number();
     let pt = |l: &mut Lex| -> Option<Point> { Some(Point::new(l.number()?, l.number()?) + base) };
     match c.to_ascii_uppercase() {
         b'L' => {
-            *cur = pt(l)?;
-            p.line_to(*cur);
-            *last_cubic = None;
-            *last_quad = None;
+            let current = pt(l)?;
+            if !push_element(p, PathEl::LineTo(current), limit) {
+                return None;
+            }
+            state.current = current;
+            state.last_cubic = None;
+            state.last_quad = None;
         }
         b'H' => {
             let x = num(l)? + base.x;
-            *cur = Point::new(x, cur.y);
-            p.line_to(*cur);
-            *last_cubic = None;
-            *last_quad = None;
+            let current = Point::new(x, state.current.y);
+            if !push_element(p, PathEl::LineTo(current), limit) {
+                return None;
+            }
+            state.current = current;
+            state.last_cubic = None;
+            state.last_quad = None;
         }
         b'V' => {
             let y = num(l)? + base.y;
-            *cur = Point::new(cur.x, y);
-            p.line_to(*cur);
-            *last_cubic = None;
-            *last_quad = None;
+            let current = Point::new(state.current.x, y);
+            if !push_element(p, PathEl::LineTo(current), limit) {
+                return None;
+            }
+            state.current = current;
+            state.last_cubic = None;
+            state.last_quad = None;
         }
         b'C' => {
             let (c1, c2, e) = (pt(l)?, pt(l)?, pt(l)?);
-            p.curve_to(c1, c2, e);
-            *last_cubic = Some(c2);
-            *last_quad = None;
-            *cur = e;
+            if !push_element(p, PathEl::CurveTo(c1, c2, e), limit) {
+                return None;
+            }
+            state.last_cubic = Some(c2);
+            state.last_quad = None;
+            state.current = e;
         }
         b'S' => {
-            let c1 = last_cubic.map_or(*cur, |c| *cur + (*cur - c));
+            let c1 = state.last_cubic.map_or(state.current, |c| state.current + (state.current - c));
             let (c2, e) = (pt(l)?, pt(l)?);
-            p.curve_to(c1, c2, e);
-            *last_cubic = Some(c2);
-            *last_quad = None;
-            *cur = e;
+            if !push_element(p, PathEl::CurveTo(c1, c2, e), limit) {
+                return None;
+            }
+            state.last_cubic = Some(c2);
+            state.last_quad = None;
+            state.current = e;
         }
         b'Q' => {
             let (q, e) = (pt(l)?, pt(l)?);
-            p.quad_to(q, e);
-            *last_quad = Some(q);
-            *last_cubic = None;
-            *cur = e;
+            if !push_element(p, PathEl::QuadTo(q, e), limit) {
+                return None;
+            }
+            state.last_quad = Some(q);
+            state.last_cubic = None;
+            state.current = e;
         }
         b'T' => {
-            let q = last_quad.map_or(*cur, |c| *cur + (*cur - c));
+            let q = state.last_quad.map_or(state.current, |c| state.current + (state.current - c));
             let e = pt(l)?;
-            p.quad_to(q, e);
-            *last_quad = Some(q);
-            *last_cubic = None;
-            *cur = e;
+            if !push_element(p, PathEl::QuadTo(q, e), limit) {
+                return None;
+            }
+            state.last_quad = Some(q);
+            state.last_cubic = None;
+            state.current = e;
         }
         b'A' => {
             let rx = num(l)?.abs();
@@ -225,23 +293,30 @@ fn segment(l: &mut Lex, c: u8, base: Vec2, p: &mut BezPath, cur: &mut Point, las
             let large = l.flag()?;
             let sweep = l.flag()?;
             let e = pt(l)?;
-            let arc = SvgArc { from: *cur, to: e, radii: Vec2::new(rx, ry), x_rotation: rot.to_radians(), large_arc: large, sweep };
+            let arc = SvgArc { from: state.current, to: e, radii: Vec2::new(rx, ry), x_rotation: rot.to_radians(), large_arc: large, sweep };
             let mut last_end = None;
             if let Some(a) = kurbo::Arc::from_svg_arc(&arc) {
                 // Scale tolerance with the radius so the segment count stays bounded.
                 let tol = 0.1_f64.max(a.radii.x.max(a.radii.y) * 1e-4);
                 a.to_cubic_beziers(tol, |c1, c2, end| {
-                    p.curve_to(c1, c2, end);
-                    last_end = Some(end);
+                    if limit.exceeded {
+                        return;
+                    }
+                    if push_element(p, PathEl::CurveTo(c1, c2, end), limit) {
+                        last_end = Some(end);
+                    }
                 });
             }
+            if limit.exceeded {
+                return None;
+            }
             // Degenerate arcs (e.g. huge radii) may emit nothing or stop short of the end point.
-            if last_end.is_none_or(|q| (q - e).hypot() > 1e-3 * (1.0 + e.to_vec2().hypot())) {
-                p.line_to(e);
+            if last_end.is_none_or(|q| (q - e).hypot() > 1e-3 * (1.0 + e.to_vec2().hypot())) && !push_element(p, PathEl::LineTo(e), limit) {
+                return None;
             }
-            *cur = e;
-            *last_cubic = None;
-            *last_quad = None;
+            state.current = e;
+            state.last_cubic = None;
+            state.last_quad = None;
         }
         _ => return None,
     }
@@ -323,8 +398,23 @@ mod tests {
 
     #[test]
     fn number_lists() {
-        assert_eq!(numbers("0 0,100 50"), vec![0.0, 0.0, 100.0, 50.0]);
-        assert_eq!(numbers("-1-2.5.5"), vec![-1.0, -2.5, 0.5]);
-        assert_eq!(numbers("1e2,2E-1"), vec![100.0, 0.2]);
+        assert_eq!(numbers_bounded("0 0,100 50", 8).0, vec![0.0, 0.0, 100.0, 50.0]);
+        assert_eq!(numbers_bounded("-1-2.5.5", 8).0, vec![-1.0, -2.5, 0.5]);
+        assert_eq!(numbers_bounded("1e2,2E-1", 8).0, vec![100.0, 0.2]);
+    }
+
+    #[test]
+    fn path_element_limit_stops_expansion_and_reports_truncation() {
+        let data = format!("M0 0{}", "h1".repeat(MAX_PATH_ELEMENTS + 1));
+        let (path, exceeded) = parse_path_data_bounded(&data, 32);
+        assert!(exceeded);
+        assert!(path.elements().len() <= 32);
+    }
+
+    #[test]
+    fn number_list_limit_stops_retaining_values() {
+        let (values, exceeded) = numbers_bounded("1 2 3 4", 3);
+        assert_eq!(values, [1.0, 2.0, 3.0]);
+        assert!(exceeded);
     }
 }
diff --git a/crates/svg/src/raster.rs b/crates/svg/src/raster.rs
index 568b10b25c..51fd944833 100644
--- a/crates/svg/src/raster.rs
+++ b/crates/svg/src/raster.rs
@@ -6,7 +6,7 @@ use effectcraft_raster::{Image, Mask};
 use kurbo::{Affine, Point, Shape as _};
 use rayon::prelude::*;
 
-use crate::{BlendMode, Doc, FillRule, Gradient, GradientKind, Group, Node, Paint, Shape, SoftMask, Spread};
+use crate::{BlendMode, Doc, FillRule, Gradient, GradientKind, Group, Node, Paint, Pattern, PatternUnits, Shape, SoftMask, Spread};
 
 fn mat3(a: Affine) -> Mat3 {
     let c = a.as_coeffs();
@@ -20,7 +20,18 @@ pub fn rasterize(doc: &Doc, w: u32, h: u32, scale: f64) -> Image {
 
 /// Rasterise `doc` with `m` mapping document pixels to image pixels.
 pub fn rasterize_with(doc: &Doc, w: u32, h: u32, m: Affine) -> Image {
-    let mut budget = SurfaceBudget { live_bytes: 0, limit_bytes: MAX_LIVE_SURFACE_BYTES };
+    let mut budget = SurfaceBudget {
+        live_bytes: 0,
+        coverage_bytes: 0,
+        pattern_tile_bytes: 0,
+        pattern_render_work: 0,
+        pattern_render_work_limit: MAX_PATTERN_RENDER_WORK,
+        clip_render_work: 0,
+        clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+        image_render_work: 0,
+        image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+        limit_bytes: MAX_LIVE_SURFACE_BYTES,
+    };
     let Some(mut img) = budget.image(w, h, None) else { return Image::default() };
     draw_group(&doc.root, m, 1.0, &mut img, &mut budget);
     img
@@ -28,9 +39,26 @@ pub fn rasterize_with(doc: &Doc, w: u32, h: u32, m: Affine) -> Image {
 
 /// Bound the simultaneously live offscreen image surfaces created by nested groups.
 const MAX_LIVE_SURFACE_BYTES: usize = 512 * 1024 * 1024;
+/// Bound tile allocation and rasterisation work across one SVG render, even though each tile is
+/// released before the next pattern paint.
+const MAX_PATTERN_TILE_BYTES: usize = 512 * 1024 * 1024;
+/// Bound the sum of tile-pixel × content-traversal work and destination sampling work per render.
+const MAX_PATTERN_RENDER_WORK: usize = 256 * 1024 * 1024;
+/// Bound repeated clip-path rasterisation across one SVG render.
+const MAX_CLIP_RENDER_WORK: usize = 256 * 1024 * 1024;
+/// Bound source-image sampling across one SVG render (up to 8×8 taps per destination pixel).
+const MAX_IMAGE_RENDER_WORK: usize = 256 * 1024 * 1024;
 
 struct SurfaceBudget {
     live_bytes: usize,
+    coverage_bytes: usize,
+    pattern_tile_bytes: usize,
+    pattern_render_work: usize,
+    pattern_render_work_limit: usize,
+    clip_render_work: usize,
+    clip_render_work_limit: usize,
+    image_render_work: usize,
+    image_render_work_limit: usize,
     limit_bytes: usize,
 }
 
@@ -39,7 +67,7 @@ impl SurfaceBudget {
         let pixels = (width as usize).checked_mul(height as usize)?;
         let bytes = pixels.checked_mul(std::mem::size_of::<[f32; 4]>())?;
         let new_live = self.live_bytes.checked_add(bytes)?;
-        if new_live > self.limit_bytes {
+        if new_live.checked_add(self.coverage_bytes)? > self.limit_bytes {
             return None;
         }
         let mut data = Vec::new();
@@ -55,9 +83,74 @@ impl SurfaceBudget {
         Some(Image { width, height, data })
     }
 
+    /// Reserve both the returned f32 coverage mask and tiny-skia's temporary u8 mask.
+    fn coverage(&mut self, width: u32, height: u32) -> Option<usize> {
+        let pixels = (width as usize).checked_mul(height as usize)?;
+        let mask_pixels = (width.max(1) as usize).checked_mul(height.max(1) as usize)?;
+        let output_mask = pixels.checked_mul(std::mem::size_of::<f32>())?;
+        let scratch_mask = mask_pixels.checked_mul(std::mem::size_of::<u8>())?;
+        let bytes = output_mask.checked_add(scratch_mask)?;
+        self.reserve_coverage(bytes)?;
+        Some(bytes)
+    }
+
+    fn reserve_coverage(&mut self, bytes: usize) -> Option<()> {
+        let total = self.coverage_bytes.checked_add(bytes)?;
+        if self.live_bytes.checked_add(total)? > self.limit_bytes {
+            return None;
+        }
+        self.coverage_bytes = total;
+        Some(())
+    }
+
+    fn release_coverage(&mut self, bytes: usize) {
+        self.coverage_bytes = self.coverage_bytes.saturating_sub(bytes);
+    }
+
     fn release(&mut self, image: &Image) {
         self.live_bytes = self.live_bytes.saturating_sub(image.data.len().saturating_mul(std::mem::size_of::<[f32; 4]>()));
     }
+
+    /// Allocate one pattern tile while charging its full storage cost against the render-wide
+    /// pattern budget. This prevents many shapes from repeatedly rasterising a near-limit tile.
+    fn pattern_tile(&mut self, width: u32, height: u32) -> Option<Image> {
+        let pixels = (width as usize).checked_mul(height as usize)?;
+        let bytes = pixels.checked_mul(std::mem::size_of::<[f32; 4]>())?;
+        let total = self.pattern_tile_bytes.checked_add(bytes)?;
+        if total > MAX_PATTERN_TILE_BYTES {
+            return None;
+        }
+        let image = self.image(width, height, None)?;
+        self.pattern_tile_bytes = total;
+        Some(image)
+    }
+
+    fn charge_pattern_render_work(&mut self, work: usize) -> bool {
+        let Some(total) = self.pattern_render_work.checked_add(work) else { return false };
+        if total > self.pattern_render_work_limit {
+            return false;
+        }
+        self.pattern_render_work = total;
+        true
+    }
+
+    fn charge_clip_render_work(&mut self, work: usize) -> bool {
+        let Some(total) = self.clip_render_work.checked_add(work) else { return false };
+        if total > self.clip_render_work_limit {
+            return false;
+        }
+        self.clip_render_work = total;
+        true
+    }
+
+    fn charge_image_render_work(&mut self, work: usize) -> bool {
+        let Some(total) = self.image_render_work.checked_add(work) else { return false };
+        if total > self.image_render_work_limit {
+            return false;
+        }
+        self.image_render_work = total;
+        true
+    }
 }
 
 fn draw_group(g: &Group, m: Affine, opacity: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
@@ -98,7 +191,11 @@ fn draw_offscreen_group(g: &Group, m: Affine, o: f64, dst: &mut Image, budget: &
     if let Some(b) = &backdrop {
         if only_clip {
             // A non-isolated clipping group: the backdrop where the clip excludes the children.
-            clip_onto_backdrop(g, m, dst, &tmp);
+            if !clip_onto_backdrop(g, m, dst, &tmp, budget) {
+                budget.release(&tmp);
+                release_backdrop(budget, backdrop.as_ref());
+                return;
+            }
             budget.release(&tmp);
             release_backdrop(budget, backdrop.as_ref());
             return;
@@ -110,12 +207,18 @@ fn draw_offscreen_group(g: &Group, m: Affine, o: f64, dst: &mut Image, budget: &
         }
     }
     if !g.clip.is_empty() {
-        let cov = clip_coverage(g, m, dst.width, dst.height);
+        let Some((cov, reserved)) = clip_coverage(g, m, dst.width, dst.height, budget) else {
+            budget.release(&tmp);
+            release_backdrop(budget, backdrop.as_ref());
+            return;
+        };
         tmp.data.par_iter_mut().zip(cov.par_iter()).for_each(|(p, c)| {
             for v in p.iter_mut() {
                 *v *= c;
             }
         });
+        drop(cov);
+        budget.release_coverage(reserved);
     }
     if let Some(sm) = &g.mask
         && !apply_soft_mask(sm, m, &mut tmp, budget)
@@ -147,13 +250,16 @@ fn release_backdrop(budget: &mut SurfaceBudget, backdrop: Option<&Image>) {
 }
 
 /// A clipping group over a backdrop: the children where the clip covers, the backdrop elsewhere.
-fn clip_onto_backdrop(g: &Group, m: Affine, dst: &mut Image, tmp: &Image) {
-    let cov = clip_coverage(g, m, dst.width, dst.height);
+fn clip_onto_backdrop(g: &Group, m: Affine, dst: &mut Image, tmp: &Image, budget: &mut SurfaceBudget) -> bool {
+    let Some((cov, reserved)) = clip_coverage(g, m, dst.width, dst.height, budget) else { return false };
     dst.data.par_iter_mut().zip(tmp.data.par_iter()).zip(cov.par_iter()).for_each(|((d, t), c)| {
         for i in 0..4 {
             d[i] = d[i] * (1.0 - c) + t[i] * c;
         }
     });
+    drop(cov);
+    budget.release_coverage(reserved);
+    true
 }
 
 /// Remove the backdrop's contribution (ISO 32000-1 §11.4.8): with the group's own
@@ -212,9 +318,24 @@ fn apply_soft_mask(sm: &SoftMask, m: Affine, tmp: &mut Image, budget: &mut Surfa
     true
 }
 
-/// The product of a group's clip-path coverages.
-fn clip_coverage(g: &Group, m: Affine, w: u32, h: u32) -> Vec<f32> {
-    let mut out = vec![1.0f32; w as usize * h as usize];
+/// The product of a group's clip-path coverages, or `None` when the work or surface budget is
+/// exhausted. The reservation covers the output and the temporary masks used to rasterise clips.
+fn clip_coverage(g: &Group, m: Affine, w: u32, h: u32, budget: &mut SurfaceBudget) -> Option<(Vec<f32>, usize)> {
+    let pixels = (w as usize).checked_mul(h as usize)?;
+    let mask_pixels = (w.max(1) as usize).checked_mul(h.max(1) as usize)?;
+    let paths_work = g.clip.iter().try_fold(0usize, |work, (path, _)| work.checked_add(path.elements().len().max(1)))?;
+    let work = pixels.checked_mul(paths_work)?;
+    if !budget.charge_clip_render_work(work) {
+        return None;
+    }
+    let bytes = pixels.checked_mul(std::mem::size_of::<f32>())?.checked_mul(2)?.checked_add(mask_pixels.checked_mul(std::mem::size_of::<u8>())?)?;
+    budget.reserve_coverage(bytes)?;
+    let mut out = Vec::new();
+    if out.try_reserve_exact(pixels).is_err() {
+        budget.release_coverage(bytes);
+        return None;
+    }
+    out.resize(pixels, 1.0f32);
     for (path, rule) in &g.clip {
         let rule = match rule {
             FillRule::NonZero => effectcraft_path::FillRule::NonZero,
@@ -223,7 +344,7 @@ fn clip_coverage(g: &Group, m: Affine, w: u32, h: u32) -> Vec<f32> {
         let cov = effectcraft_path::fill_coverage(std::slice::from_ref(path), &mat3(m), w, h, rule);
         out.par_iter_mut().zip(cov.data.par_iter()).for_each(|(o, c)| *o *= c);
     }
-    out
+    Some((out, bytes))
 }
 
 /// Draw a group's children into `dst`. Knockout groups composite each child with the
@@ -398,22 +519,31 @@ fn draw_node(n: &Node, m: Affine, opacity: f64, dst: &mut Image, budget: &mut Su
         Node::Group(g) => draw_group(g, m, opacity, dst, budget),
         Node::Shape(s) => {
             if s.opacity < 1.0 && s.fill.is_some() && s.stroke.is_some() {
+                if s.fill.as_ref().is_some_and(|paint| matches!(paint, Paint::Pattern(_)))
+                    || s.stroke.as_ref().is_some_and(|stroke| matches!(&stroke.paint, Paint::Pattern(_)))
+                {
+                    let Some(pixels) = (dst.width as usize).checked_mul(dst.height as usize) else { return };
+                    if !budget.charge_pattern_render_work(pixels) {
+                        return;
+                    }
+                }
                 let Some(mut tmp) = budget.image(dst.width, dst.height, None) else { return };
-                draw_shape(s, m, 1.0, &mut tmp);
+                draw_shape(s, m, 1.0, &mut tmp, budget);
                 over(dst, &tmp, (opacity * s.opacity) as f32);
                 budget.release(&tmp);
             } else {
-                draw_shape(s, m, opacity * s.opacity, dst);
+                draw_shape(s, m, opacity * s.opacity, dst, budget);
             }
         }
-        Node::Image(im) => draw_image(im, m, opacity * im.opacity, dst),
+        Node::Image(im) => draw_image(im, m, opacity * im.opacity, dst, budget),
     }
 }
 
 /// Draw a raster image: bilinear samples inside the image's (anti-aliased) quadrilateral.
-fn draw_image(im: &crate::Image, m: Affine, opacity: f64, dst: &mut Image) {
+fn draw_image(im: &crate::Image, m: Affine, opacity: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
     let (iw, ih) = (im.width as usize, im.height as usize);
-    if iw == 0 || ih == 0 || im.rgba.len() < iw * ih * 4 || opacity <= 0.0 {
+    let Some(image_bytes) = iw.checked_mul(ih).and_then(|pixels| pixels.checked_mul(4)) else { return };
+    if iw == 0 || ih == 0 || im.rgba.len() < image_bytes || opacity <= 0.0 || dst.width == 0 {
         return;
     }
     let full = m * im.transform;
@@ -422,25 +552,31 @@ fn draw_image(im: &crate::Image, m: Affine, opacity: f64, dst: &mut Image) {
         return;
     }
     let quad = kurbo::Rect::new(0.0, 0.0, iw as f64, ih as f64).to_path(0.01);
-    let cov = effectcraft_path::fill_coverage(std::slice::from_ref(&quad), &mat3(full), dst.width, dst.height, effectcraft_path::FillRule::NonZero);
     let w = dst.width as usize;
-    if w == 0 {
-        return;
-    }
-    let px = |x: usize, y: usize| -> [f32; 4] {
-        let i = (y * iw + x) * 4;
-        let a = im.rgba[i + 3] as f32 / 255.0;
-        [im.rgba[i] as f32 / 255.0 * a, im.rgba[i + 1] as f32 / 255.0 * a, im.rgba[i + 2] as f32 / 255.0 * a, a]
-    };
     // Pixel footprint in image pixels: box-filter heavy minification instead of aliasing.
     let c = inv.as_coeffs();
     let fx = (c[0] * c[0] + c[1] * c[1]).sqrt();
     let fy = (c[2] * c[2] + c[3] * c[3]).sqrt();
     let taps = (fx.max(fy).ceil() as usize).clamp(1, 8);
+    let Some(destination_pixels) = (dst.width as usize).checked_mul(dst.height as usize) else { return };
+    let Some(render_work) = destination_pixels.checked_mul(taps).and_then(|work| work.checked_mul(taps)) else { return };
+    if !budget.charge_image_render_work(render_work) {
+        return;
+    }
+    let Some(coverage_bytes) = budget.coverage(dst.width, dst.height) else { return };
+    let cov = effectcraft_path::fill_coverage(std::slice::from_ref(&quad), &mat3(full), dst.width, dst.height, effectcraft_path::FillRule::NonZero);
+    let px = |x: usize, y: usize| -> Option<[f32; 4]> {
+        let i = y.checked_mul(iw)?.checked_add(x)?.checked_mul(4)?;
+        let end = i.checked_add(4)?;
+        let [r, g, b, a] = im.rgba.get(i..end)? else { return None };
+        let a = *a as f32 / 255.0;
+        Some([*r as f32 / 255.0 * a, *g as f32 / 255.0 * a, *b as f32 / 255.0 * a, a])
+    };
     let k = opacity as f32;
     dst.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
         for (x, d) in row.iter_mut().enumerate() {
-            let cv = cov.data[y * w + x];
+            let Some(mask_index) = y.checked_mul(w).and_then(|index| index.checked_add(x)) else { continue };
+            let Some(&cv) = cov.data.get(mask_index) else { continue };
             if cv <= 0.0 {
                 continue;
             }
@@ -454,7 +590,7 @@ fn draw_image(im: &crate::Image, m: Affine, opacity: f64, dst: &mut Image) {
                     let (x0, y0) = (u.floor() as usize, v.floor() as usize);
                     let (x1, y1) = ((x0 + 1).min(iw - 1), (y0 + 1).min(ih - 1));
                     let (a, b) = ((u - x0 as f64) as f32, (v - y0 as f64) as f32);
-                    let (p00, p10, p01, p11) = (px(x0, y0), px(x1, y0), px(x0, y1), px(x1, y1));
+                    let (Some(p00), Some(p10), Some(p01), Some(p11)) = (px(x0, y0), px(x1, y0), px(x0, y1), px(x1, y1)) else { continue };
                     for i in 0..4 {
                         acc[i] += (p00[i] * (1.0 - a) + p10[i] * a) * (1.0 - b) + (p01[i] * (1.0 - a) + p11[i] * a) * b;
                     }
@@ -471,6 +607,8 @@ fn draw_image(im: &crate::Image, m: Affine, opacity: f64, dst: &mut Image) {
             d[3] = s[3] + d[3] * (1.0 - s[3]);
         }
     });
+    drop(cov);
+    budget.release_coverage(coverage_bytes);
 }
 
 /// `dst = src·k over dst` (premultiplied).
@@ -486,30 +624,43 @@ fn over(dst: &mut Image, src: &Image, k: f32) {
     });
 }
 
-fn draw_shape(s: &Shape, m: Affine, opacity: f64, dst: &mut Image) {
+fn draw_shape(s: &Shape, m: Affine, opacity: f64, dst: &mut Image, budget: &mut SurfaceBudget) {
     let m = m * s.transform;
     let path = s.geom.to_path();
     let bbox = path.bounding_box();
     let (w, h) = (dst.width, dst.height);
-    if let Some(fill) = &s.fill {
-        let rule = match s.fill_rule {
-            FillRule::NonZero => effectcraft_path::FillRule::NonZero,
-            FillRule::EvenOdd => effectcraft_path::FillRule::EvenOdd,
-        };
-        let cov = effectcraft_path::fill_coverage(std::slice::from_ref(&path), &mat3(m), w, h, rule);
-        paint(dst, &cov, fill, (opacity * s.fill_opacity) as f32, m, bbox);
+    let pattern_coverage_work = (w as usize).checked_mul(h as usize).and_then(|pixels| pixels.checked_mul(path.elements().len().max(1)));
+    if let Some(fill) = &s.fill
+        && let Some(coverage_bytes) = budget.coverage(w, h)
+    {
+        let coverage_allowed = !matches!(fill, Paint::Pattern(_)) || pattern_coverage_work.is_some_and(|work| budget.charge_pattern_render_work(work));
+        if coverage_allowed {
+            let rule = match s.fill_rule {
+                FillRule::NonZero => effectcraft_path::FillRule::NonZero,
+                FillRule::EvenOdd => effectcraft_path::FillRule::EvenOdd,
+            };
+            let cov = effectcraft_path::fill_coverage(std::slice::from_ref(&path), &mat3(m), w, h, rule);
+            paint(dst, &cov, fill, (opacity * s.fill_opacity) as f32, m, bbox, budget);
+        }
+        budget.release_coverage(coverage_bytes);
     }
-    if let Some(st) = &s.stroke {
-        let style = st.style();
-        let cov = effectcraft_path::stroke_coverage(std::slice::from_ref(&path), &style, &mat3(m), w, h);
-        paint(dst, &cov, &st.paint, (opacity * st.opacity) as f32, m, bbox);
+    if let Some(st) = &s.stroke
+        && let Some(coverage_bytes) = budget.coverage(w, h)
+    {
+        let coverage_allowed = !matches!(&st.paint, Paint::Pattern(_)) || pattern_coverage_work.is_some_and(|work| budget.charge_pattern_render_work(work));
+        if coverage_allowed {
+            let style = st.style();
+            let cov = effectcraft_path::stroke_coverage(std::slice::from_ref(&path), &style, &mat3(m), w, h);
+            paint(dst, &cov, &st.paint, (opacity * st.opacity) as f32, m, bbox, budget);
+        }
+        budget.release_coverage(coverage_bytes);
     }
 }
 
 /// Composite paint through coverage.
-fn paint(dst: &mut Image, cov: &Mask, p: &Paint, opacity: f32, m: Affine, bbox: kurbo::Rect) {
-    let w = dst.width as usize;
-    if w == 0 {
+fn paint(dst: &mut Image, cov: &Mask, p: &Paint, opacity: f32, m: Affine, bbox: kurbo::Rect, budget: &mut SurfaceBudget) {
+    if let Paint::Pattern(pattern) = p {
+        paint_pattern(dst, cov, pattern, opacity, m, bbox, budget);
         return;
     }
     let shader = match p {
@@ -522,10 +673,124 @@ fn paint(dst: &mut Image, cov: &Mask, p: &Paint, opacity: f32, m: Affine, bbox:
             }
             Shader::Gradient(g, to_grad)
         }
+        Paint::Pattern(_) => return,
+    };
+    paint_shader(dst, cov, &shader, opacity);
+}
+
+/// Render a pattern tile once for this paint operation, then sample it repeatedly over the mask.
+fn paint_pattern(dst: &mut Image, cov: &Mask, pattern: &Pattern, opacity: f32, m: Affine, bbox: kurbo::Rect, budget: &mut SurfaceBudget) {
+    let fallback = || pattern.fallback.map(|c| Shader::Solid(c.map(|v| v as f32)));
+    let fallback_paint = |dst: &mut Image, budget: &mut SurfaceBudget| {
+        if let Some(shader) = fallback() {
+            let Some(pixels) = (dst.width as usize).checked_mul(dst.height as usize) else { return };
+            if budget.charge_pattern_render_work(pixels) {
+                paint_shader(dst, cov, &shader, opacity);
+            }
+        }
+    };
+    if opacity <= 0.0 || pattern.render_complexity == 0 {
+        return;
+    }
+
+    let bbox_transform = || {
+        let (x, y, width, height) = (bbox.x0, bbox.y0, bbox.width(), bbox.height());
+        (x.is_finite() && y.is_finite() && width.is_finite() && height.is_finite() && width > 0.0 && height > 0.0)
+            .then(|| Affine::new([width, 0.0, 0.0, height, x, y]))
+    };
+    let units = match pattern.pattern_units {
+        PatternUnits::ObjectBoundingBox => match bbox_transform() {
+            Some(transform) => transform,
+            None => {
+                fallback_paint(dst, budget);
+                return;
+            }
+        },
+        PatternUnits::UserSpaceOnUse => Affine::IDENTITY,
+    };
+    let content_units = match pattern.content_units {
+        PatternUnits::ObjectBoundingBox => match bbox_transform() {
+            Some(transform) => transform,
+            None => {
+                fallback_paint(dst, budget);
+                return;
+            }
+        },
+        PatternUnits::UserSpaceOnUse => Affine::IDENTITY,
+    };
+    let tile_to_device = m * units * pattern.transform;
+    let device_to_pattern = tile_to_device.inverse();
+    let pattern_to_content = units.inverse() * content_units;
+    if !tile_to_device.as_coeffs().iter().all(|v| v.is_finite())
+        || !device_to_pattern.as_coeffs().iter().all(|v| v.is_finite())
+        || !pattern_to_content.as_coeffs().iter().all(|v| v.is_finite())
+    {
+        fallback_paint(dst, budget);
+        return;
+    }
+
+    let c = tile_to_device.as_coeffs();
+    let pixel_extent = |tile: f64, scale: f64| -> Option<u32> {
+        let pixels = tile * scale;
+        if !pixels.is_finite() || pixels <= 0.0 || pixels.ceil() > u32::MAX as f64 {
+            return None;
+        }
+        Some(pixels.ceil().max(1.0) as u32)
+    };
+    let Some(tile_width) = pixel_extent(pattern.width, c[0].hypot(c[1])) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let Some(tile_height) = pixel_extent(pattern.height, c[2].hypot(c[3])) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let Some(tile_pixels) = (tile_width as usize).checked_mul(tile_height as usize) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let Some(destination_pixels) = (dst.width as usize).checked_mul(dst.height as usize) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let Some(content_work) = tile_pixels.checked_mul(pattern.render_complexity) else {
+        fallback_paint(dst, budget);
+        return;
     };
+    let Some(render_work) = content_work.checked_add(destination_pixels) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    if !budget.charge_pattern_render_work(render_work) {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let Some(mut tile) = budget.pattern_tile(tile_width, tile_height) else {
+        fallback_paint(dst, budget);
+        return;
+    };
+    let tile_scale = Affine::scale_non_uniform(tile_width as f64 / pattern.width, tile_height as f64 / pattern.height);
+    let content_to_tile = tile_scale * Affine::translate((-pattern.x, -pattern.y)) * pattern_to_content;
+    if !tile_scale.as_coeffs().iter().all(|v| v.is_finite()) || !content_to_tile.as_coeffs().iter().all(|v| v.is_finite()) {
+        budget.release(&tile);
+        fallback_paint(dst, budget);
+        return;
+    }
+    draw_group(&pattern.content, content_to_tile, 1.0, &mut tile, budget);
+    let shader = Shader::Pattern(pattern, &tile, device_to_pattern);
+    paint_shader(dst, cov, &shader, opacity);
+    budget.release(&tile);
+}
+
+/// Composite a shader through a coverage mask using premultiplied destination pixels.
+fn paint_shader(dst: &mut Image, cov: &Mask, shader: &Shader<'_>, opacity: f32) {
+    let w = dst.width as usize;
+    if w == 0 {
+        return;
+    }
     dst.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
         for (x, d) in row.iter_mut().enumerate() {
-            let c = cov.data[y * w + x];
+            let Some(c) = cov.data.get(y.saturating_mul(w).saturating_add(x)).copied() else { continue };
             if c <= 0.0 {
                 continue;
             }
@@ -545,6 +810,7 @@ fn paint(dst: &mut Image, cov: &Mask, p: &Paint, opacity: f32, m: Affine, bbox:
 enum Shader<'a> {
     Solid([f32; 4]),
     Gradient(&'a Gradient, Affine),
+    Pattern(&'a Pattern, &'a Image, Affine),
 }
 
 impl Shader<'_> {
@@ -564,10 +830,50 @@ impl Shader<'_> {
                 };
                 eval_stops(&g.stops, spread(t, g.spread))
             }
+            Shader::Pattern(pattern, tile, inv) => sample_pattern(pattern, tile, *inv, x, y),
         }
     }
 }
 
+/// Bilinearly sample a repeating pattern tile. Coordinates are transformed into pattern space,
+/// shifted by the tile origin, then wrapped in both dimensions before filtering across seams.
+fn sample_pattern(pattern: &Pattern, tile: &Image, inv: Affine, x: f64, y: f64) -> [f32; 4] {
+    if tile.width == 0 || tile.height == 0 || pattern.width <= 0.0 || pattern.height <= 0.0 {
+        return [0.0; 4];
+    }
+    let p = inv * Point::new(x, y);
+    let (width, height) = (pattern.width, pattern.height);
+    if !p.x.is_finite() || !p.y.is_finite() {
+        return [0.0; 4];
+    }
+    let u = (p.x - pattern.x).rem_euclid(width) / width * tile.width as f64 - 0.5;
+    let v = (p.y - pattern.y).rem_euclid(height) / height * tile.height as f64 - 0.5;
+    if !u.is_finite() || !v.is_finite() {
+        return [0.0; 4];
+    }
+
+    let x0 = u.floor() as i64;
+    let y0 = v.floor() as i64;
+    let (fx, fy) = ((u - x0 as f64) as f32, (v - y0 as f64) as f32);
+    let wrap = |i: i64, size: u32| -> usize { i.rem_euclid(i64::from(size)) as usize };
+    let (x0, x1) = (wrap(x0, tile.width), wrap(x0.saturating_add(1), tile.width));
+    let (y0, y1) = (wrap(y0, tile.height), wrap(y0.saturating_add(1), tile.height));
+    let pixel = |px: usize, py: usize| -> [f32; 4] {
+        let index = py.saturating_mul(tile.width as usize).saturating_add(px);
+        tile.data.get(index).copied().unwrap_or([0.0; 4])
+    };
+    let (p00, p10, p01, p11) = (pixel(x0, y0), pixel(x1, y0), pixel(x0, y1), pixel(x1, y1));
+    let mut premultiplied = [0.0; 4];
+    for i in 0..4 {
+        premultiplied[i] = (p00[i] * (1.0 - fx) + p10[i] * fx) * (1.0 - fy) + (p01[i] * (1.0 - fx) + p11[i] * fx) * fy;
+    }
+    let alpha = premultiplied[3];
+    if alpha <= 0.0 || !alpha.is_finite() {
+        return [0.0; 4];
+    }
+    [(premultiplied[0] / alpha).clamp(0.0, 1.0), (premultiplied[1] / alpha).clamp(0.0, 1.0), (premultiplied[2] / alpha).clamp(0.0, 1.0), alpha.clamp(0.0, 1.0)]
+}
+
 /// Radial gradient parameter with a focal point: the circle through `p` from the focus.
 pub(crate) fn radial_t(p: Point, cx: f64, cy: f64, r: f64, fx: f64, fy: f64) -> f64 {
     if r <= 0.0 {
@@ -618,3 +924,188 @@ pub(crate) fn eval_stops(stops: &[(f64, [f64; 4])], t: f64) -> [f32; 4] {
     let k = if b.0 > a.0 { (t - a.0) / (b.0 - a.0) } else { 1.0 };
     [0, 1, 2, 3].map(|i| (a.1[i] + (b.1[i] - a.1[i]) * k) as f32)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pattern_tile_budget_is_cumulative_after_tiles_are_released() {
+        let mut budget = SurfaceBudget {
+            live_bytes: 0,
+            coverage_bytes: 0,
+            pattern_tile_bytes: MAX_PATTERN_TILE_BYTES - std::mem::size_of::<[f32; 4]>(),
+            pattern_render_work: 0,
+            pattern_render_work_limit: MAX_PATTERN_RENDER_WORK,
+            clip_render_work: 0,
+            clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+            image_render_work: 0,
+            image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+            limit_bytes: MAX_LIVE_SURFACE_BYTES,
+        };
+        let tile = budget.pattern_tile(1, 1).expect("last tile within the budget");
+        budget.release(&tile);
+        assert!(budget.pattern_tile(1, 1).is_none(), "a released tile still counts toward cumulative pattern work");
+    }
+
+    #[test]
+    fn coverage_masks_share_the_live_surface_budget() {
+        let mut budget = SurfaceBudget {
+            live_bytes: 0,
+            coverage_bytes: 0,
+            pattern_tile_bytes: 0,
+            pattern_render_work: 0,
+            pattern_render_work_limit: MAX_PATTERN_RENDER_WORK,
+            clip_render_work: 0,
+            clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+            image_render_work: 0,
+            image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+            limit_bytes: 4,
+        };
+        assert!(budget.coverage(1, 1).is_none(), "the returned f32 mask and temporary u8 mask need five bytes");
+        budget.limit_bytes = 20;
+        let reserved = budget.coverage(1, 1).expect("mask fits at the limit");
+        assert_eq!(reserved, 5);
+        assert!(budget.image(1, 1, None).is_none(), "live images and coverage masks share one cap");
+        budget.release_coverage(reserved);
+        assert!(budget.image(1, 1, None).is_some(), "the released coverage budget is available to images");
+    }
+
+    #[test]
+    fn clip_coverage_reserves_all_masks_and_refuses_excess_work() {
+        let mut group = Group::new("clip");
+        group.clip.push((kurbo::Rect::new(0.0, 0.0, 1.0, 1.0).to_path(0.01), FillRule::NonZero));
+        let mut budget = SurfaceBudget {
+            live_bytes: 0,
+            coverage_bytes: 0,
+            pattern_tile_bytes: 0,
+            pattern_render_work: 0,
+            pattern_render_work_limit: MAX_PATTERN_RENDER_WORK,
+            clip_render_work: 0,
+            clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+            image_render_work: 0,
+            image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+            limit_bytes: 9,
+        };
+
+        let (coverage, reserved) = clip_coverage(&group, Affine::IDENTITY, 1, 1, &mut budget).expect("clip fits exactly");
+        assert_eq!(reserved, 9, "clip output, fill mask, and tiny-skia scratch mask are reserved together");
+        assert_eq!(coverage.len(), 1);
+        assert_eq!(budget.coverage_bytes, reserved);
+        drop(coverage);
+        budget.release_coverage(reserved);
+        assert_eq!(budget.coverage_bytes, 0);
+
+        budget.limit_bytes = 8;
+        assert!(clip_coverage(&group, Affine::IDENTITY, 1, 1, &mut budget).is_none(), "refuse before allocating when clip masks do not fit");
+        assert_eq!(budget.coverage_bytes, 0);
+
+        budget.limit_bytes = 9;
+        budget.clip_render_work_limit = 0;
+        let work_before = budget.clip_render_work;
+        assert!(clip_coverage(&group, Affine::IDENTITY, 1, 1, &mut budget).is_none(), "refuse clip raster work before allocating masks");
+        assert_eq!(budget.coverage_bytes, 0);
+        assert_eq!(budget.clip_render_work, work_before, "refused work is not charged");
+    }
+
+    #[test]
+    fn image_render_checks_input_size_and_charges_sampling_work() {
+        let mut budget = SurfaceBudget {
+            live_bytes: 0,
+            coverage_bytes: 0,
+            pattern_tile_bytes: 0,
+            pattern_render_work: 0,
+            pattern_render_work_limit: MAX_PATTERN_RENDER_WORK,
+            clip_render_work: 0,
+            clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+            image_render_work: 0,
+            image_render_work_limit: 0,
+            limit_bytes: MAX_LIVE_SURFACE_BYTES,
+        };
+        let mut dst = Image::new(1, 1);
+        let source = crate::Image {
+            name: "pixel".into(),
+            transform: Affine::IDENTITY,
+            width: 1,
+            height: 1,
+            rgba: std::sync::Arc::new(vec![255, 0, 0, 255]),
+            opacity: 1.0,
+        };
+
+        draw_image(&source, Affine::IDENTITY, 1.0, &mut dst, &mut budget);
+        assert_eq!(dst.data.first().copied(), Some([0.0; 4]), "excess sampling work is refused before coverage allocation");
+        assert_eq!(budget.coverage_bytes, 0);
+
+        let oversized = crate::Image { width: u32::MAX, height: u32::MAX, rgba: std::sync::Arc::new(Vec::new()), ..source };
+        draw_image(&oversized, Affine::IDENTITY, 1.0, &mut dst, &mut budget);
+        assert_eq!(dst.data.first().copied(), Some([0.0; 4]), "overflowing source dimensions are rejected");
+    }
+
+    #[test]
+    fn pattern_content_work_exhaustion_uses_a_budgeted_fallback() {
+        let doc = crate::parse(
+            br##"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
+                <defs><pattern id="p" patternUnits="userSpaceOnUse" width="1" height="1">
+                    <rect width="1" height="1" fill="red"/>
+                </pattern></defs>
+                <rect width="1" height="1" fill="url(#p) blue"/>
+            </svg>"##,
+        )
+        .expect("test SVG parses");
+        let shapes = doc.flatten();
+        let Some(Paint::Pattern(pattern)) = shapes[0].2.fill.as_ref() else { panic!("pattern paint expected") };
+        let (mut dst, cov) = (Image::new(1, 1), Mask::new(1, 1, 1.0));
+        let mut budget = SurfaceBudget {
+            live_bytes: 0,
+            coverage_bytes: 0,
+            pattern_tile_bytes: 0,
+            pattern_render_work: 0,
+            pattern_render_work_limit: 1,
+            clip_render_work: 0,
+            clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+            image_render_work: 0,
+            image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+            limit_bytes: MAX_LIVE_SURFACE_BYTES,
+        };
+
+        paint_pattern(&mut dst, &cov, pattern, 1.0, Affine::IDENTITY, kurbo::Rect::new(0.0, 0.0, 1.0, 1.0), &mut budget);
+
+        assert_eq!(dst.data.first().copied(), Some([0.0, 0.0, 1.0, 1.0]));
+        assert_eq!(budget.pattern_render_work, 1, "the pattern is refused and fallback sampling is charged");
+    }
+
+    #[test]
+    fn pattern_coverage_work_is_charged_before_allocating_its_mask() {
+        let doc = crate::parse(
+            br#"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
+                <defs><pattern id="p" patternUnits="userSpaceOnUse" width="1" height="1">
+                    <rect width="1" height="1" fill="red"/>
+                </pattern></defs>
+                <rect width="1" height="1" fill="url(#p)"/>
+            </svg>"#,
+        )
+        .expect("test SVG parses");
+        let Some(Node::Shape(shape)) = doc.root.children.first() else { panic!("shape expected") };
+        let (mut dst, mut budget) = (
+            Image::new(1, 1),
+            SurfaceBudget {
+                live_bytes: 0,
+                coverage_bytes: 0,
+                pattern_tile_bytes: 0,
+                pattern_render_work: 0,
+                pattern_render_work_limit: 1,
+                clip_render_work: 0,
+                clip_render_work_limit: MAX_CLIP_RENDER_WORK,
+                image_render_work: 0,
+                image_render_work_limit: MAX_IMAGE_RENDER_WORK,
+                limit_bytes: MAX_LIVE_SURFACE_BYTES,
+            },
+        );
+
+        draw_shape(shape, Affine::IDENTITY, 1.0, &mut dst, &mut budget);
+
+        assert_eq!(dst.data.first().copied(), Some([0.0; 4]));
+        assert_eq!(budget.pattern_tile_bytes, 0, "work is refused before a tile or coverage mask is produced");
+        assert_eq!(budget.pattern_render_work, 0);
+    }
+}
diff --git a/crates/svg/src/tests.rs b/crates/svg/src/tests.rs
index 06dfbd3338..3be9c725c5 100644
--- a/crates/svg/src/tests.rs
+++ b/crates/svg/src/tests.rs
@@ -30,6 +30,389 @@ fn raster_surface_budget_rejects_oversized_destination_before_allocation() {
     assert_eq!((img.width, img.height), (0, 0));
 }
 
+#[test]
+fn static_pattern_fill_and_stroke_repeat_with_tile_origin() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="8" height="4">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" x="1" width="2" height="2">
+                <rect x="1" width="1" height="2" fill="red"/>
+                <rect x="2" width="1" height="2" fill="blue"/>
+            </pattern></defs>
+            <rect id="filled" width="8" height="4" fill="url(#p)"/>
+            <path d="M0 3 H8" fill="none" stroke="url(#p)" stroke-width="2"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    assert!(matches!(shapes[0].2.fill.as_ref(), Some(Paint::Pattern(_))));
+    assert!(matches!(shapes[1].2.stroke.as_ref().map(|s| &s.paint), Some(Paint::Pattern(_))));
+
+    let img = rasterize(&doc, 8, 4, 1.0);
+    // The tile occupies [1, 3): blue wraps into x=0, red starts at x=1.
+    assert!(near(px(&img, 0, 1), [0.0, 0.0, 1.0, 1.0], 1e-3));
+    assert!(near(px(&img, 1, 1), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 2, 1), [0.0, 0.0, 1.0, 1.0], 1e-3));
+    // The same pattern server paints the stroke.
+    assert!(near(px(&img, 1, 2), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn object_bounding_box_pattern_units_map_tile_and_content_coordinates() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="20" height="8">
+            <defs><pattern id="p" patternUnits="objectBoundingBox" width="0.5" height="1" patternContentUnits="objectBoundingBox">
+                <rect width="25%" height="100%" fill="green"/>
+            </pattern></defs>
+            <rect x="10" y="2" width="8" height="4" fill="url(#p)" stroke="url(#p)" stroke-width="1"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    assert!(matches!(shapes[0].2.fill.as_ref(), Some(Paint::Pattern(_))));
+    assert!(matches!(shapes[0].2.stroke.as_ref().map(|stroke| &stroke.paint), Some(Paint::Pattern(_))));
+    let img = rasterize(&doc, 20, 8, 1.0);
+    assert!(near(px(&img, 10, 3), [0.0, 128.0 / 255.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 12, 3)[3], 0.0);
+    assert!(near(px(&img, 14, 3), [0.0, 128.0 / 255.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 16, 3)[3], 0.0);
+}
+
+#[test]
+fn pattern_transform_scales_tile_spacing_and_its_content_together() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="8" height="2">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" width="2" height="2" patternTransform="scale(2)">
+                <rect width="1" height="2" fill="red"/>
+            </pattern></defs>
+            <rect width="8" height="2" fill="url(#p)"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 8, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 1, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 2, 0)[3], 0.0);
+    assert_eq!(px(&img, 3, 0)[3], 0.0);
+    assert!(near(px(&img, 4, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn pattern_href_inherits_units_and_content_and_prefers_plain_href() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="8" height="2">
+            <defs>
+                <pattern id="base" patternUnits="userSpaceOnUse" width="2" height="2">
+                    <rect width="1" height="2" fill="red"/>
+                </pattern>
+                <pattern id="other" patternUnits="userSpaceOnUse" width="2" height="2">
+                    <rect width="2" height="2" fill="blue"/>
+                </pattern>
+                <pattern id="derived" href="#base" xlink:href="#other"/>
+                <pattern id="xlink-derived" xlink:href="#base"/>
+            </defs>
+            <rect width="8" height="2" fill="url(#derived)"/>
+            <rect x="8" width="8" height="2" fill="url(#xlink-derived)"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 16, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 1, 0)[3], 0.0);
+    assert!(near(px(&img, 2, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 8, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 9, 0)[3], 0.0);
+}
+
+#[test]
+fn pattern_content_inherits_styles_from_its_ancestors() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="2" height="2" fill="red">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" width="2" height="2">
+                <rect width="2" height="2"/>
+            </pattern></defs>
+            <rect width="2" height="2" fill="url(#p) blue"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 2, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn pattern_href_ignores_descriptive_children_when_inheriting_content() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="2" height="2">
+            <defs>
+                <pattern id="base" patternUnits="userSpaceOnUse" width="2" height="2">
+                    <rect width="2" height="2" fill="red"/>
+                </pattern>
+                <pattern id="derived" href="#base">
+                    <title>Documentation only</title>
+                    <desc>Still documentation only</desc>
+                    <metadata><author>Test</author></metadata>
+                </pattern>
+            </defs>
+            <rect width="2" height="2" fill="url(#derived)"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 2, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn cached_patterns_reuse_same_viewport_but_separate_percentage_sized_viewports() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="120" height="10" viewBox="0 0 120 10">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" width="50%" height="100%">
+                <rect width="4" height="100%" fill="red"/>
+            </pattern></defs>
+            <svg width="40" height="10" viewBox="0 0 40 10">
+                <rect id="small-one" width="20" height="10" fill="url(#p) blue"/>
+                <rect id="small-two" x="20" width="20" height="10" fill="url(#p) green"/>
+            </svg>
+            <svg x="40" width="80" height="10" viewBox="0 0 80 10">
+                <rect id="large" width="80" height="10" fill="url(#p) yellow"/>
+            </svg>
+        </svg>"##,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    let Some((_, _, small_one)) = shapes.iter().find(|(_, _, shape)| shape.name == "small-one") else { panic!("small-one expected") };
+    let Some(Paint::Pattern(small_one)) = small_one.fill.as_ref() else { panic!("small-one pattern expected") };
+    let Some((_, _, small_two)) = shapes.iter().find(|(_, _, shape)| shape.name == "small-two") else { panic!("small-two expected") };
+    let Some(Paint::Pattern(small_two)) = small_two.fill.as_ref() else { panic!("small-two pattern expected") };
+    let Some((_, _, large)) = shapes.iter().find(|(_, _, shape)| shape.name == "large") else { panic!("large expected") };
+    let Some(Paint::Pattern(large)) = large.fill.as_ref() else { panic!("large pattern expected") };
+    assert_eq!(small_one.width, 20.0);
+    assert_eq!(small_two.width, 20.0);
+    assert_eq!(large.width, 40.0);
+    assert_eq!(small_one.fallback, Some([0.0, 0.0, 1.0, 1.0]));
+    assert_eq!(small_two.fallback, Some([0.0, 128.0 / 255.0, 0.0, 1.0]));
+    assert_eq!(large.fallback, Some([1.0, 1.0, 0.0, 1.0]));
+    assert!(std::sync::Arc::ptr_eq(&small_one.content, &small_two.content));
+    assert!(!std::sync::Arc::ptr_eq(&small_one.content, &large.content));
+
+    let img = rasterize(&doc, 120, 10, 1.0);
+    for x in [1, 21, 41, 81] {
+        assert!(near(px(&img, x, 5), [1.0, 0.0, 0.0, 1.0], 1e-3), "x={x}");
+    }
+    for x in [5, 25, 45, 85] {
+        assert_eq!(px(&img, x, 5)[3], 0.0, "x={x}");
+    }
+}
+
+#[test]
+fn symbol_viewports_select_distinct_percentage_sized_pattern_cache_entries() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="60" height="10">
+            <defs>
+                <pattern id="p" patternUnits="userSpaceOnUse" width="50%" height="100%">
+                    <rect width="4" height="100%" fill="red"/>
+                </pattern>
+                <symbol id="small-symbol" viewBox="0 0 20 10">
+                    <rect id="small-symbol-shape" width="20" height="10" fill="url(#p) blue"/>
+                </symbol>
+                <symbol id="large-symbol" viewBox="0 0 40 10">
+                    <rect id="large-symbol-shape" width="40" height="10" fill="url(#p) green"/>
+                </symbol>
+            </defs>
+            <use href="#small-symbol" width="20" height="10"/>
+            <use href="#large-symbol" x="20" width="40" height="10"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    let Some((_, _, small)) = shapes.iter().find(|(_, _, shape)| shape.name == "small-symbol-shape") else { panic!("small symbol shape expected") };
+    let Some(Paint::Pattern(small)) = small.fill.as_ref() else { panic!("small symbol pattern expected") };
+    let Some((_, _, large)) = shapes.iter().find(|(_, _, shape)| shape.name == "large-symbol-shape") else { panic!("large symbol shape expected") };
+    let Some(Paint::Pattern(large)) = large.fill.as_ref() else { panic!("large symbol pattern expected") };
+    assert_eq!(small.width, 10.0);
+    assert_eq!(large.width, 20.0);
+
+    let img = rasterize(&doc, 60, 10, 1.0);
+    assert!(near(px(&img, 1, 5), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 5, 5)[3], 0.0);
+    assert!(near(px(&img, 21, 5), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert_eq!(px(&img, 25, 5)[3], 0.0);
+    assert!(near(px(&img, 41, 5), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn bare_urls_and_hrefs_do_not_resolve_as_local_pattern_ids() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="6" height="2">
+            <defs>
+                <pattern id="target" patternUnits="userSpaceOnUse" width="2" height="2">
+                    <rect width="2" height="2" fill="red"/>
+                </pattern>
+                <pattern id="bare-href" href="target" width="2" height="2"/>
+            </defs>
+            <rect width="2" height="2" fill="url(target) blue"/>
+            <rect x="2" width="2" height="2" fill="url(#bare-href) green"/>
+            <rect x="4" width="2" height="2" fill="url(#target)"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    assert_eq!(shapes[0].2.fill, Some(Paint::Color([0.0, 0.0, 1.0])));
+    assert_eq!(shapes[1].2.fill, Some(Paint::Color([0.0, 128.0 / 255.0, 0.0])));
+    assert!(matches!(shapes[2].2.fill.as_ref(), Some(Paint::Pattern(_))));
+    let img = rasterize(&doc, 6, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [0.0, 0.0, 1.0, 1.0], 1e-3));
+    assert!(near(px(&img, 2, 0), [0.0, 128.0 / 255.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 4, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn empty_valid_pattern_is_transparent_instead_of_using_its_fallback() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="4" height="2">
+            <defs><pattern id="empty" patternUnits="userSpaceOnUse" width="2" height="2"/></defs>
+            <rect width="4" height="2" fill="url(#empty) red"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let Some(Paint::Pattern(pattern)) = doc.flatten()[0].2.fill.as_ref() else { panic!("valid pattern expected") };
+    assert_eq!(pattern.fallback, Some([1.0, 0.0, 0.0, 1.0]));
+    let img = rasterize(&doc, 4, 2, 1.0);
+    assert_eq!(px(&img, 0, 0)[3], 0.0);
+    assert_eq!(px(&img, 3, 0)[3], 0.0);
+}
+
+#[test]
+fn pattern_content_attribute_work_is_bounded_across_distinct_viewports() {
+    let large_attribute = "x".repeat(2 * 1024 * 1024);
+    let shapes: String = (0..12)
+        .map(|index| format!(r##"<svg x="{index}" width="1" height="1" viewBox="0 0 {} 1"><rect width="1" height="1" fill="url(#p)"/></svg>"##, index + 1))
+        .collect();
+    let svg = format!(
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="12" height="1"><defs>
+            <pattern id="p" data-repeat="{large_attribute}" patternUnits="userSpaceOnUse" width="50%" height="100%">
+                <rect width="1" height="1" fill="red"/>
+            </pattern></defs>{shapes}</svg>"##
+    );
+    let error = parse(svg.as_bytes()).unwrap_err();
+    assert!(error.to_string().contains("<pattern> references scans more than"), "{error}");
+}
+
+#[test]
+fn pattern_href_depth_limit_uses_paint_fallback() {
+    let patterns: String = (0..=16)
+        .map(|index| {
+            if index == 16 {
+                format!(r#"<pattern id="p{index}" patternUnits="userSpaceOnUse" width="1" height="1"/>"#)
+            } else {
+                format!(r##"<pattern id="p{index}" href="#p{}"/>"##, index + 1)
+            }
+        })
+        .collect();
+    let svg = format!(
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"><defs>{patterns}</defs><rect width="1" height="1" fill="url(#p0) blue"/></svg>"##
+    );
+    let doc = parse(svg.as_bytes()).unwrap();
+    assert_eq!(doc.flatten()[0].2.fill, Some(Paint::Color([0.0, 0.0, 1.0])));
+}
+
+#[test]
+fn pattern_ancestor_attribute_work_is_bounded_across_distinct_viewports() {
+    let large_attribute = "x".repeat(2 * 1024 * 1024);
+    let shapes: String = (0..12)
+        .map(|index| format!(r##"<svg x="{index}" width="1" height="1" viewBox="0 0 {} 1"><rect width="1" height="1" fill="url(#p)"/></svg>"##, index + 1))
+        .collect();
+    let svg = format!(
+        r##"<svg xmlns="http://www.w3.org/2000/svg" width="12" height="1"><defs data-repeat="{large_attribute}">
+            <pattern id="p" patternUnits="userSpaceOnUse" width="50%" height="100%">
+                <rect width="1" height="1" fill="red"/>
+            </pattern></defs>{shapes}</svg>"##
+    );
+    let error = parse(svg.as_bytes()).unwrap_err();
+    assert!(error.to_string().contains("<pattern> references scans more than"), "{error}");
+}
+
+#[test]
+fn pattern_tile_alpha_composites_as_premultiplied_color() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="2" height="2">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" width="1" height="1">
+                <rect width="1" height="1" fill="red" fill-opacity="0.5"/>
+            </pattern></defs>
+            <rect width="2" height="2" fill="url(#p)"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 2, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [0.5, 0.0, 0.0, 0.5], 1e-3));
+    assert!(near(px(&img, 1, 1), [0.5, 0.0, 0.0, 0.5], 1e-3));
+}
+
+#[test]
+fn oversized_pattern_tile_falls_back_without_allocating() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
+            <defs><pattern id="huge" patternUnits="userSpaceOnUse" width="1e300" height="1e300">
+                <rect width="1" height="1" fill="red"/>
+            </pattern></defs>
+            <rect width="1" height="1" fill="url(#huge) gold"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 1, 1, 1.0);
+    assert!(near(px(&img, 0, 0), [1.0, 215.0 / 255.0, 0.0, 1.0], 1e-3));
+}
+
+#[test]
+fn invalid_or_cyclic_pattern_uses_paint_fallback_without_expanding() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="2">
+            <defs>
+                <pattern id="bad" width="0" height="1"/>
+                <pattern id="viewbox" width="1" height="1" viewBox="0 0 1 1"/>
+                <pattern id="collapsed" patternUnits="userSpaceOnUse" width="1" height="1" patternTransform="scale(0)"/>
+                <pattern id="a" href="#b"/>
+                <pattern id="b" href="#a"/>
+                <pattern id="self" href="#self"/>
+            </defs>
+            <rect width="2" height="2" fill="url(#bad) blue"/>
+            <rect x="2" width="2" height="2" fill="url(#viewbox) red"/>
+            <rect x="4" width="2" height="2" fill="url(#collapsed) yellow"/>
+            <rect x="6" width="2" height="2" fill="url(#a) green"/>
+            <rect x="8" width="2" height="2" fill="url(#self) cyan"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    assert_eq!(shapes[0].2.fill, Some(Paint::Color([0.0, 0.0, 1.0])));
+    assert_eq!(shapes[1].2.fill, Some(Paint::Color([1.0, 0.0, 0.0])));
+    assert_eq!(shapes[2].2.fill, Some(Paint::Color([1.0, 1.0, 0.0])));
+    assert_eq!(shapes[3].2.fill, Some(Paint::Color([0.0, 128.0 / 255.0, 0.0])));
+    assert_eq!(shapes[4].2.fill, Some(Paint::Color([0.0, 1.0, 1.0])));
+    let img = rasterize(&doc, 10, 2, 1.0);
+    assert!(near(px(&img, 0, 0), [0.0, 0.0, 1.0, 1.0], 1e-3));
+    assert!(near(px(&img, 3, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 5, 0), [1.0, 1.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 7, 0), [0.0, 128.0 / 255.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 9, 0), [0.0, 1.0, 1.0, 1.0], 1e-3));
+}
+
+#[test]
+fn one_pixel_pattern_tiles_a_large_rectangle_from_one_surface() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024">
+            <defs><pattern id="p" patternUnits="userSpaceOnUse" width="1" height="1">
+                <rect width="1" height="1" fill="red"/>
+            </pattern></defs>
+            <rect width="1024" height="1024" fill="url(#p)"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 1024, 1024, 1.0);
+    assert_eq!((img.width, img.height), (1024, 1024));
+    for (x, y) in [(0, 0), (511, 511), (1023, 1023)] {
+        assert!(near(px(&img, x, y), [1.0, 0.0, 0.0, 1.0], 1e-3), "({x}, {y})");
+    }
+}
+
 #[test]
 fn basic_shapes_structure() {
     let d = parse(BASIC).unwrap();
@@ -105,6 +488,39 @@ fn paths_gradients_css_use() {
     assert!(c[0] > 0.9 && c[3] > 0.9, "{c:?}");
 }
 
+#[test]
+fn repeated_gradient_paints_share_their_cached_stop_storage() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="4" height="2">
+            <defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="0">
+                <stop offset="0" stop-color="red"/><stop offset="1" stop-color="blue"/>
+            </linearGradient></defs>
+            <rect id="first" width="2" height="2" fill="url(#g)"/>
+            <rect id="second" x="2" width="2" height="2" fill="url(#g)"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    let Some((_, _, first)) = shapes.iter().find(|(_, _, shape)| shape.name == "first") else { panic!("first shape expected") };
+    let Some(Paint::Gradient(first_gradient)) = first.fill.as_ref() else { panic!("first gradient expected") };
+    let Some((_, _, second)) = shapes.iter().find(|(_, _, shape)| shape.name == "second") else { panic!("second shape expected") };
+    let Some(Paint::Gradient(second_gradient)) = second.fill.as_ref() else { panic!("second gradient expected") };
+    assert!(std::sync::Arc::ptr_eq(&first_gradient.stops, &second_gradient.stops));
+}
+
+#[test]
+fn oversized_svg_path_geometry_fails_with_a_bounded_import_error() {
+    let data = format!("M0 0{}", "h1".repeat(pathdata::MAX_PATH_ELEMENTS + 1));
+    let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg"><path d="{data}"/></svg>"#);
+    let error = parse(svg.as_bytes()).unwrap_err();
+    assert!(error.to_string().contains("bounded path-data work budget"), "{error}");
+
+    let points = (0..=pathdata::MAX_PATH_ELEMENTS).map(|x| format!("{x} 0")).collect::<Vec<_>>().join(" ");
+    let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg"><polyline points="{points}"/></svg>"#);
+    let error = parse(svg.as_bytes()).unwrap_err();
+    assert!(error.to_string().contains("bounded path-data work budget"), "{error}");
+}
+
 #[test]
 fn root_svg_percentages_use_the_document_viewport() {
     for (attrs, width, height) in [
@@ -160,6 +576,69 @@ fn nested_svg_percentages_use_the_nearest_viewport() {
     assert_eq!(px(&img, 55, 65)[3], 0.0);
 }
 
+#[test]
+fn symbol_viewport_sets_percentage_pattern_units_and_cache_key() {
+    let doc = parse(
+        br##"<svg xmlns="http://www.w3.org/2000/svg" width="60" height="10">
+            <defs>
+                <pattern id="p" patternUnits="userSpaceOnUse" width="50%" height="100%">
+                    <rect width="4" height="100%" fill="red"/>
+                </pattern>
+                <symbol id="small" viewBox="0 0 20 10">
+                    <rect id="small-shape" width="20" height="10" fill="url(#p)"/>
+                </symbol>
+                <symbol id="large" viewBox="0 0 40 10">
+                    <rect id="large-shape" width="40" height="10" fill="url(#p)"/>
+                </symbol>
+            </defs>
+            <use href="#small" width="20" height="10"/>
+            <use href="#large" x="20" width="40" height="10"/>
+        </svg>"##,
+    )
+    .unwrap();
+    let shapes = doc.flatten();
+    let Some((_, _, small)) = shapes.iter().find(|(_, _, shape)| shape.name == "small-shape") else { panic!("small symbol shape expected") };
+    let Some(Paint::Pattern(small)) = small.fill.as_ref() else { panic!("small symbol pattern expected") };
+    let Some((_, _, large)) = shapes.iter().find(|(_, _, shape)| shape.name == "large-shape") else { panic!("large symbol shape expected") };
+    let Some(Paint::Pattern(large)) = large.fill.as_ref() else { panic!("large symbol pattern expected") };
+    assert_eq!(small.width, 10.0);
+    assert_eq!(large.width, 20.0);
+}
+
+#[test]
+fn non_finite_opacity_values_do_not_write_nan_pixels() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="6" height="2">
+            <defs><linearGradient id="g"><stop offset="0" stop-color="red" stop-opacity="NaN"/><stop offset="1" stop-color="blue"/></linearGradient></defs>
+            <rect width="2" height="2" fill="red" fill-opacity="NaN"/>
+            <rect x="2" width="2" height="2" fill="blue" opacity="1e400"/>
+            <rect x="4" width="2" height="2" fill="url(#g)"/>
+        </svg>"#,
+    )
+    .unwrap();
+    let img = rasterize(&doc, 6, 2, 1.0);
+    assert!(img.data.iter().flatten().all(|channel| channel.is_finite()));
+    assert!(near(px(&img, 0, 0), [1.0, 0.0, 0.0, 1.0], 1e-3));
+    assert!(near(px(&img, 3, 1), [0.0, 0.0, 1.0, 1.0], 1e-3));
+    assert!(px(&img, 4, 1)[3].is_finite());
+}
+
+#[test]
+fn basic_shapes_with_overflowing_derived_bounds_are_skipped() {
+    let doc = parse(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="2" height="2">
+            <rect x="1e308" y="0" width="1e308" height="1" fill="red"/>
+            <circle cx="1e308" cy="0" r="1e308" fill="blue"/>
+            <circle cx="0" cy="0" r="1e300" fill="green"/>
+        </svg>"#,
+    )
+    .unwrap();
+
+    assert!(doc.flatten().is_empty());
+    let image = rasterize(&doc, 2, 2, 1.0);
+    assert!(image.data.iter().flatten().all(|channel| channel.is_finite()));
+}
+
 #[test]
 fn non_finite_viewboxes_do_not_panic_or_produce_nan_geometry() {
     for attrs in ["viewBox=\"0 0 1e400 100\"", "viewBox=\"0 0 100 1e400\"", "viewBox=\"-1e400 0 100 100\""] {