👌 Reject unterminated inline HTML in constant time

[chrisjsewell]

Summary

Follow-up to #423, covering the remaining quadratic in the same class that #423 deliberately left out because it is a different code path. With html=True (which the commonmark and gfm-like presets enable), a run of unterminated inline HTML openers in inline context is O(n²):

input ("x" + opener × 40 000)	before	after
<[CDATA[	~245 s	~2.3 s
<!--	~71 s	~0.25 s
<?	~30 s	~0.09 s
<!a	~3 s	~0.16 s

All four now grow ~2.0× per doubling. markdown-it (JavaScript) has the same quadratic shape here (with smaller constants), so unlike #423 this is inherited rather than port-specific; it is still worth fixing because the constants in Python are up to 50× worse.

Root cause

Every alternative of HTML_TAG_RE ends in a specific terminator: --> for comments, ?> for processing instructions, ]]> for CDATA, > for declarations and tags. The lazy sub-patterns ([\s\S]*?, [^>]*) rescan to the end of the input on every failed attempt, once per opener.

Fix

• StateInline.html_terminator_last(term): a lazily-populated per-state cache of src.rfind(term), so each distinct terminator costs one scan per inline parse.
• html_inline consults it before running the regex and returns False when the terminator the opener needs cannot occur at or after the earliest index it could legally start (e.g. ?> at pos+2 for <??>, ]]> at pos+9 for <[CDATA[]]>, --> at pos+4 unless the opener is one of the short forms <!--> / <!--->).

This is a pure quick-reject: it only skips attempts the regex could never match, so output is unchanged. The regexes themselves are untouched. The check uses src rather than posMax, matching how the existing HTML_TAG_RE.match(state.src, pos) already behaves inside link labels.

Verification

• Output unchanged: 47,936-case differential (repo fixtures, CommonMark spec, targeted constructs, fuzzed inputs × 7 presets) comparing HTML, renderInline and full token streams: 0 differences. A further 4,730-case HTML-focused corpus (all "Raw HTML" spec examples, random strings over <>!?-[]CDATA/abz \n="', random tag concatenations) and 12,000 posMax-restricted variants (inside links, emphasis, blockquotes, tables, images): 0 differences.
• Bounds proven, not just tested: an exhaustive check over all strings up to length 6 on the alphabet <>!?-[Aa/ plus 250,000 random strings, 1,040,507 < positions in total, found no position where the quick-reject fired but the regex would have matched.
• No cost on real documents: spec.md and README.md render at 0.99–1.00× (min of 20 reps, interleaved).
• Full suite passes; pre-commit (ruff 0.16.6 / mypy 2.3.1) clean; local docs build adds no warnings.

Tests (tests/test_html_inline.py)

Deterministic rather than timed, so they are immune to coverage and PyPy slowdowns (a first version used the global timeout as a guard and timed out on the PyPy job):

• the shortest legal form of every construct (<a>, </a>, <!-->, <!--->, <!---->, <??>, <!a>, <[CDATA[]]>) still passes through unchanged;
• for a 1,000-repetition run of each unterminated opener, HTML_TAG_RE.match is asserted to be invoked zero times (before the fix: once per opener) and the output is the escaped text;
• a run of terminated constructs is asserted to still reach the regex and render as raw HTML.