leptris 1.9.207.0 → 1.9.208.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b10f689b2142684316157264cfd935433d6d0d22db8cf90b4a27e9c4ba79bd88
-  data.tar.gz: f3e625c375d995087bec8cd6c058a7a9c900791125f1422f6da8b2436e90047b
+  metadata.gz: 8c88c4d67f3b29d8e39348f96c9dfd6580563de8c1adcbb76a35a29a932a45dc
+  data.tar.gz: '030917e922c2ae16f63d588378d7d5552e52d03cfc2b5e33043aaea39c067c78'
 SHA512:
-  metadata.gz: ddf28875bb34e2eb14074c51834614f5cb5acddf0a33c58f55a50d9e6970a065eb70cb6f3da51c1114cad3a8c062a6dec98d6ce271ff27a81a77033f92e774ea
-  data.tar.gz: b1c7bc0629b2840a7a23d71bd27b08303426ab7b013d8a272d9a1fedc82b8f40ba8fdd6805724f878fbf4374752912658ea5922e79548f16a53a859cf4de3164
+  metadata.gz: '09ba6dc5293eb1d93becec0eef194a97466ae800017ba5e2d44169dc3912b9620398f090300147ed62a8ebcacce5b83a7165b133f9bb84771cbdefc0e4c8d303'
+  data.tar.gz: 8b88a8828ce0bed5e3b7b8140bbb3f31238fc5e484737e6dcdc3a3f4171f3c36e768dd8245c3c7097657a7715add8afcf1c2f0a22d42c0f6fb5631b7d1771650

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.207"
+LIBLEPTRIS_VERSION = "1.9.208"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.207.0"
+  VERSION = "1.9.208.0"
 end

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,30 @@
 ## [Unreleased]
 
+## [1.9.208] - 2026-09-19
+
+### Fixed
+
+- Per-machine process-global corruption (#1242): the TLS (root, doc)
+  last-hit memo in `leptris_element_get_document` trusted the root
+  ADDRESS and was cleared only by document identity — an element-level
+  unregistration left `(freed_address, doc)` behind, and a
+  recycled address resolved the WRONG document (poisoning attribute
+  ownership: whole-run all-NULL `leptris_element_attribute` reads;
+  and tripping set_root's cross-document check). The memo is now
+  cleared whenever the outgoing root address matches, in both the
+  element-level unregister and the document sweep — closing the
+  same recycled-address class #1038 fixed for the root-doc map.
+- `leptris_document_set_root` now sets a fresh thread-local error on
+  every rejection (NULL_ARG + both EINVAL paths) — previously the
+  previous operation's message leaked through (the reported "EINVAL
+  with a stale XPath parse error").
+- New diagnostic: `LEPTRIS_DEBUG_ATTR_MISS=1` dumps attribute-chain
+  state on lookup misses (chain length, per-attr name bytes/hash15)
+  — the discriminator for any residual binding-side corruption
+  report.
+
+
+
 ## [1.9.207] - 2026-09-19
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.207
+    VERSION 1.9.208
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/TODO.max-perf/00-INDEX.md

@@ -5,12 +5,12 @@ RED bench first where perf claims are made.
 
 | # | Lever | Type | Effort | Status |
 |---|-------|------|--------|--------|
-| 3 | iterparse fixed-cost (6.9µs) + error channel (#563) | perf | bench landed #1195; remaining = zero-copy one-shot emission (design with lever 2) | half done |
+| 3 | iterparse fixed-cost (6.9µs) + error channel (#563) | perf | bench #1195; zero-copy emission landed #1236 (295->52us full-doc); remaining = iterparse per-event DOM construction (0.45->0.15us/event stretch) | mostly done |
 | 1 | SIMD/memchr HTML tokenizer scans | perf | memchr ×2 (#1176/#1190) + LUT (#1199, +30%/+51%) | DONE v1.9.199 |
 | 7 | leptris validate CLI + bindings | feature | engine half merged #1198 (--dtd + DTD engine fixes); bindings remain | half done |
-| 8 | native XML diff consumer surface | feature | small | next |
+| 8 | native XML diff consumer surface | feature | CLI diff text/JSON/--summary + engine API shipped | DONE (#1184 closed) |
 | 4 | compact-node micro-opts (non-layout) | perf | audited: TODOs 172/195/Lane18-P3 already in; residual = node-creation cost (node-layout fork, owner call) | parked on fork |
-| 2 | compiled-dispatch tokenizer | perf | medium; design together with lever 3's zero-copy emission | queued |
+| 2 | compiled-dispatch tokenizer | perf | slices 1+3 landed #1236; slice 2's class LUT + dense switch pre-existed; residual = iterparse consumer (row 3) | mostly done |
 | 5 | XSLT 2x per-bench profile rounds (#682) | perf | medium, ongoing | in progress |
 | 6 | language tails (QT3/dates/fn-items/lane 15) | correctness | medium-large | queued |
 | 9 | prebuilt-gem 12-platform matrix | release | small, BLOCKED on owner go | blocked |

data/vendor-src/libleptris/TODO.max-perf/2-3-oneshot-tokenizer-design.md

@@ -1,6 +1,12 @@
 # Levers 2+3 — compiled-dispatch + zero-copy one-shot emission (design)
 
-Status: DESIGNED (2026-09-19). Implementation slices below.
+Status: LANDED (2026-09-19, PR #1236). Slices 1+3 implemented;
+slice 2's class LUT (`sxs_chartype`) + dense state switch already
+existed. Measured: bench_iterparse full-doc 295->52-63us wall,
+15.9->74-91 MB/s, 2.54->0.45-0.55us/event. Residual to the 0.15
+stretch = iterparse per-event DOM construction (element create +
+namespace resolution through the public element API), a consumer
+lever, not string copies.
 Owners: engine repo. Bench: `benchmarks/sax/bench_iterparse.c` (#1195).
 
 ## Problem

data/vendor-src/libleptris/src/leptris/dom/element_query.c

@@ -178,7 +178,49 @@ LEPTRIS_API const char* leptris_element_attribute(LeptrisElement elem, const cha
         if (!uri) return NULL;                             /* (4) */
         attr = find_attr_expanded(elem, uri, colon + 1);   /* (2) */
     }
-    if (!attr) return NULL;
+    if (!attr) {
+        /* #1242 diagnostic: LEPTRIS_DEBUG_ATTR_MISS=1 dumps the
+         * element's attribute-chain state for the first 5 misses in
+         * the process — distinguishes construction loss
+         * (chain_len=0) from storage corruption (garbage name
+         * bytes) from hash-discipline drift (correct bytes,
+         * mismatching hash15). Off by default; fprintf only on
+         * miss. */
+        static int dumped = 0;
+        if (dumped < 5 && getenv("LEPTRIS_DEBUG_ATTR_MISS")) {
+            dumped++;
+            size_t chain = 0;
+            for (struct leptris_attribute* a =
+                     leptris_element_get_first_attribute(elem);
+                 a; a = leptris_attr_next(a))
+                chain++;
+            fprintf(stderr,
+                    "[leptris-attr-miss] elem=%p needle='%s' "
+                    "chain_len=%zu\n",
+                    (void*)elem, name, chain);
+            size_t i = 0;
+            for (struct leptris_attribute* a =
+                     leptris_element_get_first_attribute(elem);
+                 a && i < 8; a = leptris_attr_next(a), i++) {
+                char nb[17];
+                size_t nl = a->name_view.length < 16
+                                ? a->name_view.length : 16;
+                for (size_t k = 0; k < nl; k++) {
+                    unsigned char c = (unsigned char)a->name_view.data[k];
+                    nb[k] = (c >= 32 && c < 127) ? (char)c : '.';
+                }
+                nb[nl] = '\0';
+                fprintf(stderr,
+                        "  attr[%zu] addr=%p name_ptr=%p len=%zu "
+                        "bytes='%s' hash15=%u entities=%d\n",
+                        i, (void*)a, (void*)a->name_view.data,
+                        a->name_view.length, nb,
+                        (unsigned)(a->name_hash & 0x7FFFu),
+                        (int)((a->name_hash & 0x8000u) != 0));
+            }
+        }
+        return NULL;
+    }
 
     /* Single representation (round 4): entity values expand lazily
      * INTO the view (owned copy); no-entity views are already

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.c

@@ -102,6 +102,15 @@ static size_t bucket_index(LeptrisElement root) {
     return (size_t)(v & (ROOT_DOC_BUCKETS - 1));
 }
 
+/* #682 2x lever (sound): last-hit (root, doc) memo. The climb to
+ * the root is unavoidable without a per-element field, but the TLS
+ * bucket-array walk is not — consecutive queries in a transform
+ * hit the same root, so one pointer compare replaces the hash
+ * bucket chain. One TLS access total (the memo pair), and the
+ * 1M-loop sentinel becomes a plain NULL check. */
+static LEPTRIS_THREAD_LOCAL LeptrisElement g_memo_root;
+static LEPTRIS_THREAD_LOCAL struct leptris_document* g_memo_doc;
+
 void leptris_root_doc_register(LeptrisElement root, struct leptris_document* doc) {
     if (!root || !doc) return;
     size_t idx = bucket_index(root);
@@ -160,6 +169,17 @@ void leptris_root_doc_drain_thread_caches(void) {
 void leptris_root_doc_unregister(LeptrisElement root) {
     if (!root) return;
     if (!rootmap_marked(root)) return;  /* never registered: O(1) out */
+    /* #1242: the (root, doc) memo trusts the root ADDRESS. An
+     * element-level unregister frees that address while the doc
+     * lives — the doc-keyed invalidation never fires, and the
+     * allocator recycling the address into another element's climb
+     * target made get_document return the WRONG document. Same
+     * exposure class #1038 closed for the map; the memo needs it
+     * at element granularity. */
+    if (g_memo_root == root) {
+        g_memo_root = NULL;
+        g_memo_doc = NULL;
+    }
     size_t idx = bucket_index(root);
     RootDocEntry** pp = &g_root_doc_buckets[idx];
     while (*pp) {
@@ -202,6 +222,13 @@ size_t leptris_root_doc_unregister_doc(struct leptris_document* doc) {
     doc->map_entries = NULL;
     while (e) {
         RootDocEntry* next = e->doc_next;
+        /* #1242: a swept root address must not survive in the memo
+         * even when the memo's doc differs (a previously poisoned
+         * pair). */
+        if (g_memo_root == e->root) {
+            g_memo_root = NULL;
+            g_memo_doc = NULL;
+        }
         size_t idx = bucket_index(e->root);
         RootDocEntry** pp = &g_root_doc_buckets[idx];
         while (*pp) {
@@ -234,15 +261,6 @@ struct leptris_document* leptris_root_doc_lookup(LeptrisElement root) {
  * are skipped entirely (get_document was 3.5% of the light bench).
  * Hint is thread-local-scoped by construction (one transform per
  * thread), validated by the root-walk fallback when it misses. */
-/* #682 2x lever (sound): last-hit (root, doc) memo. The climb to
- * the root is unavoidable without a per-element field, but the TLS
- * bucket-array walk is not — consecutive queries in a transform
- * hit the same root, so one pointer compare replaces the hash
- * bucket chain. One TLS access total (the memo pair), and the
- * 1M-loop sentinel becomes a plain NULL check. */
-static LEPTRIS_THREAD_LOCAL LeptrisElement g_memo_root;
-static LEPTRIS_THREAD_LOCAL struct leptris_document* g_memo_doc;
-
 /* #904: prime the TLS last-root memo from a driver that already
  * knows the (root, doc) pair — the iterparse yield path hands out
  * a subtree that is released before the next, so the memo misses
@@ -263,6 +281,10 @@ void leptris_root_doc_memo_invalidate(const struct leptris_document* doc) {
     }
 }
 
+LeptrisElement leptris_root_doc_memo_root_for_tests(void) {
+    return g_memo_root;
+}
+
 struct leptris_document* leptris_element_get_document(LeptrisElement elem) {
     if (!elem) return NULL;
     LeptrisElement cur = elem;

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.h

@@ -15,6 +15,8 @@ void leptris_root_doc_register(LeptrisElement root, struct leptris_document* doc
 void leptris_root_doc_unregister(LeptrisElement root);
 struct leptris_document* leptris_root_doc_lookup(LeptrisElement root);
 void leptris_root_doc_memo_invalidate(const struct leptris_document* doc);
+/* Test hook (#1242): the memo's current root, or NULL. */
+LeptrisElement leptris_root_doc_memo_root_for_tests(void);
 /* #904: prime the TLS (root, doc) memo from a driver that knows
  * the pair (iterparse yields). Root must be registered. */
 void leptris_root_doc_memo_prime(LeptrisElement root,

data/vendor-src/libleptris/src/leptris/leptris.c

@@ -253,12 +253,19 @@ struct leptris_document* leptris_document_create_on_arena(
  */
 LEPTRIS_API LeptrisStatus leptris_document_set_root(LeptrisDocument doc,
                                                     LeptrisElement root) {
-    if (!doc || !root) return LEPTRIS_ERROR_NULL_ARG;
+    if (!doc || !root) {
+        leptris_set_error(LEPTRIS_ERROR_NULL_ARG,
+                          "set_root: NULL document or element");
+        return LEPTRIS_ERROR_NULL_ARG;
+    }
 
     /* Already attached under a parent? (parent_off == 0 encodes NULL;
      * leptris_elem_parent is the static inline accessor from dom/element.h) */
-    if (leptris_elem_parent(root))
+    if (leptris_elem_parent(root)) {
+        leptris_set_error(LEPTRIS_ERROR_INVALID_ARG,
+                          "set_root: element is attached to a parent");
         return LEPTRIS_ERROR_INVALID_ARG;
+    }
 
     /* Cross-document attach would dangle the source pool on free.
      * Lane 18 P1: resolve via get_document (map + namebp fallback)
@@ -266,8 +273,11 @@ LEPTRIS_API LeptrisStatus leptris_document_set_root(LeptrisDocument doc,
      * lookup rejected every one of them. */
     extern struct leptris_document* leptris_element_get_document(
         LeptrisElement elem);
-    if (leptris_element_get_document(root) != doc)
+    if (leptris_element_get_document(root) != doc) {
+        leptris_set_error(LEPTRIS_ERROR_INVALID_ARG,
+                          "set_root: element belongs to a different document");
         return LEPTRIS_ERROR_INVALID_ARG;
+    }
 
     doc->root = root;
     doc->new_dom_root = root;

data/vendor-src/libleptris/test/dom/test_dom.cpp

@@ -3,8 +3,17 @@
 #include <gtest/gtest.h>
 
 #include "leptris.h"
+#include "leptris/error.h"
 /* #1125 pristine-buffer gate: reach doc->xml_buffer directly. */
 #include "../leptris/leptris_internal.h"
+/* Internal root-doc-map surface (#1242 spec); C linkage. */
+extern "C" {
+LeptrisElement leptris_root_doc_memo_root_for_tests(void);
+void leptris_root_doc_register(LeptrisElement root,
+                               struct leptris_document* doc);
+void leptris_root_doc_unregister(LeptrisElement root);
+struct leptris_document* leptris_element_get_document(LeptrisElement elem);
+}
 #include "../leptris/memory/pool.h"
 
 #include <cstring>
@@ -92,6 +101,30 @@ TEST(DomBasics, DocumentSetRootRejectsNullInputs) {
     leptris_document_free(doc);
 }
 
+// #1242 symptom 2: a failed set_root must set a FRESH thread-local
+// error — the binding's exception message was stitched from whatever
+// the previous operation left behind (a stale XPath parse error).
+TEST(DomBasics, DocumentSetRootFailureSetsFreshError) {
+    LeptrisDocument doc_a = leptris_document_create();
+    LeptrisDocument doc_b = leptris_document_create();
+    ASSERT_NE(doc_a, nullptr);
+    ASSERT_NE(doc_b, nullptr);
+    /* Poison the thread-local slot with an unrelated message. */
+    ASSERT_EQ(leptris_parse_string("<a><b></a>", 10, nullptr), nullptr);
+
+    LeptrisElement foreign = leptris_element_create(doc_b, "b");
+    ASSERT_NE(foreign, nullptr);
+    EXPECT_EQ(leptris_document_set_root(doc_a, foreign),
+              LEPTRIS_ERROR_INVALID_ARG);
+    const char* msg = leptris_last_error();
+    ASSERT_NE(msg, nullptr);
+    EXPECT_EQ(strstr(msg, "set_root"), msg)
+        << "expected a fresh set_root message, got: " << msg;
+
+    leptris_document_free(doc_a);
+    leptris_document_free(doc_b);
+}
+
 TEST(DomBasics, DocumentSetRootRejectsForeignElement) {
     LeptrisDocument doc_a = leptris_document_create();
     LeptrisDocument doc_b = leptris_document_create();
@@ -117,6 +150,69 @@ TEST(DomBasics, DocumentSetRootRejectsParentedElement) {
     leptris_document_free(doc);
 }
 
+/* #1242: the TLS (root, doc) memo trusts the root address. An
+ * element-level unregister frees that address while the document
+ * lives; a recycled address later made get_document resolve the
+ * WRONG document (per-machine corruption signature). Unregistering
+ * a root must drop the memo. */
+TEST(DomBasics, RootDocMemoClearedWhenRootUnregisters) {
+    LeptrisDocument doc = leptris_document_create();
+    ASSERT_NE(doc, nullptr);
+    LeptrisElement e = leptris_element_create(doc, "r");
+    ASSERT_NE(e, nullptr);
+    leptris_root_doc_register(e, doc);
+    /* Prime the memo through a resolution. */
+    ASSERT_EQ(leptris_element_get_document(e), doc);
+    ASSERT_EQ(leptris_root_doc_memo_root_for_tests(), e);
+    /* Element-level lifecycle: the root goes away, the doc stays. */
+    leptris_root_doc_unregister(e);
+    EXPECT_EQ(leptris_root_doc_memo_root_for_tests(), nullptr)
+        << "stale (root, doc) memo survived root unregistration";
+    leptris_document_free(doc);
+}
+
+/* #1242: every status-returning rejection must refresh the
+ * thread-local error channel — a stale message from an earlier
+ * operation leaking through an EINVAL is the reported signature. */
+TEST(DomBasics, DocumentSetRootRejectionSetsFreshError) {
+    const char xml[] = "<a><b/></a>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string(xml, std::strlen(xml), &st);
+    ASSERT_NE(doc, nullptr);
+    /* Poison the channel with an XPath syntax error and snapshot it. */
+    LeptrisXPathResult bad = leptris_xpath_eval(doc, nullptr, "<<");
+    if (bad) leptris_xpath_result_free(bad);
+    std::string poisoned = leptris_last_error() ? leptris_last_error() : "";
+    ASSERT_FALSE(poisoned.empty());
+
+    LeptrisElement b = (LeptrisElement)leptris_node_first_child(
+        leptris_element_as_node(leptris_document_root(doc)));
+    ASSERT_NE(b, nullptr);
+    EXPECT_EQ(leptris_document_set_root(doc, b), LEPTRIS_ERROR_INVALID_ARG);
+    /* The channel must now describe THIS failure, not the XPath one. */
+    const char* err = leptris_last_error();
+    ASSERT_TRUE(err != nullptr && err[0] != '\0');
+    EXPECT_STRNE(err, poisoned.c_str())
+        << "stale XPath error leaked through set_root EINVAL: " << err;
+    EXPECT_TRUE(strstr(err, "root") != nullptr)
+        << "expected a set_root-specific message, got: " << err;
+
+    /* Cross-document rejection refreshes the channel too. */
+    LeptrisDocument other = leptris_document_create();
+    ASSERT_NE(other, nullptr);
+    LeptrisElement foreign = leptris_element_create(other, "f");
+    ASSERT_NE(foreign, nullptr);
+    EXPECT_EQ(leptris_document_set_root(doc, foreign),
+              LEPTRIS_ERROR_INVALID_ARG);
+    err = leptris_last_error();
+    ASSERT_TRUE(err != nullptr && err[0] != '\0');
+    EXPECT_STRNE(err, poisoned.c_str());
+    EXPECT_TRUE(strstr(err, "document") != nullptr)
+        << "expected a cross-document message, got: " << err;
+    leptris_document_free(other);
+    leptris_document_free(doc);
+}
+
 TEST(DomBasics, AttributeLookupByName) {
     const char xml[] = "<r a='1' b='2' c='3'/>";
     LeptrisStatus st = LEPTRIS_OK;

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.207",
+  "version": "1.9.208",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.207.0
+  version: 1.9.208.0
 platform: ruby
 authors:
 - Ribose Inc.