leptris 1.9.311.0-aarch64-linux → 1.9.311.2-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a1dbcc70a5f38206cb508de092c27caf828a4d7629c1e9d45c6cb2cfeb07930
-  data.tar.gz: c74843b1414838d09b76655059d8e1e141a94efa158b025507378c1d2f4a3912
+  metadata.gz: 5bdff2edc4dd2718b7e55edc7cb459597f5119a7275439648cb14118510c2b48
+  data.tar.gz: d2925ceeb71346cc106c8ed3985e490779a9ba23a8c61b576d8f7b4e9527b7ab
 SHA512:
-  metadata.gz: e1635680abcb25b2912fa64d8ae3f5523f3d00d1ee08536ecf6e77d0fec2962c74d45d0641fa089c39dbe9c305b0e79cf4916523eedee03469d37b18b8cdfb7a
-  data.tar.gz: fb6ffb273a99b6be783e68f8ec990d44092c2831db5a95ab5079747e0e833c0c2ace54db397732f31b7b6c1d459a7fcf6c3e4a2eeb9212cae2f64df3497fba94
+  metadata.gz: 013d7a590fbf1c5e03b2c5b3be4158519f976c30694dc35f45ed5a1e9cfa7e655d421f40751b80ead5a84dda2a8dd1e429991574d50ec29b0db404bd15302cc8
+  data.tar.gz: a1c8447bc14ea7636dd3ca945de6c0d64fd79512ff119c53bfd923fa2d4f188f49785c230c5713da8f07bb298c7d41633906134107cf216290a00b7f1d043e4c

data/CHANGELOG.md

@@ -1,3 +1,43 @@
+## [1.9.311.2] - 2026-10-06
+
+### Fixed
+
+- **Absorbed sources alive at exit no longer double-free the pool
+  (#386)**: `Document#absorb`'s handle-only contract was enforced
+  only by the explicit `#free` — the C lifetime handle's dfree
+  and the no-native Ruby finalizer still called
+  `leptris_document_free`, destroying a pool already owned (and
+  released) by the absorber. Libraries that pin adopted-source
+  documents (moxml's lifetime pins) aborted at exit-time
+  finalization (`leptris_pool_destroy` → `free_small_botch`). The
+  absorbed flag now lives where every release path reads it: the
+  shared `Freed` struct (Ruby finalizer) and the C handle
+  (`doc_handle_mark_absorbed`; dfree is handle-only when the pool
+  moved). Both paths pinned by subprocess regression specs.
+
+## [1.9.311.1] - 2026-10-06
+
+### Fixed
+
+- **Docless children now route through the adoption contract
+  (#376)**: moxml's created nodes arrive as Node wrappers whose
+  #document is nil but whose C node is live in a foreign pool —
+  the splice sites' foreign check required a document, so those
+  children bypassed the namespace lift and, worse, the returned
+  wrapper addressed the ABANDONED source instead of the installed
+  in-tree copy (moxml's flows then mutated a node the tree never
+  saw). `foreign_child?` now treats document-nil as foreign at
+  add_child, prepend_child, add_next_sibling,
+  add_previous_sibling, and append_children, so every splice
+  returns the installed wrapper. Document#root= routes docless
+  roots through the copying ex-face too — the plain set_root of a
+  foreign-pool node linked the pointer WITHOUT adopting it into
+  the destination pool, so destination-side writes landed in the
+  source arena and reads through the root memo missed them.
+  Node-level mutations on docless
+  wrappers no longer crash the version gate (they memoize
+  nothing, so there is no version to advance).
+
 ## [1.9.311.0] - 2026-10-06
 
 ### Added

data/ext/leptris/native/native.c

@@ -2682,15 +2682,21 @@ static VALUE nf_fast_inner_xml(VALUE self, VALUE addr)
  * Ruby-finalizer path (which stays for LEPTRIS_NO_NATIVE). */
 struct doc_handle {
     void *doc;
+    /* Pool ownership transferred to an absorber (engine #1548):
+     * the destination's free performs the real release, so this
+     * handle's dfree is HANDLE-ONLY (#386: malloc_zone_error /
+     * free_small_botch when an absorbed source survived to
+     * exit-time finalization after its destination's release). */
+    int absorbed;
 };
 
 static void dh_free(void *p)
 {
     struct doc_handle *h = p;
-    if (h->doc) {
+    if (h->doc && !h->absorbed) {
         f_doc_free(h->doc);
-        h->doc = NULL;
     }
+    h->doc = NULL;
 }
 
 static size_t dh_size(const void *p)
@@ -2888,6 +2894,22 @@ static VALUE nf_doc_handle_release(VALUE self, VALUE document)
     return Qnil;
 }
 
+/* Absorption bookkeeping (#386, engine #1548): Document#absorb
+ * calls this on the SOURCE right after the engine transfers pool
+ * ownership — the handle's dfree becomes handle-only, matching
+ * the Ruby-side Freed flag the no-native finalizer reads. */
+static VALUE nf_doc_handle_mark_absorbed(VALUE self, VALUE document)
+{
+    VALUE handle = rb_ivar_get(document, id_iv_doc_handle);
+    (void)self;
+    if (handle != Qnil) {
+        struct doc_handle *h;
+        TypedData_Get_Struct(handle, struct doc_handle, &dh_type, h);
+        h->absorbed = 1;
+    }
+    return Qnil;
+}
+
 /* The full Document.create in one dispatch: engine create,
  * binding wrapper (ivar-seeded, bypassing initialize), and the
  * lifetime handle. Returns Qnil when the engine refuses. */
@@ -3158,6 +3180,8 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
                               nf_doc_handle_attach, 1);
     rb_define_module_function(m_native, "doc_handle_release",
                               nf_doc_handle_release, 1);
+    rb_define_module_function(m_native, "doc_handle_mark_absorbed",
+                              nf_doc_handle_mark_absorbed, 1);
     rb_define_module_function(m_native, "create_binding_document",
                               nf_create_binding_document, 0);
     c_doc_handle = rb_define_class_under(m_xml, "DocHandle", rb_cObject);

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.311.0"
+  VERSION = "1.9.311.2"
 end

data/lib/leptris/xml/document.rb

@@ -11,7 +11,9 @@ class Leptris::XML::Document
   # the explicit `free` path and the finalizer. This eliminates the
   # double-free that FFI::AutoPointer's release proc caused when
   # `Document#free` was called explicitly and then GC ran.
-  Freed = Struct.new(:state)  # state: :alive | :freed
+  # +absorbed+ (engine #1548, #386): pool ownership moved to an
+  # absorber — the finalizer must never call the engine free.
+  Freed = Struct.new(:state, :absorbed)  # state: :alive | :freed
 
   # Mutation version: advanced by every data mutation (via
   # Node#ensure_writable!, root=, add_pi). Node memos stamp the
@@ -286,7 +288,7 @@ class Leptris::XML::Document
 
   def self.finalizer(address, freed)
     proc do
-      next if freed.state == :freed
+      next if freed.state == :freed || freed.absorbed
       freed.state = :freed
       Leptris::XML::FFI.leptris_document_free(::FFI::Pointer.new(address))
     end
@@ -388,7 +390,12 @@ class Leptris::XML::Document
     # the foreign subtree into this document's pool and reports the
     # installed element — a fresh handle distinct from the source
     # pointer. Same-document installs keep the native fast path.
-    cross = element.document && !element.document.equal?(self)
+    # Docless roots count as foreign (#376): a plain set_root of a
+    # foreign-pool node links the pointer WITHOUT adopting it into
+    # this pool — writes through this document land in the source
+    # arena and reads through the root memo miss them. The ex-face
+    # copies properly.
+    cross = Leptris::XML::Element.foreign_to?(element, self)
     installed_ptr = nil
     if cross
       out = ::FFI::MemoryPointer.new(:pointer)
@@ -586,8 +593,16 @@ class Leptris::XML::Document
   # objects by hand): the absorbed document's #free skips the
   # engine release, and splice seams skip source-side removals
   # because absorbed splices MOVE the node (nothing to remove).
+  # The flag is mirrored into every release path (#386): the
+  # shared Freed struct (the no-native Ruby finalizer reads it)
+  # and the C lifetime handle (dh_free must be handle-only when
+  # the pool belongs to the absorber).
   def mark_absorbed_into(destination)
     @absorbed_into = destination
+    @freed.absorbed = true
+    if defined?(Leptris::XML::NATIVE_FAST)
+      Leptris::XML::Native.doc_handle_mark_absorbed(self)
+    end
   end
 
   def absorbed_into?(destination)

data/lib/leptris/xml/element.rb

@@ -389,6 +389,15 @@ class Leptris::XML::Element < Leptris::XML::Node
     !Leptris::XML::Native.ns_lift_needed?(node.c_ptr.address)
   end
 
+  # A node is foreign to +document+ when it belongs to another one
+  # — or to NONE (#376): moxml's created nodes are live C nodes
+  # wrapped without a document, and they splice by copy exactly
+  # like attached-foreign ones. One definition of "foreign" for
+  # the element splices and Document#root=.
+  def self.foreign_to?(node, document)
+    node.document.nil? || !node.document.equal?(document)
+  end
+
   def self.lift_namespaces_for_adoption(node, target_scope)
     return unless node.is_a?(Leptris::XML::Element)
     # Declarations the node already carries (its own definitions —
@@ -419,11 +428,11 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document nodes skip the fast path entirely (1.9.304,
-    # #1528): the engine deep-copies them at the splice, so the
-    # full path's lift must run FIRST and the source original is
-    # removed after (move semantics).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless nodes skip the fast path entirely
+    # (1.9.304, #1528; #376): the engine deep-copies them at the
+    # splice, so the full path's lift must run FIRST and the source
+    # original is removed after (move semantics).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -455,10 +464,10 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document: full path first (lift + engine copy), then
-    # the source original is removed; returns the installed copy
-    # (self's new next sibling).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless (#376): full path first (lift +
+    # engine copy), then the source original is removed; returns
+    # the installed copy (self's new next sibling).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -490,10 +499,10 @@ class Leptris::XML::Element < Leptris::XML::Node
     # C-bound insert (TODO.perf/14): gates + predicate + version
     # bump + engine insert in one dispatch; Qnil = the child needs
     # the namespace lift — the full path below handles it.
-    # Cross-document: full path first (lift + engine copy), then
-    # the source original is removed; returns the installed copy
-    # (self's new previous sibling).
-    if node.document && !node.document.equal?(@document)
+    # Cross-document and docless (#376): full path first (lift +
+    # engine copy), then the source original is removed; returns
+    # the installed copy (self's new previous sibling).
+    if Leptris::XML::Element.foreign_to?(node, @document)
       ensure_writable!
       unless Leptris::XML::Element.skip_adoption_lift?(node)
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces)
@@ -551,9 +560,7 @@ class Leptris::XML::Element < Leptris::XML::Node
       nodes.each { |n| add_child(n) }
       return
     end
-    cross = nodes.any? do |n|
-      n.document && !n.document.equal?(@document)
-    end
+    cross = nodes.any? { |n| Leptris::XML::Element.foreign_to?(n, @document) }
     if native_fast_children?
       addrs = nodes.map { |n| n.c_ptr.address }
       done = Leptris::XML::Native.append_binding_children(
@@ -668,13 +675,13 @@ class Leptris::XML::Element < Leptris::XML::Node
     ensure_writable!
     case node_or_markup
     when Leptris::XML::Node
-      # Cross-document adoption (1.9.304, #1528): the engine
+      # Foreign-child adoption (1.9.304, #1528): the engine
       # deep-copies foreign nodes at the splice — the returned
       # wrapper must be the INSTALLED copy, not the detached
-      # source. Route those through the re-resolving path.
-      cross = node_or_markup.document &&
-              !node_or_markup.document.equal?(@document)
-      return append_installed(node_or_markup) if cross
+      # source. Docless wrappers count as foreign (#376): moxml's
+      # created nodes carry live C pointers with no owning
+      # document, and their callers expect the in-tree handle.
+      return append_installed(node_or_markup) if Leptris::XML::Element.foreign_to?(node_or_markup, @document)
       # C-bound append (TODO.perf/08-09): one dispatch runs the
       # readonly/liveness gates, the provable no-op lift
       # predicate, the version bump, and the engine append. Qnil

data/lib/leptris/xml/node.rb

@@ -281,14 +281,15 @@ class Leptris::XML::Node
   # passes through this gate, so it is where the document's mutation
   # version advances — the invalidation behind writable-document
   # memoization. Bumping before the C call is conservative: a failed
-  # mutation merely discards memos.
+  # mutation merely discards memos. Docless wrappers (#376) mutate
+  # fine — they memoize nothing, so there is no version to advance.
   def ensure_writable!
     ensure_alive!
     if readonly_document?
       raise Leptris::XML::ReadOnlyError,
         "document is readonly — mutation attempted on #{inspect}"
     end
-    @document.advance_version
+    @document&.advance_version
     nil
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.311.0
+  version: 1.9.311.2
 platform: aarch64-linux
 authors:
 - Ribose Inc.