leptris 1.9.312.1 → 1.9.313.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0f5231d3973de22dc4db540fb5edfac2e567500de54b9f68901806e29d99ebc
-  data.tar.gz: 2480900d27aa291e5e5bed4f6481cb680051e1ddabefeb9f419b3adca9bc1815
+  metadata.gz: 716410c15581403307f3b94bd529c21d2bc778478bcfca064b6778f8e1826a9b
+  data.tar.gz: c566d9e1828cd1803523b0eb99ffc9b861995aee576ef7fae6d24ac536bea7d0
 SHA512:
-  metadata.gz: bdf5c50d694d51b5db9a859e1c24a4f11ed90c49f977e12fd6fe882e190d84078470c0ade2ab0307b314b9f8de6c628e24a0d57313b8df4d0655eead19d7dbd0
-  data.tar.gz: e1b78d323c99d8033aef4132475c5dd74d8ac532fa524d1714054391afd5fcd9e72403f71257384dc3a8e5d6edaabd627d2d155cc454f4b7a9bef88618e95db2
+  metadata.gz: 66c08d6699d345e0a74c313c9d02bef8b84a6f25e0b310e846a5694dd01e78c45c983f1871bba57e4711564208d90e6710d08d2a499d88582c1ec4cf3ab3f211
+  data.tar.gz: ecda89d28b0ad3e7954a93064c6abeaf430159bad758c0dcf88db4c4ad20fe7e6b56a17201142ead36aac05c64a025c759dfff7736e36969dc2635265f302083

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.9.313.0] - 2026-10-07
+
+### Fixed — engine sync (libleptris 1.9.313)
+
+- **Absorption-aware release at the C ABI (#1557, engine #1566)**:
+  the follow-up to the #386 mitigation — `leptris_document_free`
+  now consults the absorption state itself. The anchor dying while
+  `absorbed_handle > 0` detaches the source and defers its release
+  to the outstanding holder's free (`absorbed_deferred`); handles
+  released before the anchor keep the #1548 handle-only no-op. C
+  consumers no longer need to mirror the absorbed flag at their own
+  release sites; the binding's 1.9.311.2 mitigation stays as
+  defense-in-depth. Both release orderings spec-pinned.
+
 ## [1.9.312.1] - 2026-10-07
 
 ### Added

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.312"
+LIBLEPTRIS_VERSION = "1.9.313"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.312.1"
+  VERSION = "1.9.313.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.312
+- libleptris v1.9.313
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,27 @@
 ## [Unreleased]
 
+## [1.9.313] - 2026-10-07
+
+### Fixed
+
+- **Absorbed sources defer their release to outstanding handles
+  (#1557, PR #1566).** Follow-up to #1548's
+  `leptris_document_absorb`: the absorber's free cleared the
+  absorbed state before recursing, so a source handle that
+  OUTLIVED the absorber read the cleared flag and re-released the
+  already-destroyed pool — heap corruption (glibc abort /
+  `malloc_zone_error`), deterministic under exit-time finalizers
+  (leptris-ruby#386, 50-iteration repro). When the anchor dies
+  while `absorbed_handle > 0` it now detaches the source and marks
+  `absorbed_deferred`: the holder's `leptris_document_free`
+  performs the FULL release; handles released before the anchor
+  keep the #1548 handle-only no-op. Consumers no longer need to
+  mirror the absorbed flag at their own release sites. Gates: the
+  repro red under ASAN at leptris.c:937, green after; mutation
+  suite 27/27 ASAN + Release; full ctest 1866/1866; leaks 0.
+
+
+
 ## [1.9.312] - 2026-10-06
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.312
+    VERSION 1.9.313
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/leptris/leptris.c

@@ -933,9 +933,11 @@ LEPTRIS_API void leptris_document_free(struct leptris_document* doc) {
 
     /* #1548: an absorbed document's MEMORY belongs to its absorber
      * (it rides the absorber's child_docs chain). A caller free
-     * releases only the outstanding handle. */
-    if (doc->absorbed_by) {
-        doc->absorbed_handle = 0;
+     * releases only the outstanding handle. #1557: unless the
+     * anchor died first and DEFERRED the release to this holder —
+     * then this free is the real one. */
+    if (doc->absorbed_by && !doc->absorbed_deferred) {
+        if (doc->absorbed_handle > 0) doc->absorbed_handle--;
         return;
     }
 
@@ -1021,12 +1023,24 @@ LEPTRIS_API void leptris_document_free(struct leptris_document* doc) {
                                        * doesn't try to walk the
                                        * adopted subtree. */
             ch->root = NULL;
-            /* #1548: the anchor's free is the REAL one — clear the
-             * absorbed state so the early handle-return above does
-             * not swallow it. */
-            ch->absorbed_by = NULL;
-            ch->absorbed_handle = 0;
-            leptris_document_free(ch);
+            if (ch->absorbed_by && ch->absorbed_handle > 0) {
+                /* #1557: a caller still holds this absorbed handle.
+                 * Freeing here would strand it on freed memory (its
+                 * later free read the cleared flag and re-released
+                 * the pool — the leptris-ruby#386 double free).
+                 * DEFER: detach from our chain and hand the release
+                 * to the holder's leptris_document_free, which sees
+                 * absorbed_deferred and runs the full release. */
+                ch->absorbed_deferred = 1;
+                ch->next_adopted = NULL;
+            } else {
+                /* #1548: the anchor's free is the REAL one — clear
+                 * the absorbed state so the early handle-return
+                 * above does not swallow it. */
+                ch->absorbed_by = NULL;
+                ch->absorbed_handle = 0;
+                leptris_document_free(ch);
+            }
             ch = next;
         }
         doc->child_docs = NULL;

data/vendor-src/libleptris/src/leptris/leptris_internal.h

@@ -195,6 +195,11 @@ struct leptris_document {
      * (the anchor frees the memory later). */
     struct leptris_document* absorbed_by;
     int absorbed_handle;
+    /* #1557: the absorber died while this handle was outstanding —
+     * the anchor deferred the pool release to THIS holder's free,
+     * so leptris_document_free must run the full release (not the
+     * handle-only early return). */
+    int absorbed_deferred;
     /* XML Declaration support */
     char* xml_version;              /* "1.0", "1.1", etc. or NULL if not present */
     int standalone;                 /* -1=not set, 0=no, 1=yes */

data/vendor-src/libleptris/test/abi/test_dom_mutation_bugs.cpp

@@ -670,6 +670,32 @@ TEST(CrossDocumentLeafAdoption, RootLevelLeafArgumentAdoptsByKind) {
     }
 }
 
+// #1557: an absorbed source's handle may OUTLIVE the absorber. The
+// anchor's free used to clear the absorbed state, so the holder's
+// later free re-released the same pool — heap corruption. The anchor
+// now defers the release to the outstanding handle.
+TEST(AbsorbAdoption, SourceHandleMayOutliveAnchor) {
+    for (int i = 0; i < 50; i++) {
+        LeptrisDocument dest = Parse("<main><keep/></main>");
+        ASSERT_NE(dest, nullptr);
+        LeptrisDocument src = Parse("<scratch><a/></scratch>");
+        ASSERT_NE(src, nullptr);
+        ASSERT_EQ(leptris_document_absorb(dest, src), LEPTRIS_OK);
+        leptris_document_free(dest);   /* anchor dies first */
+        leptris_document_free(src);    /* holder releases after */
+    }
+}
+
+TEST(AbsorbAdoption, SourceHandleFreedBeforeAnchorStillNoOp) {
+    LeptrisDocument dest = Parse("<main><keep/></main>");
+    ASSERT_NE(dest, nullptr);
+    LeptrisDocument src = Parse("<scratch><a/></scratch>");
+    ASSERT_NE(src, nullptr);
+    ASSERT_EQ(leptris_document_absorb(dest, src), LEPTRIS_OK);
+    leptris_document_free(src);    /* handle-only: memory stays with anchor */
+    leptris_document_free(dest);   /* releases everything incl. the source */
+}
+
 TEST(AbsorbAdoption, SpliceAfterAbsorbIsZeroCopy) {
     LeptrisDocument dst = Parse("<main><keep/></main>");
     ASSERT_NE(dst, nullptr);

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.312",
+  "version": "1.9.313",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.312.1
+  version: 1.9.313.0
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-06 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi