leptris 1.9.366.2-ppc64le-linux → 1.9.368.1-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 401321147dcbb50a159d39d90befa2217ff70f1b11e2623cc517c168ca8388c9
-  data.tar.gz: 24595ec7730ae70e60a0344041e5bd18cbb42202ca0b2bba6e9e223eb55fec0d
+  metadata.gz: a9f080aaa7146688d0de80520eb91b6377e22fa1ff6b45033ac349b7b24b274f
+  data.tar.gz: ee97afd2b4faaf64a9d57bec5633bc5a026bda9e6fb192d8b3cd34a6f0192672
 SHA512:
-  metadata.gz: de9dbb58b20bc2c37bdf38f1b7995bfd2dea826586b46b968f08671f212ebda067a12c82dc886afff9c8a2665aa41d7f0e5ece2b1870fb8fd81b7bfd63e4b743
-  data.tar.gz: 2bc6c5ca652dbf337103e28518f31c705800c9ea7310b9d7e3f765bf52d938f0407ad0bc0fe27c7c42d40143f82766afd1d0430ecba9b7421cf48319989fdd48
+  metadata.gz: 3abda08bb47737ca15bee7ec88e64c5f98887b8fe050e70defd72e961fb609398e56f9f80a23142a47a92f398234d0bf42f170a9e323c5fa9032dff33c9a0a22
+  data.tar.gz: 282b05fdc6b475a5075f3348d4d24186c9f0f4c10bd9cb119076661f9f909b88c7484a7ab9d41616d34ff6241a1c061919fccb2e9d8deb8f40f84846cb082e56

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.366"
+LIBLEPTRIS_VERSION = "1.9.368"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/ext/leptris/native/native.c

@@ -39,6 +39,7 @@ typedef int (*xp_node_kind_fn)(void *, int);
 typedef const char *(*xp_node_name_fn)(void *, int);
 typedef const char *(*xp_node_value_fn)(void *, int);
 typedef size_t (*serialize_into_fn)(void *, char *, size_t, void *, void *);
+typedef char *(*serialize_ext_sized_fn)(void *, const void *, const void *, size_t);
 typedef int (*ns_count_fn)(void *);
 typedef void *(*attr_first_fn)(void *);
 typedef void *(*attr_next_fn)(void *);
@@ -75,7 +76,8 @@ static xp_nodes_ex_fn f_xp_nodes_ex;
 static xp_node_kind_fn f_xp_node_kind;
 static xp_node_name_fn f_xp_node_name;
 static xp_node_value_fn f_xp_node_value;
-static serialize_into_fn f_doc_serialize, f_elem_serialize;
+static serialize_ext_sized_fn f_doc_serialize_xml;
+static serialize_into_fn f_elem_serialize;
 static ns_count_fn f_elem_ns_count;
 static attr_first_fn f_attr_first;
 static attr_next_fn f_attr_next;
@@ -272,7 +274,8 @@ static void resolve_symbols(const char *lib_path)
     f_xp_node_kind = (xp_node_kind_fn)lib_sym(h, "leptris_xpath_result_node_kind");
     f_xp_node_name = (xp_node_name_fn)lib_sym(h, "leptris_xpath_result_node_name");
     f_xp_node_value = (xp_node_value_fn)lib_sym(h, "leptris_xpath_result_node_value");
-    f_doc_serialize = (serialize_into_fn)lib_sym(h, "leptris_document_serialize_into");
+    f_doc_serialize_xml = (serialize_ext_sized_fn)lib_sym(
+        h, "leptris_document_serialize_ext_sized");
     f_elem_serialize = (serialize_into_fn)lib_sym(h, "leptris_element_serialize_into");
     f_attr_first = (attr_first_fn)lib_sym(h, "leptris_element_first_attribute");
     f_attr_next = (attr_next_fn)lib_sym(h, "leptris_attribute_next");
@@ -352,7 +355,7 @@ static void resolve_symbols(const char *lib_path)
         !f_sax_pfree || !f_sax_set_flags ||
         !f_elem_prefix || !f_xp_count || !f_xp_nodes_ex ||
         !f_xp_node_kind || !f_xp_node_name || !f_xp_node_value ||
-        !f_doc_serialize || !f_elem_serialize || !f_attr_first ||
+        !f_doc_serialize_xml || !f_elem_serialize || !f_attr_first ||
         !f_elem_ns_count || !f_elem_ns ||
         !f_attr_next || !f_attr_name || !f_attr_value ||
         !f_node_line || !f_node_offset)
@@ -2120,15 +2123,52 @@ static VALUE fast_serialize(serialize_into_fn fn, void *node,
                       : rb_utf8_str_new_cstr("");
 }
 
+/* rb_utf8_str_new_cstr may raise; the engine allocation remains owned
+ * until the ensure callback runs on either return or exception. */
+struct document_xml_result {
+    char *xml;
+};
+
+static VALUE document_xml_string(VALUE arg)
+{
+    struct document_xml_result *result = (void *)(uintptr_t)arg;
+    return rb_utf8_str_new_cstr(result->xml);
+}
+
+static VALUE document_xml_free(VALUE arg)
+{
+    struct document_xml_result *result = (void *)(uintptr_t)arg;
+    f_free_str(result->xml);
+    return Qnil;
+}
+
 static VALUE nf_fast_document_xml(VALUE self, VALUE addr,
                                   VALUE indent, VALUE decl,
                                   VALUE encoding)
 {
+    /* Prefix of LeptrisSerializeExtOptions through html_method.
+     * Pass its size so later engine fields remain at their defaults. */
+    struct {
+        int indent_text;
+        const char *indent_unit;
+        int expand_empty;
+        int html_method;
+    } ext = {0, NULL, 0, -1};
+    struct serialize_opts opts;
+    struct document_xml_result result;
+
     (void)self;
-    return fast_serialize(f_doc_serialize,
-                          (void *)(uintptr_t)NUM2ULL(addr),
-                          NUM2INT(indent), RTEST(decl) ? 1 : 0,
-                          encoding);
+    opts.indent = NUM2INT(indent);
+    opts.xml_declaration = RTEST(decl) ? 1 : 0;
+    opts.encoding = NIL_P(encoding) ? NULL : StringValueCStr(encoding);
+    /* HTML documents default to HTML output in the generic entry.
+     * This XML face forces XML without changing the document's mode. */
+    result.xml = f_doc_serialize_xml((void *)(uintptr_t)NUM2ULL(addr),
+                                    &opts, &ext, sizeof(ext));
+    if (!result.xml)
+        return rb_utf8_str_new_cstr("");
+    return rb_ensure(document_xml_string, (VALUE)(uintptr_t)&result,
+                     document_xml_free, (VALUE)(uintptr_t)&result);
 }
 
 static VALUE nf_fast_element_xml(VALUE self, VALUE addr,

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.366.2"
+  VERSION = "1.9.368.1"
 end

data/lib/leptris/xml/serialization.rb

@@ -28,6 +28,15 @@ module Leptris::XML::Serialization
   # Public within the library: Element#to_xml and Document#to_xml
   # pass the hoisted bound methods straight through.
 
+  # Document XML output must override an HTML document's default
+  # serialization method. Element serialization already defaults to XML.
+  XML_METHOD_EXT = begin
+    ext = Leptris::XML::FFI::SerializeExtStruct.new
+    ext[:html_method] = -1
+    ext
+  end
+  private_constant :XML_METHOD_EXT
+
   # +ffi_function+ is a bound _serialize_into function. The buffer
   # cycle lives at the FFI seam (FFI.serialize_into_string); this
   # module owns only options selection and construction.
@@ -52,6 +61,11 @@ module Leptris::XML::Serialization
           indent: indent, no_decl: no_decl, encoding: encoding)
         opts
       end
+    if ffi_function == DOCUMENT_SERIALIZE_INTO
+      return Leptris::XML::FFI.read_owned_string(
+        Leptris::XML::FFI.leptris_document_serialize_ext_sized(
+          c_ptr, opts.pointer, XML_METHOD_EXT.pointer, XML_METHOD_EXT.size))
+    end
     Leptris::XML::FFI.serialize_into_string(ffi_function, c_ptr, opts.pointer)
   end
 
@@ -140,6 +154,7 @@ module Leptris::XML::Serialization
   INDENT_TEXT_EXT = begin
     ext = Leptris::XML::FFI::SerializeExtStruct.new
     ext[:indent_text] = 1
+    ext[:html_method] = -1
     ext
   end
   private_constant :INDENT_TEXT_EXT
@@ -167,6 +182,7 @@ module Leptris::XML::Serialization
     unit_anchor = ::FFI::MemoryPointer.from_string(
       indent.positive? ? unit.to_s * indent : unit.to_s)
     ext[:indent_unit] = unit_anchor
+    ext[:html_method] = -1
     str_ptr = Leptris::XML::FFI.leptris_document_serialize_ext_sized(
       c_ptr, opts.pointer, ext.pointer, ext.size)
     Leptris::XML::FFI.read_owned_string(str_ptr)

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.366
+- libleptris v1.9.368
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,46 @@
 ## [Unreleased]
 
+## [1.9.368] - 2026-10-18
+
+### Fixed
+
+- **dom: `leptris_element_get_document` is kind-safe (#487, PR #1763).**
+  The addr-based attach face called get_document on the RAW child before
+  any kind routing. For the TEXT nodes a hydration loop appends,
+  get_document read element-form fields — the namebp fast-outs and
+  element parent offsets. A live inline text usually survived the
+  misread; a recycled or heap-backed text handed the walk a wild pointer
+  and the process died: the **Ruby 4.0 + darwin Bus error at
+  element.rb:809** in the lutaml/moxml DOCX hydration suite
+  (leptris-ruby#487) — deterministic across randomized runs, with
+  Ruby 3.3/3.4 and 4.0-ubuntu clean on identical code (GC timing, not
+  semantics). Non-element nodes now route through the per-struct
+  `owner_doc` read (the same authority adopt_for_splice's #1534 kind
+  routing uses); NULL answers for unstamped detached leaves stay part of
+  the contract. Verified on Ruby 4.0.5 darwin with the reporter's
+  harness: the uniword DOCX suite runs 385/385 plain AND under
+  RUBY_GC_STRESS (deterministic SIGSEGV before). Engine suite
+  2036/2036 with a new kind-safety contract test.
+
+
+## [1.9.367] - 2026-10-17
+
+### Fixed
+
+- **dom: zero-initialize the namespace cache at every allocation site (#1742, PR #1742).**
+  The three cache-creating sites partially initialized the new
+  `leptris_ns_cache` — prefix/URI/declarations (and `raw_attrs` at only one of
+  the three) — leaving `doc_next`, the heap-ownership flags, and the
+  child-iteration cache (generations, index, node pointer) on **arena
+  garbage**. Any read before its explicit set was an uninitialized read: the
+  document-free walk chain and the child-cache generation compare could act on
+  poisoned bytes. All three sites now zero the whole struct. New
+  poisoned-arena regressions fill the remaining arena with `0xa5` and assert
+  every field comes up clean through the prefix setter, the URI setter, and
+  `cache_ensure` (red on main's header, green on the fix). Engine suite
+  2040/2040 on the PR, 2048/2048 on merged main.
+
+
 ## [1.9.366] - 2026-10-17
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.366
+    VERSION 1.9.368
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/TODO.xslt-full/README.md

@@ -16,8 +16,13 @@ Rules (per repo conventions):
   (benchmarks/xslt/*) — conformance may not cost the lead. A fix
   that regresses a benchmark by >3% needs an algorithmic answer.
 
-Live census (157 open, by failure signature; refresh with the
-triage script in 00):
+**GATE MET (verified 2026-10-17, main @ 75cd5f6e):**
+libxslt suite **205/205** (open_cases.txt empty; macOS legitimately
+skips bug-169 — encoding-sensitive via iconv, Linux CI is
+authoritative), XsltFull **27/27** (the suite carries 27 cases; the
+historical 45 count predates the case consolidation), full suite
+**2053/2053** locally. The census below is the campaign-start
+snapshot, kept for the record:
 - 84 PI/COMMENT-OUT — fragment-node serialization + content edges
 - 28 EMPTY — root-node `/` semantics, doc() chains, early exits
 - 24 DIFF — number corners, attr-set precedence, sort, AVT edges

data/vendor-src/libleptris/src/leptris/dom/element.h

@@ -501,6 +501,12 @@ int leptris_elem_pos_lookup(const struct leptris_document* doc,
                             uint32_t* start_tag_end, uint32_t* element_end);
 
 struct leptris_document* leptris_element_get_document(LeptrisElement elem);
+
+/* #487: the KIND-SAFE document resolver for non-element nodes
+ * (text/cdata/comment/pi) — reads each struct's own owner_doc
+ * field instead of element-form views. get_document routes
+ * non-elements here; element callers keep the element path. */
+struct leptris_document* leptris_leaf_owner_doc(LeptrisNode* n);
 LeptrisMemoryPool* leptris_element_get_pool(LeptrisElement elem);
 
 /* Round 21: header.flags bit 6 — "elem->name is preceded by 8 bytes
@@ -576,9 +582,7 @@ static inline void leptris_elem_set_prefix(LeptrisElement e, char* prefix,
         nc = (struct leptris_ns_cache*)
             leptris_pool_alloc(pool, sizeof(struct leptris_ns_cache));
         if (!nc) return;
-        nc->prefix = NULL;
-        nc->namespace_uri = NULL;
-        nc->declarations = NULL;
+        memset(nc, 0, sizeof(*nc));
         elem_set_ns_cache(e, nc);
     }
     nc->prefix = prefix;
@@ -594,9 +598,7 @@ static inline void leptris_elem_set_ns_uri(LeptrisElement e, char* uri,
         nc = (struct leptris_ns_cache*)
             leptris_pool_alloc(pool, sizeof(struct leptris_ns_cache));
         if (!nc) return;
-        nc->prefix = NULL;
-        nc->namespace_uri = NULL;
-        nc->declarations = NULL;
+        memset(nc, 0, sizeof(*nc));
         elem_set_ns_cache(e, nc);
     }
     nc->namespace_uri = uri;
@@ -694,10 +696,7 @@ static inline struct leptris_ns_cache* leptris_elem_cache_ensure(
     nc = (struct leptris_ns_cache*)
         leptris_pool_alloc(pool, sizeof(struct leptris_ns_cache));
     if (!nc) return NULL;
-    nc->prefix = NULL;
-    nc->namespace_uri = NULL;
-    nc->declarations = NULL;
-    nc->raw_attrs = NULL;
+    memset(nc, 0, sizeof(*nc));
     elem_set_ns_cache(e, nc);
     return nc;
 }

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -299,7 +299,7 @@ static int node_in_current_mut_block(struct leptris_document* doc,
  * #1320-family doc stamps: text an int32 offset, cdata/comment/pi
  * a direct pointer. Unstamped = the #540 same-doc detached-chain
  * contract (public creators stamp; hand-built chains don't). */
-static struct leptris_document* leaf_owner_doc(LeptrisNode* n) {
+struct leptris_document* leptris_leaf_owner_doc(LeptrisNode* n) {
     switch (n->type) {
         case LEPTRIS_NODE_TYPE_TEXT:
             return leptris_textnode_owner_doc((LeptrisTextNode*)n);
@@ -390,7 +390,7 @@ static LeptrisNode* adopt_for_splice(LeptrisNode* node,
             src = leptris_element_get_document(
                 (LeptrisElement)top);
         } else {
-            src = leaf_owner_doc(top);
+            src = leptris_leaf_owner_doc(top);
         }
         if (!src || src == target) return node;
         /* #1548: the source is a doomed scratch doc absorbed into

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.c

@@ -400,6 +400,14 @@ LeptrisElement leptris_root_doc_memo_root_for_tests(void) {
 
 struct leptris_document* leptris_element_get_document(LeptrisElement elem) {
     if (!elem) return NULL;
+    /* #487: a non-element node must never read element-form fields
+     * (the namebp fast-outs and element parent offsets below) — a
+     * recycled or heap-backed text handed the walk a wild pointer
+     * and the process died. Route through the kind-safe owner
+     * read; NULL answers are part of the contract (unstamped
+     * detached leaves). */
+    if (((LeptrisNodeRef)elem)->type != LEPTRIS_NODE_TYPE_ELEMENT)
+        return leptris_leaf_owner_doc((LeptrisNode*)elem);
     /* Lane 18 R3: an UNATTACHED namebp-carrying element roots
      * itself in the name slot (#1189) — that slot is its
      * authoritative document and must never see the recyclable-

data/vendor-src/libleptris/test/CMakeLists.txt

@@ -105,6 +105,7 @@ leptris_add_test(test_large_docs parser/test_large_documents.cpp)
 leptris_add_test(test_encoding   parser/test_encoding.cpp)
 leptris_add_test(test_dom        dom/test_dom.cpp)
 leptris_add_test(test_element_children dom/test_element_children.cpp)
+leptris_add_test(test_namespace_cache dom/test_namespace_cache.cpp)
 leptris_add_test(test_map_lifecycle dom/test_map_lifecycle.cpp)
 leptris_add_test(test_simd_count parser/test_simd_count.cpp)
 leptris_add_test(test_ws_shape    parser/test_whitespace_shape.cpp)
@@ -259,16 +260,18 @@ if(Python3_FOUND)
         ENVIRONMENT "PYTHONPATH=")
 endif()
 
-# libFuzzer harness (TODO 40) — built only when LEPTRIS_ENABLE_FUZZING=ON.
-# Not a ctest target; invoked manually with corpus.
+# libFuzzer harnesses — built only when LEPTRIS_ENABLE_FUZZING=ON.
+# Not ctest targets; invoked manually with a corpus (or by the
+# nightly fuzz workflow, which invokes them at the build root —
+# subdirectory targets land under build/test/ by default).
 if(LEPTRIS_ENABLE_FUZZING)
-    add_executable(fuzz_parse ${CMAKE_CURRENT_SOURCE_DIR}/fuzz/fuzz_parse.c)
-    target_link_libraries(fuzz_parse PRIVATE leptris)
-    target_include_directories(fuzz_parse PRIVATE
-        ${PROJECT_SOURCE_DIR}/src/include)
-    # The harness doc and the nightly workflow invoke the binary at
-    # the build root, not under build/test/ where subdirectory
-    # targets land by default.
-    set_target_properties(fuzz_parse PROPERTIES
-        RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
+    foreach(target fuzz_parse fuzz_mutate fuzz_xpath)
+        add_executable(${target}
+            ${CMAKE_CURRENT_SOURCE_DIR}/fuzz/${target}.c)
+        target_link_libraries(${target} PRIVATE leptris)
+        target_include_directories(${target} PRIVATE
+            ${PROJECT_SOURCE_DIR}/src/include)
+        set_target_properties(${target} PROPERTIES
+            RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
+    endforeach()
 endif()

data/vendor-src/libleptris/test/abi/test_descriptor.cpp

@@ -407,6 +407,132 @@ TEST(PlanWalk, NestedScalarsAttributesCollections) {
     leptris_plan_free(plan);
 }
 
+/* leptris#1743: diamond-shared plan graphs — two sibling rows
+ * referencing the SAME plan index (lutaml-model's PlanCompiler
+ * emits recursive content models as a DAG; the binding flattens it
+ * identity-memoized). Each parent must walk the shared plan
+ * independently: b's <leaf> must materialize even though plan 1
+ * was already walked under a. */
+TEST(PlanWalk, SharedChildPlanIndexWalksPerParent) {
+    LeptrisDocument doc = parse(
+        "<n><a><leaf>x</leaf></a><b><leaf>y</leaf></b></n>");
+    ASSERT_NE(doc, nullptr);
+    LeptrisElement root = leptris_document_root(doc);
+
+    leptris_child_plan n_kids[2] = {
+        {"a", LEPTRIS_PLAN_KIND_NESTED, 1, 1},
+        {"b", LEPTRIS_PLAN_KIND_NESTED, 1, 1},
+    };
+    leptris_child_plan shared_kids[1] = {
+        {"leaf", LEPTRIS_PLAN_KIND_NESTED, 2, 2}};
+    leptris_element_plan plans[3] = {};
+    plans[0].element_name = "n";
+    plans[0].child_count = 2;
+    plans[0].child_plans = n_kids;
+    plans[1].element_name = "a";
+    plans[1].child_count = 1;
+    plans[1].child_plans = shared_kids;
+    plans[2].element_name = "leaf";
+
+    leptris_plan_spec spec = {};
+    spec.abi_version = leptris_plan_abi_version();
+    spec.plan_count = 3;
+    spec.plans = plans;
+
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisPlan plan = leptris_plan_build(&spec, &st);
+    ASSERT_NE(plan, nullptr);
+    EXPECT_EQ(st, LEPTRIS_OK);
+
+    LeptrisPlanResult r = leptris_plan_walk(doc, root, plan, &st);
+    ASSERT_NE(r, nullptr);
+    ASSERT_EQ(leptris_plan_value_count(r), 2u);
+
+    LeptrisPlanResult a = leptris_plan_value_at(r, 0);
+    ASSERT_NE(a, nullptr);
+    EXPECT_STREQ(leptris_plan_value_name(a), "a");
+    ASSERT_EQ(leptris_plan_value_count(a), 1u);
+    LeptrisPlanResult al = leptris_plan_value_at(a, 0);
+    EXPECT_STREQ(leptris_plan_value_name(al), "leaf");
+    EXPECT_EQ(leptris_plan_value_kind(al), LEPTRIS_PLAN_VALUE_ELEMENT);
+
+    LeptrisPlanResult b = leptris_plan_value_at(r, 1);
+    ASSERT_NE(b, nullptr);
+    EXPECT_STREQ(leptris_plan_value_name(b), "b");
+    ASSERT_EQ(leptris_plan_value_count(b), 1u);
+    LeptrisPlanResult bl = leptris_plan_value_at(b, 0);
+    EXPECT_STREQ(leptris_plan_value_name(bl), "leaf");
+    EXPECT_EQ(leptris_plan_value_kind(bl), LEPTRIS_PLAN_VALUE_ELEMENT);
+
+    leptris_plan_result_free(r);
+    leptris_plan_free(plan);
+    leptris_document_free(doc);
+}
+
+/* leptris#1743: RECURSIVE plan graphs — lutaml-model's
+ * PlanCompiler emits recursive content models as a plan CYCLE
+ * (entry -> sub -> entry); a NESTED row's target plan describes
+ * the element the row matches, so the cycle rides an
+ * intermediate plan. The binding flattens these identity-memoized
+ * (the flatten is where the STS runaway lived). The walk follows
+ * the DOCUMENT tree, so a finite document must materialize
+ * through every re-entry of the shared plans. */
+TEST(PlanWalk, RecursivePlanCycleWalksFiniteDocument) {
+    LeptrisDocument doc = parse(
+        "<entry><t>1</t><sub><entry><t>2</t></entry></sub></entry>");
+    ASSERT_NE(doc, nullptr);
+    LeptrisElement root = leptris_document_root(doc);
+
+    leptris_child_plan entry_kids[2] = {
+        {"t", LEPTRIS_PLAN_KIND_SCALAR, 1, -1},
+        {"sub", LEPTRIS_PLAN_KIND_NESTED, 2, 1},
+    };
+    leptris_child_plan sub_kids[1] = {
+        {"entry", LEPTRIS_PLAN_KIND_NESTED, 3, 0}};
+    leptris_element_plan plans[2] = {};
+    plans[0].element_name = "entry";
+    plans[0].child_count = 2;
+    plans[0].child_plans = entry_kids;
+    plans[1].element_name = "sub";
+    plans[1].child_count = 1;
+    plans[1].child_plans = sub_kids;
+
+    leptris_plan_spec spec = {};
+    spec.abi_version = leptris_plan_abi_version();
+    spec.plan_count = 2;
+    spec.plans = plans;
+
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisPlan plan = leptris_plan_build(&spec, &st);
+    ASSERT_NE(plan, nullptr);
+    EXPECT_EQ(st, LEPTRIS_OK);
+
+    LeptrisPlanResult r = leptris_plan_walk(doc, root, plan, &st);
+    ASSERT_NE(r, nullptr);
+    ASSERT_EQ(leptris_plan_value_count(r), 2u);
+
+    LeptrisPlanResult t1 = leptris_plan_value_at(r, 0);
+    ASSERT_NE(t1, nullptr);
+    EXPECT_STREQ(leptris_plan_value_string(t1), "1");
+
+    LeptrisPlanResult sub = leptris_plan_value_at(r, 1);
+    ASSERT_NE(sub, nullptr);
+    EXPECT_STREQ(leptris_plan_value_name(sub), "sub");
+    /* the cycle re-enters plan 0 for the entry inside sub */
+    ASSERT_EQ(leptris_plan_value_count(sub), 1u);
+    LeptrisPlanResult inner = leptris_plan_value_at(sub, 0);
+    ASSERT_NE(inner, nullptr);
+    EXPECT_STREQ(leptris_plan_value_name(inner), "entry");
+    ASSERT_EQ(leptris_plan_value_count(inner), 1u);
+    LeptrisPlanResult t2 = leptris_plan_value_at(inner, 0);
+    ASSERT_NE(t2, nullptr);
+    EXPECT_STREQ(leptris_plan_value_string(t2), "2");
+
+    leptris_plan_result_free(r);
+    leptris_plan_free(plan);
+    leptris_document_free(doc);
+}
+
 TEST(PlanWalk, RawCallbackAndMixedContent) {
     LeptrisDocument doc = parse(
         "<p>intro <b>bold</b> mid"

data/vendor-src/libleptris/test/dom/test_dom.cpp

@@ -3071,6 +3071,42 @@ TEST(DomAttachInstalled, ForeignMixedChainTextBeforeElement) {
     leptris_document_free(target);
 }
 
+/* leptris-ruby#487: the addr-based attach face ran
+ * leptris_element_get_document on the RAW child before any kind
+ * routing — for a TEXT child that reads element-form fields
+ * (namebp fast-outs, element parent offsets). A live inline text
+ * usually survives the misread; a recycled or heap-backed text
+ * hands the walk a wild pointer and the process dies. The face (and
+ * get_document itself) must be kind-safe. */
+TEST(DomAttachInstalled, TextChildAttachIsKindSafe) {
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);
+    ASSERT_NE(d, nullptr);
+    LeptrisElement root = leptris_document_root(d);
+
+    /* detached text via the public face — a non-element child */
+    LeptrisNodeRef text =
+        leptris_text_node_create(d, "hello");
+    ASSERT_NE(text, nullptr);
+    EXPECT_EQ(leptris_node_get_type(text), LEPTRIS_NODE_TYPE_TEXT);
+
+    /* get_document on the text must not crash and must not
+     * manufacture a bogus document pointer */
+    LeptrisDocument tdoc = leptris_element_get_document(
+        (LeptrisElement)text);
+    EXPECT_TRUE(tdoc == d || tdoc == nullptr);
+
+    /* the attach face with the text child must succeed */
+    EXPECT_EQ(leptris_element_add_child_addr_installed(
+                  (uintptr_t)root, (uintptr_t)text, NULL),
+              LEPTRIS_OK);
+    char* out = leptris_element_serialize(root, nullptr);
+    ASSERT_NE(out, nullptr);
+    EXPECT_STREQ(out, "<r>hello</r>");
+    leptris_free_string(out);
+    leptris_document_free(d);
+}
+
 TEST(DomAttachInstalled, SameDocumentReturnsArgument) {
     LeptrisStatus st = LEPTRIS_OK;
     LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);

data/vendor-src/libleptris/test/dom/test_namespace_cache.cpp

@@ -0,0 +1,89 @@
+#include <gtest/gtest.h>
+#include <cstring>
+
+#include "leptris.h"
+extern "C" {
+#include "element.h"
+#include "pool.h"
+#include "arena.h"
+}
+
+namespace {
+
+class NamespaceCacheInitialization : public ::testing::Test {
+protected:
+    LeptrisMemoryPool* pool = nullptr;
+    LeptrisElement element = nullptr;
+
+    void SetUp() override {
+        LeptrisArena* arena = leptris_arena_create(4096);
+        ASSERT_NE(arena, nullptr);
+        pool = leptris_pool_create_arena_backed(arena, 1);
+        if (!pool) leptris_arena_destroy(arena);
+        ASSERT_NE(pool, nullptr);
+        // Pool allocations are deliberately not zeroed. Poison the remaining
+        // arena so a new cache cannot pass by inheriting fresh OS zero pages.
+        std::memset(arena->base + arena->used, 0xa5, arena->size - arena->used);
+        element = static_cast<LeptrisElement>(
+            leptris_pool_alloc(pool, sizeof(*element)));
+        ASSERT_NE(element, nullptr);
+        std::memset(element, 0, sizeof(*element));
+    }
+
+    void TearDown() override {
+        leptris_pool_destroy(pool);
+    }
+
+    void ExpectEmptyAuxiliaryState(const leptris_ns_cache* cache) {
+        ASSERT_NE(cache, nullptr);
+        EXPECT_EQ(cache->declarations, nullptr);
+        EXPECT_EQ(cache->raw_attrs, nullptr);
+        EXPECT_EQ(cache->doc_next, nullptr);
+        EXPECT_EQ(cache->prefix_heap, 0);
+        EXPECT_EQ(cache->uri_heap, 0);
+        EXPECT_EQ(cache->child_gen, 0u);
+        EXPECT_EQ(cache->child_cached_gen, 0u);
+        EXPECT_EQ(cache->child_idx, 0u);
+        EXPECT_EQ(cache->child_node, nullptr);
+        // The public raw-attribute read must see no phantom journal entries.
+        // Avoid following the poisoned pointer if the assertion above failed.
+        if (!cache->raw_attrs) {
+            EXPECT_EQ(leptris_element_attributes_raw(element, nullptr, nullptr, 0), 0u);
+        }
+    }
+};
+
+TEST_F(NamespaceCacheInitialization, PrefixSetterStartsWithEmptyAuxiliaryState) {
+    char prefix[] = "p";
+    leptris_elem_set_prefix(element, prefix, pool);
+    const auto* cache = elem_get_ns_cache(element);
+    ASSERT_NE(cache, nullptr);
+    EXPECT_EQ(cache->prefix, prefix);
+    EXPECT_EQ(cache->namespace_uri, nullptr);
+    ExpectEmptyAuxiliaryState(cache);
+}
+
+TEST_F(NamespaceCacheInitialization, NamespaceSetterStartsWithEmptyAuxiliaryState) {
+    char uri[] = "urn:example";
+    leptris_elem_set_ns_uri(element, uri, pool);
+    const auto* cache = elem_get_ns_cache(element);
+    ASSERT_NE(cache, nullptr);
+    EXPECT_EQ(cache->prefix, nullptr);
+    EXPECT_EQ(cache->namespace_uri, uri);
+    ExpectEmptyAuxiliaryState(cache);
+}
+
+TEST_F(NamespaceCacheInitialization, EnsureStartsEmptyAndPreservesExistingCache) {
+    auto* cache = leptris_elem_cache_ensure(element, pool);
+    ASSERT_NE(cache, nullptr);
+    EXPECT_EQ(cache->prefix, nullptr);
+    EXPECT_EQ(cache->namespace_uri, nullptr);
+    ExpectEmptyAuxiliaryState(cache);
+
+    // Reusing a cache must preserve the state its consumers already stored.
+    cache->child_gen = 7;
+    EXPECT_EQ(leptris_elem_cache_ensure(element, pool), cache);
+    EXPECT_EQ(cache->child_gen, 7u);
+}
+
+} // namespace

data/vendor-src/libleptris/test/fuzz/fuzz_mutate.c

@@ -0,0 +1,146 @@
+/* test/fuzz/fuzz_mutate.c — libFuzzer harness for the MUTATION API
+ * (approach ported from teptris's op-driven fuzz_dump): the input
+ * bytes drive a deterministic builder/mutation sequence — element
+ * creation, attribute and text edits, append/insert/remove, and
+ * cross-document adoption — against three documents (a RECOVER
+ * parse, a second parse, and a fresh programmatic one), then the
+ * final trees serialize and re-parse. Invariants under ASan/UBSan:
+ * no crash, no leak, every op result consumed; status errors from
+ * rejected ops (cycles, foreign shapes) are fine — that IS the
+ * contract. The mutation faces are where the adopt/copy and
+ * sibling-chain bug classes lived (#1755, #1717, #1636). */
+#include "leptris.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const char* const kNames[] = {
+    "a", "b", "r", "item", "p", "x"};
+#define MUT_ALPHA 6
+
+static const char* name_at(const uint8_t* d, size_t sz, size_t i) {
+    return sz ? kNames[d[i % sz] % MUT_ALPHA] : kNames[0];
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size < 4 || size > (1u << 20)) return 0;
+
+    /* First half: markup for two documents. Second half: ops. */
+    size_t cut = 1 + (size % (size / 2 ? size / 2 : 1));
+    if (cut >= size) cut = size / 2;
+    const uint8_t* ops = data + cut;
+    size_t nops = size - cut;
+    if (nops > 256) nops = 256;
+
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = 1;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc =
+        leptris_parse_string_ex((const char*)data, cut, &opts, &st);
+    if (!doc) return 0;
+    LeptrisDocument doc2 = leptris_parse_string_ex(
+        (const char*)data + cut, nops, &opts, &st);
+    if (!doc2) {
+        leptris_document_free(doc);
+        return 0;
+    }
+    LeptrisDocument fresh = leptris_document_create();
+
+    /* A stable pool of nodes to point ops at: the docs' roots, the
+     * fresh doc's created children, and a few created elements. */
+    enum { POOL = 8 };
+    LeptrisElement pool[POOL] = {0};
+    LeptrisElement root = leptris_document_root(doc);
+    LeptrisElement root2 = leptris_document_root(doc2);
+    if (root) pool[0] = root;
+    if (root2) pool[1] = root2;
+    if (root)
+        for (int i = 2, j = 0; i < POOL && j < 3; j++) {
+            LeptrisElement c = leptris_element_create(fresh, "c");
+            if (!c) break;
+            pool[i++] = c;
+        }
+
+    for (size_t k = 0; k + 1 < nops; k += 2) {
+        unsigned op = ops[k] % 10u;
+        LeptrisElement tgt = pool[ops[k + 1] % POOL];
+        if (!tgt) continue;
+        const char* name = name_at(data, size, k);
+        switch (op) {
+            case 0: {
+                LeptrisElement e = leptris_element_create(doc, name);
+                if (e) (void)leptris_element_append_child(tgt, e);
+                break;
+            }
+            case 1: {
+                /* cross-document adopt-by-copy (#1528/#1755) */
+                LeptrisElement e =
+                    leptris_element_create(doc2, name);
+                if (e) (void)leptris_element_append_child(tgt, e);
+                break;
+            }
+            case 2:
+                (void)leptris_element_set_text(tgt, name);
+                break;
+            case 3:
+                (void)leptris_element_set_attribute(tgt, name, "v");
+                break;
+            case 4:
+                (void)leptris_element_remove_attribute(tgt, name);
+                break;
+            case 5: {
+                LeptrisElement kid =
+                    leptris_element_first_child_any(tgt);
+                if (kid)
+                    (void)leptris_element_remove_child(tgt, kid);
+                break;
+            }
+            case 6:
+                (void)leptris_element_remove_children(tgt);
+                break;
+            case 7: {
+                /* insert_before with a fresh sibling of the target's
+                 * parent (cycle rejection walks the parent chain) */
+                LeptrisElement p = leptris_element_parent(tgt);
+                if (p) {
+                    LeptrisElement e =
+                        leptris_element_create(doc, name);
+                    if (e) (void)leptris_element_insert_before(
+                            tgt, e);
+                }
+                break;
+            }
+            case 8: {
+                char* out = leptris_document_serialize(doc, NULL);
+                if (out) leptris_free_string(out);
+                break;
+            }
+            default: {
+                LeptrisXPathResult r =
+                    leptris_xpath_eval(doc, NULL, "//node()");
+                if (r) leptris_xpath_result_free(r);
+                break;
+            }
+        }
+    }
+
+    /* Final trees must serialize and re-parse without incident. */
+    LeptrisDocument docs[3] = {doc, doc2, fresh};
+    for (int i = 0; i < 3; i++) {
+        char* out = leptris_document_serialize(docs[i], NULL);
+        if (out) {
+            LeptrisParseOptions back_opts;
+            memset(&back_opts, 0, sizeof(back_opts));
+            back_opts.recover = 1;
+            LeptrisStatus st2 = LEPTRIS_OK;
+            LeptrisDocument back = leptris_parse_string_ex(
+                out, strlen(out), &back_opts, &st2);
+            if (back) leptris_document_free(back);
+            leptris_free_string(out);
+        }
+        leptris_document_free(docs[i]);
+    }
+    return 0;
+}

data/vendor-src/libleptris/test/fuzz/fuzz_parse.c

@@ -1,40 +1,49 @@
-/* test/fuzz/fuzz_parse.c — libFuzzer harness for leptris_parse_string.
- *
- * Run:
- *   cmake -B build -S . -DLEPTRIS_ENABLE_FUZZING=ON
- *   cmake --build build --target fuzz_parse
- *   mkdir -p corpus && cp test/fixtures/*.xml corpus/
- *   ./build/fuzz_parse -max_total_time=600 corpus/
- *
- * Crashes are written to crash-*; add them as regression tests.
- *
- * See TODO 40.
- */
-
+/* test/fuzz/fuzz_parse.c — libFuzzer harness for the parse surface
+ * (approach ported from teptris test/fuzz): parse -> serialize ->
+ * re-parse, under both the default and the RECOVER parse mode. The
+ * invariants under fuzz are the memory-safety contracts (no crash
+ * under ASan/UBSan, no leak — every parse path frees or transfers
+ * its document), not semantic correctness — the conformance suites
+ * own that. The serialize output is engine-owned memory; re-parsing
+ * it exercises the serializer's guarantee that its bytes parse
+ * back. */
 #include "leptris.h"
 
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
-int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-    /* Avoid pathological inputs that immediately exceed the depth limit
-     * (already covered by tests).  Cap input size for speed. */
-    if (size > 1024 * 1024) return 0;
+static void round_trip(const char* data, size_t size, int recover) {
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = recover;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string_ex(data, size, &opts, &st);
+    if (st != LEPTRIS_OK && doc == NULL) return;
 
-    LeptrisStatus st;
-    LeptrisDocument doc = leptris_parse_string((const char*)data, size, &st);
+    /* exercise XPath against whatever tree came back */
+    LeptrisXPathResult r = leptris_xpath_eval(doc, NULL, "//node()");
+    if (r) leptris_xpath_result_free(r);
 
-    if (doc) {
-        /* Exercise serialize + free to catch use-after-free in cleanup. */
-        char* out = leptris_document_serialize(doc, NULL);
-        if (out) leptris_free_string(out);
+    char* out = leptris_document_serialize(doc, NULL);
+    if (out) {
+        LeptrisParseOptions opts2;
+        memset(&opts2, 0, sizeof(opts2));
+        opts2.recover = recover;
+        LeptrisStatus st2 = LEPTRIS_OK;
+        LeptrisDocument doc2 = leptris_parse_string_ex(
+            out, strlen(out), &opts2, &st2);
+        if (doc2) leptris_document_free(doc2);
+        leptris_free_string(out);
+    }
+    leptris_document_free(doc);
+}
 
-        /* Also exercise XPath on the parsed document — catches bugs
-         * in the evaluator's interaction with the DOM. */
-        LeptrisXPathResult r = leptris_xpath_eval(doc, NULL, "//node()");
-        if (r) leptris_xpath_result_free(r);
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    /* Cap input size for speed; the depth cap is tested elsewhere. */
+    if (size == 0 || size > (1u << 20)) return 0;
 
-        leptris_document_free(doc);
-    }
+    round_trip((const char*)data, size, 0);
+    round_trip((const char*)data, size, 1);
     return 0;
 }

data/vendor-src/libleptris/test/fuzz/fuzz_xpath.c

@@ -0,0 +1,67 @@
+/* test/fuzz/fuzz_xpath.c — libFuzzer harness for the XPath evaluator
+ * (approach ported from teptris's fuzz_plan): the input parses into
+ * a document, then a fixed ALPHABET of expressions — paths and
+ * predicates that overlap the corpus shapes — evaluates against it
+ * and every result accessor drains, including kind-mismatched reads
+ * (the contract answers those with NULL/0/false, never a crash).
+ * Invariants under ASan/UBSan: evaluator and result lifetimes, node
+ * handles into a live document, no leaks. */
+#include "leptris.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const char* const kExprs[] = {
+    "//node()",
+    "//*",
+    "//@*",
+    "/a/b",
+    "//item[@id='1']",
+    "//p[@*]",
+    "count(//*)",
+    "string(//a)",
+    "number(//@n)",
+    "boolean(//x)",
+    "//a[2]/following-sibling::*",
+    "//@xmlns:*/..",
+    "//* | //@* | //text()",
+};
+#define XPATH_ALPHA ((int)(sizeof(kExprs) / sizeof(kExprs[0])))
+
+static void drain(LeptrisXPathResult r) {
+    if (!r) return;
+    size_t n = leptris_xpath_result_count(r);
+    for (size_t i = 0; i < n; i++) {
+        LeptrisElement e = leptris_xpath_result_get(r, i);
+        (void)e; /* a handle into the live document — no deref race */
+        (void)leptris_xpath_result_node_kind(r, i);
+    }
+    LeptrisNodeRef nodes[8];
+    LeptrisXPathNodeKind kinds[8];
+    (void)leptris_xpath_result_get_nodes_ex(r, nodes, kinds, 8);
+    char* whole = leptris_xpath_result_string(r);
+    if (whole) leptris_free_string(whole);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size == 0 || size > (1u << 20)) return 0;
+
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = 1;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc =
+        leptris_parse_string_ex((const char*)data, size, &opts, &st);
+    if (!doc) return 0;
+
+    for (int i = 0; i < XPATH_ALPHA; i++) {
+        LeptrisXPathResult r =
+            leptris_xpath_eval(doc, NULL, kExprs[i]);
+        drain(r);
+        if (r) leptris_xpath_result_free(r);
+    }
+
+    leptris_document_free(doc);
+    return 0;
+}

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.366",
+  "version": "1.9.368",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.366.2
+  version: 1.9.368.1
 platform: ppc64le-linux
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-17 00:00:00.000000000 Z
+date: 2026-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -745,6 +745,7 @@ files:
 - vendor-src/libleptris/test/dom/test_dom.cpp
 - vendor-src/libleptris/test/dom/test_element_children.cpp
 - vendor-src/libleptris/test/dom/test_map_lifecycle.cpp
+- vendor-src/libleptris/test/dom/test_namespace_cache.cpp
 - vendor-src/libleptris/test/dom/test_node_surface_parity.cpp
 - vendor-src/libleptris/test/dom/test_text_borrowed.cpp
 - vendor-src/libleptris/test/dom/test_vtable.cpp
@@ -755,7 +756,9 @@ files:
 - vendor-src/libleptris/test/fixtures/malformed.xml
 - vendor-src/libleptris/test/fixtures/namespaces.xml
 - vendor-src/libleptris/test/fixtures/utf16_decl.xml
+- vendor-src/libleptris/test/fuzz/fuzz_mutate.c
 - vendor-src/libleptris/test/fuzz/fuzz_parse.c
+- vendor-src/libleptris/test/fuzz/fuzz_xpath.c
 - vendor-src/libleptris/test/html/html5lib-redlist.txt
 - vendor-src/libleptris/test/html/html5lib-tests/LICENSE
 - vendor-src/libleptris/test/html/html5lib-tests/README.md