leptris 1.9.368.1-ppc64le-linux → 1.9.369.1-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9f080aaa7146688d0de80520eb91b6377e22fa1ff6b45033ac349b7b24b274f
-  data.tar.gz: ee97afd2b4faaf64a9d57bec5633bc5a026bda9e6fb192d8b3cd34a6f0192672
+  metadata.gz: 0f451671bfbfef2c8214b8b0048cd9e194a11d0fc785a4103d55d4b6ab433b8b
+  data.tar.gz: 3dba06c1dcd64872e7fbb5c6571973eae7851bc169ee339c9f7f3de317869bb7
 SHA512:
-  metadata.gz: 3abda08bb47737ca15bee7ec88e64c5f98887b8fe050e70defd72e961fb609398e56f9f80a23142a47a92f398234d0bf42f170a9e323c5fa9032dff33c9a0a22
-  data.tar.gz: 282b05fdc6b475a5075f3348d4d24186c9f0f4c10bd9cb119076661f9f909b88c7484a7ab9d41616d34ff6241a1c061919fccb2e9d8deb8f40f84846cb082e56
+  metadata.gz: 350a63801e8dda06cf2c77b76183eaef92d10a7af1ab3734b2b673f81c56a4aa394c9c87b8cf707b4336fc9152ee74d531ae1a16eda611794e4aa81a2eeccb24
+  data.tar.gz: ec987fd143eeae44588459b5a1394d56bc540a2496ac9ec7df4c068fd7ed6e2dec91697f90e7e1e6c31102048e285959cdb3a7964230002847cc0d1f1b6ea7ff

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.368"
+LIBLEPTRIS_VERSION = "1.9.369"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.368.1"
+  VERSION = "1.9.369.1"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.368
+- libleptris v1.9.369
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,24 @@
 ## [Unreleased]
 
+## [1.9.369] - 2026-10-18
+
+### Added
+
+- **test: falsifiable kind-safety pin for the #487 class (PR #1765).**
+  The #487 fix's original contract test passes on both sides of the fix
+  (a pool-created detached text survives the element-form misread), so
+  it could not catch a regression. `OversizedTextKindSafe` uses the
+  shape that actually crashed in the wild — HEAP-BACKED text (oversized
+  content leaves the inline-window allocation) — and asserts the
+  kind-safe contract end to end: get_document answers the text's own
+  owner document (the observable red on pre-fix source was NULL — the
+  same element-form misread that wild-pointer-walked under the
+  reporter's GC timing), and the oversized text attaches through the
+  addr face and round-trips byte-exactly. Falsifiability verified both
+  ways: RED on pre-fix source (deterministic NULL), GREEN on the
+  fixed source. Test-only.
+
+
 ## [1.9.368] - 2026-10-18
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.368
+    VERSION 1.9.369
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/test/dom/test_dom.cpp

@@ -3078,6 +3078,36 @@ TEST(DomAttachInstalled, ForeignMixedChainTextBeforeElement) {
  * usually survives the misread; a recycled or heap-backed text
  * hands the walk a wild pointer and the process dies. The face (and
  * get_document itself) must be kind-safe. */
+/* leptris-ruby#487, the falsifiable pin: the crashing texts in the
+ * wild were HEAP-BACKED (oversized content leaves the inline window —
+ * the pool-created text of TextChildAttachIsKindSafe survives the
+ * element-form misread, so that test alone cannot go red). An
+ * oversized text must resolve its document through its OWN owner
+ * field, attach, and round-trip — never through element-form reads. */
+TEST(DomAttachInstalled, OversizedTextKindSafe) {
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);
+    ASSERT_NE(d, nullptr);
+    LeptrisElement root = leptris_document_root(d);
+
+    std::string big(8192, 'x');
+    LeptrisNodeRef text = leptris_text_node_create(d, big.c_str());
+    ASSERT_NE(text, nullptr);
+    EXPECT_EQ(leptris_node_get_type(text), LEPTRIS_NODE_TYPE_TEXT);
+
+    /* kind-safe document resolution: the text's OWN owner doc */
+    EXPECT_EQ(leptris_element_get_document((LeptrisElement)text), d);
+
+    EXPECT_EQ(leptris_element_add_child_addr_installed(
+                  (uintptr_t)root, (uintptr_t)text, NULL),
+              LEPTRIS_OK);
+    char* out = leptris_element_serialize(root, nullptr);
+    ASSERT_NE(out, nullptr);
+    EXPECT_EQ(std::string(out), "<r>" + big + "</r>");
+    leptris_free_string(out);
+    leptris_document_free(d);
+}
+
 TEST(DomAttachInstalled, TextChildAttachIsKindSafe) {
     LeptrisStatus st = LEPTRIS_OK;
     LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.368",
+  "version": "1.9.369",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.368.1
+  version: 1.9.369.1
 platform: ppc64le-linux
 authors:
 - Ribose Inc.