leptris 1.9.368.1 → 1.9.369.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30686ca983cb245b5c714d377fcfc15564120e9a9d07b214404d421ecc061ad6
-  data.tar.gz: 9533b2b213a8223e0e44ac82869859e9db9d9459e61531679cf8e9f27f1e6eaf
+  metadata.gz: 119dd3417c3112db688622491e4f7bc2b748557dee198b4f10ce11d70b5a7cf7
+  data.tar.gz: 702eb13ed592dc01276376bf251b5ecfe53f121779e1d49133fb8600dd340395
 SHA512:
-  metadata.gz: 2aac2d092f0d80717257a49e7cdbee6607ce52759c9d711d48704320ca52a0b6b6ea3e536cc115d86631669d81072e9da6e50ee568fc9c41686e5e1fbb32be53
-  data.tar.gz: d260eb007e6a21cc5fc7f295b3707c49012576397688fa929e630eb9a8fe7e14664ae05da4971ed951f718077699faed8b9bef841e5c61e7d45752a338921aac
+  metadata.gz: f771d5a9356384f1a80a34fcf6a8ce5c6903091c328b0a9330e646908c9c3a493a15206902d8eed0ed44c77d6c618c990e77afea8da3459702c5e2f0257b5608
+  data.tar.gz: 6b6526cff3611273d3c44d2738d56db4807f1f51e23ae3ba008970765227b6544ec81fa074ff76c887dfaceb6e8c7566456189f93713dfbf20a5e0a0aea3e285

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.368"
+LIBLEPTRIS_VERSION = "1.9.369"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.368.1"
+  VERSION = "1.9.369.1"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.368
+- libleptris v1.9.369
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,24 @@
 ## [Unreleased]
 
+## [1.9.369] - 2026-10-18
+
+### Added
+
+- **test: falsifiable kind-safety pin for the #487 class (PR #1765).**
+  The #487 fix's original contract test passes on both sides of the fix
+  (a pool-created detached text survives the element-form misread), so
+  it could not catch a regression. `OversizedTextKindSafe` uses the
+  shape that actually crashed in the wild — HEAP-BACKED text (oversized
+  content leaves the inline-window allocation) — and asserts the
+  kind-safe contract end to end: get_document answers the text's own
+  owner document (the observable red on pre-fix source was NULL — the
+  same element-form misread that wild-pointer-walked under the
+  reporter's GC timing), and the oversized text attaches through the
+  addr face and round-trips byte-exactly. Falsifiability verified both
+  ways: RED on pre-fix source (deterministic NULL), GREEN on the
+  fixed source. Test-only.
+
+
 ## [1.9.368] - 2026-10-18
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.368
+    VERSION 1.9.369
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/test/dom/test_dom.cpp

@@ -3078,6 +3078,36 @@ TEST(DomAttachInstalled, ForeignMixedChainTextBeforeElement) {
  * usually survives the misread; a recycled or heap-backed text
  * hands the walk a wild pointer and the process dies. The face (and
  * get_document itself) must be kind-safe. */
+/* leptris-ruby#487, the falsifiable pin: the crashing texts in the
+ * wild were HEAP-BACKED (oversized content leaves the inline window —
+ * the pool-created text of TextChildAttachIsKindSafe survives the
+ * element-form misread, so that test alone cannot go red). An
+ * oversized text must resolve its document through its OWN owner
+ * field, attach, and round-trip — never through element-form reads. */
+TEST(DomAttachInstalled, OversizedTextKindSafe) {
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);
+    ASSERT_NE(d, nullptr);
+    LeptrisElement root = leptris_document_root(d);
+
+    std::string big(8192, 'x');
+    LeptrisNodeRef text = leptris_text_node_create(d, big.c_str());
+    ASSERT_NE(text, nullptr);
+    EXPECT_EQ(leptris_node_get_type(text), LEPTRIS_NODE_TYPE_TEXT);
+
+    /* kind-safe document resolution: the text's OWN owner doc */
+    EXPECT_EQ(leptris_element_get_document((LeptrisElement)text), d);
+
+    EXPECT_EQ(leptris_element_add_child_addr_installed(
+                  (uintptr_t)root, (uintptr_t)text, NULL),
+              LEPTRIS_OK);
+    char* out = leptris_element_serialize(root, nullptr);
+    ASSERT_NE(out, nullptr);
+    EXPECT_EQ(std::string(out), "<r>" + big + "</r>");
+    leptris_free_string(out);
+    leptris_document_free(d);
+}
+
 TEST(DomAttachInstalled, TextChildAttachIsKindSafe) {
     LeptrisStatus st = LEPTRIS_OK;
     LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.368",
+  "version": "1.9.369",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.368.1
+  version: 1.9.369.1
 platform: ruby
 authors:
 - Ribose Inc.