leptris 1.9.385.0-ppc64le-linux → 1.9.386.0-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70c7c46f84000ef1dbedd0367cfcb8231a77aaa185f5bfa9eadd7cfa46731eb7
-  data.tar.gz: e048fbc5ae240341068767084703d66e551e89cffcaa805a27a66eb1369e46c4
+  metadata.gz: 693b3140d5bc11495cb1fe2569a09502e30a93ffbd0174352428f5fa8db73843
+  data.tar.gz: b68d2e270256b7d92056189a417100fd01c0d71982e6f69a81b9f83cfeac8495
 SHA512:
-  metadata.gz: b4b8cc4d89e1ed4a7dcf627d84603d0494b318a0cbf7dfb13372adcadafd40859f49c43df41106ca06b5872b193e9b69f4469c7326016acf5ce93d4581d1320c
-  data.tar.gz: 8848542808eb2d2cf13c459e71eff7035e72373f6f646f73212699936b7c61bf10855d6eb2c7eb2a22b5fdce6d55661909c10b70be5b4540e537481090286340
+  metadata.gz: 526a5ff1640e8adc2c107e0f5289e388eb9cd236fe6c47d8bc54c57a9e0bbf31dde18e0ed3d03ce9a8301f004cb51fef481d9c3b4bb820d9da418b338c96eed2
+  data.tar.gz: 6b0e71839d07aa3734bff6c110da078a7cfa597404bb891e14590756b230928a6058968d265bf6af1c30a24ec34ec01a588a703830d036a23b288de9d897d2a0

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.384"
+LIBLEPTRIS_VERSION = "1.9.387"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.385.0"
+  VERSION = "1.9.386.0"
 end

data/lib/leptris/xml/document.rb

@@ -692,7 +692,17 @@ class Leptris::XML::Document
   def absorbed?
     !@absorbed_into.nil?
   end
-  private :absorbed?
+
+  # leptris#1866: cross-document adoption lifetime anchor — the
+  # target document keeps the source alive so no wrapper/cache can
+  # outlive the source arena (standoc svg cleanup crash).
+  def retain_source_document!(source)
+    return unless source.is_a?(Leptris::XML::Document)
+    return if source.equal?(self)
+    (@retained_sources ||= []) << source
+    source
+  end
+
   def free
     return if @freed.state == :freed
     @freed.state = :freed

data/lib/leptris/xml/element.rb

@@ -494,16 +494,19 @@ class Leptris::XML::Element < Leptris::XML::Node
       prefix = key.start_with?("xmlns:") ? key.delete_prefix("xmlns:") : nil
       node.add_namespace_definition(prefix, uri)
     end
-    # libxml2 reparent parity (moxml #208 lineage): an OWN
-    # declaration the attach target already resolves identically
-    # is redundant — prune it so serialized output does not
-    # re-declare (libxml2 drops these on reparent). Shadowing
-    # declarations (same prefix, different URI) are preserved.
-    node.namespace_definitions.each do |ns|
-      key = ns.prefix ? "xmlns:#{ns.prefix}" : "xmlns"
-      next unless target_scope[key] == ns.href
-      node.remove_namespace_definition(ns.prefix)
-    end
+    # leptris#1866: the own-declaration PRUNE that used to live here
+    # (libxml2 reparent parity, moxml #208 lineage) is REMOVED — it
+    # is unsound on this engine. The engine's cross-document deep
+    # copy resolves each copied element's namespace through the
+    # SOURCE's in-scope declarations at copy time: pruning an own
+    # declaration made every descendant copy lose its namespace URI
+    # (adopted svgs fell out of the SVG namespace; classupdate's
+    # namespaced queries then matched nothing and the attribute
+    # write path corrupted a sibling attr name — <use =""> and the
+    # standoc svg-cleanup segfaults). libxml2 gets away with the
+    # prune because its nodes keep per-node URIs on reparent; the
+    # redundant xmlns in the serialized copy is the correct output
+    # here.
     nil
   end
 
@@ -559,6 +562,7 @@ class Leptris::XML::Element < Leptris::XML::Node
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces_for_sibling)
       end
       @document&.advance_version
+      @document&.retain_source_document!(node.document)
       Leptris::XML::FFI.check_status(
         Leptris::XML::FFI.leptris_element_insert_after(c_ptr, node.c_ptr))
       Leptris::XML::Node.invalidate_cross_document!(node, @document)
@@ -595,6 +599,7 @@ class Leptris::XML::Element < Leptris::XML::Node
         Leptris::XML::Element.lift_namespaces_for_adoption(node, namespaces_for_sibling)
       end
       @document&.advance_version
+      @document&.retain_source_document!(node.document)
       Leptris::XML::FFI.check_status(
         Leptris::XML::FFI.leptris_element_insert_before(c_ptr, node.c_ptr))
       Leptris::XML::Node.invalidate_cross_document!(node, @document)

data/lib/leptris/xml/ffi.rb

@@ -442,6 +442,16 @@ module Leptris
       PLAN_OP_END = 3
       attach_function :leptris_plan_result_build,
         [:leptris_plan, :pointer, :size_t, :pointer], :leptris_plan_result
+      # libleptris 1.9.387: the packed-blob lane of the same face
+      # (five uint32 per op plus name/value bytes). SOFT attach —
+      # engines before 1.9.387 lack the symbol.
+      begin
+        attach_function :leptris_plan_result_build_packed,
+          [:leptris_plan, :pointer, :size_t, :pointer],
+          :leptris_plan_result
+      rescue ::FFI::NotFoundError
+        nil
+      end
 
       # libleptris 1.9.312 (#1551): serialize a walk result back
       # to XML guided by its plan — the plan supplies element
@@ -750,6 +760,26 @@ attach_function :leptris_parse_string,
         [:leptris_element, :pointer, :pointer, :size_t], :size_t
       attach_function :leptris_element_children,
         [:leptris_element, :pointer, :size_t], :size_t
+      # libleptris 1.9.387 engine faces not yet wrapped in Ruby —
+      # attached so the export audit stays in lockstep; adoption
+      # wraps them (leptris#1855 batch children: (addr, kind) pairs,
+      # document order only when cap >= count; #1874 namespace
+      # snapshot: one crossing per subtree, rows are seven uint32
+      # (depth, name_count, names_off, prefix_off, prefix_len,
+      # href_off, href_len) into a caller blob, 0xFFFFFFFF prefix_off
+      # = default-ns declaration; #1855 ask-2 name compare: strcmp
+      # semantics, non-elements compare as the empty string).
+      begin
+        attach_function :leptris_element_children_batch,
+          [:pointer, :pointer, :pointer, :size_t], :size_t
+        attach_function :leptris_node_name_compare,
+          [:pointer, :string, :size_t], :int
+        attach_function :leptris_element_namespace_declarations_snapshot,
+          [:leptris_element, :pointer, :size_t, :pointer,
+           :pointer, :size_t, :pointer], :size_t
+      rescue ::FFI::NotFoundError
+        nil
+      end
       attach_function :leptris_node_as_element,
         [:leptris_node_ref], :leptris_element
       attach_function :leptris_element_as_node,
@@ -1391,6 +1421,18 @@ attach_function :leptris_parse_string,
       # handles, exactly like the string face.
       attach_function :leptris_xsd_compile_file,
         [:string, :pointer], :leptris_xsd_schema
+      # libleptris 1.9.387 (leptris#1881): compile a SET of schema
+      # documents (NULL-terminated char* array) into one schema —
+      # imports resolve across the whole set, so substitution-group
+      # members declared in importing documents are visible to the
+      # head's content model. SOFT attach: engines before 1.9.387
+      # lack the symbol.
+      begin
+        attach_function :leptris_xsd_compile_set,
+          [:pointer, :size_t, :pointer], :leptris_xsd_schema
+      rescue ::FFI::NotFoundError
+        nil
+      end
       attach_function :leptris_xsd_free,
         [:leptris_xsd_schema], :void
       attach_function :leptris_xsd_declaration_count,

data/lib/leptris/xml/xsd.rb

@@ -16,6 +16,12 @@ module Leptris::XML::XSD
     Schema.compile_file(path)
   end
 
+  # Compile a set of schema documents (paths) into one schema
+  # (libleptris >= 1.9.387): imports resolve across the whole set.
+  def compile_set(paths)
+    Schema.compile_set(paths)
+  end
+
   # Slice 2 (libleptris 1.9.319, #1075): built-in lexical table.
   # +builtin+ takes the "xs:NAME" reference spelling. Returns
   # true/false; an unknown table name raises — a silent false
@@ -101,6 +107,35 @@ module Leptris::XML::XSD
       new(Handle.new(raw))
     end
 
+    # Compile a SET of schema documents (paths) into one schema:
+    # imports resolve across the whole set, so components declared
+    # in importing documents (substitution-group members, derived
+    # types) are visible to the head's content models — the
+    # one-document compile cannot see them (libleptris 1.9.387,
+    # leptris#1881). Requires the leptris_xsd_compile_set face.
+    def self.compile_set(paths)
+      paths = paths.map { |p| p.to_s }
+      raise ArgumentError, "schema set needs at least one path" if paths.empty?
+      unless Leptris::XML::FFI.respond_to?(:leptris_xsd_compile_set)
+        raise Leptris::XML::Error,
+              "Schema.compile_set requires libleptris 1.9.387+ " \
+              "(the leptris_xsd_compile_set face)"
+      end
+
+      strings = paths.map { |p| ::FFI::MemoryPointer.from_string(p) }
+      array = ::FFI::MemoryPointer.new(:pointer, strings.size)
+      array.write_array_of_pointer(strings)
+      status = ::FFI::MemoryPointer.new(:int)
+      raw = Leptris::XML::FFI.leptris_xsd_compile_set(array, strings.size,
+                                                      status)
+      if raw.null?
+        raise Leptris::XML::Error,
+          "schema set compile failed (status #{status.read_int}): " \
+          "#{paths.join(', ')}"
+      end
+      new(Handle.new(raw))
+    end
+
     # Number of top-level schema declarations the compiler
     # recognized (elements, types, groups, ...).
     def declaration_count

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.384
+- libleptris v1.9.387
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,140 @@
 ## [Unreleased]
 
+## [1.9.387] - 2026-10-28
+
+### Added
+
+- **XSD: schema-set compilation — `leptris_xsd_compile_set(paths, count,
+  status)` (leptris#1881).** A head document cannot see
+  substitution-group members declared in schemas that IMPORT it —
+  nothing loads those from the head alone, so the head's content model
+  could never match the member. The set face merges every listed
+  document into ONE schema: per-document checks and capture with
+  per-unit target namespaces, a shared visited-set so each unit
+  captures exactly once in either member order, and extension bases
+  resolving once after all units are in. The deferred extension-base
+  fold now records the base QName's RESOLVED namespace
+  (`ext_base_ns`, prefix resolved against the extension element's
+  in-scope declarations) — set compilation extends ACROSS units
+  (g:foo1 extends f:foo), which the old same-ns fallback silently
+  dropped into an empty model.
+
+### Fixed
+
+- **XSD: `processContents="skip"` wildcards impose no constraint on
+  matched children (leptris#1879).** XSD 1.0 §3.9.4.2 — the engine
+  found the child's global declaration and validated its lexical type
+  anyway (`<a>1</a>` under a skip wildcard rejected `1` as a bad
+  xs:ID; the W3C suite addB130/addB140 expect it valid).
+  `XsdCm` records the processContents level (strict/lax/skip) at both
+  wildcard capture sites; validate_children computes the strongest
+  level among the wildcards admitting each child (the attribute
+  wildcard's namespace-grammar matcher, unit-tns aware) and skips
+  skip-admitted children entirely. Lax keeps validating declared
+  children; wildcard-admitted undeclared names pass under every
+  level (the pinned moxml#460 notQName semantics).
+
+- **XSD: attributeGroup refs resolve regardless of declaration order
+  (leptris#1880).** Top-level declarations form one symbol space, but
+  the ref expansion looked up `s->attr_groups` at capture time — a
+  group declared AFTER the referencing type was silently dropped
+  (W3C suite addB096). Top-level `xs:attributeGroup` definitions are
+  now captured in a pre-pass at the head of `xsd_capture_root`;
+  the main walk skips already-captured names instead of shadowing.
+
+- **XSD: length facets measure the VALUE SPACE (leptris#1882).** On
+  list types the length family counts whitespace-separated ITEMS, not
+  characters (`xs:IDREFS` + `length=2` accepts `a b`, was rejected as
+  3 characters; the minLength/maxLength NMTOKENS rows flip likewise).
+  The list detection walks the base chain — a restriction OF a list
+  keeps `deriv=RESTRICT`, so `xsd_chain_is_list` resolves through
+  local bases and threads a flag into the facet gate. And
+  `xs:QName`/`xs:NOTATION` have no length family at all (Part 2
+  §4.3.1–4.3.3 applicability): the gate skips those comparisons
+  entirely.
+
+- **XSD: the builtin lexical table converges on Datatypes Part 2
+  (leptris#1883)** — thirteen rows disagreed in both directions.
+  Over-strict, now valid: `xs:token` accepts any whitespace shape
+  (collapse is total); `xs:ID` collapses before the NCName check; the
+  unbounded integer family accepts arbitrary precision with the sign
+  class intact; `xs:float`/`xs:double` accept `+INF` (float018).
+  Too lenient, now invalid: `xs:long` rejects 2^63 (strtoll ERANGE)
+  and `xs:unsignedLong` string-compares against 2^64−1; `xs:date`
+  applies calendar-aware day bounds with leap years; `xs:time` bounds
+  hour 0–23 (`24:00:00` exact), minute 0–59, second 0–60 with 60
+  reserved for `23:59:60`; `xs:duration` rejects a bare `T` (P1Y2MT)
+  and fractions on anything but seconds (P200.5Y); `xs:base64Binary`
+  rejects a one-byte remainder (`abcde`) and data after padding;
+  `xs:QName` rejects the reserved `xmlns` prefix.
+
+- **DOM: bulk namespace-declaration snapshot — one crossing per
+  subtree (leptris#1874).**
+  `leptris_element_namespace_declarations_snapshot(elem, ...)` walks
+  the subtree in pre-order once and returns one row per (element
+  carrying declarations, declaration) with path depth, ancestor name
+  chain, and NUL-terminated prefix/URI lanes — the same rows the
+  binding's collect_native_namespaces produces today with one
+  `namespace_definitions` FFI round trip per node plus a
+  whole-subtree Ruby recursion. attributes_snapshot retry discipline;
+  default-ns and xmlns="" undeclaration markers included.
+
+- **DOM: address-Integer batch faces (leptris#1855).**
+  `leptris_element_children_batch(elem_addr, ...)` returns every
+  child's address + node kind in document order from ONE crossing per
+  parent (the binding's plan-path hydration measured ~35% FFI
+  materialization; `bulk_children` was 12.4% of self-time) — NODE-level
+  walk, all five child kinds ride the batch.
+  `leptris_node_name_compare(node_addr, name, len)` compares names
+  inside the engine with strcmp semantics — the `fast_name` band (4.5%)
+  was Ruby constructing Strings that mostly feed `==`.
+
+- **XSD: test pin — a type-less element declaration defaults to
+  xs:anyType (leptris#1878).** XSD 1.0 §3.3.2: any attributes, lax
+  content, never an undeclared-element error. The moxml 0.5.153 repro
+  fails on the bundled engine 1.9.381.0 and passes since e5762cdc;
+  the moxml Gemfile already allows `~> 1.9.351` (a `bundle update
+  leptris` picks the fixed engine).
+
+
+
+## [1.9.386] - 2026-10-28
+
+### Fixed
+
+- **DOM: cross-document subtree adoption no longer corrupts attribute
+  chains when the destination arena spills into extension blocks
+  (leptris#1866).** `copy_subtree_detached` wired the first-attribute
+  edge with a truncating `int32_t` cast; once the sized arena was
+  exhausted, copy allocations landed in tracked malloc blocks that on
+  64-bit hosts sit farther from the arena span than int32 can express
+  (~105 TB on macOS). The truncated delta decoded to a wild pointer —
+  blank attribute names (`<use ="">`) and a serializer SEGV in
+  mutation-heavy SVG-rewrite loops. The edge now goes through
+  `leptris_elem_set_first_attribute`, which spills out-of-range deltas
+  to the compact overflow table, and `leptris_pool_contains`
+  recognizes extension blocks as pool-owned.
+
+- **XSD: a local element particle with its own type shadows a
+  same-named global element declaration (leptris#1871).** Per Element
+  Locally Valid (Complex Type), XSD 1.0 §3.4.4, the matched
+  particle's declaration governs its instance element — an inline
+  anonymous (or named `type=`) local type was previously assessed as
+  the global declaration's type, rejecting valid instances and
+  accepting invalid ones. Resolution order is particle-type-first
+  (with `xsi:type` substitution applied there); `ref` particles,
+  which carry no type, keep the global lookup unchanged.
+
+
+
+## [1.9.385] - 2026-10-27
+
+### Fixed
+
+- the cross-doc adopt keeps its attribute chain; @id/.. names the owner
+
+
+
 ## [1.9.384] - 2026-10-27
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.384
+    VERSION 1.9.387
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/include/leptris/descriptor.h

@@ -293,6 +293,22 @@ LEPTRIS_API LeptrisPlanResult leptris_plan_result_build(
     LeptrisPlan plan, const leptris_plan_row_op* ops, size_t count,
     LeptrisStatus* status);
 
+/* leptris#1854: build a result from a PACKED op blob — the whole
+ * emission crosses in one call and no per-op host struct writes
+ * (the #408 address-Integer law applied to the build side; the
+ * binding's emission loop was 37% FFI::Pointer#+). Same program
+ * semantics as leptris_plan_result_build. Blob layout, per op:
+ * five native-byte-order uint32_t (kind, plan_index, row_index,
+ * name_len, value_len), then name_len name bytes PLUS a NUL
+ * terminator (the ATTR path dup's names NUL-terminated), then
+ * value_len raw value bytes; a zero length omits the bytes and
+ * reads as NULL. Bounds-checked: a truncated blob fails
+ * INVALID_ARG. Strings are copied; the blob is only read during
+ * the call. Memory: free with leptris_plan_result_free. */
+LEPTRIS_API LeptrisPlanResult leptris_plan_result_build_packed(
+    LeptrisPlan plan, const void* blob, size_t blob_len,
+    LeptrisStatus* status);
+
 /* #1551: serialize a walk result back to XML, guided by its plan.
  * The plan supplies element wrappers (row wire_name + ns_prefix)
  * and the result supplies content; children emit in document order

data/vendor-src/libleptris/src/include/leptris.h

@@ -913,6 +913,21 @@ LEPTRIS_API void leptris_rng_free(LeptrisRelaxNG rng);
 LEPTRIS_API LeptrisXsdSchema leptris_xsd_compile_file(const char* path,
                                                      LeptrisStatus* status);
 
+/* leptris#1881: compile a schema SET — every listed document's
+ * declarations merge into ONE schema, in order, with the shared
+ * visited-set closing include/import cycles across members. A head
+ * document cannot see substitution-group members declared in
+ * schemas that import it (nothing loads those from the head alone);
+ * a set compilation does. Per-unit target namespaces are honored
+ * during each document's capture; the FIRST document's
+ * targetNamespace remains the schema's. Relative schemaLocations
+ * resolve against each document's own directory. NULL paths or
+ * count 0 return NULL; an unreadable or malformed member yields an
+ * error-carrying handle like leptris_xsd_compile_file.
+ * (Memory: free with leptris_xsd_free.) */
+LEPTRIS_API LeptrisXsdSchema leptris_xsd_compile_set(
+    const char* const* paths, size_t count, LeptrisStatus* status);
+
 LEPTRIS_API LeptrisXsdSchema leptris_xsd_compile(const char* xsd_text,
                                                  size_t len,
                                                  LeptrisStatus* status);
@@ -2019,6 +2034,68 @@ LEPTRIS_API size_t leptris_element_attributes_snapshot(
     char* ns_prefixes, size_t prefixes_cap, size_t* prefix_offsets,
     char* ns_uris, size_t uris_cap, size_t* uri_offsets);
 
+/* leptris#1855 (ask 1): batched child materialization under the
+ * #408 address-Integer law — one crossing per PARENT returns every
+ * child's address and node kind, replacing the binding's per-child
+ * FFI walk. Returns the element's child count; the (addr, kind)
+ * pairs are written in document order only when cap >= count —
+ * otherwise nothing is written and the count comes back so the
+ * caller sizes and retries. A 0 address reads as "no children". */
+LEPTRIS_API size_t leptris_element_children_batch(
+    uintptr_t elem_addr,
+    uintptr_t* child_addrs, uint8_t* child_kinds, size_t cap);
+
+/* leptris#1855 (ask 2): engine-side name comparison — strcmp
+ * semantics (-1/0/1) between the node's name and the caller's
+ * (name, len) lens, with no String constructed on either side.
+ * Element nodes compare their name; non-element nodes compare as
+ * the empty string. A 0 address is an error lane: -2. */
+LEPTRIS_API int leptris_node_name_compare(uintptr_t node_addr,
+                                          const char* name, size_t len);
+
+/* leptris#1874: bulk namespace-declaration snapshot — the whole
+ * subtree's declared namespaces in ONE crossing (the binding's
+ * collect_native_namespaces walk paid one namespace_definitions FFI
+ * round trip per node). Pre-order DFS under `elem`; one row per
+ * (element carrying declarations, declaration) in document order,
+ * exactly the rows the binding's per-node namespace_definitions
+ * union produces.
+ *
+ * Each row carries the element's path depth (0 = `elem` itself, 1 =
+ * a child, ...) and blob offsets: the path names (depth NUL-
+ * terminated components in ancestor-first order, `names_off`), the
+ * prefix (`prefix_off`/`prefix_len`, NUL-terminated in the blob;
+ * 0xFFFFFFFFu off = a default-namespace declaration, no prefix),
+ * and the URI (`href_off`/`href_len`, NUL-terminated in the blob;
+ * len 0 = an xmlns="" undeclaration). Legacy xmlns:* attributes
+ * added through the attribute API are included (same union as
+ * leptris_element_namespace_count).
+ *
+ * Contract (the attributes_snapshot discipline): with `rows == NULL`
+ * returns 0 and writes the required row count to *out_row_count and
+ * the required blob bytes to *blob_used (either pointer may be
+ * NULL); with non-NULL buffers smaller than required returns
+ * (size_t)-1 and writes nothing; on success returns 0 and writes
+ * the used blob bytes to *blob_used when non-NULL.
+ *
+ * Memory: the snapshot copies strings into the caller's blob;
+ * nothing borrows the document.
+ */
+typedef struct {
+    uint32_t depth;       /* 0 = elem itself, 1 = child, ... */
+    uint32_t name_count;  /* == depth */
+    uint32_t names_off;   /* blob offset of the first path name */
+    uint32_t prefix_off;  /* 0xFFFFFFFFu = default-ns declaration */
+    uint32_t prefix_len;
+    uint32_t href_off;
+    uint32_t href_len;
+} leptris_ns_decl_row;
+
+LEPTRIS_API size_t leptris_element_namespace_declarations_snapshot(
+    LeptrisElement elem,
+    leptris_ns_decl_row* rows, size_t rows_cap, size_t* out_row_count,
+    char* blob, size_t blob_cap, size_t* blob_used);
+
 /**
  * Get name of attribute by index
  *

data/vendor-src/libleptris/src/leptris/descriptor/plan.c

@@ -2126,6 +2126,88 @@ LEPTRIS_API LeptrisPlanResult leptris_plan_result_build(
     return (LeptrisPlanResult)r;
 }
 
+/* leptris#1854: decode the packed blob into borrowed op rows
+ * (name/value point INTO the blob — the windowed builder dup's
+ * every string) and hand the IDENTICAL op stream to the IDENTICAL
+ * builder, so byte parity with leptris_plan_result_build holds by
+ * construction. */
+LEPTRIS_API LeptrisPlanResult leptris_plan_result_build_packed(
+    LeptrisPlan plan, const void* blob, size_t blob_len,
+    LeptrisStatus* status) {
+    if (status) *status = LEPTRIS_OK;
+    if (!plan || !blob || blob_len < 5 * sizeof(uint32_t)) {
+        if (status) *status = LEPTRIS_ERROR_INVALID_ARG;
+        return NULL;
+    }
+    /* Two passes: count ops to size the row array, then decode with
+     * a bounds check on every field. */
+    const uint8_t* p = (const uint8_t*)blob;
+    const uint8_t* const end = p + blob_len;
+    size_t op_count = 0;
+    for (const uint8_t* q = p; q < end;) {
+        if ((size_t)(end - q) < 5 * sizeof(uint32_t)) {
+            if (status) *status = LEPTRIS_ERROR_INVALID_ARG;
+            return NULL;
+        }
+        uint32_t nl, vl;
+        memcpy(&nl, q + 12, sizeof(nl));
+        memcpy(&vl, q + 16, sizeof(vl));
+        q += 5 * sizeof(uint32_t);
+        /* name bytes + their NUL (none when nl == 0) + value bytes
+         * <= remaining: size_t math, no overflow (lens < 4G) */
+        size_t name_span = nl ? (size_t)nl + 1 : 0;
+        if ((size_t)(end - q) < name_span + (size_t)vl) {
+            if (status) *status = LEPTRIS_ERROR_INVALID_ARG;
+            return NULL;
+        }
+        q += name_span + (size_t)vl;
+        op_count++;
+    }
+    leptris_plan_row_op* ops =
+        (leptris_plan_row_op*)malloc(op_count * sizeof(*ops));
+    if (!ops) {
+        if (status) *status = LEPTRIS_ERROR_MEMORY;
+        return NULL;
+    }
+    const uint8_t* q = p;
+    for (size_t i = 0; i < op_count; i++) {
+        uint32_t kind, pi, ri, nl, vl;
+        memcpy(&kind, q, sizeof(kind));
+        memcpy(&pi, q + 4, sizeof(pi));
+        memcpy(&ri, q + 8, sizeof(ri));
+        memcpy(&nl, q + 12, sizeof(nl));
+        memcpy(&vl, q + 16, sizeof(vl));
+        q += 5 * sizeof(uint32_t);
+        ops[i].kind = (LeptrisPlanRowOpKind)kind;
+        ops[i].plan_index = pi;
+        ops[i].row_index = ri;
+        ops[i].name = nl ? (const char*)q : NULL; /* NUL at q[nl] */
+        q += nl ? (size_t)nl + 1 : 0;
+        ops[i].value = vl ? (const char*)q : NULL;
+        ops[i].value_len = vl;
+        q += vl;
+    }
+    /* Same arena/window discipline as the struct face (#1677). */
+    struct dp_arena* arena = dp_arena_new(DP_ARENA_CHUNK);
+    if (!arena) {
+        free(ops);
+        if (status) *status = LEPTRIS_ERROR_MEMORY;
+        return NULL;
+    }
+    struct dp_arena* saved_arena = dp_cur_arena;
+    dp_cur_arena = arena;
+    struct leptris_plan_result* r =
+        plan_result_build_windowed(plan, ops, op_count, status, arena);
+    dp_cur_arena = saved_arena;
+    free(ops);
+    if (!r) {
+        dp_arena_free_all(arena);
+        return NULL;
+    }
+    if (r->arena == arena) r->arena_owner = 1;
+    return (LeptrisPlanResult)r;
+}
+
 LEPTRIS_API void leptris_plan_result_free(LeptrisPlanResult result) {
     dp_result_free_rec((struct leptris_plan_result*)result);
 }

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -2475,6 +2475,16 @@ static LeptrisElement copy_subtree_detached(LeptrisElement source,
                 v ? leptris_sv_from_ptr(v, sav_.length)
                   : leptris_sv_from_cstr("");
             leptris_element_add_attribute(copy, nv, vv, pool);
+            /* leptris#1866: add_attribute appends via the element's
+             * cached last_attribute — the LOCAL tail below is now
+             * stale. A following direct placement linked onto the
+             * stale tail and orphaned every attribute between the
+             * two wirings (a `<use xlink:href id>` copy lost the id:
+             * invisible to the @-axis XPath, dropped at serialize,
+             * and the attr_count-vs-chain mismatch fed the O(1)
+             * index an empty name — `<use ="">`). Resync from the
+             * element's cached tail, which add_attribute maintains. */
+            last_attr = leptris_elem_last_attribute(copy);
             continue;
         }
         /* Direct placement: the source attr is already decoded and
@@ -2505,10 +2515,21 @@ static LeptrisElement copy_subtree_detached(LeptrisElement source,
         if (copy->first_attribute_off != 0) {
             leptris_attr_set_next(last_attr, attr);
         } else {
-            copy->first_attribute_off =
-                (int32_t)((char*)attr - (char*)copy);
+            /* The destination pool may hand this allocation from an
+             * arena EXTENSION block — malloc'd far from the arena
+             * span (leptris#1866: macOS puts it ~105 TB away, beyond
+             * int32). The raw cast truncated that delta and decode
+             * produced a wild pointer (blank names, serializer SEGV);
+             * the setter spills out-of-range deltas to the overflow
+             * table. */
+            leptris_elem_set_first_attribute(copy, attr);
         }
         last_attr = attr;
+        /* leptris#1866: keep the element's cached tail in step with
+         * the local chain tail — a following add_attribute appends
+         * via the cached tail, and a stale one orphans everything
+         * wired since. */
+        leptris_elem_set_last_attribute(copy, attr);
         /* add_attribute's increment — attr_count is what the count
          * accessor and the O(1) index fast path read (uint8 wrap
          * at 255 latches the walk, same convention). */