leptris 1.9.386.0 → 1.9.389.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9c9521a1e8bfc1a2bf40315abc96a7e14c66da913d9a2a85ade09b4e875dffc
-  data.tar.gz: 1b601d47c35f1a4ff1354cffbab2710540cefbf9f488a3f26e7b2bc2481f6979
+  metadata.gz: b680bf6971424414bf522ac4190bf932da4410c0714720ef2eae721698155cb4
+  data.tar.gz: a8dab91c683a6aa53b8a09af60340886ef1272cb0e0a990ebc87516229ec7252
 SHA512:
-  metadata.gz: 142705a6e1a769fd06706b5de2004b7f836d6bc189c16489e3f834b3c49de76e43d53d14399b7a2cb50cd6d0ec5c95f7602c932002827e9661a4c89ca0c9a577
-  data.tar.gz: 9bb1255ae311e908c348e9795154d8c0b4a3dcaec3e56ab95a46bf18988930acb7f246fee0ba57488038d29aec577caa60cd6495912ec36e25100d504ddb876a
+  metadata.gz: 88eb1c9c78229b6188366fb0493f5a16eaae75e4c98c4a168414220f8969e90c4b7f57761fca62c57049318fbe56c5d575612a2efc90dfb4570743536d7d76b0
+  data.tar.gz: 430d665c1fdd13b975f8ce0a63e0233ffc8b7ef46507ed3cf417ae5b4f4caca5d03f2096a8daa73f34f2775a78e5caffd281cd9ce0df68dd806a7d412f1cb715

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 ## [Unreleased]
 
+### Changed — 1.9.389.0 (rides libleptris 1.9.389)
+
+- Engine pin 1.9.388 -> 1.9.389: the XSD content-model automaton
+  size cap (leptris/leptris#1897, #1894 — pathological occurrence
+  products reject in microseconds via an analytic product bound,
+  with a 1e6 expansion cap backstop; over-cap models fail loudly
+  through the structured rows).
+
+### Changed — 1.9.388.0 (rides libleptris 1.9.388)
+
+- Engine pin 1.9.386 -> 1.9.388: carries the one-pass text-run scan
+  (leptris/leptris#1895, #1842 — text shapes 764-804 -> 1370-1448 MB/s,
+  pugixml gap 2.9x -> 1.70x) and the arena retain-pool size-class split
+  (leptris/leptris#1893, #1846), plus the 1.9.387 wave (ns-declaration
+  snapshot, packed op-blob build, children_batch + name_compare,
+  XSD skip-wildcards / attributeGroup order / length facets / builtin
+  lexical table / schema-set compile_set / anyType default — the
+  schema-set faces this pin un-gates in spec/xml/xsd_spec.rb).
+
 ### Added — 1.9.382.0 (rides libleptris 1.9.382)
 
 - **Schema#version** (moxml#460 item 2): the effective schema

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.387"
+LIBLEPTRIS_VERSION = "1.9.389"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.386.0"
+  VERSION = "1.9.389.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.387
+- libleptris v1.9.389
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,57 @@
 ## [Unreleased]
 
+## [1.9.389] - 2026-10-29
+
+### Fixed
+
+- **XSD: size-cap the content-model automaton (leptris#1897,
+  leptris#1894).** A counted particle multiplies the expanded NFA
+  (finite `maxOccurs` copies the subtree per copy), so nested large
+  bounds grew the automaton exponentially and a huge finite bound
+  walked the copy loop until the process died — jetsam/OOM with no
+  diagnostic, which read as a flaky harness in the W3C XML Schema
+  Test Suite batch runner. Two layers: an analytic, saturating
+  product bound computed BEFORE the build rejects pathological
+  models in microseconds (the 2000x2000 repro measured 10.0s ->
+  0ms), and a 1e6 state/transition expansion cap as the backstop
+  for shapes the walk cannot see (cyclic groups). Over-cap models
+  fail LOUDLY: a `content-model` structured row on instance
+  validation and a `-1` (not evaluable) from the public
+  `leptris_xsd_content_valid` with the message on
+  `leptris_xsd_error`. The issue's own repro (seq maxOccurs=100 x
+  element unbounded) lowers to a ~200-state loop model and pins
+  green.
+
+
+
+## [1.9.388] - 2026-10-29
+
+### Fixed
+
+- **Arena retain pool split by size class (leptris#1893, leptris#1846).**
+  Mid-sized spans (256 KB - 2 MB) could evict all four large-span retain
+  slots, so mixed-traffic workloads lost their warm large spans and
+  re-faulted them every parse. The retain pool is now two tiers (mid /
+  large at the 2 MB boundary) under the same shared ceiling, and a
+  pointer-identity test pins same-size reuse across mixed traffic.
+
+### Performance
+
+- **One-pass text-run scan (leptris#1895, leptris#1842).** The direct
+  parser's text path found `<` with a byte-at-a-time inline loop over
+  the first 48 bytes, then paid up to three libc memchr calls per run
+  (`<`, `&`, CR) — about 90ns of scan per ~55-byte run, capping
+  text-heavy documents near 800 MB/s while pugixml ran one vectorized
+  pass (profile: 72% of parse samples in the inline loop, 9% in the
+  three memchr sites). The new `leptris_text_scan_run` kernel (scalar +
+  NEON + AVX2, dispatched like the other simd_text primitives) finds
+  the first `<` and flags `&`/CR over the prefix in a single memory
+  pass; the recover-mode unescaped-`<` re-scan uses the same kernel.
+  Text shapes: 764-804 → 1370-1448 MB/s; gap vs pugixml 2.9x → 1.70x
+  (1.30x at 5 MB). Attr shapes unchanged.
+
+
+
 ## [1.9.387] - 2026-10-28
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.387
+    VERSION 1.9.389
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/benchmarks/parse/arena_ab.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# arena_ab.sh — interleaved A/B for parse-arena sizing changes
+# (leptris#1846 discipline: same-process-pair, order-alternating,
+# median of per-pair ratios — cross-wave deltas are NOT a valid
+# referee, the 2026-10-25 wave swung both directions at noise
+# magnitude).
+#
+# Usage: arena_ab.sh <base-build-dir> <patch-build-dir> <fixture> [pairs]
+# Both build dirs must contain benchmarks/parse_ab (the file-mode
+# bench_parse_ab). Each pair runs BASE then PATCH, then PATCH then
+# BASE (ABBA), so thermal/load drift cancels; the reported number is
+# the median of patch/base MB/s ratios.
+set -e
+BASE=$(ls "$1"/benchmarks/parse_ab "$1"/benchmarks/bench_parse_ab 2>/dev/null | head -1)
+PATCH=$(ls "$2"/benchmarks/parse_ab "$2"/benchmarks/bench_parse_ab 2>/dev/null | head -1)
+FIX="$3"
+N="${4:-10}"
+if [ -z "$BASE" ] || [ -z "$PATCH" ] || [ -z "$FIX" ]; then
+    echo "usage: $0 <base-build-dir> <patch-build-dir> <fixture> [pairs]" >&2
+    exit 1
+fi
+run_one() {
+    "$1" "$FIX" | awk '{print $4}'
+}
+ratios=""
+i=0
+while [ "$i" -lt "$N" ]; do
+    a=$(run_one "$BASE"); b=$(run_one "$PATCH")
+    b2=$(run_one "$PATCH"); a2=$(run_one "$BASE")
+    ratios="$ratios
+$(echo "$b $a" | awk '{printf "%.4f", $1/$2}')
+$(echo "$b2 $a2" | awk '{printf "%.4f", $1/$2}')"
+    i=$((i + 1))
+done
+echo "$ratios" | sort -n | awk '
+    { v[NR] = $1 }
+    END {
+        m = (NR % 2) ? v[(NR + 1) / 2] : (v[NR / 2] + v[NR / 2 + 1]) / 2
+        printf "pairs=%d median patch/base = %.4fx\n", NR, m
+    }'

data/vendor-src/libleptris/benchmarks/parse/bench_parse_ab.cpp

@@ -5,6 +5,13 @@
  * runners; the interleaved lane's slices are gated on THESE
  * numbers, never a loaded dev machine (2026-09-20: a Mac at load
  * 340 measured a 472 MB/s build at 46-85).
+ *
+ * leptris#1846: `argv[1]` switches to file mode — parse+free one
+ * fixture in a loop (median of N in-process runs, best-of-5
+ * batches) and print one `FILE <path> <bytes> <MB/s>` row. The
+ * arena-sizing A/B runner (arena_ab.sh) interleaves two builds of
+ * this binary and takes the median of per-pair ratios, so runner
+ * load cannot fake or hide the effect.
  */
 #include <stdio.h>
 #include <stdlib.h>
@@ -22,6 +29,45 @@ static double now_us(void) {
     return ts.tv_sec * 1e6 + ts.tv_nsec / 1e3;
 }
 
+static int file_mode(const char* path) {
+    FILE* f = fopen(path, "rb");
+    if (!f) { fprintf(stderr, "cannot open %s\n", path); return 1; }
+    fseek(f, 0, SEEK_END);
+    long sz = ftell(f);
+    fseek(f, 0, SEEK_SET);
+    char* doc = (char*)malloc((size_t)sz);
+    if (!doc || fread(doc, 1, (size_t)sz, f) != (size_t)sz) {
+        fprintf(stderr, "cannot read %s\n", path);
+        fclose(f);
+        return 1;
+    }
+    fclose(f);
+    /* LEPTRIS_BENCH_ITERS: profiling escape hatch (sample(1) needs a
+     * long-running process, not a 10ms one). */
+    const char* iters_env = getenv("LEPTRIS_BENCH_ITERS");
+    int iters = iters_env ? atoi(iters_env) : 5;
+    double best = 1e18;
+    double sum = 0;
+    for (int r = 0; r < iters; r++) {
+        double a = now_us();
+        LeptrisStatus st = LEPTRIS_OK;
+        LeptrisDocument d = leptris_parse_string(doc, (size_t)sz, &st);
+        double b = now_us();
+        if (!d) { printf("PARSE FAILED\n"); return 1; }
+        leptris_document_free(d);
+        if (b - a < best) best = b - a;
+        sum += b - a;
+    }
+    /* #1846: the MEAN prices in the cold parses (fresh span + full
+     * first-touch) that a best-of hides — the warm-span retention fix
+     * lives exactly there. */
+    printf("FILE %s %ld %.1f MB/s mean %.1f MB/s\n", path, sz,
+           sz / 1048576.0 / (best / 1e6),
+           sz / 1048576.0 / ((sum / (double)iters) / 1e6));
+    free(doc);
+    return 0;
+}
+
 static size_t gen(char* out, size_t target, int text_shape) {
     size_t len = 0;
     len += (size_t)sprintf(out + len, "<root>");
@@ -40,7 +86,8 @@ static size_t gen(char* out, size_t target, int text_shape) {
     return len;
 }
 
-int main(void) {
+int main(int argc, char** argv) {
+    if (argc > 1) return file_mode(argv[1]);
     const size_t sizes[3] = {1500 * 1024, 5000 * 1024, 13000 * 1024};
     const char* names[2] = {"attr", "text"};
     printf("%-6s %9s %12s %12s\n", "shape", "bytes", "leptris", "pugixml");

data/vendor-src/libleptris/src/leptris/common/simd_text.c

@@ -63,6 +63,29 @@ static void (*g_count3_high_fn)(const char*, size_t, char, char, char,
                                 int*) = NULL;
 static void (*g_copy3_fn)(char*, const char*, size_t, char, char, char,
                           size_t*, size_t*, size_t*) = NULL;
+static ptrdiff_t (*g_scan_run_fn)(const char*, size_t, char, char, char,
+                                  int*, int*) = NULL;
+
+/* #1842: one pass, three byte classes — the direct parser's text path
+ * (find '<', flag '&'/CR) drops its 48-byte inline loop and up to
+ * three per-run memchr calls for this. */
+static ptrdiff_t scan_run_scalar(const char* s, size_t len, char term,
+                                 char f1, char f2,
+                                 int* saw_f1, int* saw_f2) {
+    int a = 0, b = 0;
+    const char* p = s;
+    const char* end = s + len;
+    while (p < end) {
+        char ch = *p;
+        if (ch == term) break;
+        a |= (ch == f1);
+        b |= (ch == f2);
+        p++;
+    }
+    *saw_f1 = a;
+    *saw_f2 = b;
+    return (p < end) ? (ptrdiff_t)(p - s) : -1;
+}
 
 static size_t count_scalar(const char* s, size_t len, char c) {
     size_t n = 0;
@@ -108,6 +131,7 @@ static void dispatch_init(void) {
         g_find3_fn = leptris_text_find3_avx2;
         g_count_fn = leptris_text_count_char_avx2;
         g_count3_high_fn = count3_high_scalar;
+        g_scan_run_fn = leptris_text_scan_run_avx2;
         return;
     }
 #endif
@@ -119,6 +143,7 @@ static void dispatch_init(void) {
         g_count3_fn = leptris_text_count3_neon;
         g_count3_high_fn = leptris_text_count3_high_neon;
         g_copy3_fn = leptris_copy_count3_neon;
+        g_scan_run_fn = leptris_text_scan_run_neon;
         return;
     }
 #endif
@@ -127,6 +152,7 @@ static void dispatch_init(void) {
     g_find3_fn = find3_scalar;
     g_count_fn = count_scalar;
     g_count3_high_fn = count3_high_scalar;
+    g_scan_run_fn = scan_run_scalar;
 }
 
 /* Scalar kernel: one byte loop counts all three chars and detects
@@ -213,6 +239,13 @@ void leptris_copy_count3(char* dst, const char* src, size_t len,
     leptris_text_count3(src, len, c0, c1, c2, n0, n1, n2);
 }
 
+ptrdiff_t leptris_text_scan_run(const char* s, size_t len, char term,
+                                char f1, char f2,
+                                int* saw_f1, int* saw_f2) {
+    if (!g_scan_run_fn) dispatch_init();
+    return g_scan_run_fn(s, len, term, f1, f2, saw_f1, saw_f2);
+}
+
 /* ---- Structural span scan (TODO 193 Phase 1) ---- */
 
 unsigned char leptris_dp_class_table[256];

data/vendor-src/libleptris/src/leptris/common/simd_text.h

@@ -66,6 +66,17 @@ void leptris_copy_count3(char* dst, const char* src, size_t len,
                         char c0, char c1, char c2,
                         size_t* n0, size_t* n1, size_t* n2);
 
+/* One-pass text-run scan (#1842): find the first `term` byte in
+ * [s, s+len) and report whether f1/f2 occur strictly before it.
+ * Returns the term offset, or -1 when absent (flags then cover the
+ * whole span). saw_f1/saw_f2 are always written (0 or 1). Replaces
+ * the direct parser's 48-byte inline loop plus up to three per-run
+ * memchr calls with a single memory pass. term/f1/f2 must be
+ * distinct. */
+ptrdiff_t leptris_text_scan_run(const char* s, size_t len, char term,
+                                char f1, char f2,
+                                int* saw_f1, int* saw_f2);
+
 /* ---- Structural span scan (TODO 193 Phase 1: parser v3) ----
  *
  * Records every byte of the XML structural set in [buf, buf+len)
@@ -121,6 +132,12 @@ void leptris_copy_count3_neon(char* dst, const char* src, size_t len,
                               size_t* ca, size_t* cb, size_t* cc);
 size_t leptris_text_scan_events_neon(const char* buf, size_t len,
                                      LeptrisScanEvent* events, size_t max);
+ptrdiff_t leptris_text_scan_run_avx2(const char* s, size_t len, char term,
+                                     char f1, char f2,
+                                     int* saw_f1, int* saw_f2);
+ptrdiff_t leptris_text_scan_run_neon(const char* s, size_t len, char term,
+                                     char f1, char f2,
+                                     int* saw_f1, int* saw_f2);
 
 /* Append events for every structural byte to out (capacity max).
  * Returns the number of events written; returns max unchanged as

data/vendor-src/libleptris/src/leptris/common/simd_text_avx2.c

@@ -103,3 +103,53 @@ size_t leptris_text_count_char_avx2(const char* s, size_t len, char c) {
 }
 
 #endif /* LEPTRIS_ARCH_X86 && __AVX2__ */
+
+/* #1842: one-pass text-run scan — AVX2 mirror of the NEON kernel:
+ * full 32-byte chunks OR-accumulate the f1/f2 movemasks; the term
+ * mask hits and the first lane is ctz-resolved with a scalar prefix
+ * fold. */
+ptrdiff_t leptris_text_scan_run_avx2(const char* s, size_t len, char term,
+                                     char f1, char f2,
+                                     int* saw_f1, int* saw_f2) {
+    const char* p = s;
+    const char* end = s + len;
+    const __m256i kt = _mm256_set1_epi8(term);
+    const __m256i k1 = _mm256_set1_epi8(f1);
+    const __m256i k2 = _mm256_set1_epi8(f2);
+    uint32_t acc1 = 0, acc2 = 0;
+
+    while (end - p >= 32) {
+        __m256i v = _mm256_loadu_si256((const __m256i*)p);
+        uint32_t mt =
+            (uint32_t)_mm256_movemask_epi8(_mm256_cmpeq_epi8(v, kt));
+        if (mt) {
+            unsigned idx = (unsigned)LEPTRIS_CTZ(mt);
+            int a = (acc1 != 0);
+            int b = (acc2 != 0);
+            for (unsigned j = 0; j < idx; j++) {
+                a |= (p[j] == f1);
+                b |= (p[j] == f2);
+            }
+            *saw_f1 = a;
+            *saw_f2 = b;
+            return (ptrdiff_t)(p + idx - s);
+        }
+        acc1 |= (uint32_t)_mm256_movemask_epi8(_mm256_cmpeq_epi8(v, k1));
+        acc2 |= (uint32_t)_mm256_movemask_epi8(_mm256_cmpeq_epi8(v, k2));
+        p += 32;
+    }
+    {
+        int a = (acc1 != 0);
+        int b = (acc2 != 0);
+        while (p < end) {
+            char ch = *p;
+            if (ch == term) break;
+            a |= (ch == f1);
+            b |= (ch == f2);
+            p++;
+        }
+        *saw_f1 = a;
+        *saw_f2 = b;
+        return (p < end) ? (ptrdiff_t)(p - s) : -1;
+    }
+}

data/vendor-src/libleptris/src/leptris/common/simd_text_neon.c

@@ -328,3 +328,55 @@ size_t leptris_text_scan_events_neon(const char* buf, size_t len,
     }
     return n;
 }
+
+/* #1842: one-pass text-run scan — first `term` byte plus f1/f2
+ * seen-flags over the prefix. Full chunks OR-accumulate the f1/f2
+ * compare masks; a term hit resolves its lane scalar (once per run,
+ * at most 15 bytes of prefix re-check) and returns without folding
+ * the post-hit lanes. */
+ptrdiff_t leptris_text_scan_run_neon(const char* s, size_t len, char term,
+                                     char f1, char f2,
+                                     int* saw_f1, int* saw_f2) {
+    const char* p = s;
+    const char* end = s + len;
+    const uint8x16_t kt = vdupq_n_u8((uint8_t)term);
+    const uint8x16_t k1 = vdupq_n_u8((uint8_t)f1);
+    const uint8x16_t k2 = vdupq_n_u8((uint8_t)f2);
+    uint8x16_t acc1 = vdupq_n_u8(0);
+    uint8x16_t acc2 = vdupq_n_u8(0);
+
+    while (end - p >= 16) {
+        uint8x16_t v = vld1q_u8((const uint8_t*)p);
+        uint8x16_t eqt = vceqq_u8(v, kt);
+        if (vmaxvq_u8(eqt) != 0) {
+            int i = 0;
+            while (p[i] != term) i++;
+            int a = vmaxvq_u8(acc1) != 0;
+            int b = vmaxvq_u8(acc2) != 0;
+            for (int j = 0; j < i; j++) {
+                a |= (p[j] == f1);
+                b |= (p[j] == f2);
+            }
+            *saw_f1 = a;
+            *saw_f2 = b;
+            return (ptrdiff_t)(p + i - s);
+        }
+        acc1 = vorrq_u8(acc1, vceqq_u8(v, k1));
+        acc2 = vorrq_u8(acc2, vceqq_u8(v, k2));
+        p += 16;
+    }
+    {
+        int a = vmaxvq_u8(acc1) != 0;
+        int b = vmaxvq_u8(acc2) != 0;
+        while (p < end) {
+            char ch = *p;
+            if (ch == term) break;
+            a |= (ch == f1);
+            b |= (ch == f2);
+            p++;
+        }
+        *saw_f1 = a;
+        *saw_f2 = b;
+        return (p < end) ? (ptrdiff_t)(p - s) : -1;
+    }
+}

data/vendor-src/libleptris/src/leptris/flat/direct_parse.c

@@ -1726,44 +1726,31 @@ static struct leptris_document* direct_parse_internal(char* buf, size_t len,
                 if (q >= p.end) break;
                 if (*q == '<') { p.pos = q; continue; }
             }
-            /* Text content — FUSED scan (TODO 184): one inline loop
-             * finds '<' AND counts '\n' (issue #223 line tracking),
-             * replacing the memchr + dp_advance_line re-walk (two
-             * passes; memchr pays ~10ns setup on short text — the
-             * same finding as the attr-value scan). First 48 bytes
-             * inline, SIMD fallback for longer spans. */
+            /* Text content — one-pass scan (#1842): leptris_text_
+             * scan_run finds '<' AND flags '&'/'\r' in a single SIMD
+             * pass, replacing the 48-byte inline loop plus up to
+             * three per-run memchr calls (the three setup costs
+             * dominated on text-heavy shapes: ~90ns of scan per
+             * ~55-byte run). Identical semantics: flags cover
+             * [text_start, lt) only. */
             char* text_start = p.pos;
             uint32_t text_off =
                 p.line_offsets_ok
                     ? (uint32_t)(text_start - p.buf) + 1u : 0u;
             char* lt = NULL;
-            /* #1285 slice 4: '&' tracking fused into the scan (one
-             * predicted compare per byte) — the flush below needs
-             * it and a separate memchr per run cost ~7% parse on
-             * entity-free docs. The memchr fallback covers the
-             * >48-byte tail region only. */
             int has_amp = 0;
-            /* §2.11 (#326): literal-CR tracking rides the same fused
-             * loop — CR-bearing runs take the pool-copy collapse,
-             * CR-free runs (the norm) keep the zero-copy carve. */
+            /* §2.11 (#326): literal-CR tracking rides the same pass —
+             * CR-bearing runs take the pool-copy collapse, CR-free
+             * runs (the norm) keep the zero-copy carve. */
             int has_cr = 0;
             {
-                const char* q = p.pos;
-                const char* probe_end = p.probe_slack
-                    ? q + 48
-                    : ((p.end - q > 48) ? q + 48 : p.end);
-                while (q < probe_end) {
-                    char ch = *q;
-                    if (ch == '<') { lt = (char*)q; break; }
-                    has_amp |= (ch == '&');
-                    has_cr |= (ch == '\r');
-                    q++;
-                }
-                if (q >= p.end) goto text_done;
-                lt = (char*)memchr(q, '<', p.end - q);
-                if (!lt) lt = p.end;
-                has_amp |= memchr(q, '&', (size_t)((char*)lt - q)) != NULL;
-                has_cr |= memchr(q, '\r', (size_t)((char*)lt - q)) != NULL;
+                int saw_amp = 0, saw_cr = 0;
+                ptrdiff_t t_off = leptris_text_scan_run(
+                    p.pos, (size_t)(p.end - p.pos), '<', '&', '\r',
+                    &saw_amp, &saw_cr);
+                lt = (t_off >= 0) ? (char*)(p.pos + t_off) : NULL;
+                has_amp |= saw_amp;
+                has_cr |= saw_cr;
             }
             /* leptris#1748: a '<' that opens no markup construct
              * ('!', '?', '/', name-start) is unescaped text. Strict
@@ -1783,14 +1770,13 @@ static struct leptris_document* direct_parse_internal(char* buf, size_t len,
                     LEPTRIS_DIAG_UNESCAPED_LT, NULL,
                     "Unescaped < not allowed in a text node");
                 const char* nq = lt + 1;
-                const char* nlt =
-                    memchr(nq, '<', (size_t)(p.end - nq));
-                const char* span_end = nlt ? nlt : p.end;
-                has_amp |= memchr(nq, '&',
-                                  (size_t)(span_end - nq)) != NULL;
-                has_cr |= memchr(nq, '\r',
-                                 (size_t)(span_end - nq)) != NULL;
-                lt = (char*)nlt;
+                int saw_amp2 = 0, saw_cr2 = 0;
+                ptrdiff_t n_off = leptris_text_scan_run(
+                    nq, (size_t)(p.end - nq), '<', '&', '\r',
+                    &saw_amp2, &saw_cr2);
+                has_amp |= saw_amp2;
+                has_cr |= saw_cr2;
+                lt = (n_off >= 0) ? (char*)(nq + n_off) : NULL;
             }
         text_done:
             p.pos = lt ? lt : p.end;

data/vendor-src/libleptris/src/leptris/memory/arena.c

@@ -6,6 +6,7 @@
 #include "../common/port.h" /* LEPTRIS_THREAD_LOCAL */
 #include <stdint.h> /* uintptr_t: was transitive via glibc's mman graph */
 #include <stdlib.h>
+#include <stdio.h>
 #include <string.h>
 #if defined(__linux__)
 #include <sys/mman.h>   /* madvise(MADV_HUGEPAGE) — Linux only */
@@ -53,6 +54,14 @@ static inline size_t align_up(size_t n) {
  * twice per document lifetime, so contention is irrelevant. */
 #define ARENA_RETAIN_MIN (256u * 1024u)
 #define ARENA_RETAIN_MAX_BLOCKS 4u
+/* #1846 slice 4: the global tier is split by size class. With ONE
+ * 4-slot pool, every parked block kind competes for the same slots —
+ * and parse input copies (freed at document close, never taken back)
+ * permanently occupy slots, so arena spans hit the FULL free path and
+ * the next same-size parse lands on a cold mapping (fresh mmap +
+ * full first-touch: 2 of 5 takes missed on the 306KB fixture). Mid
+ * [256KB, 2MB) and large [2MB, ..) now churn among themselves. */
+#define ARENA_RETAIN_LARGE_MIN (2u * 1024u * 1024u)
 /* 96MB: a large-document parse arena (~4x input with the
  * pre-sized estimate) must survive the free to be reused by the
  * next parse — at the old 32MB ceiling, every big-doc cycle
@@ -73,7 +82,12 @@ static struct {
     size_t size[ARENA_RETAIN_MAX_BLOCKS];
     size_t count;
     size_t bytes;
-} g_retain;
+} g_retain_mid, g_retain_large;
+
+/* Shared byte ceiling across both tiers (the footprint bound). */
+static size_t retain_bytes_total(void) {
+    return g_retain_mid.bytes + g_retain_large.bytes;
+}
 
 #if defined(_MSC_VER)
 #include <intrin.h>
@@ -171,18 +185,43 @@ static char* retain_take(size_t request, size_t* capacity) {
     char* found = NULL;
     size_t found_size = 0;
     retain_lock();
-    for (size_t i = 0; i < g_retain.count; i++) {
-        if (g_retain.size[i] >= request &&
-            (found_size == 0 || g_retain.size[i] < found_size)) {
-            found = g_retain.base[i];
-            found_size = g_retain.size[i];
-            g_retain.base[i] = g_retain.base[g_retain.count - 1];
-            g_retain.size[i] = g_retain.size[g_retain.count - 1];
-            g_retain.count--;
+    /* #1846: search ONLY the request's size class — mid blocks can't
+     * serve large requests, and a large block must never serve a mid
+     * request (it would burn the only large slots on input-copy
+     * churn). */
+    struct {
+        char** base;
+        size_t* size;
+        size_t* count;
+    } t;
+    size_t tcount;
+    if (request >= ARENA_RETAIN_LARGE_MIN) {
+        t.base = g_retain_large.base;
+        t.size = g_retain_large.size;
+        tcount = g_retain_large.count;
+    } else {
+        t.base = g_retain_mid.base;
+        t.size = g_retain_mid.size;
+        tcount = g_retain_mid.count;
+    }
+    for (size_t i = 0; i < tcount; i++) {
+        if (t.size[i] >= request &&
+            (found_size == 0 || t.size[i] < found_size)) {
+            found = t.base[i];
+            found_size = t.size[i];
+            t.base[i] = t.base[tcount - 1];
+            t.size[i] = t.size[tcount - 1];
+            tcount--;
             break;
         }
     }
-    g_retain.bytes -= found_size;
+    if (request >= ARENA_RETAIN_LARGE_MIN) {
+        g_retain_large.count = tcount;
+        g_retain_large.bytes -= found_size;
+    } else {
+        g_retain_mid.count = tcount;
+        g_retain_mid.bytes -= found_size;
+    }
     retain_unlock();
     if (found) *capacity = found_size;
     return found;
@@ -203,16 +242,25 @@ static void retain_give(char* base, size_t size) {
         return;
     }
     retain_lock();
-    if (g_retain.count >= ARENA_RETAIN_MAX_BLOCKS ||
-        g_retain.bytes + size > ARENA_RETAIN_MAX_BYTES) {
+    const int large_class = size >= ARENA_RETAIN_LARGE_MIN;
+    size_t count = large_class ? g_retain_large.count : g_retain_mid.count;
+    if (count >= ARENA_RETAIN_MAX_BLOCKS ||
+        retain_bytes_total() + size > ARENA_RETAIN_MAX_BYTES) {
         retain_unlock();
         leptris_free_hook(base);
         return;
     }
-    g_retain.base[g_retain.count] = base;
-    g_retain.size[g_retain.count] = size;
-    g_retain.count++;
-    g_retain.bytes += size;
+    if (large_class) {
+        g_retain_large.base[count] = base;
+        g_retain_large.size[count] = size;
+        g_retain_large.count = count + 1;
+        g_retain_large.bytes += size;
+    } else {
+        g_retain_mid.base[count] = base;
+        g_retain_mid.size[count] = size;
+        g_retain_mid.count = count + 1;
+        g_retain_mid.bytes += size;
+    }
     retain_unlock();
 }
 
@@ -231,10 +279,14 @@ void leptris_arena_retain_drain(void) {
     g_small.bytes = 0;
 
     retain_lock();
-    for (size_t i = 0; i < g_retain.count; i++)
-        leptris_free_hook(g_retain.base[i]);
-    g_retain.count = 0;
-    g_retain.bytes = 0;
+    for (size_t i = 0; i < g_retain_mid.count; i++)
+        leptris_free_hook(g_retain_mid.base[i]);
+    g_retain_mid.count = 0;
+    g_retain_mid.bytes = 0;
+    for (size_t i = 0; i < g_retain_large.count; i++)
+        leptris_free_hook(g_retain_large.base[i]);
+    g_retain_large.count = 0;
+    g_retain_large.bytes = 0;
     retain_unlock();
 }
 

data/vendor-src/libleptris/src/leptris/xsd/compile.c

@@ -3651,8 +3651,17 @@ LEPTRIS_API int leptris_xsd_content_valid(
     XsdCm* model = ct->first_child;
     if (!model) return child_count == 0;
 
-    return xsd_content_valid(s, model, s->target_ns, child_names,
-                             child_ns, child_count);
+    int ok = xsd_content_valid(s, model, s->target_ns, child_names,
+                               child_ns, child_count);
+    /* #1894: -2 = the model crosses the automaton size cap — surface
+     * the loud structured row and keep the public contract's -1 for
+     * "not evaluable". */
+    if (ok == -2) {
+        xsd_set_error(s, "content model exceeds the automaton size "
+                         "cap (pathological occurrence product)");
+        return -1;
+    }
+    return ok;
 }
 
 LEPTRIS_API size_t leptris_xsd_declaration_count(LeptrisXsdSchema schema) {

data/vendor-src/libleptris/src/leptris/xsd/content_model.c

@@ -29,12 +29,34 @@ typedef struct {
     int start, accept;
     struct leptris_xsd_schema* s; /* group-ref resolution */
     int depth;                    /* cyclic-group guard */
+    int overflow; /* #1894: crossed XSD_CM_NFA_MAX — abort the build */
 } CmNfa;
 
-static int nfa_state(CmNfa* n) { return n->state_count++; }
+/* leptris#1894: a counted particle multiplies the expanded NFA (finite
+ * maxOccurs copies the subtree per copy), so nested large bounds grow
+ * the automaton exponentially and a huge finite bound walks the copy
+ * loop until the process dies (jetsam/OOM, no diagnostic). Crossing
+ * this bound aborts the build; xsd_content_valid reports -2 and the
+ * callers surface a loud structured row. Generous: legitimate suite
+ * content models stay orders of magnitude below it. */
+#define XSD_CM_NFA_MAX 1000000
+
+static int nfa_state(CmNfa* n) {
+    if (n->overflow) return 0;
+    if (n->state_count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return 0;
+    }
+    return n->state_count++;
+}
 
 static void nfa_trans(CmNfa* n, int from, int symbol, XsdCm* particle,
                       int to) {
+    if (n->overflow) return;
+    if (n->count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return;
+    }
     if (n->count == n->cap) {
         size_t cap = n->cap ? n->cap * 2 : 16;
         CmTrans* grown = (CmTrans*)realloc(n->trans, cap * sizeof(*grown));
@@ -125,7 +147,9 @@ static void cm_build(CmNfa* n, XsdCm* node, int from, int to) {
 /* occurrence bounds: min copies, then (max-min) optionals, or an
  * epsilon self-loop region for unbounded. */
 static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
+    if (n->overflow) return;
     for (int i = 0; i < node->min; i++) {
+        if (n->overflow) return;
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
         from = mid;
@@ -138,6 +162,7 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
         return;
     }
     for (int i = node->min; i < node->max; i++) {
+        if (n->overflow) return;
         nfa_trans(n, from, -1, NULL, to);
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
@@ -146,6 +171,62 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
     nfa_trans(n, from, -1, NULL, to);
 }
 
+/* ---- #1894 analytic product bound (pre-build rejection) ----------- */
+
+/* Saturating upper bound on the states+transitions one subtree
+ * expands, honoring the same occurrence lowering cm_build_occurrence
+ * performs: finite max copies the subtree max times; unbounded lowers
+ * to ONE loop region (min + 1 copies). Groups follow like cm_build
+ * (depth-capped; unresolved/cyclic refs count as 1 — the expansion
+ * cap remains the backstop for anything the walk cannot see). Returns
+ * nonzero when the bound crosses XSD_CM_NFA_MAX. */
+static int cm_bound_over(struct leptris_xsd_schema* s,
+                         const XsdCm* node, size_t* bound, int depth) {
+    if (!node || depth > 64) return 0;
+    size_t sub;
+    switch (node->kind) {
+        case XSD_CM_ELEMENT:
+        case XSD_CM_ANY:
+            sub = 1;
+            break;
+        case XSD_CM_GROUP_REF: {
+            XsdGroupDef* g = s ? xsd_find_group(s, node->name) : NULL;
+            if (!g || !g->model ||
+                cm_bound_over(s, g->model, &sub, depth + 1))
+                sub = 1;
+            break;
+        }
+        case XSD_CM_SEQ:
+        case XSD_CM_ALL:
+        case XSD_CM_CHOICE: {
+            sub = 0;
+            for (const XsdCm* c = node->first_child; c; c = c->next) {
+                size_t cb = 0;
+                if (cm_bound_over(s, c, &cb, depth + 1)) return 1;
+                if (sub > XSD_CM_NFA_MAX) return 1;
+                sub += cb;
+            }
+            break;
+        }
+        default:
+            sub = 1;
+            break;
+    }
+    /* occurrence multiplier: copies of the subtree */
+    size_t copies;
+    if (node->max < 0)
+        copies = (size_t)(node->min > 0 ? node->min : 0) + 1;
+    else
+        copies = (size_t)(node->max > 0 ? node->max : 0);
+    if (copies == 0) {
+        *bound = 0;
+        return 0;
+    }
+    if (sub != 0 && copies > XSD_CM_NFA_MAX / sub) return 1;
+    *bound = sub * copies + 1;
+    return *bound > XSD_CM_NFA_MAX;
+}
+
 /* ---- namespace filter (xs:any/@namespace) ------------------------ */
 
 /* XSD 1.1 notQName hit test (moxml#460): ##defined matches a name
@@ -297,7 +378,19 @@ int xsd_content_valid(struct leptris_xsd_schema* s, XsdCm* model,
     n.s = s;
     n.start = nfa_state(&n);
     n.accept = nfa_state(&n);
+    /* #1894: bound the expansion analytically BEFORE building — a
+     * pathological occurrence product (nested finite maxOccurs)
+     * rejects in microseconds instead of growing the automaton until
+     * the process dies. */
+    {
+        size_t bound = 0;
+        if (cm_bound_over(s, model, &bound, 0)) return -2;
+    }
     cm_build_occurrence(&n, model, n.start, n.accept);
+    if (n.overflow) {
+        free(n.trans);
+        return -2;
+    }
 
     StateSet live;
     memset(&live, 0, sizeof(live));

data/vendor-src/libleptris/src/leptris/xsd/validate.c

@@ -391,6 +391,19 @@ static void validate_children(struct xsd_validator* v,
      * min == 0. names/uris stay NULL (never dereferenced at n==0). */
     int ok = xsd_content_valid(s, model, xsd_target_ns(s), names, uris,
                                n);
+    if (ok == -2) {
+        /* #1894: pathological occurrence product — the automaton
+         * exceeds the compile-time size cap. Loud, not a hang. */
+        const char* l2 = NULL;
+        leptris_element_expanded_name(elem, &l2, NULL, NULL);
+        verrf_atk(v, elem, "content-model", l2 ? l2 : "", "element",
+                  l2 ? l2 : "",
+                  "content model exceeds the automaton size cap "
+                  "(pathological occurrence product)");
+        free(names);
+        free(uris);
+        return;
+    }
     if (ok) {
         free(names);
         free(uris);

data/vendor-src/libleptris/test/common/test_simd_text.cpp

@@ -139,4 +139,141 @@ TEST(SimdText, Find3TerminatorAtVeryEnd) {
     EXPECT_EQ(leptris_text_find3(u.data(), u.size(), '-', '-', '>'), -1);
 }
 
+/* ---- leptris_text_scan_run (#1842): one-pass text-run scan ----
+ *
+ * Parser contract: find the first `term` byte and report whether f1/f2
+ * occur strictly BEFORE it. Replaces the 48-byte inline loop plus up to
+ * three per-run memchr calls in the direct parser's text path. */
+
+TEST(SimdText, ScanRunFindsTermEveryPosition) {
+    std::string base = "abcdefghijklmnopqrstuvwxyz";
+    for (size_t len = 1; len <= 80; len++) {
+        std::string s;
+        for (size_t i = 0; i < len; i++) s += base[i % base.size()];
+        for (size_t pos = 0; pos < len; pos++) {
+            std::string t = s;
+            t[pos] = '<';
+            int saw_amp = -1, saw_cr = -1;
+            ptrdiff_t off = leptris_text_scan_run(
+                t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+            EXPECT_EQ(off, (ptrdiff_t)pos)
+                << "len=" << len << " pos=" << pos;
+            EXPECT_EQ(saw_amp, 0) << "len=" << len << " pos=" << pos;
+            EXPECT_EQ(saw_cr, 0) << "len=" << len << " pos=" << pos;
+        }
+    }
+}
+
+TEST(SimdText, ScanRunFlagsCountPrefixOnly) {
+    /* '&'/CR before the term set the flags; the same bytes after it
+     * must NOT (the parser's entity/CR handling only covers the run
+     * it carves). */
+    {
+        std::string t = "ab&cd<ef&gh";
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        EXPECT_EQ(off, 5);
+        EXPECT_EQ(saw_amp, 1);
+        EXPECT_EQ(saw_cr, 0);
+    }
+    {
+        std::string t = "ab<cd&";  /* flag byte after the term is skipped */
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        EXPECT_EQ(off, 2);
+        EXPECT_EQ(saw_amp, 0);
+        EXPECT_EQ(saw_cr, 0);
+    }
+    {
+        std::string t = "a\r\rb<c\r";
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        EXPECT_EQ(off, 4);
+        EXPECT_EQ(saw_amp, 0);
+        EXPECT_EQ(saw_cr, 1);
+    }
+    {
+        std::string t = "&x\ry<z";
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        EXPECT_EQ(off, 4);
+        EXPECT_EQ(saw_amp, 1);
+        EXPECT_EQ(saw_cr, 1);
+    }
+}
+
+TEST(SimdText, ScanRunNoTermFlagsWholeSpan) {
+    std::string base = "The quick brown fox jumps over the lazy dog ";
+    for (size_t len = 0; len <= 200; len++) {
+        std::string s;
+        for (size_t i = 0; i < len; i++) s += base[i % base.size()];
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            s.data(), s.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        EXPECT_EQ(off, -1) << "len=" << len;
+        EXPECT_EQ(saw_amp, 0) << "len=" << len;
+        EXPECT_EQ(saw_cr, 0) << "len=" << len;
+    }
+    /* Flags fire across chunk boundaries when the term is absent. */
+    std::string t(15, 'x');
+    t += '&';
+    t.append(20, 'x');
+    t += '\r';
+    t.append(40, 'x');
+    int saw_amp = -1, saw_cr = -1;
+    EXPECT_EQ(leptris_text_scan_run(t.data(), t.size(), '<', '&', '\r',
+                                    &saw_amp, &saw_cr),
+              -1);
+    EXPECT_EQ(saw_amp, 1);
+    EXPECT_EQ(saw_cr, 1);
+}
+
+TEST(SimdText, ScanRunTermAtVeryEnd) {
+    std::string t(40, 'y');
+    t += '<';
+    int saw_amp = -1, saw_cr = -1;
+    EXPECT_EQ(leptris_text_scan_run(t.data(), t.size(), '<', '&', '\r',
+                                    &saw_amp, &saw_cr),
+              40);
+    EXPECT_EQ(saw_amp, 0);
+    EXPECT_EQ(saw_cr, 0);
+}
+
+TEST(SimdText, ScanRunEmptySpan) {
+    int saw_amp = -1, saw_cr = -1;
+    EXPECT_EQ(leptris_text_scan_run("", 0, '<', '&', '\r', &saw_amp,
+                                    &saw_cr),
+              -1);
+    EXPECT_EQ(saw_amp, 0);
+    EXPECT_EQ(saw_cr, 0);
+}
+
+TEST(SimdText, ScanRunLongBodyEveryPosition) {
+    /* Vector-loop coverage: term at every offset of a 300-byte body,
+     * with flag bytes seeded before and after each position. */
+    std::string body(300, 'x');
+    for (size_t pos = 0; pos < body.size(); pos++) {
+        std::string t = body;
+        if (pos > 0) t[pos / 2] = '&';
+        if (pos > 2) t[pos / 3] = '\r';
+        t[pos] = '<';
+        /* Expected flags derive from the final seeded string. */
+        int e_amp = 0, e_cr = 0;
+        for (size_t i = 0; i < pos; i++) {
+            e_amp |= (t[i] == '&');
+            e_cr |= (t[i] == '\r');
+        }
+        int saw_amp = -1, saw_cr = -1;
+        ptrdiff_t off = leptris_text_scan_run(
+            t.data(), t.size(), '<', '&', '\r', &saw_amp, &saw_cr);
+        ASSERT_EQ(off, (ptrdiff_t)pos) << "pos=" << pos;
+        EXPECT_EQ(saw_amp, e_amp) << "pos=" << pos;
+        EXPECT_EQ(saw_cr, e_cr) << "pos=" << pos;
+    }
+}
+
 }  // namespace

data/vendor-src/libleptris/test/memory/test_arena.cpp

@@ -377,3 +377,41 @@ TEST(ArenaSmallRecycle, BulkDestroyParksUpToTheBound) {
     leptris_arena_retain_drain();
 }
 
+
+// ---- #1846 slice 4: mixed-size traffic must not evict arena spans ---
+// The single 4-slot global pool mixes every parked block kind (parse
+// input copies never get taken back; they just occupy slots). With
+// more block kinds than slots the FULL path frees ARENA spans and the
+// next same-size create lands on a cold mapping. The fix splits the
+// global tier by size class: mid [256KB, 2MB) and large [2MB, ..),
+// each with its own slots — the four mid kinds churn among
+// themselves and the large span keeps its slot.
+TEST(LeptrisArena, SameSizeReuseSurvivesMixedSizeTraffic) {
+#if defined(ARENA_TESTS_ASAN)
+    GTEST_SKIP() << "retain cache disabled under ASAN";
+#endif
+    const size_t huge = 4u * 1024u * 1024u;
+    void* huge_base = nullptr;
+    for (int round = 0; round < 3; round++) {
+        /* mid-class traffic: four distinct sizes, one per slot */
+        for (size_t mid : {300u * 1024u, 350u * 1024u, 400u * 1024u,
+                           450u * 1024u}) {
+            LeptrisArena* m = leptris_arena_create(mid);
+            ASSERT_NE(m, nullptr);
+            memset(leptris_arena_base(m), 1, mid);
+            leptris_arena_destroy(m);
+        }
+        /* the large arena: after warmup its mapping must repeat */
+        LeptrisArena* h = leptris_arena_create(huge);
+        ASSERT_NE(h, nullptr);
+        memset(leptris_arena_base(h), 1, huge);
+        if (round == 0) {
+            huge_base = leptris_arena_base(h);
+        } else {
+            EXPECT_EQ(leptris_arena_base(h), huge_base)
+                << "round " << round
+                << ": the large span was evicted by mid traffic";
+        }
+        leptris_arena_destroy(h);
+    }
+}

data/vendor-src/libleptris/test/xsd/test_xsd_compile.cpp

@@ -3624,3 +3624,59 @@ TEST(XsdValidate, QNameNotationIgnoreLengthFacets) {
     EXPECT_EQ(validate_doc(ul, "<test a='x y'/>"), 1);
     EXPECT_EQ(validate_doc(ul, "<test a='x'/>"), 0);
 }
+
+/* leptris#1894: pathological occurrence products. A counted particle
+ * multiplies the expanded NFA (finite maxOccurs copies the subtree per
+ * copy), so nested large bounds grow the automaton exponentially and a
+ * huge finite bound walks the copy loop until the process dies. The
+ * compile-time size guard fails LOUDLY — a structured report row and a
+ * -1 (not evaluable) from the public face — instead of consuming the
+ * machine. */
+TEST(XsdContent, PathologicalProductFailsLoudlyNotOom) {
+    std::string xsd =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " minOccurs=\"0\" maxOccurs=\"2000\"><xs:element name=\"e\""
+        " minOccurs=\"0\" maxOccurs=\"2000\"/></xs:sequence>"
+        "</xs:complexType></xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd.data(), xsd.size(), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    /* 2000 x 2000 = 4e6 expanded copies — over the cap. Zero children
+     * keep the simulation cheap; the BUILD is what the guard bounds. */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), -1);
+    /* the loud message rides the schema error face (validator rows
+     * carry it on the instance-validation path instead) */
+    const char* err = leptris_xsd_error(s);
+    ASSERT_NE(err, nullptr);
+    EXPECT_NE(std::string(err).find("size cap"), std::string::npos)
+        << "error: " << err;
+    leptris_xsd_free(s);
+}
+
+TEST(XsdContent, Issue1894ReproStaysUnderCapAndCorrect) {
+    /* The issue's exact shape — seq maxOccurs=100 x element
+     * unbounded — lowers to a loop region (not copies) and must stay
+     * far under the cap with normal answers. */
+    const char xsd[] =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " maxOccurs=\"100\"><xs:element name=\"e\""
+        " maxOccurs=\"unbounded\"/></xs:sequence></xs:complexType>"
+        "</xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd, strlen(xsd), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    const char* e[] = {"e"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", e, NULL, 1), 1);
+    /* minOccurs defaults to 1 on the inner element: empty violates */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), 0);
+    const char* x[] = {"x"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", x, NULL, 1), 0);
+    EXPECT_EQ(leptris_xsd_error_count(s), 0u);
+    leptris_xsd_free(s);
+}

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.387",
+  "version": "1.9.389",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.386.0
+  version: 1.9.389.0
 platform: ruby
 authors:
 - Ribose Inc.
@@ -458,6 +458,7 @@ files:
 - vendor-src/libleptris/benchmarks/modification/bench_append_split.cpp
 - vendor-src/libleptris/benchmarks/modification/bench_leptris_modify.c
 - vendor-src/libleptris/benchmarks/modification/bench_node_creation.c
+- vendor-src/libleptris/benchmarks/parse/arena_ab.sh
 - vendor-src/libleptris/benchmarks/parse/bench_parse_ab.cpp
 - vendor-src/libleptris/benchmarks/sax/bench_iterparse.c
 - vendor-src/libleptris/benchmarks/sax/bench_leptris.c