leptris 1.9.391.0-arm-linux → 1.9.396.0-arm-linux

data/vendor-src/libleptris/src/leptris/common/simd_text_avx2.c

@@ -75,6 +75,14 @@ ptrdiff_t leptris_text_find3_avx2(const char* s, size_t len,
     return -1;
 }
 
+/* MSVC has no __builtin_popcount; __popcnt32 maps to the POPCNT
+ * instruction the /arch:AVX2 target guarantees. */
+#if defined(_MSC_VER)
+#  define LEPTRIS_POPCOUNT32(x) __popcnt(x)
+#else
+#  define LEPTRIS_POPCOUNT32(x) __builtin_popcount(x)
+#endif
+
 /* Byte-population count: cmpeq → movemask → popcount per 32-byte
  * chunk, 16-byte SSE step, scalar tail. Never reads past s+len. */
 size_t leptris_text_count_char_avx2(const char* s, size_t len, char c) {
@@ -86,13 +94,13 @@ size_t leptris_text_count_char_avx2(const char* s, size_t len, char c) {
     while (end - p >= 32) {
         __m256i v = _mm256_loadu_si256((const __m256i*)p);
         __m256i eq = _mm256_cmpeq_epi8(v, needle);
-        n += (size_t)__builtin_popcount((unsigned)_mm256_movemask_epi8(eq));
+        n += (size_t)LEPTRIS_POPCOUNT32((unsigned)_mm256_movemask_epi8(eq));
         p += 32;
     }
     if (end - p >= 16) {
         __m128i v = _mm_loadu_si128((const __m128i*)p);
         __m128i eq = _mm_cmpeq_epi8(v, _mm256_castsi256_si128(needle));
-        n += (size_t)__builtin_popcount((unsigned)_mm_movemask_epi8(eq));
+        n += (size_t)LEPTRIS_POPCOUNT32((unsigned)_mm_movemask_epi8(eq));
         p += 16;
     }
     while (p < end) {
@@ -153,3 +161,149 @@ ptrdiff_t leptris_text_scan_run_avx2(const char* s, size_t len, char term,
         return (p < end) ? (ptrdiff_t)(p - s) : -1;
     }
 }
+
+/* ---- UTF-8 validation (leptris#1842 A5) -------------------------------
+ *
+ * Per-16-byte block, per-byte required ranges derived from the three
+ * preceding bytes (carried across blocks via palignr):
+ *   must_cont(j) = start2(j-1) | start3(j-1) | start4(j-1)
+ *                | start3(j-2) | start4(j-2) | start4(j-3)
+ * where startN(v) = v in [C2..DF | E0..EF | F0..F4] by length class.
+ * A must-cont byte must land in its opener's continuation range
+ * (E0 -> A0..BF, ED -> 80..9F, F0 -> 90..BF, F4 -> 80..8F, else
+ * 80..BF); a non-cont byte must be ASCII or a legal start. The tail
+ * (<16 bytes) runs the scalar DFA anchored at a character boundary
+ * (walk back at most 3 bytes). Verdicts identical to
+ * leptris_utf8_valid_scalar — pinned by the encoding suite.
+ */
+int leptris_utf8_valid_avx2(const char* src, size_t len) {
+    const unsigned char* p = (const unsigned char*)src;
+    if (len < 16) return leptris_utf8_valid_scalar(src, len);
+
+    const __m128i zero = _mm_setzero_si128();
+    const __m128i b80 = _mm_set1_epi8((char)0x80);
+    const __m128i bBF = _mm_set1_epi8((char)0xBF);
+    __m128i prev = zero; /* the previous block's 16 bytes */
+
+    size_t i = 0;
+    while (i + 16 <= len) {
+        __m128i cur = _mm_loadu_si128((const __m128i*)(p + i));
+        /* result[j] = byte(j-1): concat(a:b) shifted right leaves the
+         * PREVIOUS block's last lanes at the head — imm 15/14/13. */
+        __m128i b1 = _mm_alignr_epi8(cur, prev, 15);
+        __m128i b2 = _mm_alignr_epi8(cur, prev, 14);
+        __m128i b3 = _mm_alignr_epi8(cur, prev, 13);
+
+        /* start classes — the saturating idiom's operand order is the
+         * whole game: subs(v, lo)==0 tests v<=lo (saturate on
+         * underflow AND equality), so the LOWER bound must be
+         * subs(lo, v)==0 (0 iff lo<=v). subs(v, hi)==0 ⇔ v<=hi is
+         * already the right direction for the upper bound. */
+#define IN_RANGE(v, lo, hi)                                            \
+        (_mm_and_si128(                                                \
+            _mm_cmpeq_epi8(_mm_subs_epu8(_mm_set1_epi8(lo), (v)), zero), \
+            _mm_cmpeq_epi8(_mm_subs_epu8((v), _mm_set1_epi8(hi)), zero)))
+        __m128i st2c = IN_RANGE(cur, (char)0xC2, (char)0xDF);
+        __m128i st3c = IN_RANGE(cur, (char)0xE0, (char)0xEF);
+        __m128i st4c = IN_RANGE(cur, (char)0xF0, (char)0xF4);
+        __m128i is_ascii =
+            _mm_cmpeq_epi8(_mm_and_si128(cur, b80), zero);
+        __m128i legal_start = _mm_or_si128(
+            st2c, _mm_or_si128(st3c, st4c));
+
+        __m128i st2b1 = IN_RANGE(b1, (char)0xC2, (char)0xDF);
+        __m128i st3b1 = IN_RANGE(b1, (char)0xE0, (char)0xEF);
+        __m128i st4b1 = IN_RANGE(b1, (char)0xF0, (char)0xF4);
+        __m128i st3b2 = IN_RANGE(b2, (char)0xE0, (char)0xEF);
+        __m128i st4b2 = IN_RANGE(b2, (char)0xF0, (char)0xF4);
+        __m128i st4b3 = IN_RANGE(b3, (char)0xF0, (char)0xF4);
+#undef IN_RANGE
+
+        __m128i must_cont = _mm_or_si128(
+            _mm_or_si128(st2b1, _mm_or_si128(st3b1, st4b1)),
+            _mm_or_si128(_mm_or_si128(st3b2, st4b2), st4b3));
+
+        /* continuation range refinement from the opener (b1) */
+        const __m128i bA0 = _mm_set1_epi8((char)0xA0);
+        const __m128i b90 = _mm_set1_epi8((char)0x90);
+        const __m128i b9F = _mm_set1_epi8((char)0x9F);
+        const __m128i b8F = _mm_set1_epi8((char)0x8F);
+        const __m128i e0 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xE0));
+        const __m128i ed = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xED));
+        const __m128i f0 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xF0));
+        const __m128i f4 = _mm_cmpeq_epi8(b1, _mm_set1_epi8((char)0xF4));
+        __m128i lo = _mm_blendv_epi8(b80, bA0, e0);
+        lo = _mm_blendv_epi8(lo, b90, f0);
+        __m128i hi = _mm_blendv_epi8(bBF, b9F, ed);
+        hi = _mm_blendv_epi8(hi, b8F, f4);
+
+        /* cont-in-range — NEON's vcge/vcle pair translated to the
+         * saturating-subtraction idiom: subs(lo, cur) saturates to 0
+         * iff lo <= cur, subs(cur, hi) iff cur <= hi (the operand
+         * order is the whole game: subs(cur, lo) tests cur <= lo). */
+        __m128i cge = _mm_subs_epu8(lo, cur);
+        __m128i cle = _mm_subs_epu8(cur, hi);
+        __m128i cont_ok = _mm_and_si128(
+            _mm_cmpeq_epi8(cge, zero), _mm_cmpeq_epi8(cle, zero));
+
+        const __m128i ff = _mm_set1_epi8((char)0xFF);
+        __m128i not_must = _mm_xor_si128(must_cont, ff);
+        __m128i not_ascii = _mm_xor_si128(is_ascii, ff);
+        __m128i not_start = _mm_xor_si128(legal_start, ff);
+        /* error = must_cont & !cont_ok  |  !must_cont & !ascii &
+         * !legal_start (0x80..C1 and F5..FF fall out of the latter). */
+        __m128i block_error = _mm_or_si128(
+            _mm_and_si128(must_cont,
+                          _mm_xor_si128(cont_ok, ff)),
+            _mm_and_si128(not_must,
+                          _mm_and_si128(not_ascii, not_start)));
+        if (_mm_movemask_epi8(
+                _mm_cmpeq_epi8(_mm_and_si128(block_error, b80), b80)) != 0)
+            return 0;
+        prev = cur;
+        i += 16;
+    }
+    if (i >= len) {
+        /* The input ENDS at the block edge: the last sequence must
+         * be complete (the scalar DFA's "len - i <= n" rule). Walk
+         * back over at most 3 continuations; s2 lands ON the last
+         * continuation (or the final non-continuation byte). */
+        size_t s2 = i;
+        size_t conts = 0;
+        while (s2 > 0 && (p[s2 - 1] & 0xC0) == 0x80 && conts < 3) {
+            s2--;
+            conts++;
+        }
+        if (conts > 0) {
+            if (s2 == 0) return 0; /* continuations, no opener anywhere */
+            unsigned op = p[s2 - 1]; /* the opener BEFORE the run */
+            unsigned owed = (op >= 0xF0) ? 3
+                          : (op >= 0xE0) ? 2
+                          : (op >= 0xC2) ? 1
+                                         : 0;
+            if (owed > conts) return 0;
+            return 1;
+        }
+        /* the last byte is not a continuation: it must be ASCII */
+        unsigned op = p[i - 1];
+        unsigned owed = (op >= 0xF0) ? 3
+                      : (op >= 0xE0) ? 2
+                      : (op >= 0xC2) ? 1
+                                     : 0;
+        return owed == 0 ? 1 : 0;
+    }
+    /* Tail: scalar DFA anchored at a character boundary (at most 3
+     * bytes back from the SIMD end; a sequence is at most 4) — the
+     * anchored run also covers a sequence spanning the block edge.
+     * One more step back when the byte before the anchor is a start
+     * byte: an opener in the final block lane reaches into the tail
+     * (400k-case randomized cross-check vs the scalar oracle). */
+    size_t start = i;
+    while (start > 0 && (p[start] & 0xC0) == 0x80 && i - start < 3)
+        start--;
+    if (i - start < 3 && start > 0) {
+        unsigned char b = p[start - 1];
+        if (b >= 0xC2 && b <= 0xF4) start--;
+    }
+    return leptris_utf8_valid_scalar((const char*)(p + start), len - start);
+}

data/vendor-src/libleptris/src/leptris/common/simd_text_neon.c

@@ -380,3 +380,116 @@ ptrdiff_t leptris_text_scan_run_neon(const char* s, size_t len, char term,
         return (p < end) ? (ptrdiff_t)(p - s) : -1;
     }
 }
+
+/* ---- UTF-8 validation (leptris#1842 A5) -------------------------------
+ * Same derivation as the SSE core in simd_text_avx2.c; NEON bytes are
+ * unsigned, so ranges are direct vcge/vcle pairs. */
+int leptris_utf8_valid_neon(const char* src, size_t len) {
+    const unsigned char* p = (const unsigned char*)src;
+    if (len < 16) return leptris_utf8_valid_scalar(src, len);
+
+    const uint8x16_t zero = vdupq_n_u8(0);
+    const uint8x16_t ff = vdupq_n_u8(0xFF);
+    const uint8x16_t b80 = vdupq_n_u8(0x80);
+    const uint8x16_t bBF = vdupq_n_u8(0xBF);
+    uint8x16_t prev = zero;
+
+#define IN_RANGE(v, lo, hi)                                             \
+    vandq_u8(vcgeq_u8((v), vdupq_n_u8(lo)), vcleq_u8((v), vdupq_n_u8(hi)))
+    size_t i = 0;
+    while (i + 16 <= len) {
+        uint8x16_t cur = vld1q_u8(p + i);
+        /* lane j = byte(j-1): vext(prev, cur, k) keeps the last k
+         * lanes of prev at the head -> k = 15/14/13. */
+        uint8x16_t b1 = vextq_u8(prev, cur, 15);
+        uint8x16_t b2 = vextq_u8(prev, cur, 14);
+        uint8x16_t b3 = vextq_u8(prev, cur, 13);
+
+        uint8x16_t st2c = IN_RANGE(cur, 0xC2, 0xDF);
+        uint8x16_t st3c = IN_RANGE(cur, 0xE0, 0xEF);
+        uint8x16_t st4c = IN_RANGE(cur, 0xF0, 0xF4);
+        uint8x16_t is_ascii = vcltq_u8(cur, b80);
+        uint8x16_t legal_start = vorrq_u8(st2c, vorrq_u8(st3c, st4c));
+
+        uint8x16_t st2b1 = IN_RANGE(b1, 0xC2, 0xDF);
+        uint8x16_t st3b1 = IN_RANGE(b1, 0xE0, 0xEF);
+        uint8x16_t st4b1 = IN_RANGE(b1, 0xF0, 0xF4);
+        uint8x16_t st3b2 = IN_RANGE(b2, 0xE0, 0xEF);
+        uint8x16_t st4b2 = IN_RANGE(b2, 0xF0, 0xF4);
+        uint8x16_t st4b3 = IN_RANGE(b3, 0xF0, 0xF4);
+
+        uint8x16_t must_cont =
+            vorrq_u8(vorrq_u8(st2b1, vorrq_u8(st3b1, st4b1)),
+                     vorrq_u8(vorrq_u8(st3b2, st4b2), st4b3));
+
+        const uint8x16_t bA0 = vdupq_n_u8(0xA0);
+        const uint8x16_t b90 = vdupq_n_u8(0x90);
+        const uint8x16_t b9F = vdupq_n_u8(0x9F);
+        const uint8x16_t b8F = vdupq_n_u8(0x8F);
+        uint8x16_t e0 = vceqq_u8(b1, vdupq_n_u8(0xE0));
+        uint8x16_t ed = vceqq_u8(b1, vdupq_n_u8(0xED));
+        uint8x16_t f0 = vceqq_u8(b1, vdupq_n_u8(0xF0));
+        uint8x16_t f4 = vceqq_u8(b1, vdupq_n_u8(0xF4));
+        uint8x16_t lo = vbslq_u8(e0, bA0, b80);
+        lo = vbslq_u8(f0, b90, lo);
+        uint8x16_t hi = vbslq_u8(ed, b9F, bBF);
+        hi = vbslq_u8(f4, b8F, hi);
+
+        uint8x16_t cont_ok = vandq_u8(vcgeq_u8(cur, lo), vcleq_u8(cur, hi));
+
+        uint8x16_t block_error = vorrq_u8(
+            vandq_u8(must_cont, veorq_u8(cont_ok, ff)),
+            vandq_u8(veorq_u8(must_cont, ff),
+                     vandq_u8(veorq_u8(is_ascii, ff),
+                              veorq_u8(legal_start, ff))));
+        /* any lane set? */
+        /* any lane set? */
+        if (vmaxvq_u8(block_error) != 0) return 0;
+        prev = cur;
+        i += 16;
+    }
+    if (i >= len) {
+        /* The input ENDS at the block edge: the last sequence must
+         * be complete (the scalar DFA's "len - i <= n" rule). Walk
+         * back over at most 3 continuations; s2 lands ON the last
+         * continuation (or the final non-continuation byte). */
+        size_t s2 = i;
+        size_t conts = 0;
+        while (s2 > 0 && (p[s2 - 1] & 0xC0) == 0x80 && conts < 3) {
+            s2--;
+            conts++;
+        }
+        if (conts > 0) {
+            if (s2 == 0) return 0; /* continuations, no opener anywhere */
+            unsigned op = p[s2 - 1]; /* the opener BEFORE the run */
+            unsigned owed = (op >= 0xF0) ? 3
+                          : (op >= 0xE0) ? 2
+                          : (op >= 0xC2) ? 1
+                                         : 0;
+            if (owed > conts) return 0;
+            return 1;
+        }
+        /* the last byte is not a continuation: it must be ASCII */
+        unsigned op = p[i - 1];
+        unsigned owed = (op >= 0xF0) ? 3
+                      : (op >= 0xE0) ? 2
+                      : (op >= 0xC2) ? 1
+                                     : 0;
+        return owed == 0 ? 1 : 0;
+    }
+    /* Tail: scalar DFA anchored at a character boundary (at most 3
+     * bytes back from the SIMD end; a sequence is at most 4) — the
+     * anchored run also covers a sequence spanning the block edge.
+     * One more step back when the byte before the anchor is a start
+     * byte: an opener in the final block lane reaches into the tail
+     * (400k-case randomized cross-check vs the scalar oracle). */
+    size_t start = i;
+    while (start > 0 && (p[start] & 0xC0) == 0x80 && i - start < 3)
+        start--;
+    if (i - start < 3 && start > 0) {
+        unsigned char b = p[start - 1];
+        if (b >= 0xC2 && b <= 0xF4) start--;
+    }
+    return leptris_utf8_valid_scalar((const char*)(p + start), len - start);
+}
+#undef IN_RANGE

data/vendor-src/libleptris/src/leptris/core.c

@@ -72,6 +72,37 @@ LEPTRIS_API void leptris_version_components(int* major, int* minor, int* patch)
     if (patch) *patch = LEPTRIS_VERSION_PATCH;
 }
 
+/* leptris#1905: the capability descriptor. Unconditional faces are
+ * always compiled into this library; the build-conditional bits
+ * follow the same macros the build system defines for the sources
+ * — the descriptor cannot drift from the binary it ships in. */
+LEPTRIS_API LeptrisCapabilities leptris_capabilities(void) {
+    LeptrisCapabilities c;
+    c.caps = LEPTRIS_CAP_PARSE | LEPTRIS_CAP_DOM | LEPTRIS_CAP_XPATH |
+             LEPTRIS_CAP_XQUERY | LEPTRIS_CAP_DTD | LEPTRIS_CAP_SAX |
+             LEPTRIS_CAP_HTML | LEPTRIS_CAP_XINCLUDE | LEPTRIS_CAP_DIFF |
+             LEPTRIS_CAP_DIGEST | LEPTRIS_CAP_XSD | LEPTRIS_CAP_XSD_SET |
+             LEPTRIS_CAP_RELAXNG | LEPTRIS_CAP_SCHEMATRON |
+             LEPTRIS_CAP_XSLT | LEPTRIS_CAP_DESCRIPTOR |
+             LEPTRIS_CAP_NS_SNAPSHOT_BULK | LEPTRIS_CAP_CHILDREN_BATCH |
+             LEPTRIS_CAP_NAME_COMPARE | LEPTRIS_CAP_VERSION |
+             LEPTRIS_CAP_ENTITY_REF_NODES;
+#if defined(LEPTRIS_HAS_DUCET)
+    c.caps |= LEPTRIS_CAP_COLLATION_DUCET;
+#endif
+#if defined(LEPTRIS_HAS_UTF8PROC)
+    c.caps |= LEPTRIS_CAP_UNICODE_UTF8PROC;
+#endif
+#if defined(LEPTRIS_HAS_ICONV)
+    c.caps |= LEPTRIS_CAP_ENCODING_ICONV;
+#endif
+#if defined(LEPTRIS_HAS_AVX2_BUILD)
+    c.caps |= LEPTRIS_CAP_SIMD_AVX2;
+#endif
+    c.descriptor_version = LEPTRIS_CAPS_DESCRIPTOR_VERSION;
+    return c;
+}
+
 LEPTRIS_API void leptris_thread_cleanup(void) {
     leptris_xpath_drain_thread_caches();
     leptris_root_doc_drain_thread_caches();

data/vendor-src/libleptris/src/leptris/flat/direct_parse.c

@@ -2314,6 +2314,12 @@ static struct leptris_document* direct_parse_internal(char* buf, size_t len,
             if (*p.pos != '?') {
                 if (dp_nul(&p, p.pos)) goto fail;
                 p.pos++;
+                /* consuming the separator may exhaust the buffer
+                 * ("     <?xm" — the fuzzer shape): p.pos one past
+                 * p.end made p.end - p.pos underflow to SIZE_MAX and
+                 * the data memchr below walked off the allocation
+                 * (nightly-fuzz crash-aac3c9bb, no-LTO build) */
+                if (p.pos >= p.end) goto fail;
                 data_start = p.pos;
             }
             /* memchr for '?' — fast-skip PI data bodies. */
@@ -3531,48 +3537,15 @@ static int dp_declares_non_utf8(const char* s, size_t len) {
 }
 
 static int dp_utf8_valid(const char* s, size_t len) {
-    const unsigned char* p = (const unsigned char*)s;
-    size_t i = 0;
-    /* ASCII fast path: 8 bytes per iteration. The DFA below runs
-     * only when a high byte is present; ordinary documents pay one
-     * memory-bandwidth pass. */
-    while (i + 8 <= len) {
-        uint64_t w;
-        memcpy(&w, p + i, 8);
-        if (w & UINT64_C(0x8080808080808080)) break;
-        i += 8;
-    }
-    while (i < len && p[i] < 0x80) i++;
-    while (i < len) {
-        unsigned c = p[i];
-        if (c < 0x80) {
-            i++;
-            continue;
-        }
-        size_t n;
-        unsigned lo = 0x80;
-        unsigned hi = 0xBF;
-        if (c >= 0xC2 && c <= 0xDF) {
-            n = 1;
-        } else if (c >= 0xE0 && c <= 0xEF) {
-            n = 2;
-            if (c == 0xE0) lo = 0xA0;
-            else if (c == 0xED) hi = 0x9F;
-        } else if (c >= 0xF0 && c <= 0xF4) {
-            n = 3;
-            if (c == 0xF0) lo = 0x90;
-            else if (c == 0xF4) hi = 0x8F;
-        } else {
-            return 0;
-        }
-        if (len - i <= n) return 0;
-        if (p[i + 1] < lo || p[i + 1] > hi) return 0;
-        for (size_t k = 2; k <= n; k++) {
-            if (p[i + k] < 0x80 || p[i + k] > 0xBF) return 0;
-        }
-        i += n + 1;
-    }
-    return 1;
+    /* #1842 A5: the per-byte DFA moved to the SIMD layer —
+     * leptris_utf8_valid dispatches to boundary-vector cores (AVX2/
+     * NEON) with the DFA as the fallback+oracle. Pure accept/reject
+     * on the caller's bytes: no buffer-identity interaction (the A3
+     * revert settled that question for xml_buffer; this face only
+     * READS). */
+    (void)s;
+    (void)len;
+    return leptris_utf8_valid(s, len);
 }
 
 static int dp_input_encoding_ok(const char* s, size_t len) {
@@ -3658,7 +3631,10 @@ struct leptris_document* direct_parse_inplace(char* buf, size_t len) {
     if (!dp_declares_non_utf8(buf, len) && saw_high &&
         !dp_utf8_valid(buf, len))
         return NULL;
-    buf[len] = '\0';  /* Ensure NUL termination */
+    /* No sentinel write past len: the caller owns exactly `len`
+     * writable bytes (the header contract promises NULL terminators
+     * INSIDE the buffer; an exactly-sized caller trips ASAN, and
+     * bindings hand read-only views). The scanner takes `len`. */
     return direct_parse_internal(buf, len, 0, 0, 0, 0, 0, 0,
                                  lt_count, dq_count, sq_count);
 }

data/vendor-src/libleptris/src/leptris/xpath/parser.c

@@ -643,44 +643,26 @@ static XPathASTNode* parse_string_concat_expr(XPathParser* parser) {
 }
 
 /* True when the token AFTER a bare value-comparison keyword may
- * START an operand. The base list covers scalars/parens; an NCName
- * qualifies ONLY when it opens a function call — a bare NCName
- * follower stays a path step (XPath 1.0 name-test precedence). */
+ * START an operand. Scalars, parens, variables, and (leptris#1910)
+ * every path start: a bare NCName/QName is an element name test in
+ * operand position, and adjacent name tokens are never a valid
+ * path continuation, so the keyword reading is unambiguous
+ * (`w le h` in xs:assert/xs:alternative tests). */
 static int kw_operand_boundary(XPathParser* parser, XPathToken* nx) {
+    (void)parser;
     if (!nx) return 1;
     switch (nx->type) {
         case TOK_EOF: case TOK_RPAREN: case TOK_COMMA:
         case TOK_RBRACE: case TOK_LBRACE: case TOK_NUMBER:
         case TOK_STRING: case TOK_DOLLAR: case TOK_LPAREN:
         case TOK_MINUS: case TOK_PLUS:
+        case TOK_SLASH: case TOK_DOUBLE_SLASH: case TOK_AT:
+        case TOK_DOT: case TOK_DOUBLE_DOT: case TOK_STAR:
             return 1;
         case TOK_QNAME:
-            /* prefixed call: QName '(' — a lone QName stays a path
-             * step (name-test precedence, like NCName). */
-        case TOK_NCNAME: {
-            /* unprefixed call: name '(' ... prefixed call:
-             * name ':' name '(' (the QT3 corpus writes fn:year-...). */
-            XPathToken* nnx =
-                parser->token_pos + 2 < parser->token_count
-                    ? &parser->tokens[parser->token_pos + 2]
-                    : NULL;
-            if (nnx && nnx->type == TOK_LPAREN) return 1;
-            XPathToken* t3 =
-                parser->token_pos + 3 < parser->token_count
-                    ? &parser->tokens[parser->token_pos + 3]
-                    : NULL;
-            XPathToken* t4 =
-                parser->token_pos + 4 < parser->token_count
-                    ? &parser->tokens[parser->token_pos + 4]
-                    : NULL;
-            XPathToken* t5 =
-                parser->token_pos + 5 < parser->token_count
-                    ? &parser->tokens[parser->token_pos + 5]
-                    : NULL;
-            return nnx && nnx->type == TOK_COLON && t3 &&
-                   t3->type == TOK_NCNAME && t4 &&
-                   t4->type == TOK_LPAREN && t5;
-        }
+        case TOK_NCNAME:
+            /* name test, function call, or prefixed call */
+            return 1;
         default:
             return 0;
     }

data/vendor-src/libleptris/src/leptris/xsd/compile.c

@@ -51,7 +51,11 @@ struct leptris_xsd_schema {
     char* target_ns;
     int version_11;    /* xs:schema @version = "1.1" */
     char* base_dir;    /* schemaLocation resolution (file compile) */
-    int include_depth; /* include/import recursion guard */
+    int include_depth;
+    /* xs:override body capture replaces same-named components: the
+     * attributeGroup pre-pass must re-register defs the base
+     * already captured (leptris#1913). */
+    int capture_force; /* include/import recursion guard */
     /* leptris#1644: already-captured schema units (canonical
      * location per entry) — the include/import DAG is dense and
      * cyclic; without this set every DAG path re-parses and
@@ -179,7 +183,9 @@ static void xsd_cm_free(XsdCm* cm) {
         free(cm->name);
         free(cm->type);
         free(cm->ns);
-        free(cm->ext_base);
+        free(cm->res_base);
+    free(cm->res_base_ns);
+    free(cm->ext_base);
         free(cm->ext_base_ns);
         free(cm->any_ns);
         free(cm->not_qname);
@@ -679,7 +685,7 @@ static int xsd_is_declaration(const char* local, const char* uri) {
         "element",    "attribute",    "simpleType", "complexType",
         "group",      "attributeGroup", "notation", "include",
         "defaultOpenContent",
-        "import",     "redefine",     NULL
+        "import",     "redefine",     "override", NULL
     };
     for (int i = 0; names[i]; i++)
         if (strcmp(local, names[i]) == 0) return 1;
@@ -1810,7 +1816,8 @@ static void xsd_collect_decls_doc(LeptrisElement root, const char* eff_tns,
         if (!l || !u || strcmp(u, XSD_NS) != 0)
             continue;
         int is_inc = (strcmp(l, "include") == 0 ||
-                      strcmp(l, "redefine") == 0);
+                      strcmp(l, "redefine") == 0 ||
+                      strcmp(l, "override") == 0);
         int is_imp = (strcmp(l, "import") == 0);
         if (!is_inc && !is_imp) continue;
         const char* loc = leptris_element_attribute(c, "schemaLocation");
@@ -1853,6 +1860,13 @@ static void xsd_collect_decls_doc(LeptrisElement root, const char* eff_tns,
             xsd_collect_decls_doc(subroot, eff, sub_base, decls, n, max,
                                   claimed, nclaimed, cmax, depth + 1);
         }
+        /* leptris#1913/#1926: override and redefine bodies'
+         * declarations belong to the symbol space too — walk the
+         * derivation element as a pseudo-root (it has no
+         * include/import children of its own). */
+        if (strcmp(l, "override") == 0 || strcmp(l, "redefine") == 0)
+            xsd_collect_decls_doc(c, eff_tns, base_dir, decls, n, max,
+                                  claimed, nclaimed, cmax, depth + 1);
         leptris_document_free(sub);
     }
 }
@@ -1960,8 +1974,24 @@ static LeptrisXsdSchema xsd_compile_impl(const char* xsd_text,
     s->target_ns = xsd_strdup(
         leptris_element_attribute(root, "targetNamespace"));
     {
+        /* XSD 1.1 §4.3 schema versioning: the W3C suite and the
+         * binding ecosystem mark 1.1 with vc:minVersion (the
+         * versioning namespace); the plain version attribute is
+         * the other legal spelling. vc:maxVersion below 1.1 pins
+         * a 1.0 processor target regardless. leptris#1910/#1911:
+         * reading only @version silently compiled asserts and
+         * alternatives away for every vc-marked schema. */
         const char* ver = leptris_element_attribute(root, "version");
-        s->version_11 = (ver && strcmp(ver, "1.1") == 0);
+        const char* vmin = leptris_element_attribute_ns(
+            root, "http://www.w3.org/2001/XMLSchema-versioning",
+            "minVersion");
+        const char* vmax = leptris_element_attribute_ns(
+            root, "http://www.w3.org/2001/XMLSchema-versioning",
+            "maxVersion");
+        int is11 = (ver && strcmp(ver, "1.1") == 0) ||
+                   (vmin && strcmp(vmin, "1.1") == 0);
+        if (vmax && strcmp(vmax, "1.0") == 0) is11 = 0;
+        s->version_11 = is11;
     }
 
     const char* local = NULL;
@@ -2247,7 +2277,8 @@ static void xsd_capture_root(struct leptris_xsd_schema* s,
 
         if (strcmp(local, "include") == 0 ||
             strcmp(local, "import") == 0 ||
-            strcmp(local, "redefine") == 0) {
+            strcmp(local, "redefine") == 0 ||
+            strcmp(local, "override") == 0) {
             const char* loc = leptris_element_attribute(
                 (LeptrisElement)n, "schemaLocation");
             if (loc && s->base_dir && s->include_depth < 16) {
@@ -2314,6 +2345,26 @@ static void xsd_capture_root(struct leptris_xsd_schema* s,
                             if (sub_ns) free(sub_ns);
                             s->target_ns = saved_ns;
                         }
+                        /* leptris#1913 (XSD 1.1 §I.4) + #1926 (XSD
+                         * 1.0 §4.2.2): the override/redefine
+                         * element's OWN declaration children replace
+                         * same-named components of the base just
+                         * captured — capture them AFTER the base so
+                         * the lookup ladder (head-first) sees the
+                         * replacements. A redefine body that EXTENDS
+                         * the redefined name folds its extension
+                         * against the base at this moment (base
+                         * captured, ladder sees the new head), which
+                         * is exactly the redefine hook. */
+                        if (subroot && same_ns &&
+                            (strcmp(local, "override") == 0 ||
+                             strcmp(local, "redefine") == 0)) {
+                            s->include_depth++;
+                            s->capture_force = 1;
+                            xsd_capture_root(s, (LeptrisElement)n);
+                            s->capture_force = 0;
+                            s->include_depth--;
+                        }
                         leptris_document_free(sub);
                     }
                     free(text);
@@ -2448,7 +2499,8 @@ static void xsd_capture_root(struct leptris_xsd_schema* s,
                 XsdAttrGroupDef* seen = s->attr_groups;
                 for (; seen; seen = seen->next)
                     if (strcmp(seen->name, nm) == 0) break;
-                if (!seen) xsd_capture_attr_group_def(s, (LeptrisElement)n, nm);
+                if (!seen || s->capture_force)
+                    xsd_capture_attr_group_def(s, (LeptrisElement)n, nm);
             }
         } else if (strcmp(local, "group") == 0 && uri && !strcmp(uri, XSD_NS)) {
             const char* nm =
@@ -2902,9 +2954,21 @@ static XsdCm* xsd_capture_complex_model(struct leptris_xsd_schema* s,
                             attrs = own_attrs;
                     }
                 } else {
-                    /* restriction: the derived model REPLACES */
+                    /* restriction: the derived model REPLACES.
+                     * leptris#1923: the base still rides the type —
+                     * libxml2 admits the restriction chain's declared
+                     * attributes at validation, so record the base
+                     * (local + resolved ns) for the strict-attribute
+                     * admission walk. */
                     root->first_child = xsd_cm_parse(s, dq, NULL);
                     attrs = xsd_capture_attr_rows(s, dq, 0);
+                    if (base && strncmp(base, "xs:", 3) != 0) {
+                        free(root->res_base);
+                        root->res_base = xsd_strdup(base);
+                        free(root->res_base_ns);
+                        root->res_base_ns =
+                            buri[0] ? xsd_strdup(buri) : NULL;
+                    }
                 }
                 /* XSD 1.1: asserts nested under the derivation */
                 if (s->version_11)
@@ -2971,6 +3035,16 @@ static XsdCm* xsd_capture_complex_model(struct leptris_xsd_schema* s,
                         } else {
                             root->text_type = xsd_strdup(base);
                         }
+                        /* leptris#1923: a simpleContent restriction
+                         * rides its base for strict-attribute
+                         * admission (libxml2 admits the chain's
+                         * declared attributes — ctE019). */
+                        if (strcmp(dl, "restriction") == 0) {
+                            free(root->res_base);
+                            root->res_base = xsd_strdup(base);
+                            free(root->res_base_ns);
+                            root->res_base_ns = NULL;
+                        }
                     }
                 }
                 attrs = xsd_capture_attr_rows(s, dq, 0);