makiri 0.10.0 → 0.11.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6163794fb07f39d4476e91a5d9db367d82b02888e167bc41435bb12de32de49
-  data.tar.gz: 4c075f42cbdf69b39b9783e3ad66bd09acb48f380447e8e80a47402dcdd427e5
+  metadata.gz: 7421d59a83c782fab157fb3b220761908b885190db8405dd5173ddaeb7343e83
+  data.tar.gz: 4f64149f513b8a8f5288da9158c6dd5fa673e79ca33f5acc2c06a863d6f46641
 SHA512:
-  metadata.gz: d6f1d154116c49d5b42e57e08d584781af42c2d0a02a6d3a1d6073659437cd7b0920a30a42451fedc70b173de242c9738a34ea4fd8d582dd3d199094bbfe10ab
-  data.tar.gz: 7278778cf2e98166e03ef79364ef9a4b0feec3b410949c2e4889f82f899594da8ba492ac00a6d75de2ee7a553430e5dc69a9af52a41292ab86249af830dea7fe
+  metadata.gz: b1da6427faed2ac5e96ff02c6eeeb207c999eee5322c8b65e63b95e6038dee2ffbcaa457580f2980b73de6a9d7436e8e602134e7a3bb5e0e5fc399072b6eddaf
+  data.tar.gz: 4ee2def4dbe0cc740450bfa2e0d8a448a7908f1356f6de877d2c91f1d7e58aa92d022fd9f553b55463e6e444875f0889f567102c2883ece072f886a93eb06a44

data/.github/workflows/libfuzzer.yml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath, css, html, html_xpath]
+        target: [xml, xpath, xml_xpath, css, html, html_xpath, html_css]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/.github/workflows/release.yml

@@ -86,9 +86,18 @@ jobs:
           # names the GNU triple; this installs the std that goes with it.
           # Empty elsewhere, so the other runners are unaffected.
           targets: ${{ runner.os == 'Windows' && 'x86_64-pc-windows-gnu' || '' }}
-      - name: Install libclang (bindgen, via rb-sys)
+      # clang/lld/llvm are for the vendored Lexbor's LTO, not for bindgen: on
+      # Linux the whole chain has to be LLVM or extconf turns LTO off (gcc
+      # emits GIMPLE, which rust-lld cannot read - see the note in
+      # extconf.rb). It DETECTS them, so a runner without them still builds,
+      # just without LTO - which is what this job used to ship, silently,
+      # to every user who installs the precompiled gem (see the measured win
+      # in CLAUDE.md's "Vendored Lexbor is built with LTO" section: this is
+      # the job that produces those gems, and `ci.yml` installing the chain
+      # only exercises the fast path in CI, it does not ship it).
+      - name: Install libclang (bindgen) and the LLVM chain (Lexbor LTO)
         if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev clang lld llvm
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}

data/.github/workflows/security.yml

@@ -55,7 +55,7 @@ jobs:
           bundler-cache: true
 
       - name: Run short fuzz under sanitizers
-        run: bundle exec rake fuzz:sanitize FUZZ_ARGS="--time 30"
+        run: FUZZ_TIME=30 bundle exec rake fuzz:sanitize
 
   # macOS-only malloc-leak gate: ASan everywhere runs with detect_leaks=0 (Ruby
   # and Lexbor are uninstrumented), so this is the ONLY automated leak check. It
@@ -98,9 +98,9 @@ jobs:
         run: bundle exec rake leaks
 
   # OOM-injection sweep: rebuilds with MAKIRI_ALLOC_INJECT=1 and fails each core
-  # C allocation site in turn, gating that every OOM branch fails closed - a
-  # clean exception or a baseline-identical result, never truncated output
-  # (see script/check_alloc_failures.rb).
+  # Rust allocation site in turn, gating that every OOM branch fails closed - a
+  # clean exception or a baseline-identical result, with stateful objects reusable
+  # after the failure (see script/check_alloc_failures.rb).
   security-alloc-inject:
     name: OOM-injection sweep
     runs-on: ubuntu-latest
@@ -137,9 +137,8 @@ jobs:
       - name: Run the OOM-injection sweep
         run: bundle exec rake oom
 
-  # Nightly: fuzz EVERY target (the 30s PR fuzz covers only the default xpath
-  # target; the CSS engine reuse and the XML parser/mutator are each their own
-  # documented memory-safety risk, so each gets a full 300s run).
+  # Nightly: fuzz EVERY target for a longer run. The PR job already exercises
+  # every surface for 30s; nightly gives each target a full 300s run.
   security-fuzz-nightly:
     name: Nightly sanitized fuzz (${{ matrix.target }})
     runs-on: ubuntu-latest
@@ -178,7 +177,7 @@ jobs:
           bundler-cache: true
 
       - name: Run nightly fuzz under sanitizers
-        run: bundle exec rake fuzz:sanitize FUZZ_ARGS="--target ${{ matrix.target }} --time 300"
+        run: FUZZ_ARGS="--target ${{ matrix.target }} --time 300" bundle exec rake fuzz:sanitize
 
   # Nightly: the whole spec suite with Lexbor ITSELF built under ASan (mraw
   # poisoning on), catching intra-arena overflows that a plain ASan build cannot

data/CHANGELOG.md

@@ -1,5 +1,135 @@
 # Changelog
 
+## [0.11.0.rc1] - 2026-09-29
+
+### Changed
+
+* HTML `#css` / `#at_css` / `#matches?` now match with Makiri's own Rust
+  implementation instead of Lexbor's `lxb_selectors` (selectors are still
+  parsed by Lexbor). Where the answers differ:
+  * `:nth-child(An+B of S)` / `:nth-last-child(... of S)` count by the CSS
+    definition; Lexbor miscounted when `S` was a comma list, held a
+    combinator, or carried pseudo-classes such as `:enabled`.
+  * `:disabled`, `:enabled` and `:checked` follow the HTML Standard: a
+    control inside a `<fieldset disabled>` (outside its first `<legend>`) is
+    disabled, `<option>` / `<optgroup>` count, and `:enabled` matches only
+    form elements.
+  * Attribute selector names are matched by qualified name, and
+    case-sensitively on SVG/MathML elements: `[href]` no longer finds
+    `xlink:href`, nor `[viewbox]` an SVG `viewBox`.
+  * `#id` / `.class` match only the no-namespace `id` / `class` attribute.
+  * A selector chain is capped at 64 compounds (as `Makiri::XML` already
+    was), and a query at 50M steps of work (XPath's limit); past either,
+    `Makiri::Error`.
+  * The column combinator `||` raises `Makiri::Error` instead of matching
+    nothing.
+
+### Removed
+
+* `:lexbor-contains()` in HTML `#css` / `#at_css` / `#matches?`: it still
+  parses, but raises `Makiri::Error`. `Makiri::XML`'s `#css` keeps it. See
+  NOKOGIRI_DIFFERENCES.md.
+* `Node#name=` / `#node_name=`. The DOM cannot rename an element, and renaming
+  a Lexbor element in place could crash (`div` to `template`). Create a new
+  element and `replace` the old one.
+
+### Security
+
+* Hardening: every heap block the vendored Lexbor allocates carries 16 bytes
+  of slack past its end, so a small overrun cannot reach neighbouring memory
+  (not in sanitizer builds).
+* Adding an `id` or `class` attribute beside an existing one
+  (`set_attribute_ns(nil, "ID", v)`, a namespaced `id`) no longer frees the
+  existing one under a held `Attr`. HTML attribute reads and writes follow the
+  DOM: `#[]`, `#key?`, `#[]=` and `#delete` match the qualified name
+  (`svg_a["href"]` no longer returns `xlink:href`), copies and imports keep
+  every attribute, and a no-namespace name keeps its case.
+* `content=` on an HTML element and `delete(name)` detach the nodes they
+  remove instead of freeing them under a live wrapper.
+* `el[name] = value` on an existing attribute no longer leaves a destroyed
+  attribute linked when storing the value runs out of memory.
+* A checked argument String is locked while its bytes are in use, so a later
+  argument's `#to_s` cannot rewrite it (it raises instead); a receiver frozen
+  by an argument's `#to_s` is not edited; and a mutator's argument can no
+  longer rebuild the document's indexes in the middle of the edit.
+* HTML element and attribute names follow the DOM's rules:
+  `create_element("img src=x onerror=alert(1)")` raises `ArgumentError`
+  instead of writing that markup. See NOKOGIRI_DIFFERENCES.md.
+* HTML parsing bounds the tree depth (`max_tree_depth:`, default 400) and the
+  `<option>`s one `<select>` receives (10,000), raising `Makiri::Error` past
+  either; both made the parse quadratic.
+* `Makiri::Lexbor::CSS.parse_stylesheet` no longer crashes on a
+  `:lexbor-contains()` after a string ended by CR, FF or a newline.
+* A CSS query that runs out of memory raises instead of answering with what it
+  had collected; a selector-parse OOM is reported as OOM, not
+  `CSS::SyntaxError`.
+* Inputs whose cost grew faster than their size are linear or budgeted: many
+  namespace bindings, the `preceding` axis and reverse-axis steps, XML
+  duplicate-attribute checks, `contains` / `substring-*` / `translate` on long
+  strings, XML CSS `:nth-*`, CDATA full of `]]>`, and stylesheets with
+  rejected `:lexbor-contains()`.
+* A panic in any Ruby method Makiri defines raises `Makiri::InternalError`
+  (rescuable), not `fatal`.
+
+### Fixed
+
+* A document that grows by editing (appended nodes, `inner_html=`) reports
+  its new size to the GC, so memory pressure from it triggers collections; it
+  was reported once, at parse time.
+* A node wrapped while memory runs out raises `Makiri::Error` instead of
+  coming back as a second Ruby object for the same node, without the first
+  one's `freeze`, instance variables or singleton methods.
+* Insertion follows the DOM's pre-insertion rules in HTML and XML alike: no
+  cycles through a template's contents (which hung `dup`), no children on
+  Text/Comment/PI/DocumentType/Attr, no Text directly under an XML Document,
+  and an XML `DocumentFragment` takes children.
+* `inner_html` / `inner_html=` on a `<template>` target its contents, agreeing
+  with `#to_html` and `content_fragment`.
+* HTML `#keys` / `#values` raise on out-of-memory instead of returning a
+  truncated Array.
+* `dup`, `clone_node` and `import_node` keep an element's name as written
+  (`linearGradient`, `q:Bar`), and a copied XML doctype keeps its PUBLIC id.
+* Namespaces across HTML <-> XML `import_node`: attributes keep their own
+  namespace, a prefixed element keeps its prefix and case, names XML cannot
+  write are refused where they would be written, and copied `xmlns`
+  attributes no longer move elements between namespaces.
+* XML namespaces: `set_attribute_ns` on a detached element survives insertion;
+  `[]=` on an existing attribute changes only its value; the mutators refuse
+  what the parser refuses (forbidden declarations, duplicate expanded names,
+  bad doctype names and PUBLIC ids); `canonicalize` raises instead of writing a
+  wrong namespace; and a refused declaration says which rule it broke.
+* `to_xml` output re-parses: CDATA holding `]]>`, a SYSTEM id holding `"`, and
+  attributes with a namespace but no prefix.
+* XPath: `string()` of a number follows libxml2 (as Nokogiri does);
+  `substring()` rounds per spec; node-set vs boolean comparisons follow §3.4;
+  the `xml` prefix is always bound; a comparison no longer raises
+  `LimitExceeded` because its values added up past 64 MB.
+* `Node#path` round-trips through `#at_xpath` for CDATA, PIs, and namespaced
+  nodes (SVG/MathML, XML namespaces, `xlink:href`, Vue/Word-style names); an
+  unreachable node answers `"?"` as in Nokogiri.
+* CSS over XML agrees with the HTML matcher on `.x\ y`, `:root`, empty and
+  whitespace attribute values, `$=` with non-ASCII, `:empty` beside a comment,
+  and `[|a]`; the `s` modifier is accepted.
+* An HTML document refuses a second root element or a text child; an
+  attribute's parent is always its owner element.
+* `Node#line` of a node copied from another document is nil.
+* `Makiri::XML` nodes compare with `<=>` in document order (an attribute with
+  itself too), and `XML::Document#dup` / `#clone` return a copy.
+* `clone_node` on a Document raises instead of returning the document.
+* `NodeSet#css` / `#xpath` / `#at_css` / `#at_xpath` pass their extra
+  arguments through; `#xpath` of a non-node-set expression raises
+  `ArgumentError`, as in Nokogiri.
+* `XML::Builder` no longer answers `respond_to?` for `to_ary` and similar.
+* Namespace Hashes and `register_namespace` arguments are read as a Hash and
+  with `String()`, with one length cap and one error message.
+* A rejected stylesheet rule's `selector_text` is sliced by Lexbor's offsets.
+
+### Performance
+
+* `NodeSet#at_css` / `#at_xpath` stop at the first node with a match.
+* `XML::Node#canonicalize` looks namespaces up by prefix in the scope it keeps:
+  a 1000-deep document of declarations went from 0.7 s to 0.02 s.
+
 ## [0.10.0] - 2026-09-22
 
 ### Fixed

data/NOKOGIRI_DIFFERENCES.md

@@ -26,11 +26,34 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     exactly (`//*[@refX]`, not `@refx`). Only ASCII folds: `Ø` still differs from `ø`.
     This holds in `namespace_matching: :lax` too.
   * `Nokogiri::HTML5` is case-sensitive there.
+* `Node#path` names a node by expanded name where a bare name would not reach it
+  * An SVG, MathML or namespaced-XML node, and an HTML name that is no plain
+    XPath name (`<o:p>`, `xml:lang`, Vue's `@click`), give
+    `*[local-name()='path' and namespace-uri()='http://www.w3.org/2000/svg']`,
+    which `#at_xpath` evaluates with no prefix registered. Nokogiri writes
+    `svg:svg` or `/*/*[2]` for the first kinds; the paths are equivalent, the
+    strings are not.
+  * A node not attached to its document answers `"?"`, as a doctype does.
+    Nokogiri answers `"/div/p"` for a detached `<div><p>`, which is the path of
+    the document's own `/div/p` when it has one.
 * A foreign element's namespace declarations are not attributes
   * `<svg xmlns="...">` has no `@xmlns` for `//*[@xmlns]` or `@*`, as in browsers
     and in XPath's data model. An `xmlns` on an HTML element is an ordinary
     attribute and stays visible.
 
+* A `StandardError` raised by a custom-function handler becomes `Makiri::Error`
+  ("handler raised: <message>"), with the handler's exception as its `#cause`
+  * Nokogiri re-raises the handler's exception itself. Anything that is not a
+    `StandardError` (`Interrupt`, `SystemExit`, Timeout's exception) and a
+    `throw` reach the caller unchanged in both.
+
+* A number literal is read as the nearest double; libxml2's own reader is not
+  correctly rounded for a literal with more digits than a double holds, so
+  `string(0.72609133372266155)` is `0.726091333722662` in Makiri and
+  `0.726091333722661` in Nokogiri (the digits differ in the last place). The
+  number is then written by libxml2's rule in both (`string(1234567890.5)` is
+  `1.2345678905e+09`); only the value read differs.
+
 ## XML
 
 * `Makiri::XML` is XML 1.0 (Fifth Edition) only and non-validating.
@@ -100,6 +123,14 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
   the property-based differential), including namespaces, prolog/epilog comments
   and PIs, and adjacent-CDATA coalescing.
 
+* `to_xml` keeps an element's namespace when an `xmlns` attribute on it says
+  otherwise
+  * `root["xmlns"] = "urn:x"` on an element in no namespace is not written: the
+    element stays in no namespace when the output is re-read, as the DOM Parsing
+    and Serialization spec asks. Nokogiri writes `<r xmlns="urn:x">`, which moves
+    the element into `urn:x` on re-parse. Create the element in the namespace
+    instead (`create_element("r", "xmlns" => "urn:x")`, or parse it so).
+
 ## HTML parsing
 
 * `<?php ... ?>` in HTML input is a **ProcessingInstruction** node; `#to_html`
@@ -109,6 +140,69 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     still produces the older bogus comment (`<!--?php ... ?-->`), and
     `Nokogiri::HTML` (libxml2) its own comment.
 
+* A tree deeper than `max_tree_depth` raises **`Makiri::Error`**, where
+  `Nokogiri::HTML5` raises `ArgumentError`; the default (400) and boundary are
+  Nokogiri's. `inner_html=`, `outer_html=` and `Node#parse` take no keyword.
+  `Nokogiri::HTML` (libxml2) instead stops at depth 256 and returns the
+  truncated document.
+* More than 10,000 `<option>`s in one `<select>` raise `Makiri::Error`;
+  Nokogiri has no such limit.
+
+## HTML mutation
+
+* There is no `Node#name=` / `#node_name=` (on HTML or XML nodes). Nokogiri
+  renames a node in place and keeps its identity; the DOM has no rename, and
+  Lexbor keeps elements such as `<template>`, `<option>` and `<style>` in
+  structs of their own, so a node cannot change its tag safely. Create an
+  element of the new name, move the attributes and children, and `replace`
+  the old one (see CHANGELOG.md).
+* Element and attribute names follow the WHATWG DOM's rules
+  * `create_element`, `[]=` and `set_attribute_ns` raise `ArgumentError` for a
+    name the DOM refuses - one holding whitespace, `/`, `>` (or `=` for an
+    attribute) - where `Nokogiri::HTML5` accepts it and writes it into the
+    markup as it stands: `create_element("img src=x onerror=alert(1)")`
+    serializes as that tag.
+    The names HTML actually uses (`data-*`, `aria-*`, `@click`, `:href`,
+    `v-on:x`, custom elements) are accepted.
+  * `set_attribute_ns(nil, "x:y")` raises, as the DOM's `setAttributeNS` does:
+    a prefix needs a namespace.
+* An HTML `<template>` follows the WHATWG content model, which Nokogiri does
+  not: its parsed contents live in the separate fragment `Element#content_fragment`
+  returns, `template.children` is empty, and `inner_html` / `inner_html=`
+  special-case the contents (the WHATWG DOM special-cases `innerHTML` alone;
+  `append_child`, `content=`, and `children` act on the element's own empty
+  children, as the specification says). Nokogiri treats `<template>` as an
+  ordinary element, with the parsed nodes as its children, so
+  `template.inner_html` and `template.children` answer the other way round and
+  there is no `content_fragment`.
+* An HTML document has one root element and no text child, as the DOM requires;
+  `doc << element` beside an existing root raises.
+* An insertion the DOM refuses - a child under a text, comment, PI, doctype
+  or attribute node, text under an XML Document, a second root - raises
+  `Makiri::Error` in both representations. Nokogiri refuses the same ones with
+  `ArgumentError` (or `RuntimeError` for a second XML root).
+* Moving HTML into an XML document (`xml_doc.import_node(html_node)`, or
+  inserting one) keeps every name's namespace, and refuses what XML cannot
+  write that way. An attribute in no namespace whose name has a prefix other
+  than `xml` - `v-on:click`, `fb:like`, an `xlink:href` on an HTML (not SVG)
+  element - raises `Makiri::Error`: as XML it would be a prefix bound to
+  nothing. Nokogiri copies it and writes `v-on:click="..."` into output that is
+  not namespace-well-formed. An element named with a colon (`<fb:like>`)
+  crosses as a DOM-loose name, which `to_xml` refuses.
+* A known gap, in Lexbor's tag table: an HTML document that already holds a
+  parsed element named with a colon (`<x:y>`, one local name) and then
+  receives, by `import_node` from another document, a prefixed element
+  written the same way (`x:y` from XML: prefix `x`, local name `y`) re-points
+  the table's entry for that spelling - the parsed element then no longer
+  matches CSS `x\:y`. Copies within one document do not touch the table.
+* An XML element with a prefix, imported into HTML, keeps it (`h:div` in
+  XHTML has the local name `div`). Two readers then disagree, as they do in
+  browsers: CSS's `div` matches it (Lexbor matches the local name), XPath's
+  `//div` does not (an HTML element's name test reads its qualified name). And
+  Lexbor's HTML serializer writes the prefix (`<h:div>`), where the HTML
+  standard writes the local name, so the HTML does not re-parse to the same
+  element.
+
 ## CSS
 
 * Most jQuery/Nokogiri CSS extensions are not supported (`:gt`, `:lt`, `:eq`, `:first`, ...)
@@ -116,13 +210,18 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     text-containment extension. Use XPath (`xpath("//p[contains(., 'x')]")`) or
     Enumerable (`css('li')[1]`) for the rest.
     Standard Level-4 selectors (`:is` / `:where` / `:has`) are supported; some of which Nokogiri rejects.
-  * `:lexbor-contains("text")` is supported (on both HTML and XML) - Lexbor's
-    spelling of the jQuery `:contains()` substring filter, matching an element
-    whose text contains the string; append ` i` (`:lexbor-contains("text" i)`)
-    for an ASCII case-insensitive match. (Nokogiri's name `:contains` is not an
-    alias.) Like Lexbor's matcher, it tests the element's immediate child text
-    nodes (not the deep string-value), so HTML and XML agree; on XML it lowers
-    to XPath `child::text()[contains(., "text")]`.
+  * `:lexbor-contains("text")` - Lexbor's spelling of the jQuery `:contains()`
+    substring filter, matching an element whose text contains the string;
+    append ` i` (`:lexbor-contains("text" i)`) for an ASCII case-insensitive
+    match. (Nokogiri's name `:contains` is not an alias.) **XML only**: it
+    lowers to XPath `child::text()[contains(., "text")]`, testing the
+    element's immediate child text nodes, not the deep string-value. HTML no
+    longer supports it - `lexbor::css_match`, the safe-Rust port that
+    replaced Lexbor's own matcher for HTML, deliberately does not reimplement
+    it, so a well-formed `:lexbor-contains()` now raises `Makiri::Error`
+    ("could not be run") on HTML rather than ever matching (it still PARSES,
+    and an actually malformed one still raises `Makiri::CSS::SyntaxError`, as
+    before).
 * Untyped `:*-of-type` (`:first-of-type`, `:nth-of-type(an+b)`, ... with no type
   selector) is supported and correct on both HTML and XML - the "type" is the
   element's own expanded name.
@@ -138,6 +237,22 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     prefix IS resolved against the bindings, when the namespace matters.
   * `Makiri::XML` resolves CSS prefixes properly - it lowers the selector to the
     XPath engine, which registers the bindings.
+  * The same holds for attribute selectors: HTML `[|href]` (no namespace) and
+    plain `[href]` also find an SVG `xlink:href`, which `Nokogiri::HTML5`
+    does not.
+    `Makiri::XML` reads `[|a]` as the no-namespace attribute.
+* A selector under a node matches the way `Element#querySelectorAll` does in a
+  browser, not scoped to that node, on HTML: `at_css("#c").css("div p")` finds a
+  `p` inside `#c` when `#c` is itself a `div`, since the selector is matched
+  against the whole document and only the results are kept to descendants.
+  `Nokogiri::HTML5` and `Nokogiri::XML` scope the selector to the node (`#c`
+  cannot be the `div`), and so does `Makiri::XML`, which lowers the selector to
+  an XPath from the node. Lexbor has no `:scope`; for a scoped match on HTML,
+  use XPath from the node (`xpath(".//div//p")`).
+* The attribute case modifiers (`[a="x" i]`, `[a="x" s]`): HTML supports both,
+  through Lexbor's matcher. `Makiri::XML` accepts `s` (case-sensitive, which XML
+  values are anyway) and refuses `i` with `Makiri::CSS::SyntaxError`. Nokogiri
+  refuses both on either representation.
 * `#matches?` answers for a DETACHED node (`document.create_element("p")
   .matches?("p")` is true, on both representations). Nokogiri raises
   `NoMethodError` there - it implements `#matches?` as a search from

data/README.md

@@ -23,11 +23,13 @@ XPath 1.0 evaluation in its own native engine, with no libxml2 dependency.
 * Native XML 1.0 parser
   * A strict, non-validating, fail-closed parser with its own node arena (not
     Lexbor's HTML DOM), queried through the same native XPath engine, with
-    in-place tree edits (attributes, content, rename, remove).
+    in-place tree edits (attributes, content, remove).
   * Conformance is held by the W3C XML Conformance Test Suite, an XPath
     differential, and property-based testing vs Nokogiri (see below).
 * Bounded, fail-closed execution
   * XPath evaluation is bounded by per-evaluation limits on work, memory, and recursion.
+  * HTML parsing bounds the tree depth (`max_tree_depth:`, default 400) and the
+    `<option>`s per `<select>` (10,000).
   * Ownership and borrowing are kept explicit across layers, with owned/borrowed
     string types and verified text at engine boundaries.
   * Programmatic invalid input, limit violations, allocation failures, and unsupported constructs
@@ -65,6 +67,10 @@ link.parent.name                        # => "div"
 # Source location (reconstructed from the tokenizer, no Lexbor patches)
 doc.at_css("p").line                    # => 3
 
+# Nesting deeper than 400 elements raises Makiri::Error (Nokogiri's default);
+# max_tree_depth: raises the limit, and a negative value disables it
+Makiri::HTML(deep_html, max_tree_depth: 2000)
+
 # Serialization
 doc.at_css("#main").to_html             # => "<div id=\"main\" ...>...</div>"
 doc.at_css("#main").inner_html          # => "\n    <p class=\"lead\">Hello</p>\n..."
@@ -132,11 +138,10 @@ e   = doc.at_xpath("//entry")
 e["id"]   = "9"            # add or replace an attribute (value escaped on output)
 e["dc:k"] = "v"           # a prefixed name resolves against the in-scope xmlns
 e.content = "Bye"         # replace an element's children with text
-e.name    = "post"        # rename in place (identity + namespace re-resolved)
 e.delete("id")            # remove an attribute
 doc.at_xpath("//draft").remove
 
-doc.root.to_xml           # => "<feed xmlns:dc=\"urn:dc\"><post dc:k=\"v\">Bye</post></feed>"
+doc.root.to_xml           # => "<feed xmlns:dc=\"urn:dc\"><entry dc:k=\"v\">Bye</entry></feed>"
 ```
 
 XML subtrees can be built using `Document#create_element` and other node factory methods,

data/Rakefile

@@ -649,8 +649,20 @@ task :oom do
   # The hook is compiled in only under MAKIRI_ALLOC_INJECT=1 (zero overhead in
   # a normal build), so this needs its own rebuild; see
   # script/check_alloc_failures.rb for the protocol and the property gated.
-  sh({ "MAKIRI_ALLOC_INJECT" => "1" }, "#{FileUtils::RUBY} -S rake clean compile")
-  sh "#{FileUtils::RUBY} -Ilib script/check_alloc_failures.rb"
+  sanitize = ENV["MAKIRI_SANITIZE"].to_s
+  build_env = { "MAKIRI_ALLOC_INJECT" => "1" }
+  build_env["MAKIRI_SANITIZE"] = sanitize unless sanitize.empty?
+  sh(build_env, "#{FileUtils::RUBY} -S rake clean compile")
+
+  run_env = {}
+  unless sanitize.empty?
+    assert_sanitized!("oom", sanitize)
+    run_env = {
+      "ASAN_OPTIONS" => ASAN_ENV_OPTIONS,
+      "MAKIRI_SANITIZE" => sanitize,
+    }.merge(asan_preload_env(sanitize))
+  end
+  sh(run_env, "#{FileUtils::RUBY} -Ilib script/check_alloc_failures.rb")
   puts "(injection build left in place; run `rake clean compile` to restore a normal build)"
 end
 
@@ -795,10 +807,11 @@ namespace :fuzz do
   #                 (halt_on_error). The default (isolated) is the complete net:
   #                 it also survives + attributes a genuine segfault and catches a
   #                 hang via the per-query timeout, at much lower throughput.
+  #   ISOLATED=0    same as FAST=1; ISOLATED=1 (like the default) keeps isolation.
   #   SKIP_BUILD=1  reuse the current build instead of rebuilding (refuses to run
   #                 if it is not a sanitizer build, so you never fuzz a plain ext).
   #   FUZZ_TIME=N   seconds per surface (default 90).
-  #   FUZZ_ARGS=... run a single custom invocation instead of the three surfaces.
+  #   FUZZ_ARGS=... run a single custom invocation instead of the five surfaces.
   desc "Run the fuzzer under AddressSanitizer (FAST=1 non-isolated, SKIP_BUILD=1 reuse build)"
   task :sanitize do
     sanitize = ENV["MAKIRI_SANITIZE"] || "address"
@@ -818,12 +831,15 @@ namespace :fuzz do
     if ENV["FUZZ_ARGS"]
       sh(env, "#{FileUtils::RUBY} -Ilib spec/fuzz/run.rb #{ENV['FUZZ_ARGS']}")
     else
-      iso  = %w[1 true yes].include?(ENV["ISOLATED"].to_s.downcase) ? "--isolated" : ""
+      truthy = ->(name) { %w[1 true yes].include?(ENV[name].to_s.downcase) }
+      explicit_isolated = ENV.key?("ISOLATED") && !ENV["ISOLATED"].to_s.strip.empty?
+      isolated = explicit_isolated ? truthy.call("ISOLATED") : !truthy.call("FAST")
+      iso = isolated ? "--isolated" : "--in-process"
       secs = ENV["FUZZ_TIME"] || "90"
-      # Cover every surface under the sanitizer: the query engine (XPath/CSS over
-      # parsed fixtures), the XML parser (hostile documents), and the XML mutation
-      # surface (random edit sequences + invariants).
-      ["", "--target xml", "--target mutate", "--target xmlcss"].each do |surface|
+      # Cover every surface under the sanitizer: the query engine (XPath over the
+      # default fixtures), the HTML CSS selector path, the XML parser (hostile
+      # documents), the XML mutation surface, and CSS over an XML document.
+      ["", "--target css", "--target xml", "--target mutate", "--target xmlcss"].each do |surface|
         sh(env, "#{FileUtils::RUBY} -Ilib spec/fuzz/run.rb #{surface} #{iso} --time #{secs}".squeeze(" ").strip)
       end
     end
@@ -841,7 +857,7 @@ namespace :fuzz do
   # library and headers (the crate's build.rs links the archive and generates
   # the layout from the headers), which `rake compile` produces - hence the
   # dependency, which is about Lexbor rather than about the bundle.
-  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath].freeze
+  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css].freeze
 
   # The local mode: TARGETS=css,html_xpath narrows the run to what you touched,
   # and the time is FUZZ_TIME seconds per target (default 60) or FUZZ_BUDGET

data/ext/makiri/rust/Cargo.toml

@@ -23,7 +23,7 @@ path = "src/lib.rs"
 # about an unexpected cfg name (and CI's `clippy -D warnings` turns that into an
 # error). The proof modules are compiled only under it.
 [lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = ['cfg(kani)'] }
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(kani)', 'cfg(makiri_asan)'] }
 
 # The panic gate. A panic now reaches Ruby as an exception (see the profile
 # below), but it is still an INTERNAL error nobody asked for - `rescue => e`
@@ -32,15 +32,15 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(kani)'] }
 # few sites that want one carry an `#[allow]` with a reason. Test code is
 # exempt in `lib.rs`.
 #
-# `expect_used` is deliberately NOT here: 223 of its hits are the
-# `.expect("#name")` of method registration, which cannot fail after a
-# successful `Init_makiri`, and allowing each would say nothing. Nor are
-# `indexing_slicing` and `arithmetic_side_effects` (469 hits, mostly the
+# `expect_used` joined them once method registration stopped `.expect`ing each
+# definition (223 hits, now `?`): what remains is a handful of invariants, each
+# with an `#[allow(..., reason = ...)]`. Not here are `indexing_slicing` and `arithmetic_side_effects` (469 hits, mostly the
 # engine's own bounds-checked walks): gating those needs a different argument
 # than "a panic aborts", since release builds keep `overflow-checks` on
 # precisely so a wrapped size stops the process instead of answering wrong.
 [lints.clippy]
 unwrap_used = "warn"
+expect_used = "warn"
 panic = "warn"
 
 [features]
@@ -88,13 +88,13 @@ rb-sys = { version = "0.9", optional = true }
 # an `extern "C"` boundary into an abort, because unwinding through C frames
 # built without unwind tables is undefined behaviour. So every callback catches
 # its own panic and the caller re-raises it past the C frames - `caught::
-# PanicLatch`, installed in all nine (the CSS traversal, both serializer sinks,
+# PanicLatch`, installed in all eight (the CSS traversal, the serializer sink,
 # the tokenizer hook, the GVL trampoline, and `bridge::ruby::protect`, which
 # covers every `rb_protect`). The GC callbacks in `bridge/typed.rs` keep
 # aborting on purpose; see CLAUDE.md.
 #
 # Anything that must be released across a panic is therefore a `Drop`, not a
-# statement after the work. `lexbor::selectors::PanicReset` and
+# statement after the work. `lexbor::selectors::Session` and
 # `post_parse::DocOwner` are the two that had to be converted.
 #
 # overflow-checks stays ON in release: a wrapped size is exactly the class of