makiri 0.11.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c12838a29d87a6bd9acb72b97e1e25dbdfbdaff37e38609cce6fd562e0f76d7
-  data.tar.gz: f4531547107db81c7db834d6c991adcf68b8a0d2fd714e158d69b164140a18bc
+  metadata.gz: 6432135ca3963c17f432c152ede49162c3f1be48e96179b914c971f0b2da1b76
+  data.tar.gz: 2b0478171ee224ea5c29ae19cd0a16a08c3d786e017444241d4bb8f620ecf975
 SHA512:
-  metadata.gz: fcdb5e1656c3ab6781c1bae97919b5ce65c5cbaa2bc3a0429a9088483f45407715e060afb2b6478d5ecb8a2d7495c319e3db54acd17f419c728d181a2b9becb4
-  data.tar.gz: 784ef5eaac9439e44ea99903544bcefac25869f18dc6312f0629669465f92a8f306f72b1bb62d5671babccfca2374f19c026dbb0da2a4f859f917c9822093b9b
+  metadata.gz: 8447a816ba507fb6a74ed8e6a5a92deaff6da2453ef29ba6cfe24652ec160b440409ec94b58b4aa89d3d28ab05643086f4dd1bba150339eeff27819d2e3d86d7
+  data.tar.gz: 2a9505ac1b1762cbdbc738645542acbda4bb029e06e5b4befe76f63e39e6e55a9f36a34106dd0fe24d3103d17f020939498373d9c872cb2042d71b23bb0d6513

data/.github/workflows/css-match.yml

@@ -0,0 +1,180 @@
+name: CSS matcher
+
+# The HTML CSS matcher (`lexbor::css_match`) on its own: it answers every
+# `Node#css` / `#at_css` / `#matches?`, and its failure mode is not a crash
+# but a wrong answer, which the general suites only catch by example. Two
+# checks, both against the OLD engine - Lexbor's own `lxb_selectors`, kept as
+# `lexbor::selectors` for exactly this:
+#
+#   - the randomized differential tests in `lexbor::tests::css_match`, run long
+#     with a fresh seed (MAKIRI_CSS_DIFF_SEED; a failure prints it);
+#   - the cargo-fuzz targets `html_css` (memory safety, and the three entry
+#     points agreeing) and `html_css_diff` (agreement with Lexbor's engine),
+#     with the selector dictionary.
+#
+# A PR that touches the matcher, the Lexbor layer or the pin gets a short run;
+# the nightly one is long. A disagreement on a shape where css_match departs
+# from Lexbor on purpose is not a finding: the departures are listed in
+# `css_match`'s module doc, and both checks leave them out.
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  pull_request:
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  schedule:
+    - cron: "41 4 * * *"
+  workflow_dispatch:
+
+env:
+  # Short on a push or PR, long on the nightly schedule.
+  LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+
+jobs:
+  differential:
+    name: Randomized differential (vs Lexbor's engine)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # build.rs links the vendored Lexbor archive and reads its headers.
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      # Release: the sweep is the point, and debug is ~10x slower. The seed is
+      # fresh per run, so a long series covers new ground; it is printed here
+      # and in any failure, so a finding reproduces.
+      - name: Run the css_match tests with a fresh seed
+        working-directory: ext/makiri/rust
+        run: |
+          export MAKIRI_CSS_DIFF_SEED=$(printf '0x%x' $(( (GITHUB_RUN_ID * 2654435761 + GITHUB_RUN_ATTEMPT) & 0xffffffffffff )))
+          if [ "$LONG" = true ]; then
+            export MAKIRI_CSS_DIFF_ITERATIONS=1000000
+          else
+            export MAKIRI_CSS_DIFF_ITERATIONS=20000
+          fi
+          echo "MAKIRI_CSS_DIFF_SEED=$MAKIRI_CSS_DIFF_SEED MAKIRI_CSS_DIFF_ITERATIONS=$MAKIRI_CSS_DIFF_ITERATIONS"
+          cargo test --release --no-default-features --features lexbor -- \
+            lexbor::tests::css_match lexbor::tests::selector_cache
+
+  fuzz:
+    name: cargo-fuzz ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [html_css, html_css_diff]
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      # -Zsanitizer is unstable, and cargo-fuzz needs it.
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Build the fuzz target
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo fuzz build ${{ matrix.target }}
+
+      # As in libfuzzer.yml: nm -u reads 0 on Linux whether or not the binary
+      # is instrumented, so assert on the full symbol table.
+      - name: Assert the target is instrumented
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          bin=$(ls target/*/release/${{ matrix.target }})
+          reports=$(nm "$bin" | grep -c '__asan_report')
+          echo "$bin: __asan_report symbols = $reports"
+          test "$reports" -gt 0 || { echo "not ASan-instrumented"; exit 1; }
+
+      # Both targets read the same `selector NUL document` input, so each
+      # also starts from the other's corpus (read-only: new units go to the
+      # first directory). The cache prefix is libfuzzer.yml's, so the corpus
+      # accumulated there carries over.
+      - name: Restore the corpus
+        uses: actions/cache@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target }}-
+
+      - name: Restore the sibling corpus
+        uses: actions/cache/restore@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          key: cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-
+
+      # -timeout: html_css_diff runs Lexbor's exhaustively backtracking engine
+      # too; the harness skips inputs it cannot afford, and this is the stop
+      # for one it misjudged.
+      - name: Run cargo-fuzz ${{ matrix.target }}
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          sibling=${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          mkdir -p corpus/${{ matrix.target }} corpus/$sibling
+          if [ "$LONG" = true ]; then seconds=3600; else seconds=180; fi
+          cargo fuzz run ${{ matrix.target }} corpus/${{ matrix.target }} corpus/$sibling -- \
+            -max_total_time=$seconds \
+            -max_len=4096 \
+            -timeout=30 \
+            -dict=css.dict \
+            -print_final_stats=1
+
+      - name: Upload reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-fuzz-artifacts-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/artifacts/${{ matrix.target }}
+          retention-days: 30

data/.github/workflows/libfuzzer.yml

@@ -25,7 +25,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath, css, html, html_xpath, html_css]
+        # html_css and html_css_diff run in css-match.yml, with the selector
+        # dictionary and a longer budget.
+        target: [xml, xpath, xml_xpath, css, html, html_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+## [0.12.1] - 2026-10-02
+
+### Fixed
+
+* Passing a string literal from a file without
+  `# frozen_string_literal: true` no longer warns "literal string will be
+  frozen in the future" on Ruby 3.4+ (with deprecation warnings enabled).
+* A fragment parsed with a context element from another document
+  (`fragment(context:)`, `DocumentFragment.parse(context:)`) no longer keeps
+  a reference into that document, which could be read after that document was
+  freed.
+* The 10,000-option limit per `<select>` now also counts the options a
+  fragment parsed in a select context receives (`inner_html=` and
+  `outer_html=` on or inside a select, `fragment(context: "select")`).
+  Before, they went uncounted, and inserting them took time quadratic in
+  their number.
+* A String `context:` naming a node that is not an element (`"#text"`,
+  `"!--"`, ...) raises `ArgumentError`.
+
+### Security
+
+* Hardening against Lexbor edge cases in fragment parsing, node copying,
+  element creation and serialization. Serialization is now always Makiri's
+  own walk, which uses no native recursion, so `to_html` / `inner_html` are
+  about 3% slower.
+
+## [0.12.0] - 2026-10-01
+
+Most changes accept what the DOM allows where 0.11.0 raised. The XML
+serializers (`to_xml`, `canonicalize`) raise instead when the tree holds
+something XML cannot write.
+
+### Changed
+
+HTML:
+
+* `to_html` / `inner_html` write a `<template>`'s contents, not its own
+  children (added with `add_child`), as browsers do.
+* `create_element_ns` in the HTML namespace accepts an upper-case name
+  (`BR`, `DIV`), as the DOM does. It makes an unknown element: not void, and
+  not matched by type selectors. Importing such an XHTML element from XML
+  behaves the same way.
+
+XML:
+
+* Text, attribute values and comments accept the characters the DOM allows:
+  `"\f"`, U+0001, NUL, and `--` in a comment.
+* `set_attribute_ns` accepts names XML cannot write, such as `p:a}b`.
+* `to_xml` and `canonicalize` raise while any of the above is in the tree.
+* `create_cdata` with `]]>` and `create_processing_instruction` with `?>`
+  now raise `ArgumentError`.
+* `canonicalize` adds the namespace declarations a name needs instead of
+  raising. It still raises where it would have to invent a prefix.
+
+HTML to XML (`import_node`):
+
+* The copy is in its namespace at once. Before, it was in none until
+  inserted.
+* The copy gets no `xmlns` attribute.
+* An attribute XML cannot write (`x-on:click`, `@click`) is copied as it is
+  instead of raising.
+* A `<template>` keeps its own children, after its contents.
+
+Other:
+
+* `Node#path` round-trips when a sibling with a different prefix or case
+  would also match the same XPath step.
+
 ## [0.11.0] - 2026-09-30
 
 No code changes since 0.11.0.rc2. Coming from 0.10.x, read the rc2 and rc1

data/NOKOGIRI_DIFFERENCES.md

@@ -184,11 +184,11 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     that does not fit the name (`set_attribute_ns`, `create_element_ns`)
     raises `Makiri::Error`. Invalid UTF-8 raises `Makiri::Error` for every
     argument, names included.
-  * `create_element_ns` refuses an HTML-namespace name in upper case that
-    lower-cases to an element Lexbor knows (`BR`, `DIV`), where the DOM makes
-    an unknown element: Lexbor would make that element (`BR` void, its
-    children never written). Other names keep their case (`MY-EL`). Nokogiri
-    has no `create_element_ns`.
+  * `create_element_ns` keeps the case of an HTML-namespace name, as the DOM
+    does: `create_element_ns(XHTML, "BR")` is an unknown element named `BR`,
+    not a void `br`, and type selectors do not match it (XPath name tests do,
+    folding case on HTML elements as browsers do). Nokogiri has no
+    `create_element_ns`.
 * An HTML `<template>` follows the WHATWG content model, which Nokogiri does
   not: its parsed contents live in the separate fragment `Element#content_fragment`
   returns, `template.children` is empty, and `inner_html` / `inner_html=`
@@ -198,6 +198,11 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
   ordinary element, with the parsed nodes as its children, so
   `template.inner_html` and `template.children` answer the other way round and
   there is no `content_fragment`.
+  * `Makiri::XML` has no template contents: an XHTML `<template>`'s children
+    are its children. Crossing into HTML they become its contents, and back
+    they become children - what a browser's XML parser, which puts them in the
+    contents, and its importNode give for the same document. An XML
+    `<template>` whose children should stay children has no way to say so.
 * An HTML document has one root element and no text child, as the DOM requires;
   `doc << element` beside an existing root raises.
 * An insertion the DOM refuses - a child under a text, comment, PI, doctype
@@ -205,13 +210,20 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
   `Makiri::Error` in both representations. Nokogiri refuses the same ones with
   `ArgumentError` (or `RuntimeError` for a second XML root).
 * Moving HTML into an XML document (`xml_doc.import_node(html_node)`, or
-  inserting one) keeps every name's namespace, and refuses what XML cannot
-  write that way. An attribute in no namespace whose name has a prefix other
-  than `xml` - `v-on:click`, `fb:like`, an `xlink:href` on an HTML (not SVG)
-  element - raises `Makiri::Error`: as XML it would be a prefix bound to
-  nothing. Nokogiri copies it and writes `v-on:click="..."` into output that is
-  not namespace-well-formed. An element named with a colon (`<fb:like>`)
-  crosses as a DOM-loose name, which `to_xml` refuses.
+  inserting one) copies it as the DOM's clone does: every element in its
+  namespace from the start (an imported `<p>` is XHTML before it is
+  inserted), every attribute named as it is, and no `xmlns` attribute added -
+  `to_xml` and `canonicalize` write the declarations the output needs.
+  Nokogiri's copy of an HTML5 `<div>` is in no namespace, and libxml2
+  declares `xmlns:svg` on it for an SVG child (in `namespace_definitions`),
+  writing the child as `<svg:svg>`. One XML cannot write that way -
+  in no namespace with a colon or no XML name, `v-on:click`, `:href`,
+  `@click`, `fb:like` - crosses DOM-loose, and `to_xml` refuses the tree
+  while it is there; so does an element named with a colon (`<fb:like>`).
+  Nokogiri copies them and writes output that is not namespace-well-formed.
+  * One exception to the DOM: an HTML attribute named `xml:lang` (in no
+    namespace) becomes the XML namespace's `xml:lang`, as the XML reader reads
+    that name, so XHTML-style HTML still writes as XML.
 * A known gap, in Lexbor's tag table: an HTML document that already holds a
   parsed element named with a colon (`<x:y>`, one local name) and then
   receives, by `import_node` from another document, a prefixed element
@@ -284,7 +296,7 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
   case-sensitivity rule, as browsers do: lower-cased for an HTML element (`LI`
   matches `<li>`), as written for any other (`feGaussianBlur` matches the SVG
   element, `fegaussianblur` does not). An HTML element named in upper case
-  (`create_element_ns(XHTML, "MY-EL")`, which keeps its name as the DOM does)
+  (`create_element_ns(XHTML, "DIV")`, which keeps its name as the DOM does)
   therefore matches no type selector.
   * `Nokogiri::HTML5` is case-sensitive on HTML elements too, so `LI` does not
     match `<li>` there. `Makiri::XML`'s `#css` is case-sensitive, as XML names
@@ -321,5 +333,12 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
   `Makiri::Error`.
   * On re-parse, the HTML tokenizer replaces a U+0000 in text/attributes with
     U+FFFD (WHATWG), so a serialized-then-reparsed round-trip is not byte-identical.
-  * `Makiri::XML` rejects NUL everywhere: XML 1.0 has no legal U+0000 character,
-    so admitting it would produce non-well-formed XML.
+  * `Makiri::XML` holds the character data the DOM holds, NUL included:
+    text or an attribute value with a character XML has no `Char` for (`\f`,
+    U+0001, U+0000), a comment with `--`. Nokogiri takes the same, but NUL
+    (`ArgumentError`, a Ruby C-string limit). Where they part is the output. `to_xml` / `canonicalize` raise for such a tree; Nokogiri writes
+    `\f` in text as U+FFFD (the data changes) and a comment's `--` or an
+    attribute value's `\f` as it stands (the output does not parse).
+    `create_cdata` refuses `]]>` and `create_processing_instruction` `?>`,
+    raising `ArgumentError` as the DOM's factories do; Nokogiri takes the PI
+    and writes `<?t a?>b?>`, which re-reads as another tree.

data/Rakefile

@@ -857,7 +857,9 @@ namespace :fuzz do
   # library and headers (the crate's build.rs links the archive and generates
   # the layout from the headers), which `rake compile` produces - hence the
   # dependency, which is about Lexbor rather than about the bundle.
-  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css].freeze
+  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css html_css_diff].freeze
+  # The targets whose input starts with a CSS selector take its dictionary.
+  FUZZ_CSS_DICT = %w[html_css html_css_diff].freeze
 
   # The local mode: TARGETS=css,html_xpath narrows the run to what you touched,
   # and the time is FUZZ_TIME seconds per target (default 60) or FUZZ_BUDGET
@@ -916,8 +918,9 @@ namespace :fuzz do
     env, sanitizer = libfuzzer_invocation
     Dir.chdir("ext/makiri/rust/fuzz") do
       targets.each do |target|
+        dict = FUZZ_CSS_DICT.include?(target) ? ["-dict=css.dict"] : []
         sh env, "cargo", "fuzz", "run", *sanitizer, target, "--",
-           "-max_total_time=#{time}", "-max_len=4096"
+           "-max_total_time=#{time}", "-max_len=4096", *dict
       end
     end
   end

data/ext/makiri/rust/Cargo.toml

@@ -44,8 +44,9 @@ expect_used = "warn"
 panic = "warn"
 
 [features]
-# Three features, and each names a real optional dependency rather than a step
-# of the C port: a Ruby runtime, a vendored C library, and a test hook.
+# Four features. Three name a real optional dependency rather than a step of
+# the C port - a Ruby runtime, a vendored C library, and a test hook - and the
+# fourth, `css-reference`, a test reference (below).
 #
 # The port's thirty-seven per-file flags are gone. They existed so one C file at
 # a time could be replaced behind an identical ABI; there is no C left to
@@ -68,6 +69,11 @@ lexbor = []
 # `falloc::should_fail` is a const false and the branch disappears.
 alloc-inject = []
 
+# The OLD `lxb_selectors` engine (`lexbor::selectors`) outside `cfg(test)`, as
+# the reference the `html_css_diff` fuzz harness holds `css_match` to. Never
+# part of a build that ships.
+css-reference = ["lexbor"]
+
 [dependencies]
 # Only the `ruby` feature needs these; the engine builds without them, which is
 # what lets Kani and cargo-fuzz compile it. `rb-sys` is magnus's own binding

data/ext/makiri/rust/build.rs

@@ -262,6 +262,14 @@ fn main() {
         .allowlist_function("lxb_dom_attr_set_name")
         .allowlist_function("lxb_dom_document_create_element")
         .allowlist_function("lxb_dom_element_create")
+        // An HTML element named as written (`DIV`, not `div`): its case-kept
+        // tag is Lexbor's `lxb_tag_append` (UNDECLARED_EXPORTS), and the rest
+        // is `lxb_dom_element_create`'s own steps with that tag.
+        .allowlist_function("lxb_dom_document_create_interface_noi")
+        .allowlist_function("lxb_dom_document_destroy_interface_noi")
+        .allowlist_function("lxb_ns_prefix_append")
+        .allowlist_type("lxb_tag_data_t")
+        .allowlist_type("lxb_ns_prefix_data_t")
         .allowlist_function("lxb_dom_document_create_text_node")
         .allowlist_function("lxb_dom_document_create_comment")
         .allowlist_function("lxb_dom_document_create_processing_instruction")
@@ -279,7 +287,14 @@ fn main() {
         .allowlist_function("lxb_css_property_serialize")
         .allowlist_function("lxb_css_property_serialize_name")
         .allowlist_function("lxb_css_selector_serialize_chain")
-        // The HTML serializers `lexbor::serialize` drives through its sink.
+        // One node's own markup, plain and pretty: Makiri drives the walk
+        // itself (`adapter::html::serialize`), so a <template> writes its
+        // contents and not its own children, as the HTML Standard says, and
+        // no tree depth grows the native stack.
+        .allowlist_function("lxb_html_serialize_cb")
+        .allowlist_function("lxb_html_serialize_pretty_cb")
+        // Lexbor's own walks, which those replaced: the reference the
+        // `serialize_walk` tests compare against, and called nowhere else.
         .allowlist_function("lxb_html_serialize_tree_cb")
         .allowlist_function("lxb_html_serialize_deep_cb")
         .allowlist_function("lxb_html_serialize_pretty_tree_cb")
@@ -382,6 +397,12 @@ const UNDECLARED_EXPORTS: &[(&str, &str, &str, &str)] = &[
         "lxb_dom_attr_qualified_name_append",
         "lexbor_hash_t *hash, const lxb_char_t *name, size_t length",
     ),
+    (
+        "lexbor/tag/tag.c",
+        "LXB_API const lxb_tag_data_t *",
+        "lxb_tag_append",
+        "lexbor_hash_t *hash, lxb_tag_id_t tag_id, const lxb_char_t *name, size_t length",
+    ),
     (
         "lexbor/dom/interfaces/element.c",
         "LXB_API lxb_status_t",
@@ -389,6 +410,12 @@ const UNDECLARED_EXPORTS: &[(&str, &str, &str, &str)] = &[
         "lxb_dom_element_t *element, const lxb_char_t *prefix, size_t prefix_len, \
          const lxb_char_t *lname, size_t lname_len",
     ),
+    (
+        "lexbor/ns/ns.c",
+        "LXB_API const lxb_ns_data_t *",
+        "lxb_ns_append",
+        "lexbor_hash_t *hash, const lxb_char_t *link, size_t length",
+    ),
 ];
 
 fn check_undeclared_exports(include: &std::path::Path) {

data/ext/makiri/rust/fuzz/Cargo.toml

@@ -18,7 +18,9 @@ libfuzzer-sys = "0.4"
 [dependencies.makiri_rs]
 path = ".."
 default-features = false
-features = ["lexbor"]
+# `css-reference` adds the OLD CSS engine, the reference `html_css_diff`
+# compares against; it ships in no build of the extension.
+features = ["lexbor", "css-reference"]
 
 [[bin]]
 name = "xml"
@@ -68,3 +70,10 @@ path = "fuzz_targets/html_css.rs"
 test = false
 doc = false
 bench = false
+
+[[bin]]
+name = "html_css_diff"
+path = "fuzz_targets/html_css_diff.rs"
+test = false
+doc = false
+bench = false

data/ext/makiri/rust/fuzz/css.dict

@@ -0,0 +1,77 @@
+# Selector tokens for the HTML CSS targets (html_css, html_css_diff): the
+# input is `selector NUL document`, and byte-level mutation alone rarely keeps
+# a selector parseable long enough to reach the matcher's deep paths.
+sep="\x00"
+c_desc=" "
+c_child=" > "
+c_next=" + "
+c_sub=" ~ "
+c_col=" || "
+comma=", "
+star="*"
+id="#a"
+cls=".a"
+cls2=".b"
+t_div="div"
+t_p="p"
+t_li="li"
+t_ul="ul"
+t_a="a"
+t_span="span"
+t_input="input"
+t_svg="svg"
+t_ns="svg|circle"
+a_has="[a]"
+a_eq="[a=x]"
+a_inc="[a~=x]"
+a_dash="[a|=x]"
+a_pre="[a^=x]"
+a_suf="[a$=x]"
+a_sub="[a*=x]"
+a_i=" i]"
+a_s=" s]"
+p_first=":first-child"
+p_last=":last-child"
+p_only=":only-child"
+p_fot=":first-of-type"
+p_lot=":last-of-type"
+p_oot=":only-of-type"
+p_empty=":empty"
+p_root=":root"
+p_link=":link"
+p_anylink=":any-link"
+p_req=":required"
+p_opt=":optional"
+p_ro=":read-only"
+p_rw=":read-write"
+p_ph=":placeholder-shown"
+p_hover=":hover"
+p_focus=":focus"
+p_checked=":checked"
+p_disabled=":disabled"
+p_enabled=":enabled"
+f_is=":is("
+f_where=":where("
+f_not=":not("
+f_has=":has("
+f_has_child=":has(> "
+f_has_next=":has(+ "
+f_has_sub=":has(~ "
+f_nth=":nth-child("
+f_nthl=":nth-last-child("
+f_nthot=":nth-of-type("
+f_nthlot=":nth-last-of-type("
+anb_odd="odd"
+anb_even="even"
+anb_1="2n+1"
+anb_2="-n+3"
+anb_of=" of "
+close=")"
+h_div="<div class=a id=a>"
+h_p="<p a=x>"
+h_li="<ul><li>"
+h_a="<a href=x>"
+h_input="<input required placeholder=x>"
+h_svg="<svg><circle r=1></svg>"
+h_close="</div>"
+h_quirks="<!doctype html>"

data/ext/makiri/rust/fuzz/fuzz_targets/html_css.rs

@@ -62,23 +62,25 @@ fuzz_target!(|data: &[u8]| {
     // SAFETY: `p` owns the document and outlives every handle made here.
     let root = unsafe { p.raw_doc().as_doc() }.as_node();
     for _ in 0..2 {
-        let checked = selector_cache::with_compiled(&gvl, text.as_bytes(), |groups, scratch| {
+        let answered = selector_cache::with_compiled(&gvl, text.as_bytes(), |groups, scratch| {
             check(root, groups, scratch)
         });
-        if checked.is_err() {
+        // A refusal is the budget doing its job, and each refused query spends
+        // the whole of it: asking again (or the same query a second way) only
+        // multiplies the run, which under ASan went past libFuzzer's timeout.
+        if !matches!(answered, Ok(true)) {
             return;
         }
     }
 });
 
-/// The walking query and the one-candidate query agree (module doc).
-fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
-    let all = select_all(scratch, root, groups);
-    let first = select_first(scratch, root, groups);
-    let Ok(all) = all else {
-        return;
+/// The walking query and the one-candidate query agree (module doc). False
+/// when a query refused, so the caller stops.
+fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) -> bool {
+    let Ok(all) = select_all(scratch, root, groups) else {
+        return false;
     };
-    if let Ok(first) = first {
+    if let Ok(first) = select_first(scratch, root, groups) {
         assert!(
             first == all.first().copied(),
             "select_first is not the first of select_all"
@@ -90,7 +92,7 @@ fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
         .take(ONE_BY_ONE)
     {
         let Ok(matched) = matches_any(scratch, groups, el) else {
-            return;
+            return false;
         };
         assert_eq!(
             matched,
@@ -98,4 +100,5 @@ fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
             "matches? and css disagree on an element"
         );
     }
+    true
 }