makiri 0.13.0-aarch64-linux → 0.15.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c38568d5e92468d6f4da1275cf823cdc615d079c6a0293236ad5c85897647df1
-  data.tar.gz: 33701440893a286012dcdba48d78cd30d69af8d27fff9bc3691603e5e4151900
+  metadata.gz: d9bef2471bfcd87d3e3c31bf6f4eeecef71202d81bf0bb46b7b71eee526cd1a4
+  data.tar.gz: 1836c1d1ee430cba8a058d63411259483ad84f3f4a1fdb69aae53621f1093f68
 SHA512:
-  metadata.gz: '0586c38ca0fbbac3cc9da9d3147db3d58c2f1380991a06bf412f17d92029023fbfca96289c91b8bfc30a1a25e1a26a8df8e8e5ada81cbfaf62074eae396868d1'
-  data.tar.gz: 85f351046a3e65e9e0c8f8d725b5aa585555f6055798f4d80ace09fe16f8ef28b8f00124ac9ce7de3e5e1047ae0b01cf263636f712818d402600bc0e996b1e9f
+  metadata.gz: 3f8c5b7d20a0190f05afd7e1d8c453979eeaf3dc7d1ec58e5314fdeb803e84d5a3bbbf6e1fa533b3827d0bc70b8b41269d5a5d2d06d79339c1244e3a5a10b7a4
+  data.tar.gz: e93f2d6a31337fc9e23782b4e3e5a37196e5ef95a92b206868721f8dc04d0263a593eb5361fef0c2fa0a67ab037a3777faafb65bcbe06fa0f45bdf215430bdd1

data/.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     branches: [main, master]
   pull_request:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}

data/.github/workflows/conformance.yml

@@ -15,6 +15,13 @@ on:
     - cron: "37 5 * * *" # nightly, offset from the other workflows
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # PR + push: HTML5 parsing conformance, plus the XPath and CSS differentials
   # over the curated corpus and a moderate batch of generated XPath expressions.

data/.github/workflows/css-match.yml

@@ -37,6 +37,13 @@ on:
     - cron: "41 4 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   # Short on a push or PR, long on the nightly schedule.
   LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -139,8 +146,12 @@ jobs:
       # also starts from the other's corpus (read-only: new units go to the
       # first directory). The cache prefix is libfuzzer.yml's, so the corpus
       # accumulated there carries over.
+      # Restored here, saved after the minimization below - and not on a pull
+      # request: a cache a PR saves is scoped to that PR's ref, so main and the
+      # nightly never read it, and minimizing it (~5 min) only bought a cache
+      # nobody restores.
       - name: Restore the corpus
-        uses: actions/cache@v6
+        uses: actions/cache/restore@v6
         with:
           path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
           key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
@@ -171,6 +182,32 @@ jobs:
             -dict=css.dict \
             -print_final_stats=1
 
+      # The corpus is saved after every main/nightly run, so without this it
+      # only grows: every nightly hour adds units and nothing ever drops one.
+      # It reached ~58k files (with the sibling, ~107k units replayed before
+      # the first mutation) of which libFuzzer kept ~2.8k, and a short run
+      # spent its whole 180 s replaying - 0 new units, no fuzzing at all.
+      # Minimizing before the save keeps only what adds coverage. The first
+      # run after a long gap pays one replay of the backlog; later ones a
+      # few thousand units.
+      - name: Minimize the corpus before it is cached
+        if: github.event_name != 'pull_request'
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          before=$(ls corpus/${{ matrix.target }} | wc -l)
+          cargo fuzz cmin ${{ matrix.target }} corpus/${{ matrix.target }} -- \
+            -max_len=4096 \
+            -timeout=30
+          after=$(ls corpus/${{ matrix.target }} | wc -l)
+          echo "corpus/${{ matrix.target }}: $before -> $after files"
+
+      - name: Save the corpus
+        if: github.event_name != 'pull_request'
+        uses: actions/cache/save@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+
       - name: Upload reproducers
         if: failure()
         uses: actions/upload-artifact@v4

data/.github/workflows/security.yml

@@ -8,6 +8,13 @@ on:
     - cron: "17 19 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # A "C safety lint" job stood here (`rake security:clint`, over
   # script/check_c_safety.rb). It enforced rules about C that no longer exists -

data/.github/workflows/valgrind.yml

@@ -23,6 +23,13 @@ on:
     - cron: "0 2 * * *"
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Valgrind memcheck on the full spec suite.  Complements ASan by catching
   # layout-independent errors ASan misses: use of uninitialised values, and
@@ -111,8 +118,8 @@ jobs:
   # (parse/drop cycles) scale their iteration count down under stress
   # (`gc_churn_iters` / `GC_COMPACT_ITERS`) because each stressed iteration is
   # orders of magnitude heavier; `GC_COMPACT_ITERS` below tunes the total runtime
-  # (~6-9 min on CI at 200).  An earlier version forced GC.stress onto the
-  # *entire* suite (~800 examples): it ran 1h40m+ and never finished, while
+  # (~14.5 min on CI at 200 in one job, hence the three shards below).  An
+  # earlier version forced GC.stress onto the *entire* suite (~800 examples): it ran 1h40m+ and never finished, while
   # testing borrowed-pointer discipline on hundreds of examples that have none.
   # The rest of the suite still runs in ci.yml.
   #
@@ -123,7 +130,7 @@ jobs:
     # Pull requests, nightly and on demand - not on push (the valgrind job is the
     # post-merge gate). See the note under `on:` for why pull requests.
     if: github.event_name != 'push'
-    name: GC.auto_compact + GC.stress (Ruby ${{ matrix.ruby }})
+    name: GC.auto_compact + GC.stress (Ruby ${{ matrix.ruby }}, ${{ matrix.shard.name }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
@@ -137,6 +144,17 @@ jobs:
       fail-fast: false
       matrix:
         ruby: ["3.4"]
+        # Split by spec file into three ~equal parts (measured per file: the
+        # handler spec alone is a third, attribute + source_location another).
+        # The last shard is everything ELSE, so a newly tagged file lands
+        # there rather than in no shard; rebalance if it grows past the others.
+        shard:
+          - name: xpath_handler
+            args: spec/xpath_handler_spec.rb
+          - name: attribute
+            args: spec/attribute_spec.rb spec/source_location_spec.rb
+          - name: rest
+            args: --exclude-pattern "spec/{xpath_handler,attribute,source_location}_spec.rb" spec
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)
@@ -166,4 +184,4 @@ jobs:
       # auto_compact globally and wrap each example in GC.stress; --tag gc_compact
       # limits the run to the borrowed-pointer examples.
       - name: Run GC-sensitive examples under GC.auto_compact + GC.stress
-        run: bundle exec rspec --tag gc_compact spec
+        run: bundle exec rspec --tag gc_compact ${{ matrix.shard.args }}

data/.github/workflows/verify.yml

@@ -1,11 +1,37 @@
 name: Verify
 
 on:
+  # Ten minutes of proofs, over the Ruby-free engine only - so they run when
+  # that engine (or how it is built) changes, not on every push.
   push:
     branches: [main, master]
+    paths: &kani-paths
+      # The proofs build `--no-default-features`, so the Ruby/Lexbor layers
+      # below are compiled out of them; a change confined to those cannot
+      # change a proof's outcome. Everything else under src/ stays in, since
+      # the harnesses reach the engine's shared modules (limits, text, ...).
+      - "ext/makiri/rust/src/**"
+      - "!ext/makiri/rust/src/bridge/**"
+      - "!ext/makiri/rust/src/glue/**"
+      - "!ext/makiri/rust/src/lexbor/**"
+      - "!ext/makiri/rust/src/css/**"
+      - "!ext/makiri/rust/src/init.rs"
+      - "ext/makiri/rust/build.rs"
+      - "ext/makiri/rust/Cargo.toml"
+      - "ext/makiri/rust/Cargo.lock"
+      - "Rakefile"
+      - ".github/workflows/verify.yml"
   pull_request:
+    paths: *kani-paths
   workflow_dispatch:
 
+# A new push to a pull request supersedes the run on its previous head. The
+# event is in the group so a push to main never queues behind (or replaces) a
+# nightly run of the same workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # A CBMC job stood here and proved ext/makiri/{core,xml,xpath}/*.c. Those
   # files are gone, and `rake verify` with them: every one of its fifteen

data/CHANGELOG.md

@@ -1,5 +1,110 @@
 # Changelog
 
+## [0.15.0] - 2026-10-09
+
+### Added
+
+* `Makiri::HTML::Document#create_loose_dom_element(qualified_name, prefix,
+  local_name, namespace_uri)`, like the XML Document's: the local name is
+  taken as given (`"Foo:Bar"` keeps its colon and case). Names the DOM
+  refuses raise `ArgumentError`.
+* `Makiri::XML::Document#quirks_mode?` (always `false`) and `#compat_mode`
+  (always `"CSS1Compat"`), as on the HTML Document.
+
+### Changed
+
+* `:lexbor-contains()` is no longer supported. `#css` / `#at_css` /
+  `#matches?` raise `Makiri::CSS::SyntaxError` for it (HTML and XML), and
+  `parse_stylesheet` reports its rule as `:bad_style`. Use XPath `contains()`
+  instead.
+* HTML `#css` / `#at_css` / `#matches?` raise `Makiri::Error` ("could not be
+  run") for `:current(S)` instead of matching nothing.
+
+### Fixed
+
+* `parse_stylesheet` keeps escapes in a selector's `:text`: `.md\:block` came
+  back as `.md:block`. `:current(S)` keeps its argument, and a rule
+  with `[|a]` is no longer reported as `:bad_style`.
+* `parse_stylesheet` trims only CSS whitespace and never an escaped one:
+  `screen\ ` came back as `screen\`. A `:bad_style`'s `selector_text` no
+  longer keeps the whitespace before its `{`.
+* HTML `:has()` with a descendant combinator is no longer slow on deep
+  documents: `:has(* * x)` exceeded the work budget at 200 levels.
+
+## [0.14.0] - 2026-10-04
+
+### Added
+
+* `Document#attribute_version` (HTML and XML): an Integer that increases
+  whenever an attribute is added, removed or set (to the same value too),
+  including through an Attr node's `content=` or `remove`. Child-list and
+  text edits leave it as it is, so it can key a cache of attributes.
+* `Makiri::XML::Document#create_element_ns(namespace_uri, qualified_name)`,
+  like the HTML Document's and the DOM's `createElementNS`. The element keeps
+  its namespace wherever it is inserted; a name that is not an XML QName
+  (`f}oo`) makes an element that `to_xml` refuses.
+* `Makiri::HTML::Document.new`: an empty HTML document in no-quirks mode.
+* `Makiri::HTML::Document#quirks_mode?` and `#compat_mode` (`"BackCompat"` /
+  `"CSS1Compat"`, like the DOM's `compatMode`).
+* HTML `Attr#remove` / `#unlink` remove the attribute from its element, as on
+  XML. They raised "use delete(name) to remove an attribute".
+
+### Changed
+
+* `tree_version` counts child-list changes only. A Text, Comment, CDATA or
+  PI node's `content=` no longer moves it, and an HTML Attr node's
+  `content=` moves `attribute_version` instead.
+* `tree_version` and `attribute_version` are documented as cache keys: an
+  unchanged version means nothing it covers changed, while a changed one may
+  be conservative (an edit refused part-way can still move it).
+* `namespace_uri` and `prefix` are documented as `nil`, never `""`, when
+  there is no namespace or prefix, in HTML and XML.
+* `Document#dup` copies the tree node by node instead of re-parsing its
+  serialization. An HTML copy keeps a tree with no `<html>` root as it is and
+  keeps the quirks mode, and `Node#line` on it is `nil`. An XML copy keeps
+  every name and namespace as written (a re-parse invented `ns1:` prefixes),
+  copies data XML cannot write, and keeps the original's `max_bytes`.
+* XML `create_processing_instruction` accepts the target `xml` (in any case),
+  as the DOM does; `to_xml` and `canonicalize` refuse a tree holding one.
+* HTML `create_processing_instruction` raises `ArgumentError`, as XML does,
+  for data containing `?>`. It raised `Makiri::Error`.
+* A refused XML insertion names the DOM rule it breaks, in the same words as
+  HTML. It said "invalid placement".
+
+### Fixed
+
+* An Attr's `content=` and `remove` raise `FrozenError` when the element
+  that owns it is frozen, in HTML and XML.
+* XML `Attr#content=` sets the attribute's value. It raised "operation
+  unsupported".
+* HTML `title=` and `meta_encoding=` do nothing on a document with no
+  `<head>`, as the DOM's title setter does. They inserted the element directly
+  under the root element.
+* HTML `Document#root` and CSS `:root` return the document element, or `nil`.
+  Without an `<html>` element they returned the first child of any kind, such
+  as a comment, and `title=` raised on such a document.
+* An edit refused for its arguments - a frozen or non-node argument to an
+  HTML insertion, an invalid name given to XML `[]=`, `set_attribute_ns` or
+  `set_loose_dom_attribute`, a refused HTML `Attr#remove` - no longer moves a
+  version.
+* An XML copy that runs out of the document's byte budget (`import_node`,
+  `clone_node`, an insertion from another document) gives back what it used.
+  The document could not be edited any more after one.
+* Importing HTML into an XML document stores each namespace URI once instead
+  of once per element, which used up the byte budget faster.
+* An HTML Attr imported on its own from another HTML document keeps its
+  namespace URI as written. It was lower-cased.
+* `to_xml` and `canonicalize` write an element in the XML namespace as
+  `xml:local`. They wrote a declaration that does not parse. An element in
+  the XMLNS namespace is refused with `Makiri::Error`.
+* XML XPath: a prefixed attribute on a detached element, whose namespace is
+  not decided yet, no longer matches an unprefixed name test.
+* XML: references are read by one grammar everywhere. The internal subset
+  accepted a character reference to a character XML does not allow
+  (`<!ENTITY x "&#0;">`), and a malformed reference next to an entity
+  reference was reported as an unsupported DTD construct instead of as
+  malformed XML.
+
 ## [0.13.0] - 2026-10-03
 
 ### Added
@@ -890,14 +995,3 @@ Tooling
   benchmark harness (`rake bench`); conformance harnesses (html5lib-tests, WPT
   domxpath, CSS differential vs `Nokogiri::HTML5`). GitHub Actions CI across
   Ruby 3.2–4.0 × Ubuntu/macOS plus a sanitizer job.
-
-[0.9.0]: https://github.com/takahashim/makiri/compare/v0.8.0...v0.9.0
-[0.8.0]: https://github.com/takahashim/makiri/compare/v0.7.0...v0.8.0
-[0.7.0]: https://github.com/takahashim/makiri/compare/v0.6.0...v0.7.0
-[0.6.0]: https://github.com/takahashim/makiri/compare/v0.5.1...v0.6.0
-[0.5.1]: https://github.com/takahashim/makiri/compare/v0.5.0...v0.5.1
-[0.5.0]: https://github.com/takahashim/makiri/compare/v0.4.0...v0.5.0
-[0.4.0]: https://github.com/takahashim/makiri/compare/v0.3.0...v0.4.0
-[0.3.0]: https://github.com/takahashim/makiri/compare/v0.2.0...v0.3.0
-[0.2.0]: https://github.com/takahashim/makiri/compare/v0.1.0...v0.2.0
-[0.1.0]: https://github.com/takahashim/makiri/releases/tag/v0.1.0

data/NOKOGIRI_DIFFERENCES.md

@@ -245,18 +245,12 @@ what browsers do - rather than libxml2. Detailed, test-backed notes live in
     text-containment extension. Use XPath (`xpath("//p[contains(., 'x')]")`) or
     Enumerable (`css('li')[1]`) for the rest.
     Standard Level-4 selectors (`:is` / `:where` / `:has`) are supported; some of which Nokogiri rejects.
-  * `:lexbor-contains("text")` - Lexbor's spelling of the jQuery `:contains()`
-    substring filter, matching an element whose text contains the string;
-    append ` i` (`:lexbor-contains("text" i)`) for an ASCII case-insensitive
-    match. (Nokogiri's name `:contains` is not an alias.) **XML only**: it
-    lowers to XPath `child::text()[contains(., "text")]`, testing the
-    element's immediate child text nodes, not the deep string-value. HTML no
-    longer supports it - `lexbor::css_match`, the safe-Rust port that
-    replaced Lexbor's own matcher for HTML, deliberately does not reimplement
-    it, so a well-formed `:lexbor-contains()` now raises `Makiri::Error`
-    ("could not be run") on HTML rather than ever matching (it still PARSES,
-    and an actually malformed one still raises `Makiri::CSS::SyntaxError`, as
-    before).
+  * There is no text-containment pseudo-class. Nokogiri's `:contains()` is
+    not supported, and neither is Lexbor's `:lexbor-contains()`: it raises
+    `Makiri::CSS::SyntaxError` on HTML and XML alike, like any unknown
+    pseudo-class (Lexbor's parser for it had memory-safety bugs, so Makiri
+    never lets it run). Use XPath instead:
+    `xpath('//p[contains(., "text")]')`.
 * Untyped `:*-of-type` (`:first-of-type`, `:nth-of-type(an+b)`, ... with no type
   selector) is supported and correct on both HTML and XML - the "type" is the
   element's own expanded name.

data/README.md

@@ -184,6 +184,12 @@ and unusually large documents can raise it with `max_bytes:`.
 Makiri::XML(huge_xml, max_bytes: 512 * 1024 * 1024)   # also Makiri::XML::Document.parse(..., max_bytes:)
 ```
 
+The limit covers the document's whole life, not only the parse: nodes and
+values made by editing it count too, and a replaced value or a removed node
+keeps its bytes until the document is gone. A document edited for a long time
+can be compacted with `dup`, which copies only what is in it now, under the
+same limit.
+
 ### Node identity
 
 Navigating to the same node always gives the same Ruby object, for as long as

data/Rakefile

@@ -94,10 +94,12 @@ end
 # the report down to errors whose stack touches our extension, so we no longer
 # have to fetch ruby.supp from ruby/ruby (that path was removed upstream).
 #
-# We keep this job's historical contract: catch *use of uninitialised values*
-# and *invalid reads/writes* (incl. intra-arena overflows) - NOT leaks (leak
-# detection stays with `rake leaks`). So we override ruby_memcheck's defaults,
-# which disable undef-value errors and turn on full leak-check.
+# The job catches *use of uninitialised values* and *invalid reads/writes*
+# (incl. intra-arena overflows), and also any "definitely lost" block whose
+# stack touches our extension - the one leak gate with no frequency threshold
+# (`rake leaks`, macOS, flags only stacks repeated >= 30x). It once meant to
+# leave leaks out and could not: see `--leak-check` below. ruby_memcheck's
+# defaults disable undef-value errors, so we override them.
 #
 # `filter_all_errors: true` is essential: by default ruby_memcheck only applies
 # its "stack must touch the makiri binary" filter to *leak*-kind errors
@@ -146,7 +148,19 @@ begin
       # post-merge push gate turns it off (VALGRIND_TRACK_ORIGINS=no) to run in
       # ~half the time, while the nightly / manual runs keep it on for the backtrace.
       "--track-origins=#{ENV.fetch('VALGRIND_TRACK_ORIGINS', 'yes')}",
-      "--leak-check=no",        # leaks are `rake leaks`' job, not this one
+      # Leaks ARE checked here, whatever this says: ruby_memcheck always runs
+      # valgrind with --xml=yes, and in XML mode memcheck writes its leak
+      # records even under --leak-check=no (a "definitely lost" in a spec's
+      # child process failed run 37864917248 that way). So say what happens,
+      # and keep ruby_memcheck's own leak kinds - these options REPLACE its
+      # defaults rather than adding to them, and without the line below
+      # valgrind's default (definite,possible) fails the job on a "possibly
+      # lost" too. A spec that runs Ruby in a child must leave
+      # RUBY_FREE_AT_EXIT set there (it is inherited): without it the child's
+      # live strings at exit are reported as definitely lost through our
+      # frames (PR #55).
+      "--leak-check=full",
+      "--show-leak-kinds=definite",
     ],
   )
 

data/lib/makiri/html/document.rb

@@ -26,22 +26,37 @@ module Makiri
         _parse(String(source), max_tree_depth)
       end
 
-      # An independent copy of the whole document (like Nokogiri's Document#dup).
-      # Built by serialising and re-parsing, so the copy shares no nodes with the
-      # original - Node#dup's clone_node delegation is wrong for a document node,
-      # hence this override. (A DOM mutated into a shape the HTML parser would not
-      # itself produce, e.g. a foster-parented table cell, may be re-normalised on
-      # re-parse; a freshly parsed document round-trips unchanged.) Any level
-      # argument is ignored. #clone is this too (see {CloneViaDup}).
+      # An independent copy of the whole document (like Nokogiri's Document#dup):
+      # an empty document in the same quirks mode, given a deep copy of each of
+      # this one's children (+import_node+, which carries a <template>'s
+      # contents too), so the copy shares no nodes with the original and has
+      # the same tree - whatever shape it was built into, which a re-parse of
+      # +to_html+ would not keep (a Document.new without an <html> root gained
+      # the html/head/body shell and quirks mode). Node#dup's clone_node
+      # delegation is wrong for a document node, hence this override. Any
+      # level argument is ignored. #clone is this too (see {CloneViaDup}).
       #
-      # Node#line on the copy is the line in the SERIALISED text it was parsed
-      # from, not in the original source: `to_html` does not keep the original
-      # line breaks between tags, so the two differ.
-      #
-      # The re-parse has no tree-depth limit: the tree is already here, however
-      # it was built, and a copy must not fail where the original stands.
+      # Node#line is nil on the copy: its nodes were not parsed from a source.
       def dup(*)
-        self.class.parse(to_html, max_tree_depth: -1)
+        _empty_copy.tap do |copy|
+          children.each { |child| copy.add_child(copy.import_node(child, true)) }
+        end
+      end
+
+      # Whether the document is in quirks mode - the mode a missing or legacy
+      # doctype puts it in. Limited-quirks mode is not quirks mode here, as the
+      # DOM's +compatMode+ has it. (#quirks_mode is the raw value: 0 no-quirks,
+      # 1 quirks, 2 limited-quirks.)
+      # @return [Boolean]
+      def quirks_mode?
+        quirks_mode == 1
+      end
+
+      # The DOM's +document.compatMode+: "BackCompat" in quirks mode, else
+      # "CSS1Compat".
+      # @return [String]
+      def compat_mode
+        quirks_mode? ? "BackCompat" : "CSS1Compat"
       end
 
       # The document's <body> element, or nil.
@@ -56,11 +71,13 @@ module Makiri
         at_css("head")
       end
 
-      # Set the document title, creating <title> (in <head>) if absent.
+      # Set the document title, creating <title> (in <head>) if absent. A
+      # document with no <head> - a Document.new one before it has one - is
+      # left as it is, as the DOM's title setter leaves it.
       # @param text [String]
       # @return [String]
       def title=(text)
-        ensure_in_head("title", "title").content = text
+        ensure_in_head("title", "title")&.content = text
         text
       end
 
@@ -89,21 +106,28 @@ module Makiri
         nil
       end
 
-      # Set (or insert) a <meta charset> declaration.
+      # Set (or insert, in <head>) a <meta charset> declaration. Like #title=,
+      # it leaves a document with no <head> as it is.
       # @param value [String]
       # @return [String]
       def meta_encoding=(value)
-        ensure_in_head("meta[charset]", "meta")["charset"] = value
+        ensure_in_head("meta[charset]", "meta")&.[]=("charset", value)
         value
       end
 
       private
 
       # The first node matching +css_query+, or a freshly created <+tag+>
-      # appended to <head> (or the root when the document has no head). Shared by
-      # #title= and #meta_encoding=, which then set content / attributes on it.
+      # appended to <head>; nil when there is neither a match nor a head - never
+      # an element put straight under the root, which the DOM's title setter
+      # does not do either. Shared by #title= and #meta_encoding=, which then
+      # set content / attributes on it.
       def ensure_in_head(css_query, tag)
-        at_css(css_query) || Element.new(tag, self).tap { |el| (head || root).add_child(el) }
+        found = at_css(css_query)
+        return found if found
+
+        parent = head
+        parent && Element.new(tag, self).tap { |el| parent.add_child(el) }
       end
     end
   end

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.13.0"
+  VERSION = "0.15.0"
 end

data/lib/makiri/xml/document.rb

@@ -20,25 +20,34 @@ module Makiri
         r ? r.replace(node) : add_child(node)
       end
 
-      # An independent copy of the whole document (like Nokogiri's
-      # Document#dup), sharing no nodes with the original. A document with a
-      # root is serialised and re-parsed, like {Makiri::HTML::Document#dup}. One
-      # without (still being built) is not well-formed, so it cannot be; what it
-      # can hold before a root - comments and processing instructions - is
-      # imported node by node instead. Any level argument is ignored, and
-      # #clone is this too (see {CloneViaDup}).
-      #
-      # The copy is parsed with the default +max_bytes+, not the original's, and
-      # its Node#line numbers are lines of the serialised text, which can
-      # differ from the original source's.
+      # An independent copy of the whole document (like Nokogiri's Document#dup),
+      # made node for node rather than by serialising and re-parsing: the
+      # top-level order, every name, namespace URI and namespace state,
+      # attributes, the doctype and character data are the original's. Nothing
+      # has to be writable as XML, no namespace is resolved again (a re-parse
+      # gave an attribute set in a namespace an invented `ns1:` prefix), and the
+      # copy keeps the original's +max_bytes+ budget and whether it declared an
+      # encoding. Any level argument is ignored, and #clone is this too (see
+      # {CloneViaDup}).
       #
       # @return [Makiri::XML::Document]
       def dup(*)
-        return self.class.parse(to_xml) if root
+        _copy
+      end
+
+      # Always false: an XML document is in no-quirks mode, as the DOM has it.
+      # The same name as {Makiri::HTML::Document#quirks_mode?}, so a caller
+      # need not ask which kind of document it holds.
+      # @return [false]
+      def quirks_mode?
+        false
+      end
 
-        self.class.new.tap do |copy|
-          children.each { |child| copy.add_child(copy.import_node(child, true)) }
-        end
+      # The DOM's +document.compatMode+, which is always "CSS1Compat" for an
+      # XML document.
+      # @return [String]
+      def compat_mode
+        "CSS1Compat"
       end
     end
   end

data/script/check_alloc_failures.rb

@@ -345,8 +345,8 @@ SCENARIOS = {
   # CSS on XML: a different engine from the HTML one above - the selector is
   # lowered (css/) into an XPath AST, every node of which is a falloc site. One
   # selector per lowering shape: combinators, attribute operators, the nth and
-  # of-type arithmetic, the selector-list pseudo-classes, :lexbor-contains and
-  # namespaced type/universal selectors.
+  # of-type arithmetic, the selector-list pseudo-classes and namespaced
+  # type/universal selectors.
   "xml_css" => lambda do
     doc = Makiri::XML::Document.parse(<<~XML)
       <root xmlns:p="urn:p">
@@ -362,7 +362,7 @@ SCENARIOS = {
       ":nth-child(2n+1):not(:last-child)",
       "a:nth-last-of-type(1), :first-of-type:only-of-type",
       ":is(root > a, p|*):where(a) :empty",
-      "root:has(> b + a) a:lexbor-contains(\"BETA\" i)",
+      "root:has(> b + a) a",
       "*|a, |b, p|*",
     ].map { |s| doc.css(s, ns).map { |n| n.name }.join(",") }.join("\n")
   end,
@@ -428,6 +428,7 @@ SCENARIOS = {
   "css_stylesheet" => lambda do
     css = <<~CSS
       div.a, p#b > span { color: red; margin: 0 !important }
+      .md\\:block, :is(.a\\,b, :not(#x\\.y)) > [a="q\\\\"] { color: red }
       p::before { content: "x" }
       @media (min-width: 600px) { .x { color: blue } }
       @font-face { font-family: F; src: url(f.woff) }
@@ -770,7 +771,7 @@ guard_docs = {
   "html" => Makiri::HTML::Document.parse("<p>hello</p>"),
   "xml" => Makiri::XML::Document.parse("<r><p>hello</p></r>")
 }
-[":lexbor-contains(#x)", "p:LEXBOR-CONTAINS(*)"].each do |sel|
+[":lexbor-contains(#x)", "p:LEXBOR-CONTAINS(*)", %(p:lexbor-contains("x"))].each do |sel|
   guard_docs.each do |kind, doc|
     disarm
     3.times do

data/script/check_unsafe_boundaries.rb

@@ -38,14 +38,14 @@ UNSAFE_ISLANDS = {
   "bridge/node_wrap.rs" => 1,
   "bridge/ruby.rs" => 18,
   "bridge/stack.rs" => 1,
-  "bridge/string.rs" => 29,
+  "bridge/string.rs" => 30,
   "bridge/typed.rs" => 21,
-  "bridge/wrapper.rs" => 19,
+  "bridge/wrapper.rs" => 20,
   "bridge/xml.rs" => 11,
-  "bridge/xml_decode.rs" => 7,
+  "bridge/xml_decode.rs" => 5,
   "bridge/xpath/context_object.rs" => 3,
   "bridge/xpath/handler.rs" => 7,
-  "bridge/xpath/mod.rs" => 5,
+  "bridge/xpath/mod.rs" => 7,
   "cbuf.rs" => 16,
   "cbuf/verify.rs" => 8,
   "falloc/cstr.rs" => 1,
@@ -55,9 +55,9 @@ UNSAFE_ISLANDS = {
   "lexbor/abi.rs" => 4,
   "lexbor/adapter/arena_bytes.rs" => 14,
   "lexbor/adapter/cross_import.rs" => 2,
-  "lexbor/adapter/html/attrs.rs" => 23,
-  "lexbor/adapter/html/build.rs" => 25,
-  "lexbor/adapter/html/mod.rs" => 63,
+  "lexbor/adapter/html/attrs.rs" => 25,
+  "lexbor/adapter/html/build.rs" => 26,
+  "lexbor/adapter/html/mod.rs" => 67,
   "lexbor/adapter/html/mutate.rs" => 9,
   "lexbor/adapter/html/serialize.rs" => 18,
   "lexbor/adapter/post_parse.rs" => 13,
@@ -66,14 +66,14 @@ UNSAFE_ISLANDS = {
   "lexbor/adapter/tree_guard.rs" => 9,
   "lexbor/chunks.rs" => 2,
   "lexbor/css_engine.rs" => 14,
-  "lexbor/css_parser.rs" => 21,
+  "lexbor/css_parser.rs" => 19,
   "lexbor/css_tokens.rs" => 10,
   "lexbor/fragment.rs" => 7,
   "lexbor/memory.rs" => 9,
   "lexbor/selector_cache.rs" => 15,
   "lexbor/selectors.rs" => 9,
   "lexbor/serialize.rs" => 2,
-  "lexbor/stylesheet.rs" => 7,
+  "lexbor/stylesheet.rs" => 9,
   "lexbor/tests.rs" => 16,
   "lexbor/xpath.rs" => 9,
   "token.rs" => 1,
@@ -90,24 +90,25 @@ UNSAFE_ISLANDS = {
 FORBID_ROOTS = %w[css/mod.rs glue/mod.rs lexbor/css_match/mod.rs xml/mod.rs xpath/mod.rs].freeze
 
 FORBID_FILES = %w[
-  css/build.rs css/lower.rs css/mod.rs
-  cutf8.rs cutf8/verify.rs dom_rules.rs
-  engine_error.rs falloc/verify.rs glue/css.rs
-  glue/html_doc.rs glue/html_node/css.rs glue/html_node/mutate.rs
-  glue/html_node/read.rs glue/html_node/serialize.rs glue/mod.rs
-  glue/node.rs glue/node_set.rs glue/query.rs
-  glue/xml_doc.rs glue/xml_node/css.rs glue/xml_node/mod.rs
-  glue/xml_node/mutate.rs glue/xml_node/ns.rs glue/xml_node/read.rs
-  glue/xml_node/serialize.rs glue/xml_node/strings.rs glue/xpath_context.rs
-  lexbor/adapter/dom_index.rs lexbor/contains_guard.rs lexbor/css_match/mod.rs
-  limits.rs node_type.rs ptr_table.rs
-  rust_tests.rs stack.rs text.rs
-  utf8_input.rs xml/arena.rs xml/attr_key.rs
-  xml/chars/expand.rs xml/chars/mod.rs xml/dom_name.rs
-  xml/encoding_sniff.rs xml/index.rs xml/mod.rs
-  xml/model.rs xml/mutate/attr.rs xml/mutate/copy.rs
-  xml/mutate/edit.rs xml/mutate/factory.rs xml/mutate/insert.rs
-  xml/mutate/mod.rs xml/mutate/ns.rs xml/qname.rs
+  bridge/dom_error.rs css/build.rs css/lower.rs
+  css/mod.rs cutf8.rs cutf8/verify.rs
+  dom_rules.rs engine_error.rs falloc/verify.rs
+  glue/css.rs glue/html_doc.rs glue/html_node/css.rs
+  glue/html_node/mutate.rs glue/html_node/read.rs glue/html_node/serialize.rs
+  glue/mod.rs glue/node.rs glue/node_set.rs
+  glue/query.rs glue/xml_doc.rs glue/xml_node/css.rs
+  glue/xml_node/mod.rs glue/xml_node/mutate.rs glue/xml_node/ns.rs
+  glue/xml_node/read.rs glue/xml_node/serialize.rs glue/xml_node/strings.rs
+  glue/xpath_context.rs lexbor/adapter/dom_index.rs lexbor/contains_guard.rs
+  lexbor/css_match/mod.rs lexbor/selector_text.rs limits.rs
+  node_type.rs ptr_table.rs rust_tests.rs
+  stack.rs text.rs utf8_input.rs
+  xml/arena.rs xml/attr_key.rs xml/chars/expand.rs
+  xml/chars/mod.rs xml/dom_name.rs xml/encoding_sniff.rs
+  xml/index.rs xml/mod.rs xml/model.rs
+  xml/mutate/attr.rs xml/mutate/copy.rs xml/mutate/edit.rs
+  xml/mutate/factory.rs xml/mutate/insert.rs xml/mutate/mod.rs
+  xml/mutate/ns.rs xml/ns_scope.rs xml/qname.rs
   xml/selftest.rs xml/serialize/bindings.rs xml/serialize/c14n.rs
   xml/serialize/mod.rs xml/serialize/out.rs xml/serialize/xml.rs
   xml/tree/cursor.rs xml/tree/decl.rs xml/tree/dtd.rs
@@ -163,7 +164,9 @@ RAW_NODE_CROSSING =
 RAW_NODE_CROSSING_COUNTS = {
   "bridge/doc.rs" => 1,
   "bridge/fragment.rs" => 3,
-  "bridge/html.rs" => 7,
+  # 8th: an Attr's owner, read as the wrapper cache's identity key for the
+  # owner-frozen check (`check_attr_owner_frozen`); it does not escape.
+  "bridge/html.rs" => 8,
   "bridge/wrapper.rs" => 3,
 }.freeze
 
@@ -425,7 +428,7 @@ if lexbor_abi != LEXBOR_ABI_COUNTS
 end
 
 # A Lexbor function is DECLARED in one place, `lexbor/abi.rs` (bindgen's output
-# plus the three exports no header declares). A second `extern "C"` declaration of the
+# plus the exports no header declares). A second `extern "C"` declaration of the
 # same symbol gives it a second Rust type, which nothing checks agree, and on
 # macOS a declaration that matches no symbol is a NULL call rather than a link
 # error. `post_parse.rs` re-declared four generated functions that way.
@@ -442,6 +445,31 @@ unless lexbor_decls.empty?
   errors << "Lexbor functions declared outside lexbor/abi.rs: #{lexbor_decls.inspect}"
 end
 
+# Lexbor's CSS parsers are CALLED in one place each - the function that puts
+# their input through `contains_guard` first (CLAUDE.md: the guard is not
+# optional, and a new parse entry must go through it). A type alone cannot
+# say so: the raw ABI is reachable crate-wide, so a second call site would
+# compile and reach the parser unguarded. Pinned here instead.
+GUARDED_PARSES = {
+  "lxb_css_selectors_parse" => "lexbor/css_engine.rs",   # SelectorParser::parse
+  "lxb_css_stylesheet_parse" => "lexbor/stylesheet.rs",  # guarded_stylesheet
+}.freeze
+guarded_calls = Hash.new { |h, k| h[k] = Hash.new(0) }
+Dir.glob(File.join(RUST, "**", "*.rs")).sort.each do |path|
+  relative = path.delete_prefix("#{RUST}/")
+  code = comments_removed(File.binread(path))
+  GUARDED_PARSES.each_key do |name|
+    count = code.scan(/\b#{name}\s*\(/).length
+    guarded_calls[name][relative] = count unless count.zero?
+  end
+end
+GUARDED_PARSES.each do |name, home|
+  next if guarded_calls[name] == { home => 1 }
+
+  errors << "#{name} must be called exactly once, in #{home} (behind contains_guard): " \
+            "#{guarded_calls[name].inspect}"
+end
+
 # magnus's `RHash::foreach` runs its closure under magnus's own `protect`, below
 # `rb_hash_foreach`'s C frames, so a panic in it aborts the process instead of
 # raising. `glue::hash::hash_foreach` latches it; every Hash walk goes there.
@@ -462,7 +490,7 @@ end
 # is generated, so its signature is Lexbor's. A new hand declaration of a
 # header-declared function belongs in build.rs's allowlist instead; one with no
 # header belongs in build.rs's UNDECLARED_EXPORTS as well as here.
-LEXBOR_HAND_DECLS = 5
+LEXBOR_HAND_DECLS = 4
 abi_decls = comments_removed(File.binread(File.join(RUST, "lexbor/abi.rs"))).scan(LEXBOR_DECL).length
 if abi_decls != LEXBOR_HAND_DECLS
   errors << "lexbor/abi.rs hand-declares #{abi_decls} Lexbor functions (expected " \

data/suppressions/ruby.supp

@@ -161,6 +161,20 @@
   ...
 }
 
+# The global symbol table (`global_symbols.ids`) grows in chunks as symbols are
+# interned, and lives for the life of the VM: RUBY_FREE_AT_EXIT reports its
+# chunk arrays as "definitely lost" whenever the growth happened under one of
+# our cfuncs - `parse_stylesheet` interns its hash keys with `rb_intern` on the
+# first call, and whether that call crosses a chunk boundary depends on how many
+# symbols the process made before it. Not ours to free.
+{
+  ruby-global-symbol-table
+  Memcheck:Leak
+  ...
+  fun:set_id_entry*
+  ...
+}
+
 # ---- Makiri's process-lifetime CSS compiled-selector cache ----
 # `lexbor::selector_cache` keeps compiled selector lists in a process-global
 # `HashMap<Box<[u8]>, _>` (bounded by CACHE_CAP) that lives until exit by

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.15.0
 platform: aarch64-linux
 authors:
 - takahashim