makiri 0.3.0-aarch64-linux → 0.4.0-aarch64-linux

data/script/check_c_safety_allowlist.yml

@@ -93,3 +93,22 @@ ignore_paths:
   - path: ext/makiri/glue/ruby_node_set.c
     rule: node_raw_boundary
     reason: NodeSet.new stores representation-opaque pointers; mkr_node_raw takes a seed node's pointer only after same-document validation guarantees its kind matches the set.
+
+# --- parser-TU reader discipline (raw_scan_call / raw_cursor_member) ---
+allowlist:
+  - path: ext/makiri/xpath/mkr_xpath_funcs_body.h
+    rule: raw_scan_call
+    max: 3
+    reason: "mkr_lookup_function's three strcmp over compile-time function-name tables: both sides are NUL-terminated (table literals / owned AST text), and the lookup signature takes bare const char* from the evaluator."
+
+  # --- verified_text_forge: the two Ruby-free test entry points. Neither can use
+  #     mkr_verified_text_from_view (bridge = Ruby boundary), so each mints the
+  #     token itself and must supply the contract by construction. ---
+  - path: ext/makiri/xpath/mkr_xpath_xml_selftest.c
+    rule: verified_text_forge
+    max: 2
+    reason: "Selftest expressions are compile-time string literals: NUL-terminated, NUL-free, valid UTF-8 by construction."
+  - path: ext/makiri/fuzz/xpath_fuzz.c
+    rule: verified_text_forge
+    max: 1
+    reason: "The libFuzzer harness mints over an owned mkr_strndup copy, which supplies NUL-termination and no-interior-NUL; UTF-8 validity is deliberately left to the lexer's strict decoder (its rejection path is fuzz-target behavior)."

data/script/check_leaks.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# Malloc-leak gate for the C extension (macOS only; run via `rake leaks`).
+#
+# ASan runs everywhere with detect_leaks=0 (Ruby and Lexbor are uninstrumented,
+# so LeakSanitizer drowns in their noise) - which means plain leaks were never
+# machine-checked. This gate fills that hole with macOS's `leaks` tool: it runs
+# script/leaks_harness.rb (the public surface in a loop, INCLUDING rescued
+# failure paths) under MallocStackLogging, then scans the leak report for
+# allocation stacks that (a) pass through makiri.bundle and (b) repeat in
+# proportion to the loop count - i.e. a leak per call, which is what a missing
+# free on some path looks like. One-time Init allocations and Ruby's own
+# at-exit/unscannable noise stay at 1-2 instances and are ignored.
+#
+# Found (and since fixed) by this harness: the transient fragment document
+# leaked by every inner_html=/outer_html=, and the partially-built step leaked
+# by every failing XPath parse.
+#
+#   ruby script/check_leaks.rb            # threshold = ITERATIONS / 4
+#   LEAKS_ITERATIONS=200 rake leaks       # more iterations, sharper signal
+
+require "rbconfig"
+require "tempfile"
+
+abort "check_leaks: the `leaks` tool is macOS-only" unless RUBY_PLATFORM.include?("darwin")
+
+iterations = Integer(ENV.fetch("LEAKS_ITERATIONS", "120"))
+threshold  = [iterations / 4, 10].max
+harness    = File.expand_path("leaks_harness.rb", __dir__)
+lib        = File.expand_path("../lib", __dir__)
+
+out = Tempfile.create("makiri-leaks")
+ok = system({ "MallocStackLogging" => "1", "LEAKS_ITERATIONS" => iterations.to_s },
+            "leaks", "--atExit", "--",
+            RbConfig.ruby, "-I#{lib}", harness,
+            out: out.path, err: out.path)
+report = File.read(out.path)
+# `leaks` exits non-zero whenever ANY leak exists (Ruby itself always reports
+# some at-exit noise), so the exit status is not the verdict - the scan below
+# is. But the harness itself must have completed.
+abort "check_leaks: harness did not complete:\n#{report[-2000..]}" unless report.include?("leaks harness done")
+abort "check_leaks: no leak report produced (leaks tool failed?)" unless report.include?("STACK OF") || ok
+
+offenders = report.split(/\n(?=STACK OF )/).filter_map do |stanza|
+  next unless stanza.include?("makiri.bundle")
+
+  instances = stanza[/STACK OF (\d+) INSTANCES?/, 1].to_i
+  next if instances < threshold
+
+  frames = stanza.lines.grep(/makiri\.bundle/).first(4).map(&:strip)
+  [instances, frames]
+end
+
+if offenders.empty?
+  puts "check_leaks: OK - no repeated (>= #{threshold}x) leak stacks through makiri.bundle " \
+       "(#{iterations} iterations)"
+else
+  puts "check_leaks: FAILED - #{offenders.size} repeated leak stack(s) through makiri.bundle:"
+  offenders.each do |instances, frames|
+    puts "  #{instances}x:"
+    frames.each { |f| puts "    #{f}" }
+  end
+  exit 1
+end

data/script/leaks_harness.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# Exercise script for the malloc-leak gate (script/check_leaks.rb runs this
+# under macOS `leaks --atExit`). It loops the public surface - parsing, queries,
+# serialization, mutation, fragments, the Builder, XPathContext - and, crucially,
+# RESCUED FAILURE paths (raises that skip cleanup are where leaks hide; both
+# leaks this gate was built on lived there or in a transient-document path).
+#
+# A per-call leak shows up as a leak stack with ~ITERATIONS instances, which the
+# driver flags; one-time/Init allocations stay at 1-2 instances and pass.
+
+require "makiri"
+
+ITERATIONS = Integer(ENV.fetch("LEAKS_ITERATIONS", "120"))
+
+HTML = "<div id=m class='a b'><ul><li class=item>x</li><li>y<svg><path/></svg></li></ul><p>t&amp;</p></div>"
+XML  = %(<r xmlns:p="urn:p" xmlns="urn:d"><a id="1">t</a><p:b/><!--c--><![CDATA[z]]></r>)
+
+handler = Class.new { def my_fn(nodes) = nodes.length.to_s }.new
+
+ITERATIONS.times do |i|
+  # --- HTML: parse / query / serialize / mutate / fragments ---
+  d = Makiri::HTML(HTML)
+  d.css("li.item"); d.at_css("#m"); d.at_css("li").matches?("li")
+  begin d.css("li[") rescue Makiri::CSS::SyntaxError; end             # selector syntax error (engine reset path)
+  d.xpath("//li"); d.at_xpath("//p"); d.xpath("count(//li)")
+  begin d.xpath("//li[") rescue Makiri::XPath::SyntaxError; end       # parse failure (partial-AST/step cleanup)
+  begin d.xpath("//li", handler) rescue nil; end
+  d.xpath("//*[local-name()='path']")
+  d.to_html; d.at_css("ul").inner_html; d.to_html(pretty: true); d.text
+  e = d.at_css("li"); e["k#{i}"] = "v"; e.name = "li2"; e.content = "c"
+  e.set_attribute_ns("urn:x", "x:y", "1"); e.remove_attribute_ns("urn:x", "y")
+  d.at_css("ul").inner_html = "<li>new</li>"                          # transient fragment document path
+  frag = d.fragment("<b>f</b>"); d.at_css("p") << frag
+  Makiri::DocumentFragment.parse("<tr><td>1</td></tr>", context: "tbody")
+  d.at_css("p").clone_node(true); d.dup
+  begin d.fragment("x", context: "no-such-tag") rescue ArgumentError; end
+
+  # --- XML: parse (ok + failures) / query / serialize / mutate / Builder ---
+  x = Makiri::XML(XML)
+  begin Makiri::XML("<r>\xC3</r>".b) rescue Makiri::XML::SyntaxError; end
+  begin Makiri::XML("<r><a></r>")    rescue Makiri::XML::SyntaxError; end
+  begin Makiri::XML("<r/>", max_bytes: 1) rescue Makiri::XML::LimitExceeded; end
+  begin Makiri::XML(%(<?xml version="1.1"?><r/>)) rescue Makiri::XML::SyntaxError; end
+  x.xpath("//d:a", "d" => "urn:d"); x.at_xpath("//p:b", "p" => "urn:p")
+  begin x.xpath("//unbound:a") rescue Makiri::Error; end
+  x.css("a"); x.at_css("p|b", "p" => "urn:p")
+  begin x.css("a[") rescue Makiri::CSS::SyntaxError; end
+  x.to_xml; x.to_xml(pretty: true); x.root.canonicalize
+  el = x.create_element("n", "t", "k" => "v"); x.root.add_child(el)
+  begin x.root.add_child(x.create_element("zz:q")) rescue Makiri::Error; end
+  x.root.children.first.replace(x.create_element("rep")); x.fragment("<f1/><f2/>")
+  Makiri::XML::Builder.new { |b| b.root("xmlns:d" => "urn:d") { b.item("a"); b["d"].q } }.to_xml
+
+  # --- XPathContext: AST cache / registrations / failing evaluate ---
+  ctx = Makiri::XPathContext.new(x)
+  ctx.register_namespace("d", "urn:d"); ctx.register_variable("v", "1")
+  ctx.evaluate("//d:a[@id=$v]"); ctx.evaluate("//d:a[@id=$v]")
+  begin ctx.evaluate("//(") rescue Makiri::XPath::SyntaxError; end
+end
+
+GC.start
+GC.start
+puts "leaks harness done (#{ITERATIONS} iterations)"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: aarch64-linux
 authors:
 - takahashim
@@ -64,8 +64,10 @@ extra_rdoc_files: []
 files:
 - ".github/workflows/ci.yml"
 - ".github/workflows/conformance.yml"
+- ".github/workflows/libfuzzer.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/security.yml"
+- ".github/workflows/valgrind.yml"
 - ".gitmodules"
 - CHANGELOG.md
 - LICENSE
@@ -95,13 +97,17 @@ files:
 - lib/makiri/text.rb
 - lib/makiri/version.rb
 - lib/makiri/xml.rb
+- lib/makiri/xml/builder.rb
 - lib/makiri/xml/document.rb
 - lib/makiri/xml/node_methods.rb
 - lib/makiri/xpath.rb
 - lib/makiri/xpath_context.rb
 - script/build_native_gem.rb
+- script/check_alloc_failures.rb
 - script/check_c_safety.rb
 - script/check_c_safety_allowlist.yml
+- script/check_leaks.rb
+- script/leaks_harness.rb
 - sig/makiri.rbs
 homepage: https://github.com/takahashim/makiri
 licenses: