makiri 0.3.0 → 0.4.0

data/ext/makiri/extconf.rb

@@ -28,7 +28,29 @@ abort "Lexbor source not found at #{LEXBOR_SRC}. Did you `git submodule update -
 
 cmake = find_executable("cmake") or abort "cmake is required to build Lexbor."
 
-unless File.exist?(File.join(LEXBOR_DST, "lib", "liblexbor_static.a"))
+# Optionally build the vendored Lexbor itself under AddressSanitizer. This is the
+# ONLY way to catch overflows *inside* Lexbor's bump (mraw) arena: a sub-allocation
+# overrunning into the next one stays within one big malloc'd chunk, so the heap
+# allocator's red-zones (and thus a plain ASan build of just our ext) never see it.
+# Lexbor's own mraw is ASan-aware - with -DLEXBOR_BUILD_WITH_ASAN=ON its CMake
+# defines LEXBOR_HAVE_ADDRESS_SANITIZER, and mraw then unpoisons exactly each
+# allocation and re-poisons the gap, so an intra-arena overrun writes into
+# poisoned memory and ASan reports it. Opt-in (slow full rebuild), only meaningful
+# with MAKIRI_SANITIZE=...address...; drive it via `rake sanitize:lexbor`.
+# vendor/lexbor stays vanilla - this is a build flag, not a source patch.
+sanitize = ENV["MAKIRI_SANITIZE"].to_s.strip
+lexbor_asan = !ENV["MAKIRI_SANITIZE_LEXBOR"].to_s.strip.empty? && sanitize.include?("address")
+lexbor_mode = lexbor_asan ? "asan" : "plain"
+lexbor_stamp = File.join(LEXBOR_DST, ".makiri_build_mode")
+
+# Reuse the cached archive only when it was built in the mode we now want; a mode
+# switch (plain <-> asan) forces a rebuild, so a sanitized Lexbor can never leak
+# into a normal build or vice versa.
+have_archive = File.exist?(File.join(LEXBOR_DST, "lib", "liblexbor_static.a"))
+stamp_ok = have_archive && File.exist?(lexbor_stamp) && File.read(lexbor_stamp).strip == lexbor_mode
+unless stamp_ok
+  FileUtils.rm_rf(LEXBOR_BLD)
+  FileUtils.rm_rf(LEXBOR_DST) if have_archive   # drop a wrong-mode install
   FileUtils.mkdir_p(LEXBOR_BLD)
   Dir.chdir(LEXBOR_BLD) do
     cmd = [
@@ -41,12 +63,15 @@ unless File.exist?(File.join(LEXBOR_DST, "lib", "liblexbor_static.a"))
       "-DCMAKE_BUILD_TYPE=Release",
       "-DCMAKE_POSITION_INDEPENDENT_CODE=ON",
       "-DCMAKE_INSTALL_PREFIX=#{LEXBOR_DST}",
+      *(lexbor_asan ? ["-DLEXBOR_BUILD_WITH_ASAN=ON"] : []),
       LEXBOR_SRC,
     ].shelljoin
+    warn "makiri: building vendored Lexbor (mode=#{lexbor_mode})"
     system(cmd) or abort "cmake configure failed for Lexbor."
     system("#{cmake.shellescape} --build . --target install -- -j#{Etc.respond_to?(:nprocessors) ? Etc.nprocessors : 4}") or
       abort "cmake build/install failed for Lexbor."
   end
+  File.write(lexbor_stamp, lexbor_mode)
 end
 
 $INCFLAGS << " -I#{File.join(LEXBOR_DST, 'include').shellescape}"
@@ -60,11 +85,35 @@ $LDFLAGS << " #{lexbor_archive.shellescape}"
 # Sanitizer build (opt-in): MAKIRI_SANITIZE=address,undefined rake clean compile
 # Then run the suite under the runtime via `rake sanitize` (which preloads the
 # ASan runtime). Sanitizers replace the heap allocator, so even the vendored
-# (uninstrumented) Lexbor's allocations get red-zoned - heap overflows on
-# Lexbor-owned buffers are still caught. _FORTIFY_SOURCE is dropped here because
-# it conflicts with the sanitizer interceptors.
-sanitize = ENV["MAKIRI_SANITIZE"].to_s.strip
-if sanitize.empty?
+# (uninstrumented) Lexbor's allocations get red-zoned - a heap overflow off the
+# END of a Lexbor malloc is caught. Overflows *inside* Lexbor's mraw arena are
+# NOT caught this way (they stay within one malloc'd chunk); for those, also build
+# Lexbor under ASan via MAKIRI_SANITIZE_LEXBOR=1 (see the Lexbor build above and
+# `rake sanitize:lexbor`). _FORTIFY_SOURCE is dropped here because it conflicts
+# with the sanitizer interceptors.
+# Coverage build (opt-in): MAKIRI_COVERAGE=1 instruments OUR sources with clang
+# source-based coverage (the vendored Lexbor is built separately and is NOT
+# instrumented - we measure only the code we write). Run via `rake coverage`,
+# which sets LLVM_PROFILE_FILE and renders an llvm-cov report. -O0 keeps the
+# region map close to the source; _FORTIFY_SOURCE is dropped (it needs -O2).
+coverage = !ENV["MAKIRI_COVERAGE"].to_s.strip.empty?
+
+# OOM-injection build (opt-in): MAKIRI_ALLOC_INJECT=1 compiles the core
+# allocation-failure hook (mkr_alloc.h) so `rake oom` can sweep "the nth core
+# allocation fails" over representative workloads and assert every OOM branch
+# fails closed. Debug/test builds only - a normal build carries no hook.
+# Composes with the sanitize/coverage modes below.
+if ENV["MAKIRI_ALLOC_INJECT"].to_s.strip == "1"
+  $CFLAGS << " -DMKR_ALLOC_INJECT=1"
+  warn "makiri: building with allocation-failure injection (MKR_ALLOC_INJECT)"
+end
+
+if coverage
+  $CFLAGS   << " -O0 -g -fprofile-instr-generate -fcoverage-mapping"
+  $LDFLAGS  << " -fprofile-instr-generate"
+  $DLDFLAGS << " -fprofile-instr-generate"
+  warn "makiri: building with clang source-based coverage"
+elsif sanitize.empty?
   # Security hardening flags. Keep -O2 active so _FORTIFY_SOURCE works.
   $CFLAGS << " -O2"
   $CFLAGS << " -D_FORTIFY_SOURCE=2"
@@ -72,6 +121,20 @@ else
   $CFLAGS << " -O1 -g -fno-omit-frame-pointer -fsanitize=#{sanitize}"
   $LDFLAGS  << " -fsanitize=#{sanitize}"
   $DLDFLAGS << " -fsanitize=#{sanitize}"
+  if sanitize.include?("address")
+    # No ASan *stack* red zones in the ext. CRuby is built with
+    # RUBY_SETJMP = __builtin_setjmp, so rb_raise unwinds via __builtin_longjmp,
+    # which the ASan runtime does not intercept (no __asan_handle_no_return):
+    # any raise crossing an instrumented frame - ours, or Ruby code raising
+    # through rb_protect under the evaluator - leaves that frame's stack poison
+    # behind, and an interceptor (memcpy & co.) in the uninstrumented interpreter
+    # later trips over the stale shadow: a spurious report, which ASan itself
+    # then aborts while rendering (asan_thread.cpp kCurrentStackFrameMagic
+    # CHECK). Heap red zones, UBSan, and the manual arena poisoning in
+    # mkr_xml_node.c are unaffected; only stack-buffer checks are lost.
+    $CFLAGS << (RbConfig::CONFIG["CC"] =~ /clang/ || RbConfig::CONFIG["target_os"] =~ /darwin/ ?
+                  " -mllvm -asan-stack=0" : " --param asan-stack=0")
+  end
   warn "makiri: building with -fsanitize=#{sanitize}"
 end
 
@@ -133,9 +196,41 @@ elsif RbConfig::CONFIG["target_os"] =~ /linux/
   $DLDFLAGS << " -Wl,--exclude-libs,ALL"
 end
 
-# Recursively pick up C sources under ext/makiri/.
-$srcs = Dir.glob(File.join(EXT_DIR, "**", "*.c")).map { |f| f.sub("#{EXT_DIR}/", "") }
+# Recursively pick up C sources under ext/makiri/, excluding standalone
+# libFuzzer harnesses. Those define LLVMFuzzerTestOneInput and are linked by
+# ext/makiri/fuzz/Makefile, never into the Ruby extension.
+$srcs = Dir.glob(File.join(EXT_DIR, "**", "*.c"))
+           .reject { |f| f.start_with?(File.join(EXT_DIR, "fuzz") + File::SEPARATOR) }
+           .map { |f| f.sub("#{EXT_DIR}/", "") }
 $VPATH ||= []
-$VPATH += Dir.glob(File.join(EXT_DIR, "**/")).map { |d| "$(srcdir)/#{d.sub("#{EXT_DIR}/", "")}".chomp("/") }
+# fuzz/ must be excluded here too: after a `rake fuzz:libfuzzer_build`,
+# fuzz/build/{core,xml,xpath}/ hold sanitizer-instrumented .o files, and a
+# VPATH that includes them lets make resolve the extension's object
+# prerequisites there instead of compiling them - breaking the link (or worse,
+# silently mixing differently-flagged objects).
+$VPATH += Dir.glob(File.join(EXT_DIR, "**/"))
+             .reject { |d| d.start_with?(File.join(EXT_DIR, "fuzz") + File::SEPARATOR) }
+             .map { |d| "$(srcdir)/#{d.sub("#{EXT_DIR}/", "")}".chomp("/") }
 
 create_makefile("makiri/makiri")
+
+# mkmf's generated Makefile carries NO header dependencies, so editing a header
+# (e.g. a struct layout in an internal .h) recompiles only the .c files whose
+# own timestamps changed - the rest keep their stale layout and the objects
+# silently disagree (ABI mismatch, runtime breakage). Append the coarsest sound
+# rule instead: every object depends on every project header. A header edit
+# then recompiles everything - a few seconds for this ext, and it can never
+# rot (the list regenerates each configure; a header NEW since the last
+# configure is reachable only from .c files edited to include it, which rebuild
+# on their own timestamp). Ruby/Lexbor headers are deliberately excluded: a
+# Ruby upgrade gets a fresh build dir from rake-compiler, and a Lexbor pin
+# change already requires `rake clean:lexbor` (see CLAUDE.md).
+project_headers = Dir.glob(File.join(EXT_DIR, "**", "*.h"))
+                     .reject { |f| f.start_with?(File.join(EXT_DIR, "fuzz") + File::SEPARATOR) }
+                     .map { |f| "$(srcdir)/#{f.sub("#{EXT_DIR}/", "")}" }
+                     .sort
+File.open("Makefile", "a") do |mk|
+  mk.puts
+  mk.puts "# Project-header dependencies appended by extconf.rb (mkmf emits none)."
+  mk.puts "$(OBJS): #{project_headers.join(" ")}"
+end

data/ext/makiri/fuzz/Makefile

@@ -0,0 +1,95 @@
+# ext/makiri/fuzz/Makefile - libFuzzer harness build
+#
+# Usage:
+#   make xml_fuzz      # build the XML parser harness
+#   make xpath_fuzz    # build the XPath compile+eval harness
+#   make clean         # remove build artifacts
+#
+# Requires: clang with libFuzzer support (usually part of the clang distribution)
+#   and the vendored Lexbor static library already built (via `rake compile`).
+
+CLANG ?= clang
+CXX   := $(if $(filter default,$(origin CXX)),clang++,$(CXX))
+
+# Paths relative to ext/makiri/fuzz/
+EXT_DIR    = ..
+LEXBOR_SRC = ../../../vendor/lexbor
+LEXBOR_DST = $(LEXBOR_SRC)/dist
+
+# CFLAGS mirror the security flags from extconf.rb, minus Ruby-specific flags.
+# Sanitizer instrumentation is added at compile time so every TU is covered.
+SANITIZE ?= address,undefined
+CFLAGS = -O2 -g -Wall -Wextra \
+  -fstack-protector-strong \
+  -Wformat -Wformat-security \
+  -fvisibility=hidden \
+  -fno-common \
+  -fsanitize=$(SANITIZE) \
+  -I$(LEXBOR_DST)/include \
+  -I$(EXT_DIR) \
+  -I$(EXT_DIR)/core \
+  -I$(EXT_DIR)/xml \
+  -I$(EXT_DIR)/xpath \
+  -I$(EXT_DIR)/lexbor_compat
+
+# Linker flags: libFuzzer driver + sanitizers.
+LDFLAGS  = -fsanitize=fuzzer,$(SANITIZE)
+
+BUILD_DIR = build
+
+# Ruby-free C sources that the harnesses link against.
+CORE_SRCS = \
+  $(EXT_DIR)/core/mkr_alloc.c \
+  $(EXT_DIR)/core/mkr_utf8.c \
+  $(EXT_DIR)/core/mkr_buf.c \
+  $(EXT_DIR)/core/mkr_core.c
+
+XML_SRCS = \
+  $(EXT_DIR)/xml/mkr_xml_tree.c \
+  $(EXT_DIR)/xml/mkr_xml_node.c \
+  $(EXT_DIR)/xml/mkr_xml_chars.c \
+  $(EXT_DIR)/xml/mkr_xml_index.c \
+  $(EXT_DIR)/xml/mkr_xml_mutate.c
+
+XPATH_SRCS = \
+  $(EXT_DIR)/xpath/mkr_xpath.c \
+  $(EXT_DIR)/xpath/mkr_xpath_lex.c \
+  $(EXT_DIR)/xpath/mkr_xpath_parse.c \
+  $(EXT_DIR)/xpath/mkr_xpath_shared.c \
+  $(EXT_DIR)/xpath/mkr_xpath_number.c \
+  $(EXT_DIR)/xpath/mkr_xpath_engine_xml.c \
+  $(EXT_DIR)/xpath/mkr_xpath_engine_html.c
+
+CORE_OBJS  = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(CORE_SRCS))
+XML_OBJS   = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(XML_SRCS))
+XPATH_OBJS = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(XPATH_SRCS))
+
+.PHONY: all clean check-libfuzzer xml_fuzz xpath_fuzz
+
+all: check-libfuzzer xml_fuzz xpath_fuzz
+
+check-libfuzzer:
+	@mkdir -p $(BUILD_DIR)
+	@$(CXX) $(LDFLAGS) -o $(BUILD_DIR)/check_fuzzer check_fuzzer.cc >/dev/null 2>&1 || \
+	  (echo "libFuzzer runtime not available for $(CXX). Install LLVM clang and run with CLANG=/path/to/clang CXX=/path/to/clang++." >&2; exit 1)
+
+xml_fuzz: $(BUILD_DIR)/xml_fuzz.o $(CORE_OBJS) $(XML_OBJS)
+	$(CXX) $(LDFLAGS) -o $@ $^
+
+xpath_fuzz: $(BUILD_DIR)/xpath_fuzz.o $(CORE_OBJS) $(XML_OBJS) $(XPATH_OBJS)
+	$(CXX) $(LDFLAGS) -o $@ $^ $(LEXBOR_DST)/lib/liblexbor_static.a
+
+$(BUILD_DIR)/%.o: $(EXT_DIR)/%.c
+	@mkdir -p $(dir $@)
+	$(CLANG) $(CFLAGS) -c -o $@ $<
+
+$(BUILD_DIR)/xml_fuzz.o: xml_fuzz.c
+	@mkdir -p $(dir $@)
+	$(CLANG) $(CFLAGS) -c -o $@ $<
+
+$(BUILD_DIR)/xpath_fuzz.o: xpath_fuzz.c
+	@mkdir -p $(dir $@)
+	$(CLANG) $(CFLAGS) -c -o $@ $<
+
+clean:
+	rm -rf $(BUILD_DIR) xml_fuzz xpath_fuzz

data/ext/makiri/fuzz/check_fuzzer.cc

@@ -0,0 +1,4 @@
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char *, unsigned long)
+{
+    return 0;
+}

data/ext/makiri/fuzz/xml_fuzz.c

@@ -0,0 +1,24 @@
+/* xml_fuzz.c - libFuzzer harness for mkr_xml_parse.
+ *
+ * Coverage-guided fuzzing of the XML tokenizer + tree builder.
+ * Ruby-free; runs directly on the pure-C parser surface.
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include "xml/mkr_xml.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    mkr_xml_status_t status;
+    /* The parser contract says "valid UTF-8, NUL-free", but the fuzzer feeds
+     * raw bytes.  mkr_xml_parse is fail-closed: it validates as it goes and
+     * returns an error status on malformed input, never a partial document.
+     * We pass the bytes through untouched so the fuzzer can reach the invalid-
+     * UTF-8 / unexpected-NUL error paths too. */
+    mkr_xml_doc_t *doc = mkr_xml_parse((const char *) data, size, &status);
+    if (doc) {
+        mkr_xml_doc_destroy(doc);
+    }
+    return 0;
+}

data/ext/makiri/fuzz/xpath_fuzz.c

@@ -0,0 +1,109 @@
+/* xpath_fuzz.c - libFuzzer harness for the XPath compile + eval path.
+ *
+ * Coverage-guided fuzzing of the XPath lexer, parser, and evaluator.
+ * We build a small fixed XML document as the evaluation context, then
+ * treat the fuzzer input as the XPath expression string.
+ *
+ * Ruby-free; runs directly on the pure-C engine surface.
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include "core/mkr_alloc.h"
+#include "xml/mkr_xml.h"
+#include "xpath/mkr_xpath.h"
+#include "xpath/mkr_xpath_internal.h"
+
+/* A small, fixed XML document that gives the evaluator something to walk.
+ * The expression is the fuzzer input; the document is static so the coverage
+ * signal comes from the engine, not the parser. */
+static const char FIXED_XML[] =
+    "<?xml version='1.0'?>"
+    "<root xmlns='http://example.com/default' xmlns:ns='http://example.com/ns'>"
+    "  <a id='1' ns:attr='x'>text1</a>"
+    "  <b id='2'><c/><c/></b>"
+    "  <ns:d>namespaced</ns:d>"
+    "  <!-- comment -->"
+    "  <?pi target='value'?>"
+    "</root>";
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* 1. Parse the fixed document. */
+    mkr_xml_status_t status;
+    mkr_xml_doc_t *doc = mkr_xml_parse(FIXED_XML, sizeof(FIXED_XML) - 1, &status);
+    if (!doc) return 0;
+    if (!doc->doc_node) {
+        mkr_xml_doc_destroy(doc);
+        return 0;
+    }
+
+    /* 2. The fuzzer input is the XPath expression.
+     *    The engine text contract requires no interior NUL and a NUL at
+     *    ptr[len]. libFuzzer hands us exactly `size` bytes with no terminator,
+     *    so we copy the expression prefix into an owned, NUL-terminated heap
+     *    buffer and mint the verified-text token over that copy - this is what
+     *    supplies the NUL-termination + no-interior-NUL the lexer's strtod and
+     *    "%.10s" error path rely on. If the input contains a NUL we truncate to
+     *    the prefix (the lexer hits the terminator and reports a syntax error,
+     *    a path worth exercising). UTF-8 validity is deliberately NOT
+     *    pre-checked: the lexer's strict decoder rejecting invalid UTF-8 is
+     *    itself a path the fuzzer should hit. */
+    size_t expr_len = size;
+    for (size_t i = 0; i < size; i++) {
+        if (data[i] == '\0') {
+            expr_len = i;
+            break;
+        }
+    }
+    char *expr_copy = mkr_strndup((const char *) data, expr_len);
+    if (!expr_copy) {
+        mkr_xml_doc_destroy(doc);
+        return 0;
+    }
+    /* Empty expression is a quick syntax error; still worth a run. */
+    mkr_verified_text_t expr = { expr_copy, expr_len };
+
+    /* 3. Compile the expression. */
+    mkr_xpath_limits_t limits;
+    mkr_xpath_limits_init_defaults(&limits);
+    /* Tighten the compile-time budgets so a hostile expression fails fast
+     * rather than burning fuzzer time on pathological ASTs. */
+    limits.max_ast_nodes = 10000;
+    limits.max_expr_bytes = 16 * 1024;
+
+    mkr_xpath_error_t err = {0};
+    mkr_node_t *ast = mkr_parse(expr, &limits, &err);
+    if (!ast) {
+        mkr_xpath_error_clear(&err);
+        free(expr_copy);
+        mkr_xml_doc_destroy(doc);
+        return 0;
+    }
+
+    /* 4. Evaluate against the fixed document. */
+    mkr_xpath_context_t *ctx = mkr_xpath_context_new(doc->doc_node, doc->doc_node);
+    if (ctx) {
+        mkr_xpath_set_engine_kind(ctx, 1); /* XML engine */
+        mkr_xpath_limits_init_defaults(&limits);
+        limits.max_eval_ops        = 5 * 1000 * 1000; /* 5M ops - enough for a real query */
+        limits.max_nodeset_size    = 10000;
+        limits.max_string_bytes    = 1024 * 1024;
+        limits.max_recursion_depth = 64;
+
+        mkr_xpath_value_t out = {0};
+        mkr_xpath_error_t eval_err = {0};
+        if (mkr_xpath_eval_compiled(ctx, ast, &out, &eval_err) == 0) {
+            mkr_xpath_value_clear(&out);
+        } else {
+            mkr_xpath_error_clear(&eval_err);
+        }
+        mkr_xpath_context_free(ctx);
+    }
+
+    mkr_node_free(ast);
+    free(expr_copy);
+    mkr_xml_doc_destroy(doc);
+    return 0;
+}

data/ext/makiri/glue/glue.h

@@ -64,6 +64,14 @@ lxb_dom_node_t *mkr_html_node_unwrap(VALUE rb_node);
 void           *mkr_node_raw(VALUE rb_node);
 uintptr_t       mkr_node_id(VALUE rb_node);
 
+/* Representation-neutral identity methods (ruby_node.c): depend only on
+ * mkr_node_id, so the HTML and XML NodeMethods modules bind ==/eql? to
+ * mkr_node_equals, hash to mkr_node_hash, and pointer_id to mkr_node_pointer_id -
+ * one implementation, not one per representation. */
+VALUE mkr_node_equals(VALUE self, VALUE other);
+VALUE mkr_node_pointer_id(VALUE self);
+VALUE mkr_node_hash(VALUE self);
+
 /* XML node bridge (glue/ruby_xml_node.c): wrap a custom XML node into the right
  * Makiri::XML::* leaf (Qnil for NULL, the Document VALUE for the document node). */
 struct mkr_xml_node;

data/ext/makiri/glue/ruby_doc.c

@@ -140,10 +140,10 @@ mkr_resolve_fragment_context(lxb_dom_document_t *doc, VALUE context,
     mkr_ruby_borrowed_text_t cv = mkr_ruby_verified_text(context, "fragment context element");
     const lxb_char_t *p = (const lxb_char_t *)cv.ptr;
     size_t n = cv.len;
-    if (n == 3 && memcmp(p, "svg", 3) == 0) {
+    if (mkr_bytes_eq(p, n, "svg", 3)) {
         *out_tag = LXB_TAG_SVG;  *out_ns = LXB_NS_SVG;  return;
     }
-    if (n == 4 && memcmp(p, "math", 4) == 0) {
+    if (mkr_bytes_eq(p, n, "math", 4)) {
         *out_tag = LXB_TAG_MATH; *out_ns = LXB_NS_MATH; return;
     }
     lxb_tag_id_t tid = lxb_tag_id_by_name(doc->tags, p, n);
@@ -248,7 +248,6 @@ mkr_sanitize_html_input(VALUE html, const lxb_char_t **out, size_t *out_len,
         size_t n = (hv.len > 0) ? hv.len : 1;
         char  *buf = mkr_reallocarray(NULL, n, 1);
         if (buf == NULL) {
-            RB_GC_GUARD(hv.value);
             return -1;
         }
         if (hv.len > 0) {
@@ -268,19 +267,16 @@ mkr_sanitize_html_input(VALUE html, const lxb_char_t **out, size_t *out_len,
         *owned   = NULL;
         *out     = (const lxb_char_t *)hv.ptr;
         *out_len = hv.len;
-        RB_GC_GUARD(hv.value);
         return 0;
     }
     lxb_char_t *clean = NULL;
     size_t      clean_len = 0;
     if (mkr_utf8_sanitize((const lxb_char_t *)hv.ptr, hv.len, &clean, &clean_len) != 0) {
-        RB_GC_GUARD(hv.value);
         return -1;
     }
     *owned   = clean;
     *out     = (clean != NULL) ? clean : (const lxb_char_t *)hv.ptr;
     *out_len = (clean != NULL) ? clean_len : hv.len;
-    RB_GC_GUARD(hv.value);
     return 0;
 }
 
@@ -509,28 +505,28 @@ mkr_doc_s_parse(VALUE klass, VALUE rb_source)
      * preserved rather than read as raw UTF-8 bytes. */
     rb_source = mkr_ruby_to_utf8(rb_source);
 
-    /* Allocate the wrapper first (with parsed == NULL) so that if parsing
-     * fails the GC-managed object frees cleanly. This is the HTML parse entry
-     * (defined on Makiri::HTML::Document), so the result is always HTML. */
-    mkr_doc_data_t *d;
-    VALUE obj = TypedData_Make_Struct(klass, mkr_doc_data_t, &mkr_html_doc_type, d);
-    d->parsed = NULL;
-    d->errors = rb_ary_new();
-
-    /* Copy the source into a C buffer so the parse can run with the GVL
-     * released without racing GC/compaction on the Ruby String's backing
-     * store. The source is not retained past the parse (Lexbor copies what it
-     * needs into the arena and the line table is built up front), so the
-     * buffer is freed immediately after. */
+    /* Copy the source into a C buffer up front - BEFORE allocating the wrapper
+     * (a Ruby allocation, and thus a GC point) - so no GC can run between
+     * obtaining rb_source (possibly a fresh transcoded String) and copying its
+     * bytes, and the parse can then run with the GVL released without racing
+     * GC/compaction on the Ruby String's backing store. The source is not
+     * retained past the parse (Lexbor copies what it needs into the arena and
+     * the line table is built up front), so the buffer is freed immediately
+     * after. The coderange is read first (no scan): a source Ruby already knows
+     * is valid UTF-8 lets the parse skip its sanitisation scan. */
+    bool assume_valid = mkr_ruby_str_known_valid_utf8(rb_source);
     mkr_owned_bytes_t source = {0};
     if (mkr_ruby_copy_bytes(rb_source, &source) != 0) {
         rb_raise(mkr_eError, "out of memory copying source");
     }
-    /* Read the coderange (no scan) before releasing the GVL; the copy is
-     * byte-identical, so a source Ruby already knows is valid UTF-8 lets the
-     * parse skip its sanitisation scan. */
-    bool assume_valid = mkr_ruby_str_known_valid_utf8(rb_source);
-    RB_GC_GUARD(rb_source);
+
+    /* Allocate the wrapper (with parsed == NULL) so that if parsing fails the
+     * GC-managed object frees cleanly. This is the HTML parse entry (defined on
+     * Makiri::HTML::Document), so the result is always HTML. */
+    mkr_doc_data_t *d;
+    VALUE obj = TypedData_Make_Struct(klass, mkr_doc_data_t, &mkr_html_doc_type, d);
+    d->parsed = NULL;
+    d->errors = rb_ary_new();
 
     mkr_parse_nogvl_t args = { (const lxb_char_t *)source.ptr, source.len,
                                assume_valid, NULL };

data/ext/makiri/glue/ruby_html_css.c

@@ -71,11 +71,20 @@ mkr_css_engine_init(void)
     g_css_ready  = 1;
 }
 
+/* find: the callback runs inside Lexbor's traversal frames, so it must NOT
+ * raise - a longjmp would abort lxb_selectors_find mid-walk AND skip the
+ * post-run reset in mkr_with_compiled_selector, leaving the process-global
+ * parser/memory/selectors dirty for every later query. So matches are collected
+ * into a plain C array here (no Ruby at all); the node cap and a growth failure
+ * each latch a flag and STOP, and the caller raises only after the traversal
+ * has unwound normally and the engine was reset. */
 typedef struct {
-    VALUE           set;
-    lxb_dom_node_t *root;       /* excluded from results: css is descendant-only */
-    size_t          count;
-    int             overflow;
+    lxb_dom_node_t **nodes;     /* malloc-backed; the caller owns + frees it */
+    size_t           count;
+    size_t           cap;
+    lxb_dom_node_t  *root;      /* excluded from results: css is descendant-only */
+    int              overflow;
+    int              oom;
 } mkr_css_ctx_t;
 
 static lxb_status_t
@@ -92,12 +101,39 @@ mkr_css_find_cb(lxb_dom_node_t *node, lxb_css_selector_specificity_t spec,
         c->overflow = 1;
         return LXB_STATUS_STOP; /* fail closed without raising mid-traversal */
     }
-
-    mkr_node_set_push(c->set, (mkr_raw_node_t *)node);
-    c->count++;
+    if (mkr_grow_reserve((void **)&c->nodes, &c->cap, c->count + 1,
+                         sizeof(*c->nodes)) != MKR_OK) {
+        c->oom = 1;
+        return LXB_STATUS_STOP; /* ditto: report OOM after the walk unwinds */
+    }
+    c->nodes[c->count++] = node;
     return LXB_STATUS_OK;
 }
 
+/* Move the collected matches into the NodeSet under rb_ensure, so the C array
+ * cannot leak even if a push raises (NoMemoryError). */
+typedef struct {
+    VALUE          set;
+    mkr_css_ctx_t *ctx;
+} mkr_css_fill_t;
+
+static VALUE
+mkr_css_fill_set(VALUE p)
+{
+    mkr_css_fill_t *f = (mkr_css_fill_t *)p;
+    for (size_t i = 0; i < f->ctx->count; i++) {
+        mkr_node_set_push(f->set, (mkr_raw_node_t *)f->ctx->nodes[i]);
+    }
+    return Qnil;
+}
+
+static VALUE
+mkr_css_free_nodes(VALUE p)
+{
+    free(((mkr_css_ctx_t *)p)->nodes);
+    return Qnil;
+}
+
 /* at_css: capture the first matching descendant and stop. Avoids materialising a
  * NodeSet (and a Ruby #first dispatch) for the one node the caller wants. */
 typedef struct {
@@ -199,15 +235,25 @@ mkr_node_css(VALUE self, VALUE rb_selector)
 {
     lxb_dom_node_t *root = mkr_html_node_unwrap(self);
     VALUE document = mkr_node_document(self);
-    VALUE set = mkr_node_set_new(document);
 
-    mkr_css_ctx_t ctx = { .set = set, .root = root, .count = 0, .overflow = 0 };
+    /* A syntax error raises inside mkr_with_compiled_selector BEFORE the find
+     * runs, so ctx.nodes is still NULL there - nothing leaks on that path. */
+    mkr_css_ctx_t ctx = { .nodes = NULL, .count = 0, .cap = 0,
+                          .root = root, .overflow = 0, .oom = 0 };
     mkr_with_compiled_selector(rb_selector, root, mkr_run_find, &ctx);
 
-    if (ctx.overflow) {
-        rb_raise(mkr_eError, "CSS result set exceeded the node limit (%u)",
-                 MKR_NODE_SET_MAX);
+    if (ctx.overflow || ctx.oom) {
+        free(ctx.nodes);
+        if (ctx.overflow) {
+            rb_raise(mkr_eError, "CSS result set exceeded the node limit (%u)",
+                     MKR_NODE_SET_MAX);
+        }
+        rb_raise(mkr_eError, "out of memory collecting CSS results");
     }
+
+    VALUE set = mkr_node_set_new(document);
+    mkr_css_fill_t fill = { set, &ctx };
+    rb_ensure(mkr_css_fill_set, (VALUE)&fill, mkr_css_free_nodes, (VALUE)&ctx);
     return set;
 }
 

data/ext/makiri/glue/ruby_html_mutate.c

@@ -265,8 +265,7 @@ mkr_attr_find_ns(lxb_dom_element_t *el, lxb_ns_id_t ns_id,
         const lxb_char_t *q = lxb_dom_attr_qualified_name(at, &qlen);
         (void) lxb_dom_attr_local_name(at, &llen);
         if (q != NULL && qlen >= llen
-            && llen == local_len
-            && memcmp(q + (qlen - llen), local, local_len) == 0) {
+            && mkr_bytes_eq(q + (qlen - llen), llen, local, local_len)) {
             return at;
         }
     }
@@ -312,9 +311,11 @@ mkr_node_set_attribute_ns(VALUE self, VALUE rb_ns, VALUE rb_qname, VALUE rb_valu
     }
 
     const lxb_char_t *qn = (const lxb_char_t *)qv.ptr;
-    const lxb_char_t *colon = memchr(qn, ':', qv.len);
-    const lxb_char_t *local = colon ? colon + 1 : qn;
-    size_t local_len = colon ? (size_t)(qv.len - (colon - qn) - 1) : qv.len;
+    mkr_span_t qspan = mkr_span((const char *)qn, qv.len);
+    size_t colon_off;
+    bool has_colon = mkr_span_find(&qspan, ':', &colon_off);
+    const lxb_char_t *local = has_colon ? qn + colon_off + 1 : qn;
+    size_t local_len = has_colon ? qv.len - colon_off - 1 : qv.len;
 
     /* A match keeps its qualified name (so re-setting with a different prefix
      * leaves the prefix unchanged); only the value updates. A miss appends a new
@@ -507,7 +508,11 @@ mkr_parse_fragment_into(lxb_dom_node_t *context_el, VALUE rb_html,
 
     mkr_import_fragment_children(doc, frag, emit, u);
 
-    /* Frees the transient fragment document; our imported copies live on. */
+    /* lxb_html_parse_fragment built the fragment in a TRANSIENT document that
+     * destroying the parser does NOT free (measured: one document leaked per
+     * inner_html=/outer_html= call); our imported copies live in `doc`, so the
+     * transient document is destroyed explicitly. */
+    lxb_html_document_destroy(lxb_html_interface_document(frag->owner_document));
     lxb_html_parser_destroy(parser);
     RB_GC_GUARD(html);
 }