makiri 0.3.0 → 0.4.0

data/ext/makiri/xml/mkr_xml_mutate.c

@@ -21,44 +21,6 @@
 #define XMLNS_NS_URI  "http://www.w3.org/2000/xmlns/"
 #define LIT_LEN(s)    ((uint32_t)(sizeof(s) - 1))
 
-static int
-slice_eq(const char *a, uint32_t al, const char *b, uint32_t bl)
-{
-    return al == bl && (al == 0 || memcmp(a, b, al) == 0);
-}
-
-/* Validate that [s, s+len) is a well-formed XML 1.0 QName and split it into
- * prefix:local (pfx_len 0 = no prefix). Mirrors scan_name + split_qname in the
- * tree builder: the whole name is NameStartChar NameChar* (a colon is a NameChar),
- * then at most one colon separates two NCNames. 0 on success, -1 if malformed. */
-static int
-qname_split(const char *s, uint32_t len, const char **pfx, uint32_t *pl,
-            const char **loc, uint32_t *ll)
-{
-    if (len == 0) return -1;
-    const char *p = s, *end = s + len;
-    uint32_t cp;
-    int bl = mkr_xml_utf8_decode(p, end, &cp);
-    if (bl == 0 || !mkr_xml_is_name_start(cp)) return -1;
-    p += bl;
-    while (p < end) {
-        bl = mkr_xml_utf8_decode(p, end, &cp);
-        if (bl == 0 || !mkr_xml_is_name_char(cp)) return -1;
-        p += bl;
-    }
-    const char *colon = memchr(s, ':', len);
-    if (colon == NULL) { *pfx = s; *pl = 0; *loc = s; *ll = len; return 0; }
-    uint32_t prefix_len = (uint32_t)(colon - s);
-    const char *ls = colon + 1;
-    uint32_t local_len = len - prefix_len - 1;
-    if (prefix_len == 0 || local_len == 0) return -1;             /* ":x" or "x:" */
-    if (memchr(ls, ':', local_len) != NULL) return -1;           /* a second colon */
-    if (mkr_xml_utf8_decode(ls, ls + local_len, &cp) == 0 || !mkr_xml_is_name_start(cp))
-        return -1;                                               /* local must be an NCName */
-    *pfx = s; *pl = prefix_len; *loc = ls; *ll = local_len;
-    return 0;
-}
-
 /* Nearest in-scope binding for +prefix+ (pl 0 = the default namespace) at or
  * above +node+, walking the real tree (no scope dictionary is threaded). */
 static int
@@ -70,7 +32,7 @@ resolve_in_scope(const mkr_xml_node_t *node, const char *prefix, uint32_t pl,
         for (mkr_xml_node_t *a = e->attrs; a != NULL; a = a->next) {
             const char *p, *u; uint32_t apl, ul;
             if (mkr_xml_node_xmlns_decl(a, &p, &apl, &u, &ul)
-                && apl == pl && (pl == 0 || memcmp(p, prefix, pl) == 0)) {
+                && mkr_bytes_eq(p, apl, prefix, pl)) {
                 *uri = u; *ulen = ul; return 1;
             }
         }
@@ -91,58 +53,45 @@ is_connected(const mkr_xml_node_t *node)
     return top->type == MKR_XML_NODE_TYPE_DOCUMENT;
 }
 
-/* Resolve the namespace for the QName [qname,qlen] (already split into pfx/pl)
- * applied at +scope+ (the element whose in-scope declarations apply). +is_attr+
- * selects attribute rules (xmlns* declarations live in the xmlns namespace, an
- * unprefixed attribute is in no namespace). +connected+ decides what an unbound
- * prefix means: an error in the live tree, deferred (unresolved) when detached.
- * Mirrors mkr_xml_tree.c §7. */
+/* Resolve the namespace for QName +qn+ applied at +scope+ (the element whose
+ * in-scope declarations apply). +is_attr+ selects attribute rules (xmlns*
+ * declarations live in the xmlns namespace, an unprefixed attribute is in no
+ * namespace). +connected+ decides what an unbound prefix means: an error in the
+ * live tree, deferred (unresolved) when detached. Mirrors mkr_xml_tree.c §7. */
 static mkr_xml_mut_status_t
-resolve_ns(const mkr_xml_node_t *scope, const char *qname, uint32_t qlen,
-           const char *pfx, uint32_t pl, int is_attr, int connected,
-           const char **uri, uint32_t *ulen)
+resolve_ns(const mkr_xml_node_t *scope, const mkr_xml_qname_t *qn, int is_attr,
+           int connected, const char **uri, uint32_t *ulen)
 {
     *uri = NULL; *ulen = 0;
-    if (is_attr) {
-        int is_default_decl = (qlen == 5 && memcmp(qname, "xmlns", 5) == 0);
-        int is_pfx_decl     = (qlen > 6 && memcmp(qname, "xmlns:", 6) == 0);
-        if (is_default_decl || is_pfx_decl) {
-            *uri = XMLNS_NS_URI; *ulen = LIT_LEN(XMLNS_NS_URI);
-            return MKR_XML_MUT_OK;
-        }
+    if (is_attr && mkr_xml_xmlns_prefix(qn->qname, qn->qname_len, NULL, NULL)) {
+        *uri = XMLNS_NS_URI; *ulen = LIT_LEN(XMLNS_NS_URI);   /* an xmlns declaration */
+        return MKR_XML_MUT_OK;
     }
-    if (pl == 0) {
+    if (qn->prefix_len == 0) {
         if (is_attr) return MKR_XML_MUT_OK;       /* unprefixed attribute -> no namespace */
         const char *u; uint32_t ul;               /* unprefixed element -> the default ns */
         if (resolve_in_scope(scope, "", 0, &u, &ul) && ul > 0) { *uri = u; *ulen = ul; }
         return MKR_XML_MUT_OK;
     }
-    if (slice_eq(pfx, pl, "xml", 3)) {             /* the predefined xml: prefix */
+    if (mkr_bytes_eq(qn->prefix, qn->prefix_len, "xml", 3)) {       /* the predefined xml: prefix */
         *uri = XML_NS_URI; *ulen = LIT_LEN(XML_NS_URI);
         return MKR_XML_MUT_OK;
     }
-    if (slice_eq(pfx, pl, "xmlns", 5)) return MKR_XML_MUT_BAD_NAME;  /* xmlns: as a normal name */
+    if (mkr_bytes_eq(qn->prefix, qn->prefix_len, "xmlns", 5)) return MKR_XML_MUT_BAD_NAME; /* xmlns: as a normal name */
     const char *u; uint32_t ul;
-    if (!resolve_in_scope(scope, pfx, pl, &u, &ul) || ul == 0) {
+    if (!resolve_in_scope(scope, qn->prefix, qn->prefix_len, &u, &ul) || ul == 0) {
         return connected ? MKR_XML_MUT_UNBOUND_NS : MKR_XML_MUT_OK;  /* defer when detached */
     }
     *uri = u; *ulen = ul;
     return MKR_XML_MUT_OK;
 }
 
-/* Copy the QName into the arena as ONE contiguous slice and point qname/local/
- * prefix into it (the read API and serializers borrow these). +loc+ points into
- * +name+ (from qname_split). */
+/* Copy +qn+ into the arena and point the node's name fields at it (shared
+ * mkr_xml_qname_assign), mapping its OOM to the mutation status. */
 static mkr_xml_mut_status_t
-assign_qname(mkr_xml_doc_t *doc, mkr_xml_node_t *node, const char *name, uint32_t nl,
-             const char *loc, uint32_t ll, uint32_t pl)
+assign_qname(mkr_xml_doc_t *doc, mkr_xml_node_t *node, const mkr_xml_qname_t *qn)
 {
-    const char *q = mkr_xml_arena_bytes(doc, name, nl);
-    if (nl > 0 && q == NULL) return MKR_XML_MUT_OOM;
-    node->qname  = q;                          node->qname_len  = nl;
-    node->local  = q + (size_t)(loc - name);   node->local_len  = ll;
-    node->prefix = q;                          node->prefix_len = pl;
-    return MKR_XML_MUT_OK;
+    return mkr_xml_qname_assign(doc, node, qn) == 0 ? MKR_XML_MUT_OK : MKR_XML_MUT_OOM;
 }
 
 void
@@ -171,23 +120,20 @@ mkr_xml_rename(mkr_xml_doc_t *doc, mkr_xml_node_t *node, const char *name, uint3
 {
     if (node->type != MKR_XML_NODE_TYPE_ELEMENT && node->type != MKR_XML_NODE_TYPE_ATTRIBUTE)
         return MKR_XML_MUT_TYPE;
-    const char *pfx, *loc; uint32_t pl, ll;
-    if (qname_split(name, nlen, &pfx, &pl, &loc, &ll) != 0) return MKR_XML_MUT_BAD_NAME;
+    mkr_xml_qname_t qn;
+    if (mkr_xml_qname_split(name, nlen, &qn) != 0) return MKR_XML_MUT_BAD_NAME;
 
     int is_attr = (node->type == MKR_XML_NODE_TYPE_ATTRIBUTE);
     const mkr_xml_node_t *scope = is_attr ? node->parent : node;
     const char *uri; uint32_t ulen;
     int connected = scope != NULL && is_connected(scope);
-    mkr_xml_mut_status_t st = resolve_ns(scope, name, nlen, pfx, pl, is_attr, connected, &uri, &ulen);
+    mkr_xml_mut_status_t st = resolve_ns(scope, &qn, is_attr, connected, &uri, &ulen);
     if (st != MKR_XML_MUT_OK) return st;
 
-    /* Copy the new qname BEFORE writing any field, so an OOM leaves node intact. */
-    const char *q = mkr_xml_arena_bytes(doc, name, nlen);
-    if (nlen > 0 && q == NULL) return MKR_XML_MUT_OOM;
-    node->qname  = q;                          node->qname_len  = nlen;
-    node->local  = q + (size_t)(loc - name);   node->local_len  = ll;
-    node->prefix = q;                          node->prefix_len = pl;
-    node->ns_uri = uri;                        node->ns_uri_len = ulen;
+    /* Copy the new qname BEFORE writing ns_uri, so an OOM leaves node intact. */
+    st = assign_qname(doc, node, &qn);
+    if (st != MKR_XML_MUT_OK) return st;
+    node->ns_uri = uri; node->ns_uri_len = ulen;
     return MKR_XML_MUT_OK;
 }
 
@@ -197,21 +143,22 @@ mkr_xml_set_attribute(mkr_xml_doc_t *doc, mkr_xml_node_t *el, const char *name,
 {
     if (out) *out = NULL;
     if (el->type != MKR_XML_NODE_TYPE_ELEMENT) return MKR_XML_MUT_TYPE;
-    const char *pfx, *loc; uint32_t pl, ll;
-    if (qname_split(name, nlen, &pfx, &pl, &loc, &ll) != 0) return MKR_XML_MUT_BAD_NAME;
+    mkr_xml_qname_t qn;
+    if (mkr_xml_qname_split(name, nlen, &qn) != 0) return MKR_XML_MUT_BAD_NAME;
     /* A prefixed namespace declaration (xmlns:foo="") must not bind a prefix to
      * the empty namespace: XML Namespaces 1.0 forbids it and it serializes to
      * invalid XML. (Undeclaring the DEFAULT namespace, xmlns="", is allowed.) */
-    if (vlen == 0 && pl == 5 && slice_eq(pfx, pl, "xmlns", 5)) return MKR_XML_MUT_BAD_NS_DECL;
+    if (vlen == 0 && qn.prefix_len == 5 && mkr_bytes_eq(qn.prefix, qn.prefix_len, "xmlns", 5))
+        return MKR_XML_MUT_BAD_NS_DECL;
     if (vlen > 0 && mkr_xml_validate_chars(val, vlen) != 0) return MKR_XML_MUT_BAD_CHARS;
 
     const char *uri; uint32_t ulen;
-    mkr_xml_mut_status_t st = resolve_ns(el, name, nlen, pfx, pl, 1, is_connected(el), &uri, &ulen);
+    mkr_xml_mut_status_t st = resolve_ns(el, &qn, 1, is_connected(el), &uri, &ulen);
     if (st != MKR_XML_MUT_OK) return st;
 
     /* An existing attribute with the same raw QName -> replace its value. */
     for (mkr_xml_node_t *a = el->attrs; a != NULL; a = a->next) {
-        if (slice_eq(a->qname, a->qname_len, name, nlen)) {
+        if (mkr_bytes_eq(a->qname, a->qname_len, name, nlen)) {
             const char *nv = mkr_xml_arena_bytes(doc, val, vlen);
             if (vlen > 0 && nv == NULL) return MKR_XML_MUT_OOM;
             a->value = nv ? nv : ""; a->value_len = vlen;
@@ -224,7 +171,7 @@ mkr_xml_set_attribute(mkr_xml_doc_t *doc, mkr_xml_node_t *el, const char *name,
     /* New attribute - allocate node + qname + value before linking. */
     mkr_xml_node_t *attr = mkr_xml_arena_node(doc, MKR_XML_NODE_TYPE_ATTRIBUTE);
     if (attr == NULL) return MKR_XML_MUT_OOM;
-    st = assign_qname(doc, attr, name, nlen, loc, ll, pl);
+    st = assign_qname(doc, attr, &qn);
     if (st != MKR_XML_MUT_OK) return st;          /* abandoned in the arena; freed with doc */
     const char *nv = mkr_xml_arena_bytes(doc, val, vlen);
     if (vlen > 0 && nv == NULL) return MKR_XML_MUT_OOM;
@@ -249,7 +196,7 @@ mkr_xml_remove_attribute(mkr_xml_node_t *el, const char *name, uint32_t nlen)
     if (el->type != MKR_XML_NODE_TYPE_ELEMENT) return 0;
     mkr_xml_node_t *prev = NULL;
     for (mkr_xml_node_t *a = el->attrs; a != NULL; prev = a, a = a->next) {
-        if (slice_eq(a->qname, a->qname_len, name, nlen)) {
+        if (mkr_bytes_eq(a->qname, a->qname_len, name, nlen)) {
             if (prev) prev->next = a->next; else el->attrs = a->next;
             a->next = NULL; a->parent = NULL;
             return 1;
@@ -344,12 +291,12 @@ mkr_xml_mut_status_t
 mkr_xml_new_element(mkr_xml_doc_t *doc, const char *name, uint32_t nlen, mkr_xml_node_t **out)
 {
     *out = NULL;
-    const char *pfx, *loc; uint32_t pl, ll;
-    if (qname_split(name, nlen, &pfx, &pl, &loc, &ll) != 0) return MKR_XML_MUT_BAD_NAME;
-    if (slice_eq(pfx, pl, "xmlns", 5)) return MKR_XML_MUT_BAD_NAME;  /* xmlns: is not an element prefix */
+    mkr_xml_qname_t qn;
+    if (mkr_xml_qname_split(name, nlen, &qn) != 0) return MKR_XML_MUT_BAD_NAME;
+    if (mkr_bytes_eq(qn.prefix, qn.prefix_len, "xmlns", 5)) return MKR_XML_MUT_BAD_NAME;  /* xmlns: is not an element prefix */
     mkr_xml_node_t *el = mkr_xml_arena_node(doc, MKR_XML_NODE_TYPE_ELEMENT);
     if (el == NULL) return MKR_XML_MUT_OOM;
-    mkr_xml_mut_status_t st = assign_qname(doc, el, name, nlen, loc, ll, pl);
+    mkr_xml_mut_status_t st = assign_qname(doc, el, &qn);
     if (st != MKR_XML_MUT_OK) return st;
     *out = el;                              /* ns_uri stays unresolved until insertion */
     return MKR_XML_MUT_OK;
@@ -382,8 +329,8 @@ mkr_xml_new_pi(mkr_xml_doc_t *doc, const char *target, uint32_t tlen,
 {
     *out = NULL;
     /* PITarget is an NCName (a QName with no colon) and not "xml" in any case. */
-    const char *pfx, *loc; uint32_t pl, ll;
-    if (qname_split(target, tlen, &pfx, &pl, &loc, &ll) != 0 || pl != 0) return MKR_XML_MUT_BAD_NAME;
+    mkr_xml_qname_t qn;
+    if (mkr_xml_qname_split(target, tlen, &qn) != 0 || qn.prefix_len != 0) return MKR_XML_MUT_BAD_NAME;
     if (is_reserved_pi_target(target, tlen)) return MKR_XML_MUT_BAD_NAME;
     if (dlen > 0 && mkr_xml_validate_chars(data, dlen) != 0) return MKR_XML_MUT_BAD_CHARS;
     mkr_xml_mut_status_t seq = mkr_xml_check_value_seq(MKR_XML_NODE_TYPE_PI, data, dlen);
@@ -410,12 +357,13 @@ static mkr_xml_mut_status_t
 resolve_node_ns(mkr_xml_node_t *e, int connected)
 {
     const char *uri; uint32_t ulen;
-    mkr_xml_mut_status_t st =
-        resolve_ns(e, e->qname, e->qname_len, e->prefix, e->prefix_len, 0, connected, &uri, &ulen);
+    mkr_xml_qname_t eq = mkr_xml_qname_of(e);
+    mkr_xml_mut_status_t st = resolve_ns(e, &eq, 0, connected, &uri, &ulen);
     if (st != MKR_XML_MUT_OK) return st;
     e->ns_uri = uri; e->ns_uri_len = ulen;
     for (mkr_xml_node_t *a = e->attrs; a != NULL; a = a->next) {
-        st = resolve_ns(e, a->qname, a->qname_len, a->prefix, a->prefix_len, 1, connected, &uri, &ulen);
+        mkr_xml_qname_t aq = mkr_xml_qname_of(a);
+        st = resolve_ns(e, &aq, 1, connected, &uri, &ulen);
         if (st != MKR_XML_MUT_OK) return st;
         a->ns_uri = uri; a->ns_uri_len = ulen;
     }
@@ -425,15 +373,11 @@ resolve_node_ns(mkr_xml_node_t *e, int connected)
 static mkr_xml_mut_status_t
 resolve_subtree(mkr_xml_node_t *root, int connected)
 {
-    for (mkr_xml_node_t *cur = root; cur != NULL;) {
+    for (mkr_xml_node_t *cur = root; cur != NULL; cur = mkr_xml_preorder_next(root, cur)) {
         if (cur->type == MKR_XML_NODE_TYPE_ELEMENT) {
             mkr_xml_mut_status_t st = resolve_node_ns(cur, connected);
             if (st != MKR_XML_MUT_OK) return st;
         }
-        if (cur->first_child != NULL) { cur = cur->first_child; continue; }
-        while (cur != root && cur->next == NULL) cur = cur->parent;
-        if (cur == root) break;
-        cur = cur->next;
     }
     return MKR_XML_MUT_OK;
 }
@@ -464,11 +408,8 @@ copy_one(mkr_xml_doc_t *doc, const mkr_xml_node_t *src, bool with_ns)
     mkr_xml_node_t *n = mkr_xml_arena_node(doc, src->type);
     if (n == NULL) return NULL;
     if (src->qname != NULL && src->qname_len > 0) {       /* element / attribute QName */
-        if (assign_qname(doc, n, src->qname, src->qname_len,
-                         src->qname + (size_t)(src->local - src->qname),
-                         src->local_len, src->prefix_len) != MKR_XML_MUT_OK) {
-            return NULL;
-        }
+        mkr_xml_qname_t qn = mkr_xml_qname_of(src);
+        if (assign_qname(doc, n, &qn) != MKR_XML_MUT_OK) return NULL;
     } else if (src->local != NULL && src->local_len > 0) { /* PI target */
         const char *t = mkr_xml_arena_bytes(doc, src->local, src->local_len);
         if (t == NULL) return NULL;
@@ -713,19 +654,20 @@ mkr_xml_mutate_selftest(void)
     mkr_xml_doc_t *doc = mkr_xml_doc_new();
     if (doc == NULL) return 1;
     int rc = 0;
-    const char *pfx, *loc; uint32_t pl, ll;
+    mkr_xml_qname_t qn;
 
-    /* 1. QName validation + split */
-    if (qname_split("a:b", 3, &pfx, &pl, &loc, &ll) != 0 || pl != 1 || ll != 1) { rc = 2;  goto done; }
-    if (qname_split("1bad", 4, &pfx, &pl, &loc, &ll) == 0)  { rc = 3;  goto done; } /* bad NameStartChar */
-    if (qname_split("a:b:c", 5, &pfx, &pl, &loc, &ll) == 0) { rc = 4;  goto done; } /* two colons */
-    if (qname_split(":x", 2, &pfx, &pl, &loc, &ll) == 0)    { rc = 5;  goto done; } /* empty prefix */
-    if (qname_split("x:", 2, &pfx, &pl, &loc, &ll) == 0)    { rc = 6;  goto done; } /* empty local */
+    /* 1. QName validation + split (the shared mkr_xml_qname_split) */
+    if (mkr_xml_qname_split("a:b", 3, &qn) != 0 || qn.prefix_len != 1 || qn.local_len != 1) { rc = 2;  goto done; }
+    if (mkr_xml_qname_split("1bad", 4, &qn) == 0)  { rc = 3;  goto done; } /* bad NameStartChar */
+    if (mkr_xml_qname_split("a:b:c", 5, &qn) == 0) { rc = 4;  goto done; } /* two colons */
+    if (mkr_xml_qname_split(":x", 2, &qn) == 0)    { rc = 5;  goto done; } /* empty prefix */
+    if (mkr_xml_qname_split("x:", 2, &qn) == 0)    { rc = 6;  goto done; } /* empty local */
 
     /* 2. build a root element, exercise attribute set/replace */
     mkr_xml_node_t *r = mkr_xml_arena_node(doc, MKR_XML_NODE_TYPE_ELEMENT);
     if (r == NULL) { rc = 7; goto done; }
-    if (assign_qname(doc, r, "r", 1, "r", 1, 0) != MKR_XML_MUT_OK) { rc = 8; goto done; }
+    mkr_xml_qname_t rq = { "r", 1, "r", 0, "r", 1 };
+    if (assign_qname(doc, r, &rq) != MKR_XML_MUT_OK) { rc = 8; goto done; }
 
     mkr_xml_node_t *at = NULL;
     if (mkr_xml_set_attribute(doc, r, "id", 2, "x", 1, &at) != MKR_XML_MUT_OK
@@ -757,14 +699,14 @@ mkr_xml_mutate_selftest(void)
 
     /* 4. the predefined xml: prefix resolves with no declaration */
     if (mkr_xml_set_attribute(doc, r, "xml:lang", 8, "en", 2, &at) != MKR_XML_MUT_OK
-        || !slice_eq(at->ns_uri, at->ns_uri_len, XML_NS_URI, LIT_LEN(XML_NS_URI))) { rc = 13; goto done; }
+        || !mkr_bytes_eq(at->ns_uri, at->ns_uri_len, XML_NS_URI, LIT_LEN(XML_NS_URI))) { rc = 13; goto done; }
 
     /* 5. adding an xmlns:* declaration lands in the xmlns namespace and then binds
      *    a previously-unbound prefix */
     if (mkr_xml_set_attribute(doc, r, "xmlns:p", 7, "urn:p", 5, &at) != MKR_XML_MUT_OK
-        || !slice_eq(at->ns_uri, at->ns_uri_len, XMLNS_NS_URI, LIT_LEN(XMLNS_NS_URI))) { rc = 14; goto done; }
+        || !mkr_bytes_eq(at->ns_uri, at->ns_uri_len, XMLNS_NS_URI, LIT_LEN(XMLNS_NS_URI))) { rc = 14; goto done; }
     if (mkr_xml_set_attribute(doc, r, "p:k", 3, "v", 1, &at) != MKR_XML_MUT_OK
-        || !slice_eq(at->ns_uri, at->ns_uri_len, "urn:p", 5)) { rc = 15; goto done; }
+        || !mkr_bytes_eq(at->ns_uri, at->ns_uri_len, "urn:p", 5)) { rc = 15; goto done; }
 
     /* 6. remove by name (idempotent) */
     if (mkr_xml_remove_attribute(r, "id", 2) != 1) { rc = 16; goto done; }
@@ -813,7 +755,7 @@ mkr_xml_mutate_selftest(void)
     if (mkr_xml_new_element(doc, "p:c", 3, &ne) != MKR_XML_MUT_OK) { rc = 31; goto done; }
     if (mkr_xml_insert_child(doc, pr, ne) != MKR_XML_MUT_OK
         || pr->first_child != ne || ne->parent != pr
-        || !slice_eq(ne->ns_uri, ne->ns_uri_len, "urn:p", 5)) { rc = 32; goto done; }
+        || !mkr_bytes_eq(ne->ns_uri, ne->ns_uri_len, "urn:p", 5)) { rc = 32; goto done; }
     if (mkr_xml_insert_child(doc, ne, tx) != MKR_XML_MUT_OK || ne->first_child != tx) { rc = 33; goto done; }
 
     /* 12. an unbound prefix is a hard error in the live tree, leaving it unchanged */
@@ -830,8 +772,8 @@ mkr_xml_mutate_selftest(void)
     if (mkr_xml_insert_child(doc, wrap, inner) != MKR_XML_MUT_OK
         || inner->ns_uri_len != 0) { rc = 37; goto done; }   /* deferred while detached */
     if (mkr_xml_insert_child(doc, pr, wrap) != MKR_XML_MUT_OK
-        || !slice_eq(wrap->ns_uri, wrap->ns_uri_len, "urn:p", 5)
-        || !slice_eq(inner->ns_uri, inner->ns_uri_len, "urn:p", 5)) { rc = 38; goto done; }
+        || !mkr_bytes_eq(wrap->ns_uri, wrap->ns_uri_len, "urn:p", 5)
+        || !mkr_bytes_eq(inner->ns_uri, inner->ns_uri_len, "urn:p", 5)) { rc = 38; goto done; }
 
     /* 14. cycle rejection: a node cannot be inserted under its own descendant */
     if (mkr_xml_insert_child(doc, ne, pr) != MKR_XML_MUT_CYCLE) { rc = 39; goto done; }
@@ -859,7 +801,7 @@ mkr_xml_mutate_selftest(void)
     mkr_xml_node_t *imp = NULL;
     int irc = mkr_xml_import_subtree(doc2, pr, &imp);
     if (irc != MKR_XML_MUT_OK || imp == NULL || imp == pr
-        || imp->qname_len != 2 || memcmp(imp->qname, "pr", 2) != 0
+        || !mkr_bytes_eq(imp->qname, imp->qname_len, "pr", 2)
         || imp->first_child == NULL || imp->first_child == pr->first_child) { rc = 46; }
     mkr_xml_doc_destroy(doc2);
     if (rc != 0) goto done;

data/ext/makiri/xml/mkr_xml_node.c

@@ -2,12 +2,39 @@
  * Ruby-free. See mkr_xml_node.h and docs/xml_parser_plan.ja.md §8.1/§8.2. */
 #include "mkr_xml_node.h"
 #include "mkr_xml.h"
+#include "mkr_xml_index.h"
 #include "../core/mkr_core.h"
 
 #include <stddef.h>   /* max_align_t */
 #include <stdlib.h>
 #include <string.h>
 
+/* ASan red-zoning for the bump arena. Like Lexbor's mraw, our arena carves many
+ * sub-allocations out of one malloc'd chunk, so a write past one cut into the
+ * next stays inside that single malloc and is INVISIBLE to a plain ASan build
+ * (the heap red-zones only guard the chunk's outer boundary - this is exactly
+ * how the v3.0.0 :lexbor-contains overflow hid). So we poison each fresh chunk
+ * and unpoison only the bytes a cut actually hands out, leaving the alignment
+ * tail and not-yet-cut space poisoned: an intra-arena overrun then writes into
+ * poisoned memory and ASan reports it. Auto-active whenever our ext is built
+ * with -fsanitize=address (rake sanitize / fuzz:sanitize) - no extra flag,
+ * because unlike vendored Lexbor this is our own TU. A no-op otherwise. */
+#if defined(__SANITIZE_ADDRESS__)
+#  define MKR_XML_HAVE_ASAN 1
+#elif defined(__has_feature)
+#  if __has_feature(address_sanitizer)
+#    define MKR_XML_HAVE_ASAN 1
+#  endif
+#endif
+#if defined(MKR_XML_HAVE_ASAN)
+#  include <sanitizer/asan_interface.h>
+#  define MKR_ARENA_POISON(p, n)   __asan_poison_memory_region((p), (n))
+#  define MKR_ARENA_UNPOISON(p, n) __asan_unpoison_memory_region((p), (n))
+#else
+#  define MKR_ARENA_POISON(p, n)   ((void)(p), (void)(n))
+#  define MKR_ARENA_UNPOISON(p, n) ((void)(p), (void)(n))
+#endif
+
 /* Alignment for arena cuts: the strictest fundamental alignment, so any object
  * fits. The chunk payload starts at an aligned offset past the header, and every
  * cut size is rounded up to ARENA_ALIGN, so each returned pointer is aligned. */
@@ -37,9 +64,12 @@ void
 mkr_xml_doc_destroy(mkr_xml_doc_t *doc)
 {
     if (doc == NULL) return;
+    mkr_xml_name_index_invalidate(doc); /* free the heap-side element-name index */
     /* whole-arena free: no individual node/byte free anywhere (read-only). */
+    const size_t hdr = align_up(sizeof(mkr_xml_arena_chunk_t), ARENA_ALIGN);
     for (mkr_xml_arena_chunk_t *c = doc->chunks; c != NULL; ) {
         mkr_xml_arena_chunk_t *n = c->next;
+        MKR_ARENA_UNPOISON((char *)c, hdr + c->cap); /* hand clean memory back to ASan's allocator */
         free(c);
         c = n;
     }
@@ -98,15 +128,23 @@ arena_alloc(mkr_xml_doc_t *doc, size_t size)
         nc->cap  = cap;
         doc->chunks = nc;
         c = nc;
+        /* poison the whole payload; each cut unpoisons only what it returns. */
+        MKR_ARENA_POISON((char *)nc + hdr, cap);
     }
     void *p = (char *)c + hdr + c->used;
     c->used += need;
     doc->arena_bytes += need;
+    /* Hand out exactly +size+ usable bytes; the [size, need) alignment tail (and
+     * everything past it in the chunk) stays poisoned as a red-zone, so a write
+     * one byte past the request is caught instead of silently clobbering the
+     * next cut. ASan tolerates the sub-granule trailing byte (ARENA_ALIGN cuts
+     * keep each slot on an 8-byte shadow boundary). */
+    MKR_ARENA_UNPOISON(p, size);
     return p;
 }
 
 static int
-valid_xn_type(uint8_t type)
+valid_xn_type(mkr_xml_node_type_t type)
 {
     switch (type) {
     case MKR_XML_NODE_TYPE_ELEMENT: case MKR_XML_NODE_TYPE_ATTRIBUTE: case MKR_XML_NODE_TYPE_TEXT:
@@ -120,7 +158,7 @@ valid_xn_type(uint8_t type)
 }
 
 mkr_xml_node_t *
-mkr_xml_arena_node(mkr_xml_doc_t *doc, uint8_t type)
+mkr_xml_arena_node(mkr_xml_doc_t *doc, mkr_xml_node_type_t type)
 {
     if (doc == NULL) return NULL;   /* fail-closed: never deref a NULL document */
     /* guard against a caller passing a bogus type (programming error) so it can
@@ -149,11 +187,13 @@ mkr_xml_arena_bytes(mkr_xml_doc_t *doc, const char *src, uint32_t len)
     return p;
 }
 
-/* A raw, uninitialised arena buffer of exactly +len+ bytes, for the one caller
- * that must fill it itself (entity expansion writes the expanded, never-longer
- * output here). Budget-/overflow-checked via the same choke point. */
-char *
-mkr_xml_arena_scratch_bytes(mkr_xml_doc_t *doc, size_t len)
+/* A raw, uninitialised arena buffer of exactly +len+ bytes. PRIVATE: the only
+ * way to fill arena bytes by hand is mkr_xml_arena_spanbuf below, which wraps
+ * this in a core mkr_spanbuf (cursor + bounds check) so a caller can never
+ * overrun it. Budget-/
+ * overflow-checked via the same choke point. */
+static char *
+arena_scratch_bytes(mkr_xml_doc_t *doc, size_t len)
 {
     /* a 0-length buffer needs no storage - never cut a whole chunk for it. The
      * sentinel is a valid non-NULL pointer the caller must not write to (there is
@@ -162,21 +202,113 @@ mkr_xml_arena_scratch_bytes(mkr_xml_doc_t *doc, size_t len)
     return arena_alloc(doc, len);
 }
 
+/* Carve +cap+ arena bytes and wrap them in a core mkr_spanbuf (see
+ * mkr_xml_node.h). The spanbuf owns the cursor + bounds check, so no caller can
+ * overrun the cut; this is the sole sanctioned hand-fill path and the only thing
+ * that touches the private arena_scratch_bytes. On alloc failure the buffer is
+ * NULL, so the returned writer is already not-ok (every write a no-op). */
+mkr_spanbuf_t
+mkr_xml_arena_spanbuf(mkr_xml_doc_t *doc, size_t cap)
+{
+    return mkr_spanbuf(arena_scratch_bytes(doc, cap), cap);
+}
+
 int
-mkr_xml_node_xmlns_decl(const mkr_xml_node_t *a, const char **prefix, uint32_t *plen,
-                        const char **uri, uint32_t *ulen)
+mkr_xml_xmlns_prefix(const char *name, uint32_t len, const char **prefix, uint32_t *plen)
 {
-    if (a->qname_len == 5 && memcmp(a->qname, "xmlns", 5) == 0) {
-        *prefix = ""; *plen = 0;
-    } else if (a->qname_len > 6 && memcmp(a->qname, "xmlns:", 6) == 0) {
-        *prefix = a->local; *plen = a->local_len;
+    const char *p; uint32_t pl;
+    mkr_span_t s = mkr_span(name, len);
+    if (len == 5 && mkr_span_starts(&s, "xmlns", 5)) {   /* read through the span - no raw name deref (NULL-safe) */
+        p = ""; pl = 0;
+    } else if (len > 6 && mkr_span_starts(&s, "xmlns:", 6)) {
+        p = name + 6; pl = len - 6;
     } else {
         return 0;
     }
+    if (prefix != NULL) *prefix = p;
+    if (plen != NULL)   *plen = pl;
+    return 1;
+}
+
+int
+mkr_xml_node_xmlns_decl(const mkr_xml_node_t *a, const char **prefix, uint32_t *plen,
+                        const char **uri, uint32_t *ulen)
+{
+    /* a built node's local IS qname+6 for "xmlns:p", so the byte detector's
+     * prefix slice equals the node's local - one shared rule, value read here. */
+    if (!mkr_xml_xmlns_prefix(a->qname, a->qname_len, prefix, plen)) return 0;
     *uri = a->value ? a->value : ""; *ulen = a->value_len;
     return 1;
 }
 
+mkr_xml_node_t *
+mkr_xml_preorder_next(const mkr_xml_node_t *root, mkr_xml_node_t *cur)
+{
+    if (cur->first_child != NULL) return cur->first_child;
+    /* climb until a node with a next sibling, stopping at (and not above) root */
+    while (cur != root && cur->next == NULL) cur = cur->parent;
+    if (cur == root) return NULL;
+    return cur->next;
+}
+
+int
+mkr_xml_qname_split(const char *name, uint32_t len, mkr_xml_qname_t *out)
+{
+    if (len == 0) return -1;
+    mkr_span_t s = mkr_span(name, len);
+    uint32_t cp;
+    int bl = mkr_utf8_decode1_span(&s, &cp);
+    if (bl == 0 || !mkr_xml_is_name_start(cp)) return -1;
+    mkr_span_skip(&s, (size_t)bl);
+    while (mkr_span_left(&s) > 0) {
+        bl = mkr_utf8_decode1_span(&s, &cp);
+        if (bl == 0 || !mkr_xml_is_name_char(cp)) return -1;
+        mkr_span_skip(&s, (size_t)bl);
+    }
+    out->qname = name; out->qname_len = len;
+    mkr_span_t q = mkr_span(name, len);
+    size_t colon_at;
+    if (!mkr_span_find(&q, ':', &colon_at)) {             /* no prefix */
+        out->prefix = name; out->prefix_len = 0;
+        out->local  = name; out->local_len  = len;
+        return 0;
+    }
+    uint32_t pl = (uint32_t)colon_at;
+    const char *ls = name + colon_at + 1;
+    uint32_t ll = len - pl - 1;
+    if (pl == 0 || ll == 0) return -1;                    /* ":x" or "x:" */
+    mkr_span_t lsp = mkr_span(ls, ll);
+    size_t second;
+    if (mkr_span_find(&lsp, ':', &second)) return -1;     /* a second colon */
+    if (mkr_utf8_decode1_span(&lsp, &cp) == 0 || !mkr_xml_is_name_start(cp))
+        return -1;                                        /* local must be an NCName */
+    out->prefix = name; out->prefix_len = pl;
+    out->local  = ls;   out->local_len  = ll;
+    return 0;
+}
+
+int
+mkr_xml_qname_assign(mkr_xml_doc_t *doc, mkr_xml_node_t *node, const mkr_xml_qname_t *qn)
+{
+    /* Contract: qn->local must alias INTO [qn->qname, qn->qname+qname_len) - the
+     * rebase below adds (local - qname) onto the arena copy, so a non-aliasing
+     * local would mint an out-of-bounds slice (wrong-but-plausible data, the worst
+     * failure mode here). Both in-tree producers (split_qname in mkr_xml_tree.c,
+     * mkr_xml_qname_split above) honour it; pin it so a violation fails closed
+     * (INTERNAL, sticky) instead of silently passing. */
+    if (!(qn->local >= qn->qname && qn->local_len <= qn->qname_len
+          && (size_t)(qn->local - qn->qname) <= qn->qname_len - qn->local_len)) {
+        if (doc != NULL) doc->oom = MKR_XML_ERR_INTERNAL;
+        return -1;
+    }
+    const char *q = mkr_xml_arena_bytes(doc, qn->qname, qn->qname_len);
+    if (qn->qname_len > 0 && q == NULL) return -1;        /* OOM: node left untouched */
+    node->qname  = q;                                  node->qname_len  = qn->qname_len;
+    node->local  = q + (size_t)(qn->local - qn->qname); node->local_len  = qn->local_len;
+    node->prefix = q;                                  node->prefix_len = qn->prefix_len;
+    return 0;
+}
+
 /* ---- self-test (Makiri.__c_selftest) - mirrors tmp/xml_spike/arena_spike.c --- */
 int
 mkr_xml_node_selftest(void)
@@ -191,7 +323,7 @@ mkr_xml_node_selftest(void)
     char nm[] = "Feed";
     const char *local = mkr_xml_arena_bytes(doc, nm, 4);
     if (root == NULL || root->first_child != NULL || root->type != MKR_XML_NODE_TYPE_ELEMENT
-        || local == NULL || local == nm || memcmp(local, "Feed", 4) != 0) {
+        || local == NULL || local == nm || !mkr_bytes_eq(local, 4, "Feed", 4)) {
         mkr_xml_doc_destroy(doc); return idx;
     }
     /* pointer alignment */
@@ -256,7 +388,7 @@ mkr_xml_node_selftest(void)
     idx++;                                     /* 8 */
     if (mkr_xml_arena_node(NULL, MKR_XML_NODE_TYPE_ELEMENT) != NULL
         || mkr_xml_arena_bytes(NULL, "x", 1) != NULL
-        || mkr_xml_arena_scratch_bytes(NULL, 1) != NULL) {
+        || mkr_xml_arena_spanbuf(NULL, 1).ok) {  /* alloc fails -> not ok */
         return idx;
     }