makiri 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee7e950514b33a2fa483cb6f4f4f48d5b80b8b6cc2205dbf720c2f47f790821d
-  data.tar.gz: 5c6739b1eabec71dbc34b8ce410c4ada7053112dd88d04d278840070178b4aa4
+  metadata.gz: ad4966a3bf44b4cbc01822bab034227c3c5a5c18347135bfc5cfbc13963a42eb
+  data.tar.gz: 4669d45c028deb66343788e8adb27c72819fb78c71a3f6efa14f8c5acc07efc4
 SHA512:
-  metadata.gz: 51af947ded032f4e09d3c622374cf09bbbc36f92f3f2006c98bd2f6d4884b51de83ded0a6faf8174be27cece0986d317ea2cd553e6837286d7c1d0a743c3261d
-  data.tar.gz: da5184494302a3c43cd8014972cf43e6c684460af1a53ef219a42bdfac9238e98a792ec2976b442462661ea63328330195408dd31d9b180f8dd421122676de13
+  metadata.gz: a076b9c0c2f8e790d6bf433912f8f27cf1c9439de66dbcd403a010736ee26e3716531c975969ea03274bb0fdac34e4c46ab25dbc6777eb50ec753e41a0c95e90
+  data.tar.gz: ad0d15f5fc4b6de3bf8850b21f69b0e66848c0dfe9f19b1304e9f0acde2754979506ca618a2af0449c9191052491fddc3b9ace9f226beed4b94349c48b4c09cc

data/.github/workflows/libfuzzer.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath]
+        target: [xml, xpath, xml_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/.github/workflows/verify.yml

@@ -0,0 +1,37 @@
+name: Verify
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  cbmc:
+    name: CBMC proofs
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Install CBMC
+        env:
+          CBMC_VERSION: "6.9.0"
+        run: |
+          curl -fsSLO "https://github.com/diffblue/cbmc/releases/download/cbmc-${CBMC_VERSION}/ubuntu-24.04-cbmc-${CBMC_VERSION}-Linux.deb"
+          sudo apt-get update
+          sudo apt-get install -y "./ubuntu-24.04-cbmc-${CBMC_VERSION}-Linux.deb"
+          cbmc --version
+
+      - name: Run verification suite
+        run: bundle exec rake verify

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.6.0] - 2026-07-05
+
+### Changed
+
+* Text and comment node content (`create_text_node`, `create_comment`,
+  `content=`) and attribute values (`[]=`, `set_attribute_ns`) now accept an
+  embedded NUL (U+0000) and store it verbatim, matching the WHATWG DOM and
+  browsers, instead of raising. Names, tag names, namespaces, CSS selectors, and
+  XPath expressions stay NUL-strict, and invalid UTF-8 is still rejected. XML
+  documents (`Makiri::XML`) are unchanged and still reject NUL everywhere, since
+  XML 1.0 has no legal U+0000 character.
+
 ## [0.5.1] - 2026-06-22
 
 ### Changed

data/README.md

@@ -267,6 +267,22 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
 * Type selectors are ASCII case-insensitive (CSS-correct for HTML; `LI` matches `<li>`)
   * `Nokogiri::HTML5` is case-sensitive there.
 
+### Text input (mutation APIs)
+
+* Programmatic string arguments must be **valid UTF-8** (invalid bytes raise
+  `Makiri::Error`, never silently repaired - unlike HTML *parsing*, which decodes
+  leniently to U+FFFD).
+* An embedded **NUL (U+0000)** is **accepted in HTML data-family content** -
+  text/comment node content (`create_text_node`, `create_comment`, `content=`)
+  and attribute values (`[]=`, `set_attribute_ns`) - and stored/read back
+  verbatim, matching the WHATWG DOM / browsers (`document.createTextNode("\0")`).
+  It is still **rejected** in names, tag names, namespaces, PI target/data, CSS
+  selectors, and XPath expressions/variable names (a NUL there raises).
+  * On re-parse, the HTML tokenizer replaces a U+0000 in text/attributes with
+    U+FFFD (WHATWG), so a serialized-then-reparsed round-trip is not byte-identical.
+  * `Makiri::XML` rejects NUL everywhere: XML 1.0 has no legal U+0000 character,
+    so admitting it would produce non-well-formed XML.
+
 ## Conformance
 
 The XPath engine and XML parser are original code, so their correctness is held by

data/Rakefile

@@ -287,6 +287,12 @@ task :oom do
   puts "(injection build left in place; run `rake clean compile` to restore a normal build)"
 end
 
+desc "CBMC proofs over the Ruby/Lexbor-free carve-out (core + XML + XPath front; " \
+     "needs cbmc; see docs/formal_verification.ja.md and verify/Makefile)"
+task :verify do
+  sh "make -C verify smoke selftest cbmc"
+end
+
 desc "Run the performance benchmark (Makiri vs Nokogiri reference)"
 task bench: :compile do
   # Run outside the bundle so the bench-only gems (nokogiri, benchmark-ips)

data/ext/makiri/bridge/bridge.h

@@ -24,6 +24,22 @@ typedef struct {
     size_t      len;
 } mkr_ruby_borrowed_text_t;
 
+/* A validated, borrowed view of a Ruby String argument for a DATA-FAMILY
+ * mutation (text/comment/CDATA node content, attribute value). Contract: valid
+ * UTF-8, interior NUL ALLOWED, NUL-terminated at ptr[len] but - unlike
+ * mkr_ruby_borrowed_text_t - NOT usable as a C string, because an interior NUL
+ * may truncate it. Every consumer MUST pass (ptr, len) explicitly. `value`
+ * keeps `ptr` alive while the view stays on the C stack. This type is
+ * deliberately distinct from mkr_ruby_borrowed_text_t so the compiler forbids a
+ * NUL-bearing value from reaching a name or engine API that requires the
+ * NUL-free contract (DOM createTextNode/setAttribute must accept U+0000; names
+ * and engine strings still must not). */
+typedef struct {
+    VALUE       value;
+    const char *ptr;
+    size_t      len;
+} mkr_ruby_borrowed_data_t;
+
 /* A borrowed raw byte view of a Ruby String. This deliberately does NOT enforce
  * Makiri's strict text contract; HTML parsing consumes raw bytes and decodes
  * invalid UTF-8 leniently. */
@@ -37,6 +53,12 @@ typedef struct {
  * Makiri::Error (naming +what+) on a NUL byte or invalid UTF-8. */
 mkr_ruby_borrowed_text_t mkr_ruby_verified_text(VALUE in, const char *what);
 
+/* Constructor for mkr_ruby_borrowed_data_t (see its contract above): coerce +in+
+ * to a String, requiring valid UTF-8 but permitting an interior NUL. Raises
+ * Makiri::Error (naming +what+) on invalid UTF-8 only. For data-family values;
+ * names and engine strings use mkr_ruby_verified_text. */
+mkr_ruby_borrowed_data_t mkr_ruby_verified_data(VALUE in, const char *what);
+
 /* Coerce +in+ to a String and return its raw bytes. No UTF-8 / NUL validation.
  * The returned `ptr` borrows the bytes of `value`; use mkr_ruby_copy_bytes when
  * the buffer must outlive the source String. */
@@ -84,10 +106,12 @@ const char *mkr_ruby_try_verified_text(VALUE sv, size_t max_bytes,
  * escape. Embedded NULs are intentionally truncated by %s formatting. */
 void mkr_ruby_exception_message(VALUE exc, char *buf, size_t len);
 
-/* The sole constructor of mkr_verified_text_t. Turns an already-validated view
- * (from mkr_ruby_verified_text or mkr_ruby_try_verified_text) into the token the
- * XPath engine accepts. The returned token borrows v.ptr; the caller must keep
- * v.value alive for the duration of the engine call. */
+/* The Ruby-bound constructor of mkr_verified_text_t. Turns an already-validated
+ * view (from mkr_ruby_verified_text or mkr_ruby_try_verified_text) into the token
+ * the XPath engine accepts. The returned token borrows v.ptr; the caller must
+ * keep v.value alive for the duration of the engine call. The sole Ruby-free
+ * constructor is mkr_verified_text_lit (core/mkr_text.h), for compile-time
+ * literals. */
 mkr_verified_text_t mkr_verified_text_from_view(mkr_ruby_borrowed_text_t v);
 
 /* Assemble a UTF-8 Ruby String of exactly +total+ bytes by concatenating +n+

data/ext/makiri/bridge/ruby_string.c

@@ -115,6 +115,31 @@ mkr_ruby_verified_text(VALUE in, const char *what)
     return v;
 }
 
+mkr_ruby_borrowed_data_t
+mkr_ruby_verified_data(VALUE in, const char *what)
+{
+    VALUE       s   = rb_String(in);
+    const char *ptr = RSTRING_PTR(s);
+    size_t      len = (size_t)RSTRING_LEN(s);
+
+    /* Data-family (text/comment/CDATA content, attribute value): only invalid
+     * UTF-8 is fatal; an interior NUL is permitted so DOM data can hold U+0000.
+     * mkr_verify_text is not reused because it raises on NUL. mkr_text_check is
+     * allocation-free, so the borrow above is not held across a GC point. */
+    switch (mkr_text_check(s, ptr, len)) {
+        case MKR_TEXT_INVALID_UTF8:
+            rb_raise(mkr_eError, "%s must be valid UTF-8", what);
+        case MKR_TEXT_HAS_NUL: /* permitted for data-family */
+        case MKR_TEXT_OK:
+            break;
+    }
+    mkr_ruby_borrowed_data_t v;
+    v.value = s;
+    v.ptr   = ptr;
+    v.len   = len;
+    return v;
+}
+
 mkr_ruby_borrowed_bytes_t
 mkr_ruby_bytes_view(VALUE in)
 {

data/ext/makiri/core/mkr_alloc.c

@@ -39,6 +39,12 @@ mkr_reallocarray(void *ptr, size_t count, size_t elem)
         free(ptr);
         return NULL;
     }
+    if (elem == 0) {
+        /* Fail closed like mkr_callocarray rather than fall through to a
+         * realloc(ptr, 0) whose free-or-not is implementation-defined; the
+         * caller keeps ownership of ptr. */
+        return NULL;
+    }
     size_t bytes;
     if (!mkr_size_mul(count, elem, &bytes)) {
         return NULL; /* overflow: leave ptr unchanged */

data/ext/makiri/core/mkr_alloc.h

@@ -48,8 +48,10 @@ mkr_size_mul(size_t a, size_t b, size_t *out)
 }
 
 /* Compute a new capacity (in elements) that is >= need and grows geometrically
- * from cap, with cap*elem guaranteed to fit in size_t. Returns false on
- * overflow. */
+ * from cap, with new_cap*elem guaranteed to fit in size_t. Succeeds EXACTLY
+ * when need*elem fits: if the geometric target overshoots what elem allows, it
+ * falls back to `need` rather than failing, so the only failure is `need`
+ * itself being too large. (cbmc-alloc proves success <=> need*elem fits.) */
 static inline bool
 mkr_grow_capacity(size_t cap, size_t need, size_t elem, size_t *new_cap)
 {
@@ -59,14 +61,21 @@ mkr_grow_capacity(size_t cap, size_t need, size_t elem, size_t *new_cap)
         nc *= 2;
     }
     size_t bytes;
-    if (!mkr_size_mul(nc, elem, &bytes)) return false;
+    if (!mkr_size_mul(nc, elem, &bytes)) {
+        /* Geometric overshoot doesn't fit; retry at exactly `need` so a
+         * representable need never fails from the *2 headroom alone. */
+        nc = need;
+        if (!mkr_size_mul(nc, elem, &bytes)) return false;
+    }
     *new_cap = nc;
     return true;
 }
 
 /* realloc(ptr, count * elem) with the multiply overflow-checked. Returns NULL
  * on overflow or OOM; the original ptr is then unchanged (caller still owns
- * it). count == 0 frees and returns NULL. */
+ * it). count == 0 frees ptr and returns NULL; elem == 0 (with count > 0)
+ * returns NULL and leaves ptr unchanged (no implementation-defined
+ * realloc(ptr, 0)). */
 void *mkr_reallocarray(void *ptr, size_t count, size_t elem);
 
 /* calloc(count, elem) with the multiply overflow-checked, result zeroed.

data/ext/makiri/core/mkr_buf.h

@@ -143,6 +143,7 @@ static inline void
 mkr_spanbuf_write(mkr_spanbuf_t *b, const void *src, size_t n)
 {
     if (!b->ok || n == 0) return;
+    if (src == NULL) { b->ok = false; return; } /* fail closed, never memcpy(,NULL,n) */
     if (b->pos > b->cap || n > b->cap - b->pos) { b->ok = false; return; }
     memcpy(b->buf + b->pos, src, n);
     b->pos += n;

data/ext/makiri/core/mkr_text.h

@@ -22,17 +22,28 @@ extern "C" {
 /* A borrowed byte slice whose contents are guaranteed to satisfy Makiri's
  * engine text contract: valid UTF-8, no interior NUL, and NUL-terminated at
  * ptr[len]. The XPath engine's public string entry points accept ONLY this
- * type, so a raw `const char *` cannot be passed without a compile error. The
- * sole constructor is mkr_verified_text_from_view() at the Ruby boundary (bridge),
- * which can only be fed a view that mkr_ruby_verified_text() already validated;
- * there is deliberately no Ruby-free constructor, so unvalidated bytes have no
- * path into the engine. (ptr is non-owning: the caller keeps it alive for the
- * duration of the engine call.) */
+ * type, so a raw `const char *` cannot be passed without a compile error.
+ * Constructors:
+ *   - mkr_verified_text_from_view() at the Ruby boundary (bridge), fed a view
+ *     that mkr_ruby_verified_text() already validated;
+ *   - mkr_verified_text_lit() below, for compile-time string literals (which
+ *     meet the contract by construction).
+ * There is deliberately no Ruby-free constructor over runtime bytes, so
+ * unvalidated bytes have no path into the engine. (ptr is non-owning: the
+ * caller keeps it alive for the duration of the engine call.) */
 typedef struct {
     const char *ptr;
     size_t      len;
 } mkr_verified_text_t;
 
+/* Wrap a compile-time string literal as a verified-text token. The literal is
+ * NUL-terminated, NUL-free, and valid UTF-8 by construction, so it meets the
+ * engine text contract without validation - the sole Ruby-free mint, for
+ * selftest / fuzz harness literals that the bridge cannot reach. Do not pass a
+ * char* variable: sizeof(pointer) would not be the byte length. */
+#define mkr_verified_text_lit(lit) \
+    ((mkr_verified_text_t){ (lit), sizeof(lit) - 1 })
+
 /* ---------------------------------------------------------------- */
 /* string-type lattice                                              */
 /* ---------------------------------------------------------------- */
@@ -59,10 +70,18 @@ typedef struct {
  *   raw slice today. When something does, name it mkr_borrowed_bytes_t per the
  *   convention above; do not resurrect a placeholder before there is a user.
  *
+ *   One bridge-only variant sits BETWEEN bytes and text on the contract axis:
+ *   mkr_ruby_borrowed_data_t (bridge.h) is "valid UTF-8 but interior NUL
+ *   PERMITTED" - a strict superset of text - for DOM data-family mutations
+ *   (text/comment/CDATA content, attribute value), where U+0000 is legal data.
+ *   It never enters the engine (the engine still requires NUL-free text), so it
+ *   is deliberately absent from this engine lattice.
+ *
  *   (*) mkr_verified_text_t (defined above) is the one deliberate naming exception:
- *   it is a borrowed valid text AND a capability token. Its sole constructor is
- *   mkr_verified_text_from_view() at the Ruby boundary, so an unvalidated const char*
- *   cannot reach the engine's public API. Internally the engine carries the
+ *   it is a borrowed valid text AND a capability token. Its constructors are
+ *   mkr_verified_text_from_view() at the Ruby boundary and mkr_verified_text_lit()
+ *   for compile-time literals, so an unvalidated runtime const char* cannot
+ *   reach the engine's public API. Internally the engine carries the
  *   freely-constructible mkr_borrowed_text_t instead.
  *
  * Conversions - the only sanctioned edges. The points that actually VALIDATE

data/ext/makiri/core/mkr_utf8.h

@@ -32,6 +32,10 @@
 extern "C" {
 #endif
 
+/* src must be non-NULL when len > 0 (it is dereferenced through [0, len)); src
+ * may be NULL only when len == 0 (trivially valid). len > 0 with src == NULL is
+ * a caller-contract violation, not a fail-closed case - this is a hot path
+ * guarded at the call site, not here. */
 bool mkr_utf8_valid(const unsigned char *src, size_t len);
 
 /* mkr_utf8_decode1 - decode ONE code point from [p, p+len), strictly: rejects
@@ -53,7 +57,10 @@ mkr_utf8_decode1_span(const mkr_span_t *s, uint32_t *cp)
 /* mkr_utf8_count_chars - count Unicode code points in [ptr, ptr+len): every
  * byte that is NOT a 0x80..0xBF continuation byte starts a new code point.
  * Length-bounded (does not rely on a NUL terminator); ptr may be NULL when
- * len == 0. Used where XPath measures string length / offsets in characters. */
+ * len == 0. Used where XPath measures string length / offsets in characters.
+ * Semantics: on VALID UTF-8 this equals the code-point count (proved in
+ * cbmc-utf8-chain); on invalid bytes it is only a lead-byte-class scan (no
+ * decoding), so the strong count/boundary guarantees hold for valid text. */
 static inline size_t
 mkr_utf8_count_chars(const char *ptr, size_t len)
 {

data/ext/makiri/fuzz/Makefile

@@ -1,9 +1,10 @@
 # ext/makiri/fuzz/Makefile - libFuzzer harness build
 #
 # Usage:
-#   make xml_fuzz      # build the XML parser harness
-#   make xpath_fuzz    # build the XPath compile+eval harness
-#   make clean         # remove build artifacts
+#   make xml_fuzz       # build the XML parser harness
+#   make xpath_fuzz     # build the XPath compile+eval harness (fixed document)
+#   make xml_xpath_fuzz # build the combined harness (fuzzer-controlled document + expression)
+#   make clean          # remove build artifacts
 #
 # Requires: clang with libFuzzer support (usually part of the clang distribution)
 #   and the vendored Lexbor static library already built (via `rake compile`).
@@ -64,9 +65,9 @@ CORE_OBJS  = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(CORE_SRCS))
 XML_OBJS   = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(XML_SRCS))
 XPATH_OBJS = $(patsubst $(EXT_DIR)/%.c,$(BUILD_DIR)/%.o,$(XPATH_SRCS))
 
-.PHONY: all clean check-libfuzzer xml_fuzz xpath_fuzz
+.PHONY: all clean check-libfuzzer xml_fuzz xpath_fuzz xml_xpath_fuzz
 
-all: check-libfuzzer xml_fuzz xpath_fuzz
+all: check-libfuzzer xml_fuzz xpath_fuzz xml_xpath_fuzz
 
 check-libfuzzer:
 	@mkdir -p $(BUILD_DIR)
@@ -79,6 +80,9 @@ xml_fuzz: $(BUILD_DIR)/xml_fuzz.o $(CORE_OBJS) $(XML_OBJS)
 xpath_fuzz: $(BUILD_DIR)/xpath_fuzz.o $(CORE_OBJS) $(XML_OBJS) $(XPATH_OBJS)
 	$(CXX) $(LDFLAGS) -o $@ $^ $(LEXBOR_DST)/lib/liblexbor_static.a
 
+xml_xpath_fuzz: $(BUILD_DIR)/xml_xpath_fuzz.o $(CORE_OBJS) $(XML_OBJS) $(XPATH_OBJS)
+	$(CXX) $(LDFLAGS) -o $@ $^ $(LEXBOR_DST)/lib/liblexbor_static.a
+
 $(BUILD_DIR)/%.o: $(EXT_DIR)/%.c
 	@mkdir -p $(dir $@)
 	$(CLANG) $(CFLAGS) -c -o $@ $<
@@ -91,5 +95,9 @@ $(BUILD_DIR)/xpath_fuzz.o: xpath_fuzz.c
 	@mkdir -p $(dir $@)
 	$(CLANG) $(CFLAGS) -c -o $@ $<
 
+$(BUILD_DIR)/xml_xpath_fuzz.o: xml_xpath_fuzz.c
+	@mkdir -p $(dir $@)
+	$(CLANG) $(CFLAGS) -c -o $@ $<
+
 clean:
-	rm -rf $(BUILD_DIR) xml_fuzz xpath_fuzz
+	rm -rf $(BUILD_DIR) xml_fuzz xpath_fuzz xml_xpath_fuzz

data/ext/makiri/fuzz/xml_xpath_fuzz.c

@@ -0,0 +1,87 @@
+/* xml_xpath_fuzz.c - libFuzzer harness where the fuzzer controls BOTH the
+ * document and the expression.
+ *
+ * Complements the other two targets: xml_fuzz covers the parser alone, and
+ * xpath_fuzz covers the engine over one fixed document shape - so evaluator
+ * paths that depend on document structure (namespace scopes, index buckets,
+ * axis edge cases) only ever see that shape. Here the input's bytes up to the
+ * first NUL are the XML document and the rest is the expression (both engine
+ * contracts forbid embedded NUL, so the separator costs no coverage).
+ *
+ * Contract violations (invalid UTF-8, non-XML chars) are filtered the same
+ * way the Ruby bridge does, so the harness only exercises in-contract inputs;
+ * the validators themselves run on every input and are fuzzed for free.
+ * Ruby-free; the XML arena self-poisons under ASan, so intra-arena overruns
+ * are caught. */
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "core/mkr_core.h"
+#include "xml/mkr_xml.h"
+#include "xpath/mkr_xpath.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    const uint8_t *sep = memchr(data, 0, size);
+    if (sep == NULL) return 0;
+
+    const char *xml  = (const char *)data;
+    size_t xml_len   = (size_t)(sep - data);
+    const char *expr = (const char *)sep + 1;
+    size_t expr_len  = size - xml_len - 1;
+
+    /* In-contract filter, mirroring the bridge's strict gate. */
+    if (!mkr_utf8_valid((const unsigned char *)xml, xml_len)) return 0;
+    if (mkr_xml_validate_chars(xml, (uint32_t)xml_len) != 0) return 0;
+    if (!mkr_utf8_valid((const unsigned char *)expr, expr_len)) return 0;
+
+    mkr_xml_status_t st = MKR_XML_OK;
+    mkr_xml_doc_t *doc = mkr_xml_parse(xml, xml_len, &st);
+    if (doc == NULL) return 0;
+
+    mkr_xpath_context_t *ctx = mkr_xpath_context_new(doc->doc_node, doc->doc_node);
+    if (ctx != NULL) {
+        mkr_xpath_set_engine_kind(ctx, 1); /* XML monomorphization */
+
+        /* Shrink the per-evaluate budgets so a single hostile input can't
+         * stall the fuzzer; overruns fail closed, which is the point. */
+        mkr_xpath_limits_t *L = mkr_ctx_limits(ctx);
+        L->max_eval_ops     = 20000;
+        L->max_nodeset_size = 1024;
+        L->max_string_bytes = 4096;
+
+        mkr_xpath_register_ns(ctx, mkr_verified_text_lit("d"), mkr_verified_text_lit("urn:d"));
+
+        /* The expression is the bytes after the separator NUL. libFuzzer
+         * gives exactly `size` bytes with no trailing terminator, so copy
+         * into an owned, NUL-terminated heap buffer and mint over that
+         * (mirroring xpath_fuzz.c): this supplies the NUL at ptr[len] the
+         * lexer's strtod / "%.10s" error path rely on. UTF-8 validity was
+         * checked above; the copy preserves it. */
+        char *expr_copy = mkr_strndup(expr, expr_len);
+        if (expr_copy == NULL) {
+            mkr_xpath_context_free(ctx);
+            mkr_xml_doc_destroy(doc);
+            return 0;
+        }
+
+        mkr_xpath_error_t err = {0};
+        mkr_verified_text_t e = { expr_copy, expr_len };
+        mkr_node_t *ast = mkr_parse(e, L, &err);
+        if (ast != NULL) {
+            mkr_xpath_value_t v = {0};
+            (void)mkr_xpath_eval_compiled(ctx, ast, &v, &err);
+            mkr_xpath_value_clear(&v);
+            mkr_node_free(ast);
+        }
+        mkr_xpath_error_clear(&err);
+        free(expr_copy);
+        mkr_xpath_context_free(ctx);
+    }
+    mkr_xml_doc_destroy(doc);
+    return 0;
+}

data/ext/makiri/glue/ruby_html_mutate.c

@@ -219,7 +219,7 @@ mkr_node_aset(VALUE self, VALUE rb_name, VALUE rb_value)
         rb_raise(mkr_eError, "cannot set an attribute on a non-element node");
     }
     mkr_ruby_borrowed_text_t nv = mkr_ruby_verified_text(rb_name, "attribute name");
-    mkr_ruby_borrowed_text_t vv = mkr_ruby_verified_text(rb_value, "attribute value");
+    mkr_ruby_borrowed_data_t vv = mkr_ruby_verified_data(rb_value, "attribute value");
     lxb_dom_attr_t *attr = lxb_dom_element_set_attribute(
         lxb_dom_interface_element(node),
         (const lxb_char_t *)nv.ptr, nv.len,
@@ -289,7 +289,7 @@ mkr_node_set_attribute_ns(VALUE self, VALUE rb_ns, VALUE rb_qname, VALUE rb_valu
     lxb_dom_element_t *el = lxb_dom_interface_element(node);
 
     mkr_ruby_borrowed_text_t qv = mkr_ruby_verified_text(rb_qname, "attribute qualified name");
-    mkr_ruby_borrowed_text_t vv = mkr_ruby_verified_text(rb_value, "attribute value");
+    mkr_ruby_borrowed_data_t vv = mkr_ruby_verified_data(rb_value, "attribute value");
 
     mkr_ruby_borrowed_text_t nv = {0};
     bool have_ns = false;
@@ -442,7 +442,7 @@ static VALUE
 mkr_node_set_content(VALUE self, VALUE rb_text)
 {
     lxb_dom_node_t *node = mkr_node_unwrap_mutable(self);
-    mkr_ruby_borrowed_text_t tv = mkr_ruby_verified_text(rb_text, "node content");
+    mkr_ruby_borrowed_data_t tv = mkr_ruby_verified_data(rb_text, "node content");
     lxb_status_t st = lxb_dom_node_text_content_set(
         node, (const lxb_char_t *)tv.ptr, tv.len);
     RB_GC_GUARD(tv.value);
@@ -584,7 +584,7 @@ static VALUE
 mkr_doc_create_text_node(VALUE self, VALUE rb_text)
 {
     lxb_dom_document_t *doc = mkr_html_doc_unwrap(self);
-    mkr_ruby_borrowed_text_t tv = mkr_ruby_verified_text(rb_text, "text content");
+    mkr_ruby_borrowed_data_t tv = mkr_ruby_verified_data(rb_text, "text content");
     lxb_dom_text_t *t = lxb_dom_document_create_text_node(
         doc, (const lxb_char_t *)tv.ptr, tv.len);
     RB_GC_GUARD(tv.value);
@@ -598,7 +598,7 @@ static VALUE
 mkr_doc_create_comment(VALUE self, VALUE rb_text)
 {
     lxb_dom_document_t *doc = mkr_html_doc_unwrap(self);
-    mkr_ruby_borrowed_text_t tv = mkr_ruby_verified_text(rb_text, "comment content");
+    mkr_ruby_borrowed_data_t tv = mkr_ruby_verified_data(rb_text, "comment content");
     lxb_dom_comment_t *c = lxb_dom_document_create_comment(
         doc, (const lxb_char_t *)tv.ptr, tv.len);
     RB_GC_GUARD(tv.value);

data/ext/makiri/xpath/mkr_xpath_eval_body.h

@@ -1509,14 +1509,15 @@ eval_fncall(mkr_xpath_context_t *ctx, const mkr_node_t *n,
             mkr_val_t *out, mkr_xpath_error_t *err)
 {
   const char *ns_uri = NULL;
+  size_t ns_uri_len = 0;
   if (n->u.fncall.prefix.ptr) {
-    ns_uri = mkr_ctx_lookup_ns(ctx, n->u.fncall.prefix.ptr, n->u.fncall.prefix.len, NULL);
+    ns_uri = mkr_ctx_lookup_ns(ctx, n->u.fncall.prefix.ptr, n->u.fncall.prefix.len, &ns_uri_len);
     if (ns_uri == NULL) {
       mkr_err_setf(err, MKR_XPATH_ERR_RUNTIME, "unknown namespace prefix '%s'", n->u.fncall.prefix.ptr);
       return -1;
     }
   }
-  mkr_func_impl_t fn = mkr_lookup_function(ns_uri, n->u.fncall.name.ptr);
+  mkr_func_impl_t fn = mkr_lookup_function(ns_uri, ns_uri_len, n->u.fncall.name.ptr, n->u.fncall.name.len);
 
   /* Evaluate arguments once and reuse for either path. */
   mkr_val_t *args = NULL;