makiri 0.5.1 → 0.7.0

data/ext/makiri/bridge/xml_decode.c

@@ -0,0 +1,237 @@
+/* xml_decode.c - XML 1.0 Appendix F byte-encoding autodetection and strict
+ * decode-to-UTF-8 for the XML reader. Part of the bridge layer, split out of
+ * ruby_string.c so this XML-specific charset subsystem is separate from the
+ * generic Ruby String helpers. Raw RSTRING access stays isolated in
+ * ruby_string.c; this file borrows bytes only through mkr_ruby_bytes_view.
+ * Shares the allocation-free strict-text-contract core (mkr_text_check) via
+ * bridge_internal.h. See mkr_xml_decode_input in bridge.h for the contract. */
+#include "bridge.h"
+#include "../makiri.h"
+#include "bridge_internal.h"
+
+#include <string.h>
+
+/* rb_str_encode with no replacement flags: an undefined conversion or invalid
+ * byte sequence RAISES (Encoding::UndefinedConversionError /
+ * Encoding::InvalidByteSequenceError) instead of substituting U+FFFD. Run under
+ * rb_protect so we can remap the Ruby Encoding error to Makiri::XML::SyntaxError. */
+static VALUE
+mkr_xml_strict_transcode_thunk(VALUE str)
+{
+    return rb_str_encode(str, rb_enc_from_encoding(rb_utf8_encoding()), 0, Qnil);
+}
+
+/* --- XML 1.0 Appendix F: byte-encoding autodetection (BOM, then declaration) ---
+ *
+ * The leading byte-order mark, or NULL; *bom_len gets its length. UTF-32 BOMs are
+ * checked before the UTF-16 LE BOM they share a prefix with.
+ *
+ * *stride / *ascii_off get the interleave geometry of the ASCII column the decl
+ * scanner later extracts (default 1/0 for a single-byte stream). It is resolved
+ * HERE, at the match, rather than re-derived downstream, because that derivation
+ * needs rb_enc_find (it can autoload an encoding = a GC point) and the decl
+ * scanner reads a borrowed RSTRING view that must not be held across one - so
+ * the scanner is kept allocation-free until its reads are done. Each span read
+ * of p still finishes before the rb_enc_find in the return. */
+static rb_encoding *
+mkr_xml_bom_encoding(const unsigned char *p, long len, long *bom_len, long *stride, long *ascii_off)
+{
+    mkr_span_t s = mkr_span((const char *)p, (size_t)len);
+    *bom_len = 0;
+    *stride = 1;
+    *ascii_off = 0;
+    if (mkr_span_starts(&s, "\x00\x00\xFE\xFF", 4)) { *bom_len = 4; *stride = 4; *ascii_off = 3; return rb_enc_find("UTF-32BE"); }
+    if (mkr_span_starts(&s, "\xFF\xFE\x00\x00", 4)) { *bom_len = 4; *stride = 4; *ascii_off = 0; return rb_enc_find("UTF-32LE"); }
+    if (mkr_span_starts(&s, "\xFE\xFF", 2)) { *bom_len = 2; *stride = 2; *ascii_off = 1; return rb_enc_find("UTF-16BE"); }
+    if (mkr_span_starts(&s, "\xFF\xFE", 2)) { *bom_len = 2; *stride = 2; *ascii_off = 0; return rb_enc_find("UTF-16LE"); }
+    if (mkr_span_starts(&s, "\xEF\xBB\xBF", 3)) { *bom_len = 3; return rb_utf8_encoding(); }
+    return NULL;
+}
+
+static int
+mkr_decl_ws(int c)
+{
+    return c == ' ' || c == '\t' || c == '\r' || c == '\n';
+}
+
+/* The encoding named in the '<?xml ... encoding="NAME" ?>' declaration, or NULL.
+ * The declaration is ASCII; for a UTF-16/32-detected document its bytes are
+ * stride-interleaved, so the ASCII column is extracted (stride/off resolved by
+ * the BOM matcher) before the scan, letting a BOM-vs-declaration conflict be
+ * caught even in UTF-16.
+ *
+ * p is a borrowed RSTRING view, so this stays allocation-free until every read
+ * of p is done: the stride/off geometry is passed in (rather than derived here
+ * via rb_enc_find, which can autoload = a GC point), and the only rb_enc_find -
+ * the final name lookup - runs after the bytes have been copied into head[]. */
+static rb_encoding *
+mkr_xml_decl_encoding(const unsigned char *p, long len, long stride, long off)
+{
+    /* Extract the ASCII column (per the BOM stride) through bounded reads into
+     * a bounded writer - neither side trusts the loop arithmetic. */
+    mkr_span_t in = mkr_span((const char *)p, len < 0 ? 0 : (size_t)len);
+    char head[256];
+    mkr_spanbuf_t hw = mkr_spanbuf(head, sizeof(head));
+    for (size_t i = (size_t)off; hw.pos < sizeof(head); i += (size_t)stride) {
+        int c = mkr_span_at(&in, i);
+        if (c < 0) break;
+        mkr_spanbuf_putc(&hw, (char)c);
+    }
+    mkr_span_t h = mkr_span(head, hw.pos);
+    size_t hn = hw.pos;
+
+    size_t i = 0;
+    while (mkr_decl_ws(mkr_span_at(&h, i))) i++;
+    {
+        mkr_span_t t = mkr_span_tail(&h, i);
+        if (!mkr_span_starts(&t, "<?xml", 5)) return NULL;
+    }
+    i += 5;
+    /* find a whitespace-introduced "encoding" before the '?>' */
+    for (; i + 8 <= hn; i++) {
+        if (mkr_span_at(&h, i) == '?' && mkr_span_at(&h, i + 1) == '>') return NULL; /* end of decl */
+        mkr_span_t t = mkr_span_tail(&h, i);
+        if (!mkr_decl_ws(mkr_span_at(&h, i - 1)) || !mkr_span_starts(&t, "encoding", 8)) continue;
+        size_t j = i + 8;
+        while (mkr_decl_ws(mkr_span_at(&h, j))) j++;
+        if (mkr_span_at(&h, j) != '=') return NULL;
+        j++;
+        while (mkr_decl_ws(mkr_span_at(&h, j))) j++;
+        int q = mkr_span_at(&h, j);
+        if (q != '"' && q != '\'') return NULL;
+        j++;
+        size_t ns = j;
+        while (mkr_span_at(&h, j) >= 0 && mkr_span_at(&h, j) != q) j++;
+        if (j >= hn) return NULL;
+        char name[64];
+        size_t nl = j - ns;
+        if (nl == 0 || nl >= sizeof(name)) return NULL;
+        memcpy(name, head + ns, nl);
+        name[nl] = '\0';
+        return rb_enc_find(name);   /* NULL for an unknown encoding name */
+    }
+    return NULL;
+}
+
+/* Two encodings agree for conflict purposes when identical, or when either is
+ * US-ASCII (a subset of UTF-8 and the single-byte encodings). */
+static int
+mkr_xml_enc_compatible(rb_encoding *a, rb_encoding *b)
+{
+    return a == b || a == rb_usascii_encoding() || b == rb_usascii_encoding();
+}
+
+/* Phase 1: resolve the input's effective byte encoding (XML 1.0 Appendix F). A
+ * BOM wins, else the '<?xml encoding=?>' declaration, else the String's own
+ * declared encoding; ASCII-8BIT ("raw bytes, no claimed encoding") is decoded by
+ * the detected encoding instead. Raises Makiri::XML::SyntaxError on any
+ * BOM/declaration/String-encoding conflict, so the caller only ever sees a
+ * single, self-consistent encoding. Reads borrowed RSTRING bytes but stays
+ * allocation-free until its reads are done (see the BOM/decl scanners). */
+static rb_encoding *
+mkr_xml_effective_encoding(VALUE str)
+{
+    rb_encoding              *tag = rb_enc_get(str);
+    mkr_ruby_borrowed_bytes_t v   = mkr_ruby_bytes_view(str);
+    const unsigned char      *raw = (const unsigned char *)v.ptr;
+    long                      rawlen = (long)v.len;
+
+    long bom_len = 0, bom_stride = 1, bom_off = 0;
+    rb_encoding *bom = mkr_xml_bom_encoding(raw, rawlen, &bom_len, &bom_stride, &bom_off);
+    /* rb_enc_find inside the BOM lookup can autoload an encoding (a Ruby
+     * allocation = a GC point), so re-borrow the bytes before reading them
+     * again - a borrowed view must not be held across one. The interleave
+     * geometry (stride/off) is resolved by the BOM matcher and passed through,
+     * keeping the decl scanner itself allocation-free. */
+    v   = mkr_ruby_bytes_view(str);
+    raw = (const unsigned char *)v.ptr;
+    rb_encoding *decl = mkr_xml_decl_encoding(raw + bom_len, rawlen - bom_len, bom_stride, bom_off);
+    int is_binary = (tag == rb_ascii8bit_encoding());
+
+    if (bom && decl && !mkr_xml_enc_compatible(bom, decl)) {
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the byte-order mark and the encoding declaration disagree");
+    }
+    if (!is_binary && bom && !mkr_xml_enc_compatible(bom, tag)) {
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the byte-order mark disagrees with the string's encoding");
+    }
+    if (!is_binary && decl && !mkr_xml_enc_compatible(decl, tag)) {
+        /* A concrete String encoding is authoritative for decoding, so the
+         * declaration is not used to transcode - but a declaration that names a
+         * different encoding than the String is tagged with (e.g. a Shift_JIS
+         * String declaring encoding="UTF-8") is a self-inconsistent document and
+         * a fatal error, not a silently-ignored mismatch. */
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the encoding declaration disagrees with the string's encoding");
+    }
+
+    return is_binary ? (bom ? bom : (decl ? decl : rb_utf8_encoding())) : tag;
+}
+
+VALUE
+mkr_xml_decode_input(VALUE str, size_t max_bytes)
+{
+    /* Phase 1: resolve the single effective byte encoding (raises on conflict). */
+    rb_encoding *eff = mkr_xml_effective_encoding(str);
+
+    /* Phase 2: decode to UTF-8 (strict). UTF-8 / US-ASCII / ASCII-8BIT are
+     * already UTF-8 bytes (validated below); anything else is strict-transcoded,
+     * raising rather than substituting U+FFFD. */
+    VALUE s;
+    if (eff == rb_utf8_encoding() || eff == rb_usascii_encoding() || eff == rb_ascii8bit_encoding()) {
+        s = str;
+    } else {
+        VALUE in = str;
+        if (rb_enc_get(str) != eff) { in = rb_str_dup(str); rb_enc_associate(in, eff); }
+        int state = 0;
+        s = rb_protect(mkr_xml_strict_transcode_thunk, in, &state);
+        if (state != 0) {
+            VALUE exc = rb_errinfo();
+            rb_set_errinfo(Qnil);
+            char msg[256];
+            mkr_ruby_exception_message(exc, msg, sizeof msg);
+            rb_raise(mkr_eXmlSyntaxError,
+                     "XML input could not be decoded to UTF-8: %s", msg);
+        }
+    }
+
+    mkr_ruby_borrowed_bytes_t sv_bytes = mkr_ruby_bytes_view(s);
+    const char *ptr = sv_bytes.ptr;
+    long        len = (long)sv_bytes.len;
+    long        off = 0;
+    /* §4.3.3: a leading BOM is the encoding signature, not document content -
+     * strip a U+FEFF (the transcode above turns any UTF-16/32 BOM into one). */
+    mkr_span_t sv = mkr_span(ptr, (size_t)len);
+    if (mkr_span_starts(&sv, "\xEF\xBB\xBF", 3)) {
+        off = 3; len -= 3;
+        mkr_span_skip(&sv, 3);
+    }
+
+    /* Fail closed on an over-budget input BEFORE the validation scan and the
+     * caller's GVL-release copy (an input whose UTF-8 length exceeds the arena
+     * budget can never parse). max_bytes == 0 disables the check (__decode). */
+    if (max_bytes != 0 && (size_t)len > max_bytes) {
+        rb_raise(mkr_eXmlLimitExceeded, "XML input exceeds the byte budget");
+    }
+
+    /* Strict UTF-8 validation via the shared, allocation-free core - no GC point
+     * while `ptr` is borrowed: an embedded NUL or any invalid UTF-8 is fatal (no
+     * U+FFFD repair - unlike the HTML mkr_utf8_sanitize path). The whole-string
+     * `s` is consulted for the cached coderange (it covers the BOM-stripped
+     * suffix too - the BOM is one complete UTF-8 character), while the validated
+     * bytes are the stripped suffix `ptr + off`. */
+    switch (mkr_text_check(s, ptr + off, (size_t)len)) {
+        case MKR_TEXT_HAS_NUL:
+            rb_raise(mkr_eXmlSyntaxError, "XML input must not contain a NUL byte");
+        case MKR_TEXT_INVALID_UTF8:
+            rb_raise(mkr_eXmlSyntaxError, "XML input must be valid UTF-8");
+        case MKR_TEXT_OK:
+            break;
+    }
+    /* Build the result through the VALUE, not the borrowed ptr (rb_str_subseq
+     * allocates, so the ptr must not be what it copies from). */
+    VALUE u = rb_str_subseq(s, off, len);
+    rb_enc_associate(u, rb_utf8_encoding());
+    return u; /* validated, UTF-8-tagged, BOM-stripped */
+}

data/ext/makiri/core/mkr_alloc.c

@@ -39,6 +39,12 @@ mkr_reallocarray(void *ptr, size_t count, size_t elem)
         free(ptr);
         return NULL;
     }
+    if (elem == 0) {
+        /* Fail closed like mkr_callocarray rather than fall through to a
+         * realloc(ptr, 0) whose free-or-not is implementation-defined; the
+         * caller keeps ownership of ptr. */
+        return NULL;
+    }
     size_t bytes;
     if (!mkr_size_mul(count, elem, &bytes)) {
         return NULL; /* overflow: leave ptr unchanged */

data/ext/makiri/core/mkr_alloc.h

@@ -48,8 +48,10 @@ mkr_size_mul(size_t a, size_t b, size_t *out)
 }
 
 /* Compute a new capacity (in elements) that is >= need and grows geometrically
- * from cap, with cap*elem guaranteed to fit in size_t. Returns false on
- * overflow. */
+ * from cap, with new_cap*elem guaranteed to fit in size_t. Succeeds EXACTLY
+ * when need*elem fits: if the geometric target overshoots what elem allows, it
+ * falls back to `need` rather than failing, so the only failure is `need`
+ * itself being too large. (cbmc-alloc proves success <=> need*elem fits.) */
 static inline bool
 mkr_grow_capacity(size_t cap, size_t need, size_t elem, size_t *new_cap)
 {
@@ -59,14 +61,21 @@ mkr_grow_capacity(size_t cap, size_t need, size_t elem, size_t *new_cap)
         nc *= 2;
     }
     size_t bytes;
-    if (!mkr_size_mul(nc, elem, &bytes)) return false;
+    if (!mkr_size_mul(nc, elem, &bytes)) {
+        /* Geometric overshoot doesn't fit; retry at exactly `need` so a
+         * representable need never fails from the *2 headroom alone. */
+        nc = need;
+        if (!mkr_size_mul(nc, elem, &bytes)) return false;
+    }
     *new_cap = nc;
     return true;
 }
 
 /* realloc(ptr, count * elem) with the multiply overflow-checked. Returns NULL
  * on overflow or OOM; the original ptr is then unchanged (caller still owns
- * it). count == 0 frees and returns NULL. */
+ * it). count == 0 frees ptr and returns NULL; elem == 0 (with count > 0)
+ * returns NULL and leaves ptr unchanged (no implementation-defined
+ * realloc(ptr, 0)). */
 void *mkr_reallocarray(void *ptr, size_t count, size_t elem);
 
 /* calloc(count, elem) with the multiply overflow-checked, result zeroed.

data/ext/makiri/core/mkr_buf.h

@@ -143,6 +143,7 @@ static inline void
 mkr_spanbuf_write(mkr_spanbuf_t *b, const void *src, size_t n)
 {
     if (!b->ok || n == 0) return;
+    if (src == NULL) { b->ok = false; return; } /* fail closed, never memcpy(,NULL,n) */
     if (b->pos > b->cap || n > b->cap - b->pos) { b->ok = false; return; }
     memcpy(b->buf + b->pos, src, n);
     b->pos += n;

data/ext/makiri/core/mkr_text.h

@@ -22,17 +22,28 @@ extern "C" {
 /* A borrowed byte slice whose contents are guaranteed to satisfy Makiri's
  * engine text contract: valid UTF-8, no interior NUL, and NUL-terminated at
  * ptr[len]. The XPath engine's public string entry points accept ONLY this
- * type, so a raw `const char *` cannot be passed without a compile error. The
- * sole constructor is mkr_verified_text_from_view() at the Ruby boundary (bridge),
- * which can only be fed a view that mkr_ruby_verified_text() already validated;
- * there is deliberately no Ruby-free constructor, so unvalidated bytes have no
- * path into the engine. (ptr is non-owning: the caller keeps it alive for the
- * duration of the engine call.) */
+ * type, so a raw `const char *` cannot be passed without a compile error.
+ * Constructors:
+ *   - mkr_verified_text_from_view() at the Ruby boundary (bridge), fed a view
+ *     that mkr_ruby_verified_text() already validated;
+ *   - mkr_verified_text_lit() below, for compile-time string literals (which
+ *     meet the contract by construction).
+ * There is deliberately no Ruby-free constructor over runtime bytes, so
+ * unvalidated bytes have no path into the engine. (ptr is non-owning: the
+ * caller keeps it alive for the duration of the engine call.) */
 typedef struct {
     const char *ptr;
     size_t      len;
 } mkr_verified_text_t;
 
+/* Wrap a compile-time string literal as a verified-text token. The literal is
+ * NUL-terminated, NUL-free, and valid UTF-8 by construction, so it meets the
+ * engine text contract without validation - the sole Ruby-free mint, for
+ * selftest / fuzz harness literals that the bridge cannot reach. Do not pass a
+ * char* variable: sizeof(pointer) would not be the byte length. */
+#define mkr_verified_text_lit(lit) \
+    ((mkr_verified_text_t){ (lit), sizeof(lit) - 1 })
+
 /* ---------------------------------------------------------------- */
 /* string-type lattice                                              */
 /* ---------------------------------------------------------------- */
@@ -59,10 +70,18 @@ typedef struct {
  *   raw slice today. When something does, name it mkr_borrowed_bytes_t per the
  *   convention above; do not resurrect a placeholder before there is a user.
  *
+ *   One bridge-only variant sits BETWEEN bytes and text on the contract axis:
+ *   mkr_ruby_borrowed_data_t (bridge.h) is "valid UTF-8 but interior NUL
+ *   PERMITTED" - a strict superset of text - for DOM data-family mutations
+ *   (text/comment/CDATA content, attribute value), where U+0000 is legal data.
+ *   It never enters the engine (the engine still requires NUL-free text), so it
+ *   is deliberately absent from this engine lattice.
+ *
  *   (*) mkr_verified_text_t (defined above) is the one deliberate naming exception:
- *   it is a borrowed valid text AND a capability token. Its sole constructor is
- *   mkr_verified_text_from_view() at the Ruby boundary, so an unvalidated const char*
- *   cannot reach the engine's public API. Internally the engine carries the
+ *   it is a borrowed valid text AND a capability token. Its constructors are
+ *   mkr_verified_text_from_view() at the Ruby boundary and mkr_verified_text_lit()
+ *   for compile-time literals, so an unvalidated runtime const char* cannot
+ *   reach the engine's public API. Internally the engine carries the
  *   freely-constructible mkr_borrowed_text_t instead.
  *
  * Conversions - the only sanctioned edges. The points that actually VALIDATE

data/ext/makiri/core/mkr_utf8.h

@@ -32,6 +32,10 @@
 extern "C" {
 #endif
 
+/* src must be non-NULL when len > 0 (it is dereferenced through [0, len)); src
+ * may be NULL only when len == 0 (trivially valid). len > 0 with src == NULL is
+ * a caller-contract violation, not a fail-closed case - this is a hot path
+ * guarded at the call site, not here. */
 bool mkr_utf8_valid(const unsigned char *src, size_t len);
 
 /* mkr_utf8_decode1 - decode ONE code point from [p, p+len), strictly: rejects
@@ -53,7 +57,10 @@ mkr_utf8_decode1_span(const mkr_span_t *s, uint32_t *cp)
 /* mkr_utf8_count_chars - count Unicode code points in [ptr, ptr+len): every
  * byte that is NOT a 0x80..0xBF continuation byte starts a new code point.
  * Length-bounded (does not rely on a NUL terminator); ptr may be NULL when
- * len == 0. Used where XPath measures string length / offsets in characters. */
+ * len == 0. Used where XPath measures string length / offsets in characters.
+ * Semantics: on VALID UTF-8 this equals the code-point count (proved in
+ * cbmc-utf8-chain); on invalid bytes it is only a lead-byte-class scan (no
+ * decoding), so the strong count/boundary guarantees hold for valid text. */
 static inline size_t
 mkr_utf8_count_chars(const char *ptr, size_t len)
 {

data/ext/makiri/dom_adapter/cross_import.c

@@ -237,6 +237,21 @@ h2x_make(mkr_xml_doc_t *xdoc, lxb_dom_node_t *s, const char *pdef, uint32_t pdef
     }
 }
 
+/* If +n+ is an HTML <template> element, set *content to its content fragment
+ * (which may itself be NULL) and return true; else return false. The shared
+ * template detection for both import directions - the two callers then apply
+ * their own (different) rule for a template whose content is NULL. */
+static bool
+mkr_lxb_template_content(lxb_dom_node_t *n, lxb_dom_document_fragment_t **content)
+{
+    if (n->type == LXB_DOM_NODE_TYPE_ELEMENT
+        && n->local_name == LXB_TAG_TEMPLATE && n->ns == LXB_NS_HTML) {
+        *content = lxb_html_interface_template(n)->content;
+        return true;
+    }
+    return false;
+}
+
 /* The children to translate under +s+. An HTML <template> keeps its content in a
  * separate document fragment, NOT the normal child chain, so a plain first_child
  * walk would silently drop template contents. We descend into the content fragment
@@ -245,9 +260,8 @@ h2x_make(mkr_xml_doc_t *xdoc, lxb_dom_node_t *s, const char *pdef, uint32_t pdef
 static lxb_dom_node_t *
 h2x_children_of(lxb_dom_node_t *s)
 {
-    if (s->type == LXB_DOM_NODE_TYPE_ELEMENT
-        && s->local_name == LXB_TAG_TEMPLATE && s->ns == LXB_NS_HTML) {
-        lxb_dom_document_fragment_t *content = lxb_html_interface_template(s)->content;
+    lxb_dom_document_fragment_t *content;
+    if (mkr_lxb_template_content(s, &content)) {
         return content != NULL ? lxb_dom_interface_node(content)->first_child : NULL;
     }
     return s->first_child;
@@ -384,10 +398,9 @@ x2h_make(lxb_dom_document_t *hdoc, const mkr_xml_node_t *s, lxb_dom_node_t **out
 static lxb_dom_node_t *
 x2h_link_target(lxb_dom_node_t *el)
 {
-    if (el->type == LXB_DOM_NODE_TYPE_ELEMENT
-        && el->local_name == LXB_TAG_TEMPLATE && el->ns == LXB_NS_HTML) {
-        lxb_dom_document_fragment_t *content = lxb_html_interface_template(el)->content;
-        if (content != NULL) return lxb_dom_interface_node(content);
+    lxb_dom_document_fragment_t *content;
+    if (mkr_lxb_template_content(el, &content) && content != NULL) {
+        return lxb_dom_interface_node(content);
     }
     return el;
 }

data/ext/makiri/dom_adapter/dom_index.c

@@ -126,44 +126,36 @@ mkr_dom_index_build(mkr_dom_index_t *idx, lxb_dom_document_t *doc)
         }
     }
 
+    /* The four sizing allocations, all freed once through `fail:` (single-exit).
+     * `cursor` is scratch (not stored on idx) and is freed on the success path too. */
+    mkr_dom_index_attr_slot_t *slots     = NULL;
+    lxb_dom_node_t           **tag_nodes = NULL;
+    size_t                    *tag_off   = NULL;
+    size_t                    *cursor    = NULL;
+    size_t                     cap       = 0;
+
     /* Size the attr->owner table (load factor <= 0.5). */
-    mkr_dom_index_attr_slot_t *slots = NULL;
-    size_t cap = 0;
     if (n_attrs > 0) {
         size_t need;
-        if (!mkr_size_mul(n_attrs, 2, &need) || !mkr_pow2_ceil(need, &cap)) {
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (!mkr_size_mul(n_attrs, 2, &need) || !mkr_pow2_ceil(need, &cap)) goto fail;
         if (cap < 8) cap = 8;
         slots = mkr_callocarray(cap, sizeof(*slots));
-        if (slots == NULL) return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+        if (slots == NULL) goto fail;
     }
 
     /* Size the tag CSR: prefix-sum the per-tag counts into offsets, plus a
      * cursor (copy of the offsets) used to scatter in document order. */
-    lxb_dom_node_t **tag_nodes = NULL;
-    size_t          *tag_off   = NULL;
-    size_t          *cursor    = NULL;
     if (n_indexed > 0) {
         size_t noff = (size_t)tag_max + 2;
         size_t off_bytes;
-        if (!mkr_size_mul(noff, sizeof(*cursor), &off_bytes)) {
-            free(slots);
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (!mkr_size_mul(noff, sizeof(*cursor), &off_bytes)) goto fail;
         tag_off = mkr_reallocarray(NULL, noff, sizeof(*tag_off));
         cursor  = mkr_reallocarray(NULL, noff, sizeof(*cursor));
         tag_nodes = mkr_reallocarray(NULL, n_indexed, sizeof(*tag_nodes));
-        if (tag_off == NULL || cursor == NULL || tag_nodes == NULL) {
-            free(slots); free(tag_off); free(cursor); free(tag_nodes);
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (tag_off == NULL || cursor == NULL || tag_nodes == NULL) goto fail;
         tag_off[0] = 0;
         for (uintptr_t t = 0; t <= tag_max; t++) {
-            if (!mkr_size_add(tag_off[t], counts[t], &tag_off[t + 1])) {
-                free(slots); free(tag_off); free(cursor); free(tag_nodes);
-                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-            }
+            if (!mkr_size_add(tag_off[t], counts[t], &tag_off[t + 1])) goto fail;
         }
         memcpy(cursor, tag_off, off_bytes);
     }
@@ -205,6 +197,15 @@ mkr_dom_index_build(mkr_dom_index_t *idx, lxb_dom_document_t *doc)
     free(cursor);
     idx->built = true;
     return LXB_STATUS_OK;
+
+fail:
+    /* Reached only before the idx->... assignments above transfer ownership, so
+     * these are all still locals (phase 2 has no failure path). */
+    free(slots);
+    free(tag_nodes);
+    free(tag_off);
+    free(cursor);
+    return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
 }
 
 static lxb_dom_node_t *

data/ext/makiri/dom_adapter/post_parse.c

@@ -22,46 +22,45 @@ mkr_parse_tracked(const lxb_char_t *src, size_t len, void **out_lines)
 {
     *out_lines = NULL;
 
-    lxb_html_parser_t *parser = lxb_html_parser_create();
-    if (parser == NULL || lxb_html_parser_init(parser) != LXB_STATUS_OK) {
-        if (parser != NULL) {
-            lxb_html_parser_destroy(parser);
-        }
-        return NULL;
-    }
+    /* All resources declared up front and freed once through `fail:` (single-exit),
+     * so the correct free-set lives in one place instead of being re-spelled at
+     * each early return. Every destructor below is NULL-safe (guarded / by
+     * contract), so ordering across the acquisition points stays trivial. */
+    lxb_html_parser_t   *parser = NULL;
+    lxb_html_document_t *doc    = NULL;
+    mkr_pos_recorder_t  *rec    = NULL;
+    lxb_status_t         st;
 
-    lxb_html_document_t *doc = lxb_html_parse_chunk_begin(parser);
-    if (doc == NULL) {
-        lxb_html_parser_destroy(parser);
-        return NULL;
-    }
+    parser = lxb_html_parser_create();
+    if (parser == NULL || lxb_html_parser_init(parser) != LXB_STATUS_OK) goto fail;
+
+    doc = lxb_html_parse_chunk_begin(parser);
+    if (doc == NULL) goto fail;
 
     /* Install the recorder, chaining the parser's own tree-building callback
      * (set by chunk_begin). If the recorder can't be allocated we simply parse
      * without source tracking. */
-    mkr_pos_recorder_t *rec = mkr_pos_recorder_create(src);
+    rec = mkr_pos_recorder_create(src);
     if (rec != NULL) {
         lxb_html_tokenizer_t *tkz = lxb_html_parser_tokenizer(parser);
+        /* Lexbor has a setter and a ctx getter for the token-done callback but no
+         * getter for the callback function itself, so read that one field
+         * directly (the ctx uses the public getter). */
         mkr_pos_recorder_set_delegate(rec, tkz->callback_token_done,
-                                      tkz->callback_token_ctx);
+                                      lxb_html_tokenizer_callback_token_done_ctx(tkz));
         lxb_html_tokenizer_callback_token_done_set(tkz, mkr_pos_token_cb, rec);
     }
 
-    lxb_status_t st = lxb_html_parse_chunk_process(parser, src, len);
+    st = lxb_html_parse_chunk_process(parser, src, len);
     if (st == LXB_STATUS_OK) {
         st = lxb_html_parse_chunk_end(parser);
     }
-
-    if (st != LXB_STATUS_OK) {
-        mkr_pos_recorder_destroy(rec);
-        lxb_html_document_destroy(doc);
-        lxb_html_parser_destroy(parser);
-        return NULL;
-    }
+    if (st != LXB_STATUS_OK) goto fail;
 
     if (rec != NULL) {
         mkr_pos_assign_to_dom(rec, lxb_dom_interface_node(doc));
         mkr_pos_recorder_destroy(rec);
+        rec = NULL;                    /* consumed */
         *out_lines = mkr_lines_build(src, len);
     }
 
@@ -69,6 +68,12 @@ mkr_parse_tracked(const lxb_char_t *src, size_t len, void **out_lines)
      * tokenizer and tree, never the document). */
     lxb_html_parser_destroy(parser);
     return doc;
+
+fail:
+    mkr_pos_recorder_destroy(rec);                  /* NULL-safe */
+    if (doc != NULL)    lxb_html_document_destroy(doc);
+    if (parser != NULL) lxb_html_parser_destroy(parser);
+    return NULL;
 }
 
 mkr_parsed_t *

data/ext/makiri/dom_adapter/text_index.c

@@ -115,6 +115,18 @@ mkr_tix_is_container(const lxb_dom_node_t *n)
         || n->type == LXB_DOM_NODE_TYPE_DOCUMENT_FRAGMENT;
 }
 
+/* The non-empty character-data payload of a TEXT/CDATA node, or NULL (for a
+ * non-text node or an empty one). The single "does this node contribute a text
+ * slice" test, shared by the count and fill passes so the two-pass sizing and
+ * filling can never disagree about which nodes yield a slice. */
+static const lexbor_str_t *
+mkr_tix_text_slice(lxb_dom_node_t *n)
+{
+    if (!mkr_tix_is_text(n)) return NULL;
+    const lexbor_str_t *d = &lxb_dom_interface_character_data(n)->data;
+    return (d->data != NULL && d->length != 0) ? d : NULL;
+}
+
 /* Pass 1: count text slices and container (element/fragment) nodes under root
  * (inclusive), so the slice arrays and the range table are each sized once. */
 static void
@@ -124,9 +136,8 @@ mkr_tix_count(lxb_dom_node_t *root, size_t *out_slices, size_t *out_containers)
     for (lxb_dom_node_t *n = root; n != NULL; n = mkr_dom_preorder_next(n, root)) {
         if (mkr_tix_is_container(n)) {
             nc++;
-        } else if (mkr_tix_is_text(n)) {
-            const lexbor_str_t *d = &lxb_dom_interface_character_data(n)->data;
-            if (d->data != NULL && d->length != 0) ns++;
+        } else if (mkr_tix_text_slice(n) != NULL) {
+            ns++;
         }
     }
     *out_slices = ns;
@@ -205,23 +216,21 @@ mkr_text_idx_build(lxb_dom_node_t *root)
         }
         top->child = child->next; /* advance the cursor for our return */
 
-        if (mkr_tix_is_text(child)) {
-            const lexbor_str_t *d = &lxb_dom_interface_character_data(child)->data;
-            if (d->data != NULL && d->length != 0) {
-                size_t i = t->nslices;
-                size_t total;
-                if (!mkr_size_add(t->prefix[i], d->length, &total)) {
-                    /* cumulative text length overflows size_t - give up the
-                     * index (fail closed); the caller falls back to a walk. */
-                    free(st);
-                    mkr_text_idx_destroy(t);
-                    return NULL;
-                }
-                t->slices[i].ptr = (const char *)d->data;
-                t->slices[i].len = d->length;
-                t->prefix[i + 1] = total;
-                t->nslices = i + 1;
+        const lexbor_str_t *d = mkr_tix_text_slice(child);
+        if (d != NULL) {
+            size_t i = t->nslices;
+            size_t total;
+            if (!mkr_size_add(t->prefix[i], d->length, &total)) {
+                /* cumulative text length overflows size_t - give up the
+                 * index (fail closed); the caller falls back to a walk. */
+                free(st);
+                mkr_text_idx_destroy(t);
+                return NULL;
             }
+            t->slices[i].ptr = (const char *)d->data;
+            t->slices[i].len = d->length;
+            t->prefix[i + 1] = total;
+            t->nslices = i + 1;
         } else if (mkr_tix_is_container(child)) {
             size_t r = mkr_tix_range_insert(t, child, t->nslices);
             /* grow_reserve may move st; top is re-fetched at the loop head and