makiri 0.6.0 → 0.7.0

data/ext/makiri/bridge/xml_decode.c

@@ -0,0 +1,237 @@
+/* xml_decode.c - XML 1.0 Appendix F byte-encoding autodetection and strict
+ * decode-to-UTF-8 for the XML reader. Part of the bridge layer, split out of
+ * ruby_string.c so this XML-specific charset subsystem is separate from the
+ * generic Ruby String helpers. Raw RSTRING access stays isolated in
+ * ruby_string.c; this file borrows bytes only through mkr_ruby_bytes_view.
+ * Shares the allocation-free strict-text-contract core (mkr_text_check) via
+ * bridge_internal.h. See mkr_xml_decode_input in bridge.h for the contract. */
+#include "bridge.h"
+#include "../makiri.h"
+#include "bridge_internal.h"
+
+#include <string.h>
+
+/* rb_str_encode with no replacement flags: an undefined conversion or invalid
+ * byte sequence RAISES (Encoding::UndefinedConversionError /
+ * Encoding::InvalidByteSequenceError) instead of substituting U+FFFD. Run under
+ * rb_protect so we can remap the Ruby Encoding error to Makiri::XML::SyntaxError. */
+static VALUE
+mkr_xml_strict_transcode_thunk(VALUE str)
+{
+    return rb_str_encode(str, rb_enc_from_encoding(rb_utf8_encoding()), 0, Qnil);
+}
+
+/* --- XML 1.0 Appendix F: byte-encoding autodetection (BOM, then declaration) ---
+ *
+ * The leading byte-order mark, or NULL; *bom_len gets its length. UTF-32 BOMs are
+ * checked before the UTF-16 LE BOM they share a prefix with.
+ *
+ * *stride / *ascii_off get the interleave geometry of the ASCII column the decl
+ * scanner later extracts (default 1/0 for a single-byte stream). It is resolved
+ * HERE, at the match, rather than re-derived downstream, because that derivation
+ * needs rb_enc_find (it can autoload an encoding = a GC point) and the decl
+ * scanner reads a borrowed RSTRING view that must not be held across one - so
+ * the scanner is kept allocation-free until its reads are done. Each span read
+ * of p still finishes before the rb_enc_find in the return. */
+static rb_encoding *
+mkr_xml_bom_encoding(const unsigned char *p, long len, long *bom_len, long *stride, long *ascii_off)
+{
+    mkr_span_t s = mkr_span((const char *)p, (size_t)len);
+    *bom_len = 0;
+    *stride = 1;
+    *ascii_off = 0;
+    if (mkr_span_starts(&s, "\x00\x00\xFE\xFF", 4)) { *bom_len = 4; *stride = 4; *ascii_off = 3; return rb_enc_find("UTF-32BE"); }
+    if (mkr_span_starts(&s, "\xFF\xFE\x00\x00", 4)) { *bom_len = 4; *stride = 4; *ascii_off = 0; return rb_enc_find("UTF-32LE"); }
+    if (mkr_span_starts(&s, "\xFE\xFF", 2)) { *bom_len = 2; *stride = 2; *ascii_off = 1; return rb_enc_find("UTF-16BE"); }
+    if (mkr_span_starts(&s, "\xFF\xFE", 2)) { *bom_len = 2; *stride = 2; *ascii_off = 0; return rb_enc_find("UTF-16LE"); }
+    if (mkr_span_starts(&s, "\xEF\xBB\xBF", 3)) { *bom_len = 3; return rb_utf8_encoding(); }
+    return NULL;
+}
+
+static int
+mkr_decl_ws(int c)
+{
+    return c == ' ' || c == '\t' || c == '\r' || c == '\n';
+}
+
+/* The encoding named in the '<?xml ... encoding="NAME" ?>' declaration, or NULL.
+ * The declaration is ASCII; for a UTF-16/32-detected document its bytes are
+ * stride-interleaved, so the ASCII column is extracted (stride/off resolved by
+ * the BOM matcher) before the scan, letting a BOM-vs-declaration conflict be
+ * caught even in UTF-16.
+ *
+ * p is a borrowed RSTRING view, so this stays allocation-free until every read
+ * of p is done: the stride/off geometry is passed in (rather than derived here
+ * via rb_enc_find, which can autoload = a GC point), and the only rb_enc_find -
+ * the final name lookup - runs after the bytes have been copied into head[]. */
+static rb_encoding *
+mkr_xml_decl_encoding(const unsigned char *p, long len, long stride, long off)
+{
+    /* Extract the ASCII column (per the BOM stride) through bounded reads into
+     * a bounded writer - neither side trusts the loop arithmetic. */
+    mkr_span_t in = mkr_span((const char *)p, len < 0 ? 0 : (size_t)len);
+    char head[256];
+    mkr_spanbuf_t hw = mkr_spanbuf(head, sizeof(head));
+    for (size_t i = (size_t)off; hw.pos < sizeof(head); i += (size_t)stride) {
+        int c = mkr_span_at(&in, i);
+        if (c < 0) break;
+        mkr_spanbuf_putc(&hw, (char)c);
+    }
+    mkr_span_t h = mkr_span(head, hw.pos);
+    size_t hn = hw.pos;
+
+    size_t i = 0;
+    while (mkr_decl_ws(mkr_span_at(&h, i))) i++;
+    {
+        mkr_span_t t = mkr_span_tail(&h, i);
+        if (!mkr_span_starts(&t, "<?xml", 5)) return NULL;
+    }
+    i += 5;
+    /* find a whitespace-introduced "encoding" before the '?>' */
+    for (; i + 8 <= hn; i++) {
+        if (mkr_span_at(&h, i) == '?' && mkr_span_at(&h, i + 1) == '>') return NULL; /* end of decl */
+        mkr_span_t t = mkr_span_tail(&h, i);
+        if (!mkr_decl_ws(mkr_span_at(&h, i - 1)) || !mkr_span_starts(&t, "encoding", 8)) continue;
+        size_t j = i + 8;
+        while (mkr_decl_ws(mkr_span_at(&h, j))) j++;
+        if (mkr_span_at(&h, j) != '=') return NULL;
+        j++;
+        while (mkr_decl_ws(mkr_span_at(&h, j))) j++;
+        int q = mkr_span_at(&h, j);
+        if (q != '"' && q != '\'') return NULL;
+        j++;
+        size_t ns = j;
+        while (mkr_span_at(&h, j) >= 0 && mkr_span_at(&h, j) != q) j++;
+        if (j >= hn) return NULL;
+        char name[64];
+        size_t nl = j - ns;
+        if (nl == 0 || nl >= sizeof(name)) return NULL;
+        memcpy(name, head + ns, nl);
+        name[nl] = '\0';
+        return rb_enc_find(name);   /* NULL for an unknown encoding name */
+    }
+    return NULL;
+}
+
+/* Two encodings agree for conflict purposes when identical, or when either is
+ * US-ASCII (a subset of UTF-8 and the single-byte encodings). */
+static int
+mkr_xml_enc_compatible(rb_encoding *a, rb_encoding *b)
+{
+    return a == b || a == rb_usascii_encoding() || b == rb_usascii_encoding();
+}
+
+/* Phase 1: resolve the input's effective byte encoding (XML 1.0 Appendix F). A
+ * BOM wins, else the '<?xml encoding=?>' declaration, else the String's own
+ * declared encoding; ASCII-8BIT ("raw bytes, no claimed encoding") is decoded by
+ * the detected encoding instead. Raises Makiri::XML::SyntaxError on any
+ * BOM/declaration/String-encoding conflict, so the caller only ever sees a
+ * single, self-consistent encoding. Reads borrowed RSTRING bytes but stays
+ * allocation-free until its reads are done (see the BOM/decl scanners). */
+static rb_encoding *
+mkr_xml_effective_encoding(VALUE str)
+{
+    rb_encoding              *tag = rb_enc_get(str);
+    mkr_ruby_borrowed_bytes_t v   = mkr_ruby_bytes_view(str);
+    const unsigned char      *raw = (const unsigned char *)v.ptr;
+    long                      rawlen = (long)v.len;
+
+    long bom_len = 0, bom_stride = 1, bom_off = 0;
+    rb_encoding *bom = mkr_xml_bom_encoding(raw, rawlen, &bom_len, &bom_stride, &bom_off);
+    /* rb_enc_find inside the BOM lookup can autoload an encoding (a Ruby
+     * allocation = a GC point), so re-borrow the bytes before reading them
+     * again - a borrowed view must not be held across one. The interleave
+     * geometry (stride/off) is resolved by the BOM matcher and passed through,
+     * keeping the decl scanner itself allocation-free. */
+    v   = mkr_ruby_bytes_view(str);
+    raw = (const unsigned char *)v.ptr;
+    rb_encoding *decl = mkr_xml_decl_encoding(raw + bom_len, rawlen - bom_len, bom_stride, bom_off);
+    int is_binary = (tag == rb_ascii8bit_encoding());
+
+    if (bom && decl && !mkr_xml_enc_compatible(bom, decl)) {
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the byte-order mark and the encoding declaration disagree");
+    }
+    if (!is_binary && bom && !mkr_xml_enc_compatible(bom, tag)) {
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the byte-order mark disagrees with the string's encoding");
+    }
+    if (!is_binary && decl && !mkr_xml_enc_compatible(decl, tag)) {
+        /* A concrete String encoding is authoritative for decoding, so the
+         * declaration is not used to transcode - but a declaration that names a
+         * different encoding than the String is tagged with (e.g. a Shift_JIS
+         * String declaring encoding="UTF-8") is a self-inconsistent document and
+         * a fatal error, not a silently-ignored mismatch. */
+        rb_raise(mkr_eXmlSyntaxError,
+                 "XML encoding conflict: the encoding declaration disagrees with the string's encoding");
+    }
+
+    return is_binary ? (bom ? bom : (decl ? decl : rb_utf8_encoding())) : tag;
+}
+
+VALUE
+mkr_xml_decode_input(VALUE str, size_t max_bytes)
+{
+    /* Phase 1: resolve the single effective byte encoding (raises on conflict). */
+    rb_encoding *eff = mkr_xml_effective_encoding(str);
+
+    /* Phase 2: decode to UTF-8 (strict). UTF-8 / US-ASCII / ASCII-8BIT are
+     * already UTF-8 bytes (validated below); anything else is strict-transcoded,
+     * raising rather than substituting U+FFFD. */
+    VALUE s;
+    if (eff == rb_utf8_encoding() || eff == rb_usascii_encoding() || eff == rb_ascii8bit_encoding()) {
+        s = str;
+    } else {
+        VALUE in = str;
+        if (rb_enc_get(str) != eff) { in = rb_str_dup(str); rb_enc_associate(in, eff); }
+        int state = 0;
+        s = rb_protect(mkr_xml_strict_transcode_thunk, in, &state);
+        if (state != 0) {
+            VALUE exc = rb_errinfo();
+            rb_set_errinfo(Qnil);
+            char msg[256];
+            mkr_ruby_exception_message(exc, msg, sizeof msg);
+            rb_raise(mkr_eXmlSyntaxError,
+                     "XML input could not be decoded to UTF-8: %s", msg);
+        }
+    }
+
+    mkr_ruby_borrowed_bytes_t sv_bytes = mkr_ruby_bytes_view(s);
+    const char *ptr = sv_bytes.ptr;
+    long        len = (long)sv_bytes.len;
+    long        off = 0;
+    /* §4.3.3: a leading BOM is the encoding signature, not document content -
+     * strip a U+FEFF (the transcode above turns any UTF-16/32 BOM into one). */
+    mkr_span_t sv = mkr_span(ptr, (size_t)len);
+    if (mkr_span_starts(&sv, "\xEF\xBB\xBF", 3)) {
+        off = 3; len -= 3;
+        mkr_span_skip(&sv, 3);
+    }
+
+    /* Fail closed on an over-budget input BEFORE the validation scan and the
+     * caller's GVL-release copy (an input whose UTF-8 length exceeds the arena
+     * budget can never parse). max_bytes == 0 disables the check (__decode). */
+    if (max_bytes != 0 && (size_t)len > max_bytes) {
+        rb_raise(mkr_eXmlLimitExceeded, "XML input exceeds the byte budget");
+    }
+
+    /* Strict UTF-8 validation via the shared, allocation-free core - no GC point
+     * while `ptr` is borrowed: an embedded NUL or any invalid UTF-8 is fatal (no
+     * U+FFFD repair - unlike the HTML mkr_utf8_sanitize path). The whole-string
+     * `s` is consulted for the cached coderange (it covers the BOM-stripped
+     * suffix too - the BOM is one complete UTF-8 character), while the validated
+     * bytes are the stripped suffix `ptr + off`. */
+    switch (mkr_text_check(s, ptr + off, (size_t)len)) {
+        case MKR_TEXT_HAS_NUL:
+            rb_raise(mkr_eXmlSyntaxError, "XML input must not contain a NUL byte");
+        case MKR_TEXT_INVALID_UTF8:
+            rb_raise(mkr_eXmlSyntaxError, "XML input must be valid UTF-8");
+        case MKR_TEXT_OK:
+            break;
+    }
+    /* Build the result through the VALUE, not the borrowed ptr (rb_str_subseq
+     * allocates, so the ptr must not be what it copies from). */
+    VALUE u = rb_str_subseq(s, off, len);
+    rb_enc_associate(u, rb_utf8_encoding());
+    return u; /* validated, UTF-8-tagged, BOM-stripped */
+}

data/ext/makiri/dom_adapter/cross_import.c

@@ -237,6 +237,21 @@ h2x_make(mkr_xml_doc_t *xdoc, lxb_dom_node_t *s, const char *pdef, uint32_t pdef
     }
 }
 
+/* If +n+ is an HTML <template> element, set *content to its content fragment
+ * (which may itself be NULL) and return true; else return false. The shared
+ * template detection for both import directions - the two callers then apply
+ * their own (different) rule for a template whose content is NULL. */
+static bool
+mkr_lxb_template_content(lxb_dom_node_t *n, lxb_dom_document_fragment_t **content)
+{
+    if (n->type == LXB_DOM_NODE_TYPE_ELEMENT
+        && n->local_name == LXB_TAG_TEMPLATE && n->ns == LXB_NS_HTML) {
+        *content = lxb_html_interface_template(n)->content;
+        return true;
+    }
+    return false;
+}
+
 /* The children to translate under +s+. An HTML <template> keeps its content in a
  * separate document fragment, NOT the normal child chain, so a plain first_child
  * walk would silently drop template contents. We descend into the content fragment
@@ -245,9 +260,8 @@ h2x_make(mkr_xml_doc_t *xdoc, lxb_dom_node_t *s, const char *pdef, uint32_t pdef
 static lxb_dom_node_t *
 h2x_children_of(lxb_dom_node_t *s)
 {
-    if (s->type == LXB_DOM_NODE_TYPE_ELEMENT
-        && s->local_name == LXB_TAG_TEMPLATE && s->ns == LXB_NS_HTML) {
-        lxb_dom_document_fragment_t *content = lxb_html_interface_template(s)->content;
+    lxb_dom_document_fragment_t *content;
+    if (mkr_lxb_template_content(s, &content)) {
         return content != NULL ? lxb_dom_interface_node(content)->first_child : NULL;
     }
     return s->first_child;
@@ -384,10 +398,9 @@ x2h_make(lxb_dom_document_t *hdoc, const mkr_xml_node_t *s, lxb_dom_node_t **out
 static lxb_dom_node_t *
 x2h_link_target(lxb_dom_node_t *el)
 {
-    if (el->type == LXB_DOM_NODE_TYPE_ELEMENT
-        && el->local_name == LXB_TAG_TEMPLATE && el->ns == LXB_NS_HTML) {
-        lxb_dom_document_fragment_t *content = lxb_html_interface_template(el)->content;
-        if (content != NULL) return lxb_dom_interface_node(content);
+    lxb_dom_document_fragment_t *content;
+    if (mkr_lxb_template_content(el, &content) && content != NULL) {
+        return lxb_dom_interface_node(content);
     }
     return el;
 }

data/ext/makiri/dom_adapter/dom_index.c

@@ -126,44 +126,36 @@ mkr_dom_index_build(mkr_dom_index_t *idx, lxb_dom_document_t *doc)
         }
     }
 
+    /* The four sizing allocations, all freed once through `fail:` (single-exit).
+     * `cursor` is scratch (not stored on idx) and is freed on the success path too. */
+    mkr_dom_index_attr_slot_t *slots     = NULL;
+    lxb_dom_node_t           **tag_nodes = NULL;
+    size_t                    *tag_off   = NULL;
+    size_t                    *cursor    = NULL;
+    size_t                     cap       = 0;
+
     /* Size the attr->owner table (load factor <= 0.5). */
-    mkr_dom_index_attr_slot_t *slots = NULL;
-    size_t cap = 0;
     if (n_attrs > 0) {
         size_t need;
-        if (!mkr_size_mul(n_attrs, 2, &need) || !mkr_pow2_ceil(need, &cap)) {
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (!mkr_size_mul(n_attrs, 2, &need) || !mkr_pow2_ceil(need, &cap)) goto fail;
         if (cap < 8) cap = 8;
         slots = mkr_callocarray(cap, sizeof(*slots));
-        if (slots == NULL) return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+        if (slots == NULL) goto fail;
     }
 
     /* Size the tag CSR: prefix-sum the per-tag counts into offsets, plus a
      * cursor (copy of the offsets) used to scatter in document order. */
-    lxb_dom_node_t **tag_nodes = NULL;
-    size_t          *tag_off   = NULL;
-    size_t          *cursor    = NULL;
     if (n_indexed > 0) {
         size_t noff = (size_t)tag_max + 2;
         size_t off_bytes;
-        if (!mkr_size_mul(noff, sizeof(*cursor), &off_bytes)) {
-            free(slots);
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (!mkr_size_mul(noff, sizeof(*cursor), &off_bytes)) goto fail;
         tag_off = mkr_reallocarray(NULL, noff, sizeof(*tag_off));
         cursor  = mkr_reallocarray(NULL, noff, sizeof(*cursor));
         tag_nodes = mkr_reallocarray(NULL, n_indexed, sizeof(*tag_nodes));
-        if (tag_off == NULL || cursor == NULL || tag_nodes == NULL) {
-            free(slots); free(tag_off); free(cursor); free(tag_nodes);
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-        }
+        if (tag_off == NULL || cursor == NULL || tag_nodes == NULL) goto fail;
         tag_off[0] = 0;
         for (uintptr_t t = 0; t <= tag_max; t++) {
-            if (!mkr_size_add(tag_off[t], counts[t], &tag_off[t + 1])) {
-                free(slots); free(tag_off); free(cursor); free(tag_nodes);
-                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
-            }
+            if (!mkr_size_add(tag_off[t], counts[t], &tag_off[t + 1])) goto fail;
         }
         memcpy(cursor, tag_off, off_bytes);
     }
@@ -205,6 +197,15 @@ mkr_dom_index_build(mkr_dom_index_t *idx, lxb_dom_document_t *doc)
     free(cursor);
     idx->built = true;
     return LXB_STATUS_OK;
+
+fail:
+    /* Reached only before the idx->... assignments above transfer ownership, so
+     * these are all still locals (phase 2 has no failure path). */
+    free(slots);
+    free(tag_nodes);
+    free(tag_off);
+    free(cursor);
+    return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
 }
 
 static lxb_dom_node_t *

data/ext/makiri/dom_adapter/post_parse.c

@@ -22,46 +22,45 @@ mkr_parse_tracked(const lxb_char_t *src, size_t len, void **out_lines)
 {
     *out_lines = NULL;
 
-    lxb_html_parser_t *parser = lxb_html_parser_create();
-    if (parser == NULL || lxb_html_parser_init(parser) != LXB_STATUS_OK) {
-        if (parser != NULL) {
-            lxb_html_parser_destroy(parser);
-        }
-        return NULL;
-    }
+    /* All resources declared up front and freed once through `fail:` (single-exit),
+     * so the correct free-set lives in one place instead of being re-spelled at
+     * each early return. Every destructor below is NULL-safe (guarded / by
+     * contract), so ordering across the acquisition points stays trivial. */
+    lxb_html_parser_t   *parser = NULL;
+    lxb_html_document_t *doc    = NULL;
+    mkr_pos_recorder_t  *rec    = NULL;
+    lxb_status_t         st;
 
-    lxb_html_document_t *doc = lxb_html_parse_chunk_begin(parser);
-    if (doc == NULL) {
-        lxb_html_parser_destroy(parser);
-        return NULL;
-    }
+    parser = lxb_html_parser_create();
+    if (parser == NULL || lxb_html_parser_init(parser) != LXB_STATUS_OK) goto fail;
+
+    doc = lxb_html_parse_chunk_begin(parser);
+    if (doc == NULL) goto fail;
 
     /* Install the recorder, chaining the parser's own tree-building callback
      * (set by chunk_begin). If the recorder can't be allocated we simply parse
      * without source tracking. */
-    mkr_pos_recorder_t *rec = mkr_pos_recorder_create(src);
+    rec = mkr_pos_recorder_create(src);
     if (rec != NULL) {
         lxb_html_tokenizer_t *tkz = lxb_html_parser_tokenizer(parser);
+        /* Lexbor has a setter and a ctx getter for the token-done callback but no
+         * getter for the callback function itself, so read that one field
+         * directly (the ctx uses the public getter). */
         mkr_pos_recorder_set_delegate(rec, tkz->callback_token_done,
-                                      tkz->callback_token_ctx);
+                                      lxb_html_tokenizer_callback_token_done_ctx(tkz));
         lxb_html_tokenizer_callback_token_done_set(tkz, mkr_pos_token_cb, rec);
     }
 
-    lxb_status_t st = lxb_html_parse_chunk_process(parser, src, len);
+    st = lxb_html_parse_chunk_process(parser, src, len);
     if (st == LXB_STATUS_OK) {
         st = lxb_html_parse_chunk_end(parser);
     }
-
-    if (st != LXB_STATUS_OK) {
-        mkr_pos_recorder_destroy(rec);
-        lxb_html_document_destroy(doc);
-        lxb_html_parser_destroy(parser);
-        return NULL;
-    }
+    if (st != LXB_STATUS_OK) goto fail;
 
     if (rec != NULL) {
         mkr_pos_assign_to_dom(rec, lxb_dom_interface_node(doc));
         mkr_pos_recorder_destroy(rec);
+        rec = NULL;                    /* consumed */
         *out_lines = mkr_lines_build(src, len);
     }
 
@@ -69,6 +68,12 @@ mkr_parse_tracked(const lxb_char_t *src, size_t len, void **out_lines)
      * tokenizer and tree, never the document). */
     lxb_html_parser_destroy(parser);
     return doc;
+
+fail:
+    mkr_pos_recorder_destroy(rec);                  /* NULL-safe */
+    if (doc != NULL)    lxb_html_document_destroy(doc);
+    if (parser != NULL) lxb_html_parser_destroy(parser);
+    return NULL;
 }
 
 mkr_parsed_t *

data/ext/makiri/dom_adapter/text_index.c

@@ -115,6 +115,18 @@ mkr_tix_is_container(const lxb_dom_node_t *n)
         || n->type == LXB_DOM_NODE_TYPE_DOCUMENT_FRAGMENT;
 }
 
+/* The non-empty character-data payload of a TEXT/CDATA node, or NULL (for a
+ * non-text node or an empty one). The single "does this node contribute a text
+ * slice" test, shared by the count and fill passes so the two-pass sizing and
+ * filling can never disagree about which nodes yield a slice. */
+static const lexbor_str_t *
+mkr_tix_text_slice(lxb_dom_node_t *n)
+{
+    if (!mkr_tix_is_text(n)) return NULL;
+    const lexbor_str_t *d = &lxb_dom_interface_character_data(n)->data;
+    return (d->data != NULL && d->length != 0) ? d : NULL;
+}
+
 /* Pass 1: count text slices and container (element/fragment) nodes under root
  * (inclusive), so the slice arrays and the range table are each sized once. */
 static void
@@ -124,9 +136,8 @@ mkr_tix_count(lxb_dom_node_t *root, size_t *out_slices, size_t *out_containers)
     for (lxb_dom_node_t *n = root; n != NULL; n = mkr_dom_preorder_next(n, root)) {
         if (mkr_tix_is_container(n)) {
             nc++;
-        } else if (mkr_tix_is_text(n)) {
-            const lexbor_str_t *d = &lxb_dom_interface_character_data(n)->data;
-            if (d->data != NULL && d->length != 0) ns++;
+        } else if (mkr_tix_text_slice(n) != NULL) {
+            ns++;
         }
     }
     *out_slices = ns;
@@ -205,23 +216,21 @@ mkr_text_idx_build(lxb_dom_node_t *root)
         }
         top->child = child->next; /* advance the cursor for our return */
 
-        if (mkr_tix_is_text(child)) {
-            const lexbor_str_t *d = &lxb_dom_interface_character_data(child)->data;
-            if (d->data != NULL && d->length != 0) {
-                size_t i = t->nslices;
-                size_t total;
-                if (!mkr_size_add(t->prefix[i], d->length, &total)) {
-                    /* cumulative text length overflows size_t - give up the
-                     * index (fail closed); the caller falls back to a walk. */
-                    free(st);
-                    mkr_text_idx_destroy(t);
-                    return NULL;
-                }
-                t->slices[i].ptr = (const char *)d->data;
-                t->slices[i].len = d->length;
-                t->prefix[i + 1] = total;
-                t->nslices = i + 1;
+        const lexbor_str_t *d = mkr_tix_text_slice(child);
+        if (d != NULL) {
+            size_t i = t->nslices;
+            size_t total;
+            if (!mkr_size_add(t->prefix[i], d->length, &total)) {
+                /* cumulative text length overflows size_t - give up the
+                 * index (fail closed); the caller falls back to a walk. */
+                free(st);
+                mkr_text_idx_destroy(t);
+                return NULL;
             }
+            t->slices[i].ptr = (const char *)d->data;
+            t->slices[i].len = d->length;
+            t->prefix[i + 1] = total;
+            t->nslices = i + 1;
         } else if (mkr_tix_is_container(child)) {
             size_t r = mkr_tix_range_insert(t, child, t->nslices);
             /* grow_reserve may move st; top is re-fetched at the loop head and

data/ext/makiri/extconf.rb

@@ -28,6 +28,10 @@ abort "Lexbor source not found at #{LEXBOR_SRC}. Did you `git submodule update -
 
 cmake = find_executable("cmake") or abort "cmake is required to build Lexbor."
 
+# Windows (RubyInstaller / MinGW-UCRT gcc). Used below to force the GNU
+# toolchain for the Lexbor build and to keep the Ruby import-library link.
+windows = RbConfig::CONFIG["target_os"] =~ /mingw|mswin/
+
 # Optionally build the vendored Lexbor itself under AddressSanitizer. This is the
 # ONLY way to catch overflows *inside* Lexbor's bump (mraw) arena: a sub-allocation
 # overrunning into the next one stays within one big malloc'd chunk, so the heap
@@ -55,6 +59,13 @@ unless stamp_ok
   Dir.chdir(LEXBOR_BLD) do
     cmd = [
       cmake,
+      # On Windows the runner ships Visual Studio, so a bare cmake defaults to the
+      # MSVC generator -> lexbor_static.lib under a Release/ subdir, breaking the
+      # hardcoded liblexbor_static.a path below. Force the GNU toolchain via Ninja
+      # (bundled by lukka/get-cmake; single-config, so no Release/ subdir) and pin
+      # the MinGW-UCRT gcc so cmake can't auto-probe MSVC. "MinGW Makefiles" is
+      # avoided: cmake refuses it when sh.exe is on PATH (MSYS2/Git-Bash put it there).
+      *(windows ? ["-G", "Ninja", "-DCMAKE_C_COMPILER=gcc"] : []),
       "-DLEXBOR_BUILD_SHARED=OFF",
       "-DLEXBOR_BUILD_STATIC=ON",
       "-DLEXBOR_BUILD_TESTS=OFF",
@@ -65,10 +76,18 @@ unless stamp_ok
       "-DCMAKE_INSTALL_PREFIX=#{LEXBOR_DST}",
       *(lexbor_asan ? ["-DLEXBOR_BUILD_WITH_ASAN=ON"] : []),
       LEXBOR_SRC,
-    ].shelljoin
+    ]
     warn "makiri: building vendored Lexbor (mode=#{lexbor_mode})"
-    system(cmd) or abort "cmake configure failed for Lexbor."
-    system("#{cmake.shellescape} --build . --target install -- -j#{Etc.respond_to?(:nprocessors) ? Etc.nprocessors : 4}") or
+    # Multi-arg system() bypasses the shell, so args pass verbatim on every
+    # platform. Do NOT shelljoin: Shellwords escapes `=` as `\=`, which a POSIX
+    # shell unwraps but Windows cmd.exe does not, mangling every -DNAME=VALUE
+    # (cmake then ignores CMAKE_INSTALL_PREFIX etc. and installs to the default).
+    system(*cmd) or abort "cmake configure failed for Lexbor."
+    nproc = Etc.respond_to?(:nprocessors) ? Etc.nprocessors : 4
+    # `-- -jN` forwards to make and is wrong for Ninja; use cmake's portable
+    # --parallel (cmake >= 3.12, satisfied by get-cmake) on Windows.
+    build_parallel = windows ? ["--parallel", nproc.to_s] : ["--", "-j#{nproc}"]
+    system(cmake, "--build", ".", "--target", "install", *build_parallel) or
       abort "cmake build/install failed for Lexbor."
   end
   File.write(lexbor_stamp, lexbor_mode)
@@ -77,6 +96,13 @@ end
 $INCFLAGS << " -I#{File.join(LEXBOR_DST, 'include').shellescape}"
 $INCFLAGS << " -I#{File.join(EXT_DIR).shellescape}"
 
+# On Windows, Lexbor's public headers default LXB_API to __declspec(dllimport)
+# (lexbor/core/def.h), emitting __imp_* references that don't resolve against the
+# STATIC archive we link. Lexbor's own static CMake target defines LEXBOR_STATIC to
+# neutralize this, but we link the .a directly (not via CMake's exported target),
+# so we must define it ourselves. Harmless (and a no-op macro) on other platforms.
+$CFLAGS << " -DLEXBOR_STATIC" if windows
+
 # Hard-link the static archive rather than pass -L/-llexbor_static, to
 # avoid accidentally linking a system-installed Lexbor.
 lexbor_archive = File.join(LEXBOR_DST, "lib", "liblexbor_static.a")
@@ -176,6 +202,10 @@ elsif RbConfig::CONFIG["target_os"] =~ /linux/
   $LIBRUBYARG = ""                          # the ruby executable already provides them
   $LIBRUBYARG_SHARED = ""
   $LIBRUBYARG_STATIC = ""
+# else (mingw/mswin): intentionally NOT blanked. PE/COFF has no dynamic_lookup
+# equivalent, so a MinGW extension MUST link the Ruby import library - we fall
+# through to mkmf's default libruby link. The precompiled x64-mingw-ucrt gem
+# still loads on any compatible Ruby of that ABI (they share ruby.dll's name).
 end
 
 # Export ONLY Init_makiri from the compiled extension. `-fvisibility=hidden`
@@ -194,6 +224,13 @@ elsif RbConfig::CONFIG["target_os"] =~ /linux/
   # are already hidden by -fvisibility=hidden, leaving just RUBY_FUNC_EXPORTED
   # Init_makiri in the dynamic symbol table.
   $DLDFLAGS << " -Wl,--exclude-libs,ALL"
+elsif windows
+  # PE DLLs export nothing unless __declspec(dllexport); Init_makiri (marked
+  # RUBY_FUNC_EXPORTED) is the only such export, which already turns off MinGW
+  # ld's auto-export-all. Belt-and-suspenders parity with the arms above: keep
+  # the export table to Init_makiri so a co-loaded Lexbor-based ext (e.g.
+  # nokolexbor) can't bind our private lxb_*.
+  $DLDFLAGS << " -Wl,--exclude-all-symbols"
 end
 
 # Recursively pick up C sources under ext/makiri/, excluding standalone

data/ext/makiri/fuzz/Makefile

@@ -43,7 +43,7 @@ CORE_SRCS = \
   $(EXT_DIR)/core/mkr_alloc.c \
   $(EXT_DIR)/core/mkr_utf8.c \
   $(EXT_DIR)/core/mkr_buf.c \
-  $(EXT_DIR)/core/mkr_core.c
+  $(EXT_DIR)/core/mkr_core_selftest.c
 
 XML_SRCS = \
   $(EXT_DIR)/xml/mkr_xml_tree.c \

data/ext/makiri/fuzz/xpath_fuzz.c

@@ -86,11 +86,16 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     mkr_xpath_context_t *ctx = mkr_xpath_context_new(doc->doc_node, doc->doc_node);
     if (ctx) {
         mkr_xpath_set_engine_kind(ctx, 1); /* XML engine */
-        mkr_xpath_limits_init_defaults(&limits);
-        limits.max_eval_ops        = 5 * 1000 * 1000; /* 5M ops - enough for a real query */
-        limits.max_nodeset_size    = 10000;
-        limits.max_string_bytes    = 1024 * 1024;
-        limits.max_recursion_depth = 64;
+        /* Shrink the per-evaluate budgets ON THE CONTEXT the evaluator actually
+         * reads: mkr_xpath_eval_compiled consults ctx->limits, not a local struct,
+         * so tighten via mkr_ctx_limits(ctx) (as xml_xpath_fuzz.c does) - otherwise
+         * a hostile expression would run under the large defaults and stall the
+         * fuzzer. */
+        mkr_xpath_limits_t *L = mkr_ctx_limits(ctx);
+        L->max_eval_ops        = 5 * 1000 * 1000; /* 5M ops - enough for a real query */
+        L->max_nodeset_size    = 10000;
+        L->max_string_bytes    = 1024 * 1024;
+        L->max_recursion_depth = 64;
 
         mkr_xpath_value_t out = {0};
         mkr_xpath_error_t eval_err = {0};

data/ext/makiri/glue/glue.h

@@ -105,6 +105,20 @@ void mkr_import_fragment_children(lxb_dom_document_t *doc, lxb_dom_node_t *root,
 void mkr_emit_append(lxb_dom_node_t *imported, void *u);
 void mkr_emit_before(lxb_dom_node_t *imported, void *u);
 
+/* Shared transient-fragment-parser scaffold (glue/ruby_doc.c): create+init an
+ * HTML parser, sanitize +html+ to UTF-8 bytes, run +parse+ (which calls the
+ * appropriate lxb_html_parse_fragment* and returns the fragment root), free the
+ * decoded input, and destroy the parser - returning the root, which is owned by
+ * its (possibly transient) document and survives the parser's destruction.
+ * Raises on parser-create / OOM / parse failure. Both fragment paths
+ * (Document#fragment via a tag-id context, inner_html=/outer_html= via an element
+ * context) share this so the create/sanitize/free/destroy + error cleanup lives
+ * once. */
+typedef lxb_dom_node_t *(*mkr_fragment_parse_fn)(lxb_html_parser_t *parser,
+                                                 const lxb_char_t *hsrc, size_t hlen,
+                                                 void *ctx);
+lxb_dom_node_t *mkr_run_fragment_parser(VALUE html, mkr_fragment_parse_fn parse, void *ctx);
+
 /* Node#clone_node(deep=false): shallow/deep DOM clone owned by this node's
  * document (import_node + <template>-content fixup), detached from any parent.
  * Implemented in ruby_doc.c (next to the import machinery), bound in