makiri 0.7.0-aarch64-linux → 0.9.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1117686dde2fd5e8a6e863971b3220a7bfffd621e3dea8097d0b0b0b14f75275
-  data.tar.gz: ee2fbfb3b456a86f9444bf9faa9ccdf051b224e44ffc951e2b84ef49333e6907
+  metadata.gz: 73e114eace5001084f191b87a1608364858d5696d79bc2f1b950aea2c7806ec4
+  data.tar.gz: 2ecdd8274159bf93573f08d47462aa69470104f4a188c4731ba36cf33efba0cb
 SHA512:
-  metadata.gz: 5fa4fce173089263057caf5f8f13ab305d60c6d07f7df4a2d5b921d7025a25be5ace35c7797e9664938f7537a7ff3c6870cfacd75b6689f3e692f3e9c9d003a8
-  data.tar.gz: 97694793f4875a0378582e504b2df12baa4902d18c2b28ea9d3fc9ed78de0da9310af78f67a7a7a5e5298a321477175343fcc34320ea49787450e0951b56a371
+  metadata.gz: 115fd4af76231a9ca4373927ee763f658b01011f5cb244befda840274789629b582267f5798e83bccdb5add73c05156281ffe49461a3abbf311af19f99e9243e
+  data.tar.gz: 976aad3964d2993a31167d01d719fe9c6d5ea762560c5e00430c19e2b6c1cb35fa0a5d8cd594e377749bcdbb4704bfaa7c401f2d986f65e3dca066409cf79c3b

data/.github/workflows/security.yml

@@ -157,6 +157,55 @@ jobs:
   # poisoning on), catching intra-arena overflows that a plain ASan build cannot
   # see - the class the v3.0.0 :lexbor-contains overflow belonged to. Heavy
   # (full instrumented Lexbor rebuild), so nightly only.
+  # The randomised property checks (spec/invariants/). Cheap enough to gate a PR
+  # on, so they run on every push; the ASan pass is nightly because an
+  # instrumented build is slow.
+  invariants:
+    name: Invariant checks
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Run the invariant checks
+        run: bundle exec rake invariants
+
+  invariants-sanitize:
+    name: Nightly invariant checks under ASan + UBSan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # The text index hands out borrowed slices, so a stale one is a memory bug
+      # as much as a wrong answer - this is the pass that would see it.
+      - name: Run the invariant checks under sanitizers
+        run: bundle exec rake "invariants:sanitize"
+
   security-sanitize-lexbor:
     name: Nightly instrumented-Lexbor ASan suite
     runs-on: ubuntu-latest

data/.github/workflows/valgrind.yml

@@ -24,11 +24,16 @@ jobs:
   # (intra-arena overflows).  Runs on Linux because Valgrind is x86_64/amd64
   # Linux only.
   valgrind-memcheck:
-    name: Valgrind memcheck (Ruby ${{ matrix.ruby }})
+    name: Valgrind memcheck (Ruby ${{ matrix.ruby }}, shard ${{ matrix.shard }}/4)
     runs-on: ubuntu-latest
     timeout-minutes: 360
     env:
       BUNDLE_WITH: valgrind
+      # Shard the suite across the matrix below: 4 parallel jobs each memcheck a
+      # quarter of the spec files, so the whole suite finishes in ~1/4 the
+      # wall-clock with no loss of coverage (each shard is balanced by file size).
+      VALGRIND_SHARDS: "4"
+      VALGRIND_SHARD_INDEX: ${{ matrix.shard }}
       # These heavy jobs verify memory discipline (uninit values, intra-arena
       # overflows, use-after-move), not the property space - so the full
       # 300-iteration PBT sweep (already run by the normal CI matrix) is
@@ -37,10 +42,16 @@ jobs:
       # keeping the run tractable.
       PBT_COUNT: "15"
       CSS_PBT_COUNT: "15"
+      # --track-origins roughly doubles memcheck's runtime and only adds an origin
+      # backtrace to a finding (the finding itself is still reported without it).
+      # Drop it on the frequent post-merge push gate to halve its runtime; keep it
+      # for the thorough nightly / manual runs, where the backtrace aids triage.
+      VALGRIND_TRACK_ORIGINS: ${{ github.event_name == 'push' && 'no' || 'yes' }}
     strategy:
       fail-fast: false
       matrix:
         ruby: ["3.4"]
+        shard: [0, 1, 2, 3]   # keep in sync with VALGRIND_SHARDS above
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## [0.9.0] - 2026-09-11
+
+### Added
+
+* `Node#attribute_by_qualified_name(name)` and
+  `Node#attribute_value_by_qualified_name(name)`: the attribute whose
+  **qualified** name is exactly `name` — its node, and its value — or nil.
+  `#[]` cannot answer this: it also finds a prefixed attribute by its local
+  name (`svg_a["href"]` returns `xlink:href`), and it lower-cases what it looks
+  up (`el["DATA-X"]` finds `data-x`). The new match is byte-exact.
+
+### Changed
+
+* **`Makiri::XML` follows the DOM namespace model.** A node's namespace URI is
+  decided once — by the parser, or by the context it is first inserted into —
+  and does not change afterwards; the serializer emits whatever xmlns
+  declarations the output needs:
+
+  - moving a node under an element that binds its prefix to a different URI
+    keeps `namespace_uri`, and the output declares the prefix at the moved node;
+  - inserting a node whose prefix is bound nowhere in the destination now
+    succeeds instead of raising;
+  - `import_node` keeps the namespace of what it copied;
+  - an element in no namespace stays in no namespace under a default namespace,
+    serialized as `xmlns=""`;
+  - `#to_xml` on a node below the root declares the prefixes its subtree uses,
+    so the output re-parses to the same namespaces standing alone.
+
+  Nodes from the factories (`create_element` and friends) still take their
+  namespace from the context they are first inserted into.
+
+* **Inserting a node from another document adopts it.** `add_child` / `before` /
+  `after` / `replace` bring the node over and remove it from the document it
+  came from, instead of copying it (`Makiri::XML`) or raising (`Makiri::HTML`).
+  A spliced fragment is left empty; a rejected insert leaves the source
+  document untouched.
+
+  The node handed back is a **different object** than the one passed in, so use
+  the return value afterwards rather than the argument. `Document#import_node`
+  is unchanged: it copies and leaves the source alone.
+
+* **XML serialization is capped at the nesting depth the parser accepts.**
+  `#to_xml` and `#canonicalize` raise `Makiri::Error` past it, rather than
+  emitting XML that Makiri could not read back. A deeper tree is still fine to
+  hold, walk and query.
+
+### Fixed
+
+* XPath axes from an **attribute** context node on the XML backend now follow
+  XPath 1.0 §2.2: `following-sibling` and `preceding-sibling` are empty, and
+  `following` / `preceding` exclude attribute nodes. They used to return the
+  element's later attributes.
+
+* A rejected insert no longer leaves part of the moved subtree carrying
+  namespace URIs resolved against the scope it was refused from.
+
+## [0.8.0] - 2026-07-12
+
+### Fixed
+
+* `Document#import_node` (DOM `importNode` / `adoptNode`) now imports an HTML
+  element whose name is a valid DOM name but not a well-formed XML QName (e.g.
+  `":good:times:"`, `"x<"`, `"0:a"`) instead of raising. Such an element is not
+  XML-serializable (`#to_xml` raises). An element carrying a similarly lenient
+  attribute name is still rejected.
+
 ## [0.7.0] - 2026-07-11
 
 ### Added

data/README.md

@@ -110,7 +110,9 @@ doc.css("feed > entry").map { |e| e.at_css("title").text }  # => ["Hello", "Worl
 
 # Serialize back to XML
 doc.to_xml                                 # => "<?xml version=\"1.0\"?>\n<feed ...>...</feed>\n"
-doc.at_xpath("//a:entry", ns).to_xml       # => "<entry><title>Hello</title></entry>" (no declaration)
+# A node below the root serializes self-contained: no XML declaration, but the
+# namespace declarations its subtree needs, so the output re-parses the same.
+doc.at_xpath("//a:entry", ns).to_xml       # => "<entry xmlns=\"http://www.w3.org/2005/Atom\"><title>Hello</title></entry>"
 doc.to_xml(pretty: true)                   # indented, element-only content
 
 # DOCTYPE is recognized but the DTD is not processed (no entities, no I/O):
@@ -138,8 +140,11 @@ doc.root.to_xml           # => "<feed xmlns:dc=\"urn:dc\"><post dc:k=\"v\">Bye</
 ```
 
 XML subtrees can be built with `Document#create_element` and related node factory methods,
-then inserted with `#add_child`, `#before`, `#after`, or `#replace`;
-namespaces are resolved at insertion time, and cross-document nodes are deep-copied.
+then inserted with `#add_child`, `#before`, `#after`, or `#replace`. A factory-built
+node takes its namespace from the context it is first inserted into; one that already
+has a namespace keeps it. A node from another document is **adopted** — brought over
+and removed from the document it came from — and the method returns the node now in
+the tree, which is a different object than the one passed in.
 
 `Document#import_node(node, deep = false)` brings a node into a document as a
 detached copy, and works **across representations**: importing a `Makiri::HTML`
@@ -240,6 +245,34 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
     (QNames), never PI targets. Nokogiri/libxml2 rejects it (`colons are forbidden
     from PI names`); Makiri follows the normative text. Only the reserved `xml`
     (any case) target is rejected.
+* A node's **namespace URI is its identity**, not something re-derived from the
+  declarations around it - the WHATWG DOM model, measured against Chrome 152
+  (`DOMParser` + `XMLSerializer`).
+  * Moving a node under an element that binds its prefix to a different URI does
+    **not** change `namespace_uri`; the serializer emits the declaration the
+    output needs (`<p:x xmlns:p="urn:a"/>`), and nothing when the destination
+    already agrees. libxml2 keeps the URI on an in-document move but does *not*
+    emit the declaration, so Nokogiri's tree and its own output disagree there.
+  * `#to_xml` on a node below the root is **self-contained**: it declares the
+    prefixes its subtree uses, so the output re-parses to the same namespaces
+    standing alone. Nokogiri omits them, and its subtree output does not
+    round-trip.
+  * Where one prefix would have to mean two things at once, the serializer
+    invents one (`ns1`, `ns2`, ...) rather than shadow the other, as browsers do.
+  * An element in **no** namespace stays that way under a default namespace,
+    serialized as `xmlns=""`.
+  * Nodes from the factories (`create_element` and friends) still take their
+    namespace from the context they are first inserted into, so a subtree can be
+    built detached and attached afterwards. Only later moves carry.
+* Inserting a node **from another document adopts it** (`add_child` / `before` /
+  `after` / `replace`): it is brought over and taken out of the document it came
+  from, as `appendChild` does in the DOM and in both Chrome and Nokogiri.
+  * Each arena owns its own nodes, so the node cannot be relinked across them: it
+    is copied here and removed there. The one visible difference from Nokogiri
+    and browsers is that the node handed back is a **different object** than the
+    one passed in - use the return value afterwards, not the argument.
+  * `Document#import_node` is the copy: it leaves the source alone, like DOM
+    `importNode`.
 * Otherwise the parsed tree is byte-identical to `Nokogiri::XML`'s (verified by
   the property-based differential), including namespaces, prolog/epilog comments
   and PIs, and adjacent-CDATA coalescing.
@@ -267,6 +300,21 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
 * Type selectors are ASCII case-insensitive (CSS-correct for HTML; `LI` matches `<li>`)
   * `Nokogiri::HTML5` is case-sensitive there.
 
+### Serialization
+
+* **Comment data is written literally**, as the WHATWG serialization algorithm
+  says and as browsers do: `comment.content = "a-->b"` serializes to
+  `<!--a-->b-->`, which re-parses as the comment `"a"` followed by text.
+  * `Nokogiri::HTML5` escapes it to `<!--a--&gt;b-->` instead. That does not
+    round-trip either - comments do not decode entities, so the data comes back
+    as `"a--&gt;b"`. Neither library round-trips this; Makiri matches Chrome.
+* The same applies to the children of `style` / `script` / `xmp` / `iframe` /
+  `noembed` / `noframes` / `plaintext`, which the algorithm also writes
+  literally. `noscript` is **escaped**, because Makiri parses it with scripting
+  disabled (its children are elements, not raw text) and escaping is what makes
+  that round-trip; `Nokogiri::HTML5` writes it literally and contradicts its own
+  parser there.
+
 ### Text input (mutation APIs)
 
 * Programmatic string arguments must be **valid UTF-8** (invalid bytes raise

data/Rakefile

@@ -88,7 +88,12 @@ begin
       "--error-limit=no",
       "--trace-children=yes",   # spec processes may fork
       "--undef-value-errors=yes", # the point of this job (ruby_memcheck defaults to =no)
-      "--track-origins=yes",    # report where an uninitialised value came from
+      # Origin tracking (where an uninitialised value came from) roughly DOUBLES
+      # memcheck's run time. It is a diagnostic aid, not a detection capability -
+      # memcheck still reports the uninitialised USE without it - so the frequent
+      # post-merge push gate turns it off (VALGRIND_TRACK_ORIGINS=no) to run in
+      # ~half the time, while the nightly / manual runs keep it on for the backtrace.
+      "--track-origins=#{ENV.fetch('VALGRIND_TRACK_ORIGINS', 'yes')}",
       "--leak-check=no",        # leaks are `rake leaks`' job, not this one
     ],
   )
@@ -96,7 +101,34 @@ begin
   namespace :spec do
     desc "Run the spec suite under Valgrind memcheck (ruby_memcheck; needs the " \
          ":valgrind bundler group and the valgrind binary)"
-    RubyMemcheck::RSpec::RakeTask.new(valgrind: :compile)
+    RubyMemcheck::RSpec::RakeTask.new(valgrind: :compile) do |t|
+      # Let spec_helper skip :slow examples (fail-closed limit tests whose sheer
+      # volume dominates memcheck without adding memory-safety coverage).
+      ENV["VALGRIND"] = "1"
+
+      # Optional sharding for CI wall-clock: with VALGRIND_SHARDS=N (>1) the spec
+      # files are partitioned into N groups and this run does only group
+      # VALGRIND_SHARD_INDEX, so N parallel matrix jobs cover the whole suite in
+      # ~1/N the time WITHOUT dropping any coverage. Files are packed
+      # largest-first onto the currently-lightest shard (greedy LPT by file size,
+      # a proxy for runtime), so the slowest shard - which sets wall-clock - is
+      # balanced rather than left to name order. Deterministic, so every shard
+      # computes the same partition and takes its own index. Default N=1 = the
+      # whole suite (local `rake spec:valgrind`).
+      shards = Integer(ENV.fetch("VALGRIND_SHARDS", "1"))
+      if shards > 1
+        index   = Integer(ENV.fetch("VALGRIND_SHARD_INDEX", "0"))
+        buckets = Array.new(shards) { { load: 0, files: [] } }
+        # sort by (size desc, name) so the packing is fully deterministic across
+        # shards regardless of Array#sort stability.
+        Dir["spec/**/*_spec.rb"].sort_by { |f| [-File.size(f), f] }.each do |f|
+          b = buckets.min_by { |x| x[:load] }
+          b[:files] << f
+          b[:load] += File.size(f)
+        end
+        t.pattern = buckets.fetch(index)[:files]
+      end
+    end
   end
 rescue LoadError
   # ruby_memcheck not installed (optional :valgrind group absent) - skip the task.
@@ -194,6 +226,63 @@ task :sanitize do
   sh(env, "#{FileUtils::RUBY} -S rspec")
 end
 
+# The randomised property checks in spec/invariants/. They are not *_spec.rb, so
+# `rake spec` skips them; they run here and nightly in CI. Each takes
+# [documents] [seed] [html|xml] and is deterministic, so a finding replays.
+INVARIANT_CHECKS = [
+  ["check_ns_reresolve.rb",       %w[]],
+  ["check_import_clone.rb",       %w[]],
+  ["check_tree_invariants.rb",    %w[html xml]],
+  ["check_index_staleness.rb",    %w[html xml]],
+  ["check_serialize_fixpoint.rb", %w[html xml]],
+  ["check_text_input.rb",         nil],           # takes no count
+].freeze
+
+# [[script, argv], ...] for a given document count.
+def invariant_runs(count)
+  INVARIANT_CHECKS.flat_map do |script, backends|
+    path = "spec/invariants/#{script}"
+    next [[path, []]] if backends.nil?
+    next [[path, [count.to_s]]] if backends.empty?
+
+    backends.map { |b| [path, [count.to_s, "20260911", b]] }
+  end
+end
+
+desc "Run the invariant checks (override the document count via INVARIANT_COUNT)"
+task invariants: :compile do
+  count = (ENV["INVARIANT_COUNT"] || 2000).to_i
+  invariant_runs(count).each do |script, argv|
+    sh "#{FileUtils::RUBY} -Ilib #{script} #{argv.join(' ')}"
+  end
+end
+
+desc "Run the invariant checks under AddressSanitizer + UBSan (the text index " \
+     "holds borrowed slices, so staleness there is a memory bug too)"
+task "invariants:sanitize" do
+  sanitize = ENV["MAKIRI_SANITIZE"] || "address,undefined"
+  sh({ "MAKIRI_SANITIZE" => sanitize }, "#{FileUtils::RUBY} -S rake clean compile")
+
+  env = {
+    "ASAN_OPTIONS"  => "detect_leaks=0:detect_container_overflow=0:" \
+                       "detect_odr_violation=0:abort_on_error=1:halt_on_error=1",
+    "UBSAN_OPTIONS" => "print_stacktrace=1:halt_on_error=1",
+  }
+  if sanitize.include?("address")
+    runtime = asan_runtime_path or
+      abort "invariants:sanitize: could not locate the ASan runtime for #{RbConfig::CONFIG['CC']}"
+    preload = RbConfig::CONFIG["target_os"] =~ /darwin/ ? "DYLD_INSERT_LIBRARIES" : "LD_PRELOAD"
+    env[preload] = runtime
+    puts "invariants:sanitize: preloading #{runtime} via #{preload}"
+  end
+
+  # Instrumented builds are slow; a smaller sweep still exercises every path.
+  count = (ENV["INVARIANT_COUNT"] || 500).to_i
+  invariant_runs(count).each do |script, argv|
+    sh(env, "#{FileUtils::RUBY} -Ilib #{script} #{argv.join(' ')}")
+  end
+end
+
 desc "Measure C coverage of OUR sources (clang source-based) over the spec suite. " \
      "Prints an llvm-cov region+branch report (excludes vendored Lexbor) and writes " \
      "a line-level detail file to tmp/coverage/show.txt."

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.7.0"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.9.0
 platform: aarch64-linux
 authors:
 - takahashim