makiri 0.8.0-aarch64-linux → 0.9.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04cb87cd8a88d6c9ba3906801a76ddf05c81ccd8493198696a79df0d2c7a60ee
-  data.tar.gz: d00b6a2afd7c3b59bfb8b1bcd01bd453339af3218d481eaa1fff4fd70d20b305
+  metadata.gz: 73e114eace5001084f191b87a1608364858d5696d79bc2f1b950aea2c7806ec4
+  data.tar.gz: 2ecdd8274159bf93573f08d47462aa69470104f4a188c4731ba36cf33efba0cb
 SHA512:
-  metadata.gz: 5d7e1303bda0a53db24ddeeec938f69449b2a28df8393cf2fda03942f3d35a92b9dba31a37c7247070c934f864436a53488cd1454f26af35400d428b0bc331a5
-  data.tar.gz: d164a159fecf71c9c8c24f588aeae7ba4ddebe2bb6c30d49de600c89ce871d91e2b8e0caa584f79a62d6e42289ffde60944d3c5c4630d4bddb89aa17191d8851
+  metadata.gz: 115fd4af76231a9ca4373927ee763f658b01011f5cb244befda840274789629b582267f5798e83bccdb5add73c05156281ffe49461a3abbf311af19f99e9243e
+  data.tar.gz: 976aad3964d2993a31167d01d719fe9c6d5ea762560c5e00430c19e2b6c1cb35fa0a5d8cd594e377749bcdbb4704bfaa7c401f2d986f65e3dca066409cf79c3b

data/.github/workflows/security.yml

@@ -157,6 +157,55 @@ jobs:
   # poisoning on), catching intra-arena overflows that a plain ASan build cannot
   # see - the class the v3.0.0 :lexbor-contains overflow belonged to. Heavy
   # (full instrumented Lexbor rebuild), so nightly only.
+  # The randomised property checks (spec/invariants/). Cheap enough to gate a PR
+  # on, so they run on every push; the ASan pass is nightly because an
+  # instrumented build is slow.
+  invariants:
+    name: Invariant checks
+    runs-on: ubuntu-latest
+    if: github.event_name != 'schedule'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Run the invariant checks
+        run: bundle exec rake invariants
+
+  invariants-sanitize:
+    name: Nightly invariant checks under ASan + UBSan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # The text index hands out borrowed slices, so a stale one is a memory bug
+      # as much as a wrong answer - this is the pass that would see it.
+      - name: Run the invariant checks under sanitizers
+        run: bundle exec rake "invariants:sanitize"
+
   security-sanitize-lexbor:
     name: Nightly instrumented-Lexbor ASan suite
     runs-on: ubuntu-latest

data/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## [0.9.0] - 2026-09-11
+
+### Added
+
+* `Node#attribute_by_qualified_name(name)` and
+  `Node#attribute_value_by_qualified_name(name)`: the attribute whose
+  **qualified** name is exactly `name` — its node, and its value — or nil.
+  `#[]` cannot answer this: it also finds a prefixed attribute by its local
+  name (`svg_a["href"]` returns `xlink:href`), and it lower-cases what it looks
+  up (`el["DATA-X"]` finds `data-x`). The new match is byte-exact.
+
+### Changed
+
+* **`Makiri::XML` follows the DOM namespace model.** A node's namespace URI is
+  decided once — by the parser, or by the context it is first inserted into —
+  and does not change afterwards; the serializer emits whatever xmlns
+  declarations the output needs:
+
+  - moving a node under an element that binds its prefix to a different URI
+    keeps `namespace_uri`, and the output declares the prefix at the moved node;
+  - inserting a node whose prefix is bound nowhere in the destination now
+    succeeds instead of raising;
+  - `import_node` keeps the namespace of what it copied;
+  - an element in no namespace stays in no namespace under a default namespace,
+    serialized as `xmlns=""`;
+  - `#to_xml` on a node below the root declares the prefixes its subtree uses,
+    so the output re-parses to the same namespaces standing alone.
+
+  Nodes from the factories (`create_element` and friends) still take their
+  namespace from the context they are first inserted into.
+
+* **Inserting a node from another document adopts it.** `add_child` / `before` /
+  `after` / `replace` bring the node over and remove it from the document it
+  came from, instead of copying it (`Makiri::XML`) or raising (`Makiri::HTML`).
+  A spliced fragment is left empty; a rejected insert leaves the source
+  document untouched.
+
+  The node handed back is a **different object** than the one passed in, so use
+  the return value afterwards rather than the argument. `Document#import_node`
+  is unchanged: it copies and leaves the source alone.
+
+* **XML serialization is capped at the nesting depth the parser accepts.**
+  `#to_xml` and `#canonicalize` raise `Makiri::Error` past it, rather than
+  emitting XML that Makiri could not read back. A deeper tree is still fine to
+  hold, walk and query.
+
+### Fixed
+
+* XPath axes from an **attribute** context node on the XML backend now follow
+  XPath 1.0 §2.2: `following-sibling` and `preceding-sibling` are empty, and
+  `following` / `preceding` exclude attribute nodes. They used to return the
+  element's later attributes.
+
+* A rejected insert no longer leaves part of the moved subtree carrying
+  namespace URIs resolved against the scope it was refused from.
+
 ## [0.8.0] - 2026-07-12
 
 ### Fixed

data/README.md

@@ -110,7 +110,9 @@ doc.css("feed > entry").map { |e| e.at_css("title").text }  # => ["Hello", "Worl
 
 # Serialize back to XML
 doc.to_xml                                 # => "<?xml version=\"1.0\"?>\n<feed ...>...</feed>\n"
-doc.at_xpath("//a:entry", ns).to_xml       # => "<entry><title>Hello</title></entry>" (no declaration)
+# A node below the root serializes self-contained: no XML declaration, but the
+# namespace declarations its subtree needs, so the output re-parses the same.
+doc.at_xpath("//a:entry", ns).to_xml       # => "<entry xmlns=\"http://www.w3.org/2005/Atom\"><title>Hello</title></entry>"
 doc.to_xml(pretty: true)                   # indented, element-only content
 
 # DOCTYPE is recognized but the DTD is not processed (no entities, no I/O):
@@ -138,8 +140,11 @@ doc.root.to_xml           # => "<feed xmlns:dc=\"urn:dc\"><post dc:k=\"v\">Bye</
 ```
 
 XML subtrees can be built with `Document#create_element` and related node factory methods,
-then inserted with `#add_child`, `#before`, `#after`, or `#replace`;
-namespaces are resolved at insertion time, and cross-document nodes are deep-copied.
+then inserted with `#add_child`, `#before`, `#after`, or `#replace`. A factory-built
+node takes its namespace from the context it is first inserted into; one that already
+has a namespace keeps it. A node from another document is **adopted** — brought over
+and removed from the document it came from — and the method returns the node now in
+the tree, which is a different object than the one passed in.
 
 `Document#import_node(node, deep = false)` brings a node into a document as a
 detached copy, and works **across representations**: importing a `Makiri::HTML`
@@ -240,6 +245,34 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
     (QNames), never PI targets. Nokogiri/libxml2 rejects it (`colons are forbidden
     from PI names`); Makiri follows the normative text. Only the reserved `xml`
     (any case) target is rejected.
+* A node's **namespace URI is its identity**, not something re-derived from the
+  declarations around it - the WHATWG DOM model, measured against Chrome 152
+  (`DOMParser` + `XMLSerializer`).
+  * Moving a node under an element that binds its prefix to a different URI does
+    **not** change `namespace_uri`; the serializer emits the declaration the
+    output needs (`<p:x xmlns:p="urn:a"/>`), and nothing when the destination
+    already agrees. libxml2 keeps the URI on an in-document move but does *not*
+    emit the declaration, so Nokogiri's tree and its own output disagree there.
+  * `#to_xml` on a node below the root is **self-contained**: it declares the
+    prefixes its subtree uses, so the output re-parses to the same namespaces
+    standing alone. Nokogiri omits them, and its subtree output does not
+    round-trip.
+  * Where one prefix would have to mean two things at once, the serializer
+    invents one (`ns1`, `ns2`, ...) rather than shadow the other, as browsers do.
+  * An element in **no** namespace stays that way under a default namespace,
+    serialized as `xmlns=""`.
+  * Nodes from the factories (`create_element` and friends) still take their
+    namespace from the context they are first inserted into, so a subtree can be
+    built detached and attached afterwards. Only later moves carry.
+* Inserting a node **from another document adopts it** (`add_child` / `before` /
+  `after` / `replace`): it is brought over and taken out of the document it came
+  from, as `appendChild` does in the DOM and in both Chrome and Nokogiri.
+  * Each arena owns its own nodes, so the node cannot be relinked across them: it
+    is copied here and removed there. The one visible difference from Nokogiri
+    and browsers is that the node handed back is a **different object** than the
+    one passed in - use the return value afterwards, not the argument.
+  * `Document#import_node` is the copy: it leaves the source alone, like DOM
+    `importNode`.
 * Otherwise the parsed tree is byte-identical to `Nokogiri::XML`'s (verified by
   the property-based differential), including namespaces, prolog/epilog comments
   and PIs, and adjacent-CDATA coalescing.
@@ -267,6 +300,21 @@ Detailed, test-backed notes live in `spec/conformance/README.md`.
 * Type selectors are ASCII case-insensitive (CSS-correct for HTML; `LI` matches `<li>`)
   * `Nokogiri::HTML5` is case-sensitive there.
 
+### Serialization
+
+* **Comment data is written literally**, as the WHATWG serialization algorithm
+  says and as browsers do: `comment.content = "a-->b"` serializes to
+  `<!--a-->b-->`, which re-parses as the comment `"a"` followed by text.
+  * `Nokogiri::HTML5` escapes it to `<!--a--&gt;b-->` instead. That does not
+    round-trip either - comments do not decode entities, so the data comes back
+    as `"a--&gt;b"`. Neither library round-trips this; Makiri matches Chrome.
+* The same applies to the children of `style` / `script` / `xmp` / `iframe` /
+  `noembed` / `noframes` / `plaintext`, which the algorithm also writes
+  literally. `noscript` is **escaped**, because Makiri parses it with scripting
+  disabled (its children are elements, not raw text) and escaping is what makes
+  that round-trip; `Nokogiri::HTML5` writes it literally and contradicts its own
+  parser there.
+
 ### Text input (mutation APIs)
 
 * Programmatic string arguments must be **valid UTF-8** (invalid bytes raise

data/Rakefile

@@ -226,6 +226,63 @@ task :sanitize do
   sh(env, "#{FileUtils::RUBY} -S rspec")
 end
 
+# The randomised property checks in spec/invariants/. They are not *_spec.rb, so
+# `rake spec` skips them; they run here and nightly in CI. Each takes
+# [documents] [seed] [html|xml] and is deterministic, so a finding replays.
+INVARIANT_CHECKS = [
+  ["check_ns_reresolve.rb",       %w[]],
+  ["check_import_clone.rb",       %w[]],
+  ["check_tree_invariants.rb",    %w[html xml]],
+  ["check_index_staleness.rb",    %w[html xml]],
+  ["check_serialize_fixpoint.rb", %w[html xml]],
+  ["check_text_input.rb",         nil],           # takes no count
+].freeze
+
+# [[script, argv], ...] for a given document count.
+def invariant_runs(count)
+  INVARIANT_CHECKS.flat_map do |script, backends|
+    path = "spec/invariants/#{script}"
+    next [[path, []]] if backends.nil?
+    next [[path, [count.to_s]]] if backends.empty?
+
+    backends.map { |b| [path, [count.to_s, "20260911", b]] }
+  end
+end
+
+desc "Run the invariant checks (override the document count via INVARIANT_COUNT)"
+task invariants: :compile do
+  count = (ENV["INVARIANT_COUNT"] || 2000).to_i
+  invariant_runs(count).each do |script, argv|
+    sh "#{FileUtils::RUBY} -Ilib #{script} #{argv.join(' ')}"
+  end
+end
+
+desc "Run the invariant checks under AddressSanitizer + UBSan (the text index " \
+     "holds borrowed slices, so staleness there is a memory bug too)"
+task "invariants:sanitize" do
+  sanitize = ENV["MAKIRI_SANITIZE"] || "address,undefined"
+  sh({ "MAKIRI_SANITIZE" => sanitize }, "#{FileUtils::RUBY} -S rake clean compile")
+
+  env = {
+    "ASAN_OPTIONS"  => "detect_leaks=0:detect_container_overflow=0:" \
+                       "detect_odr_violation=0:abort_on_error=1:halt_on_error=1",
+    "UBSAN_OPTIONS" => "print_stacktrace=1:halt_on_error=1",
+  }
+  if sanitize.include?("address")
+    runtime = asan_runtime_path or
+      abort "invariants:sanitize: could not locate the ASan runtime for #{RbConfig::CONFIG['CC']}"
+    preload = RbConfig::CONFIG["target_os"] =~ /darwin/ ? "DYLD_INSERT_LIBRARIES" : "LD_PRELOAD"
+    env[preload] = runtime
+    puts "invariants:sanitize: preloading #{runtime} via #{preload}"
+  end
+
+  # Instrumented builds are slow; a smaller sweep still exercises every path.
+  count = (ENV["INVARIANT_COUNT"] || 500).to_i
+  invariant_runs(count).each do |script, argv|
+    sh(env, "#{FileUtils::RUBY} -Ilib #{script} #{argv.join(' ')}")
+  end
+end
+
 desc "Measure C coverage of OUR sources (clang source-based) over the spec suite. " \
      "Prints an llvm-cov region+branch report (excludes vendored Lexbor) and writes " \
      "a line-level detail file to tmp/coverage/show.txt."

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.8.0"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: aarch64-linux
 authors:
 - takahashim