nokogiri 1.19.4-java → 1.19.5-java

data/ext/nokogiri/xml_sax_parser_context.c

@@ -4,10 +4,25 @@ VALUE cNokogiriXmlSaxParserContext ;
 
 static ID id_read;
 
+typedef struct {
+  xmlParserCtxtPtr ctxt;
+  VALUE rb_input;
+} nokogiriSaxParserContextTuple;
+
+static void
+_noko_xml_sax_parser_context_mark(void *data)
+{
+  nokogiriSaxParserContextTuple *tuple = data;
+  /* Pin the input because libxml2 retains the IO callback's Ruby handle. */
+  rb_gc_mark(tuple->rb_input);
+}
+
 static void
 xml_sax_parser_context_type_free(void *data)
 {
-  xmlParserCtxtPtr ctxt = data;
+  nokogiriSaxParserContextTuple *tuple = data;
+  xmlParserCtxtPtr ctxt = tuple->ctxt;
+
   ctxt->sax = NULL;
   if (ctxt->myDoc) {
     xmlFreeDoc(ctxt->myDoc);
@@ -15,6 +30,7 @@ xml_sax_parser_context_type_free(void *data)
   if (ctxt) {
     xmlFreeParserCtxt(ctxt);
   }
+  ruby_xfree(tuple);
 }
 
 /*
@@ -24,6 +40,7 @@ xml_sax_parser_context_type_free(void *data)
 static const rb_data_type_t xml_sax_parser_context_type = {
   .wrap_struct_name = "xmlParserCtxt",
   .function = {
+    .dmark = _noko_xml_sax_parser_context_mark,
     .dfree = xml_sax_parser_context_type_free,
   },
   .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
@@ -32,15 +49,29 @@ static const rb_data_type_t xml_sax_parser_context_type = {
 xmlParserCtxtPtr
 noko_xml_sax_parser_context_unwrap(VALUE rb_context)
 {
-  xmlParserCtxtPtr c_context;
-  TypedData_Get_Struct(rb_context, xmlParserCtxt, &xml_sax_parser_context_type, c_context);
-  return c_context;
+  nokogiriSaxParserContextTuple *tuple;
+  TypedData_Get_Struct(rb_context, nokogiriSaxParserContextTuple, &xml_sax_parser_context_type, tuple);
+  return tuple->ctxt;
 }
 
 VALUE
 noko_xml_sax_parser_context_wrap(VALUE klass, xmlParserCtxtPtr c_context)
 {
-  return TypedData_Wrap_Struct(klass, &xml_sax_parser_context_type, c_context);
+  nokogiriSaxParserContextTuple *tuple;
+  VALUE rb_context = TypedData_Make_Struct(klass, nokogiriSaxParserContextTuple, &xml_sax_parser_context_type, tuple);
+
+  tuple->ctxt = c_context;
+  tuple->rb_input = Qnil;
+
+  return rb_context;
+}
+
+static void
+_noko_xml_sax_parser_context_set_input(VALUE rb_context, VALUE rb_input)
+{
+  nokogiriSaxParserContextTuple *tuple;
+  TypedData_Get_Struct(rb_context, nokogiriSaxParserContextTuple, &xml_sax_parser_context_type, tuple);
+  RB_OBJ_WRITE(rb_context, &tuple->rb_input, rb_input);
 }
 
 void
@@ -103,7 +134,7 @@ noko_xml_sax_parser_context_s_native_io(VALUE rb_class, VALUE rb_io, VALUE rb_en
   }
 
   VALUE rb_context = noko_xml_sax_parser_context_wrap(rb_class, c_context);
-  rb_iv_set(rb_context, "@input", rb_io);
+  _noko_xml_sax_parser_context_set_input(rb_context, rb_io);
 
   return rb_context;
 }
@@ -158,7 +189,7 @@ noko_xml_sax_parser_context_s_native_memory(VALUE rb_class, VALUE rb_input, VALU
   }
 
   VALUE rb_context = noko_xml_sax_parser_context_wrap(rb_class, c_context);
-  rb_iv_set(rb_context, "@input", rb_input);
+  _noko_xml_sax_parser_context_set_input(rb_context, rb_input);
 
   return rb_context;
 }

data/ext/nokogiri/xml_sax_push_parser.c

@@ -14,10 +14,22 @@ xml_sax_push_parser_free(void *data)
   }
 }
 
+/* The @sax_parser ivar marks the parser; libxml2 also retains its movable VALUE in _private. */
+static void
+_noko_xml_sax_push_parser_update_references(void *data)
+{
+  xmlParserCtxtPtr ctx = data;
+
+  if (ctx->_private) {
+    ctx->_private = (void *)rb_gc_location((VALUE)ctx->_private);
+  }
+}
+
 static const rb_data_type_t xml_sax_push_parser_type = {
   .wrap_struct_name = "xmlParserCtxt",
   .function = {
     .dfree = xml_sax_push_parser_free,
+    .dcompact = _noko_xml_sax_push_parser_update_references,
   },
   .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
 };

data/ext/nokogiri/xml_xpath_context.c

@@ -231,6 +231,7 @@ Nokogiri_marshal_xpath_funcall_and_return_values(
 {
   VALUE rb_retval;
   VALUE *argv;
+  VALUE argv_handle;
   VALUE rb_node_set = Qnil;
   xmlNodeSetPtr c_node_set = NULL;
   xmlXPathObjectPtr c_xpath_object;
@@ -238,10 +239,7 @@ Nokogiri_marshal_xpath_funcall_and_return_values(
   assert(ctxt->context->doc);
   assert(DOC_RUBY_OBJECT_TEST(ctxt->context->doc));
 
-  argv = (VALUE *)ruby_xcalloc((size_t)argc, sizeof(VALUE));
-  for (int j = 0 ; j < argc ; ++j) {
-    rb_gc_register_address(&argv[j]);
-  }
+  argv = ALLOCV_N(VALUE, argv_handle, argc);
 
   for (int j = argc - 1 ; j >= 0 ; --j) {
     c_xpath_object = valuePop(ctxt);
@@ -259,10 +257,7 @@ Nokogiri_marshal_xpath_funcall_and_return_values(
                 argv
               );
 
-  for (int j = 0 ; j < argc ; ++j) {
-    rb_gc_unregister_address(&argv[j]);
-  }
-  ruby_xfree(argv);
+  ALLOCV_END(argv_handle);
 
   switch (TYPE(rb_retval)) {
     case T_FLOAT:
@@ -300,37 +295,116 @@ Nokogiri_marshal_xpath_funcall_and_return_values(
   }
 }
 
+/*
+ * A Ruby exception must not unwind through libxml2's stack frames, because that skips libxml2's
+ * cleanup and leaks memory. So the handler is called under rb_protect, and the exception is
+ * re-raised after xmlXPathEvalExpression returns.
+ *
+ * Until then, no Ruby code may run: the pending exception lives only in the thread's errinfo,
+ * which a rescue elsewhere would overwrite.
+ */
+typedef struct {
+  VALUE handler;
+  int exception_state;
+} _noko_xml_xpath_context__handler_call_t;
+
+typedef struct {
+  VALUE handler;
+  const xmlChar *name;
+  const xmlChar *ns_uri;
+} _noko_xml_xpath_context__lookup_args_t;
+
+typedef struct {
+  xmlXPathParserContextPtr ctxt;
+  int argc;
+} _noko_xml_xpath_context__invoke_args_t;
+
+PRINTFLIKE_DECL(2, 3)
+static void
+_noko_xml_xpath_context__ignore_error(void *data, const char *msg, ...)
+{
+}
+
+static void
+_noko_xml_xpath_context__abort_evaluation(xmlXPathParserContextPtr ctxt)
+{
+  /* silence the error that some libxml2 versions report, which would run Ruby code */
+  xmlSetStructuredErrorFunc(NULL, NULL);
+  xmlSetGenericErrorFunc(NULL, _noko_xml_xpath_context__ignore_error);
+
+  ctxt->error = XPATH_EXPR_ERROR;
+}
+
+static VALUE
+_noko_xml_xpath_context__invoke_handler(VALUE data)
+{
+  _noko_xml_xpath_context__invoke_args_t *args = (_noko_xml_xpath_context__invoke_args_t *)data;
+  _noko_xml_xpath_context__handler_call_t *handler_call = args->ctxt->context->userData;
+
+  Nokogiri_marshal_xpath_funcall_and_return_values(
+    args->ctxt,
+    args->argc,
+    handler_call->handler,
+    (const char *)(args->ctxt->context->function)
+  );
+
+  return Qnil;
+}
+
 static void
 _noko_xml_xpath_context__handler_invoker(xmlXPathParserContextPtr ctxt, int argc)
 {
-  VALUE rb_xpath_handler = Qnil;
-  const char *method_name = NULL ;
+  _noko_xml_xpath_context__handler_call_t *handler_call;
+  _noko_xml_xpath_context__invoke_args_t args = { ctxt, argc };
 
   assert(ctxt);
   assert(ctxt->context);
   assert(ctxt->context->userData);
   assert(ctxt->context->function);
 
-  rb_xpath_handler = (VALUE)(ctxt->context->userData);
-  method_name = (const char *)(ctxt->context->function);
+  handler_call = ctxt->context->userData;
 
-  Nokogiri_marshal_xpath_funcall_and_return_values(
-    ctxt,
-    argc,
-    rb_xpath_handler,
-    method_name
-  );
+  if (handler_call->exception_state == 0) {
+    rb_protect(_noko_xml_xpath_context__invoke_handler, (VALUE)&args, &handler_call->exception_state);
+  }
+
+  if (handler_call->exception_state != 0) {
+    _noko_xml_xpath_context__abort_evaluation(ctxt);
+  }
 }
 
-static xmlXPathFunction
-_noko_xml_xpath_context_handler_lookup(void *data, const xmlChar *c_name, const xmlChar *c_ns_uri)
+static VALUE
+_noko_xml_xpath_context__handler_responds_to(VALUE data)
 {
-  VALUE rb_handler = (VALUE)data;
-  if (rb_respond_to(rb_handler, rb_intern((const char *)c_name))) {
-    if (c_ns_uri == NULL) {
+  _noko_xml_xpath_context__lookup_args_t *args = (_noko_xml_xpath_context__lookup_args_t *)data;
+
+  if (rb_respond_to(args->handler, rb_intern((const char *)args->name))) {
+    if (args->ns_uri == NULL) {
       NOKO_WARN_DEPRECATION("A custom XPath or CSS handler function named '%s' is being invoked without a namespace. Please update your query to reference this function as 'nokogiri:%s'. Invoking custom handler functions without a namespace is deprecated and will become an error in Nokogiri v1.17.0.",
-                            c_name, c_name); // TODO deprecated in v1.15.0, remove in v1.19.0
+                            args->name, args->name); // TODO deprecated in v1.15.0, remove in v1.19.0
     }
+    return Qtrue;
+  }
+
+  return Qfalse;
+}
+
+static xmlXPathFunction
+_noko_xml_xpath_context_handler_lookup(void *data, const xmlChar *c_name, const xmlChar *c_ns_uri)
+{
+  _noko_xml_xpath_context__handler_call_t *handler_call = data;
+  _noko_xml_xpath_context__lookup_args_t args = { handler_call->handler, c_name, c_ns_uri };
+  VALUE responds_to = Qfalse;
+
+  if (handler_call->exception_state == 0) {
+    responds_to = rb_protect(_noko_xml_xpath_context__handler_responds_to, (VALUE)&args, &handler_call->exception_state);
+  }
+
+  /*
+   * After an exception, return the invoker anyway, so that it aborts the evaluation. Returning NULL
+   * would make libxml2 fall back to its own functions, or report an unknown function.
+   */
+  if (handler_call->exception_state != 0 || RTEST(responds_to)) {
     return _noko_xml_xpath_context__handler_invoker;
   }
 
@@ -381,6 +455,8 @@ noko_xml_xpath_context_evaluate(int argc, VALUE *argv, VALUE rb_context)
   VALUE rb_errors = rb_ary_new();
   xmlXPathObjectPtr c_xpath_object;
   VALUE rb_xpath_object = Qnil;
+  _noko_xml_xpath_context__handler_call_t handler_call = { Qnil, 0 };
+  void *previous_user_data;
 
   TypedData_Get_Struct(rb_context, xmlXPathContext, &_noko_xml_xpath_context_type, c_context);
 
@@ -388,13 +464,17 @@ noko_xml_xpath_context_evaluate(int argc, VALUE *argv, VALUE rb_context)
 
   c_expression_str = (xmlChar *)StringValueCStr(rb_expression);
 
+  /* restored afterwards, because a handler may call evaluate re-entrantly on this context */
+  previous_user_data = c_context->userData;
+
   if (Qnil != rb_function_lookup_handler) {
+    handler_call.handler = rb_function_lookup_handler;
     /* FIXME: not sure if this is the correct place to shove private data. */
-    c_context->userData = (void *)rb_function_lookup_handler;
+    c_context->userData = &handler_call;
     xmlXPathRegisterFuncLookup(
       c_context,
       _noko_xml_xpath_context_handler_lookup,
-      (void *)rb_function_lookup_handler
+      &handler_call
     );
   }
 
@@ -408,6 +488,12 @@ noko_xml_xpath_context_evaluate(int argc, VALUE *argv, VALUE rb_context)
   xmlSetGenericErrorFunc(NULL, NULL);
 
   xmlXPathRegisterFuncLookup(c_context, NULL, NULL);
+  c_context->userData = previous_user_data;
+
+  if (handler_call.exception_state != 0) {
+    xmlXPathFreeObject(c_xpath_object);
+    rb_jump_tag(handler_call.exception_state);
+  }
 
   if (c_xpath_object == NULL) {
     rb_exc_raise(rb_ary_entry(rb_errors, 0));
@@ -436,6 +522,12 @@ noko_xml_xpath_context_new(VALUE klass, VALUE rb_node)
   xmlXPathContextPtr c_context;
   VALUE rb_context;
 
+  if (!rb_obj_is_kind_of(rb_node, cNokogiriXmlNode)) {
+    rb_raise(rb_eTypeError,
+             "expected a Nokogiri::XML::Node, received %"PRIsVALUE,
+             rb_obj_class(rb_node));
+  }
+
   Noko_Node_Get_Struct(rb_node, xmlNode, c_node);
 
 #if LIBXML_VERSION < 21000
@@ -468,6 +560,12 @@ noko_xml_xpath_context_set_node(VALUE rb_context, VALUE rb_node)
   xmlNodePtr c_node;
   xmlXPathContextPtr c_context;
 
+  if (!rb_obj_is_kind_of(rb_node, cNokogiriXmlNode)) {
+    rb_raise(rb_eTypeError,
+             "expected a Nokogiri::XML::Node, received %"PRIsVALUE,
+             rb_obj_class(rb_node));
+  }
+
   TypedData_Get_Struct(rb_context, xmlXPathContext, &_noko_xml_xpath_context_type, c_context);
   Noko_Node_Get_Struct(rb_node, xmlNode, c_node);
 

data/ext/nokogiri/xslt_stylesheet.c

@@ -6,7 +6,19 @@ static void
 mark(void *data)
 {
   nokogiriXsltStylesheetTuple *wrapper = (nokogiriXsltStylesheetTuple *)data;
+  long i;
+
+  /* GC can run while Nokogiri_wrap_xslt_stylesheet allocates func_instances. */
+  if (!RB_TYPE_P(wrapper->func_instances, T_ARRAY)) {
+    return;
+  }
+
   rb_gc_mark(wrapper->func_instances);
+
+  /* libxslt retains each extension handler instance's movable VALUE as module data. */
+  for (i = 0; i < RARRAY_LEN(wrapper->func_instances); i++) {
+    rb_gc_mark(RARRAY_AREF(wrapper->func_instances, i));
+  }
 }
 
 static void
@@ -18,11 +30,23 @@ dealloc(void *data)
   ruby_xfree(wrapper);
 }
 
+/* libxslt retains this Stylesheet's own movable VALUE in _private. */
+static void
+update_references(void *data)
+{
+  nokogiriXsltStylesheetTuple *wrapper = (nokogiriXsltStylesheetTuple *)data;
+
+  if (wrapper->ss && wrapper->ss->_private) {
+    wrapper->ss->_private = (void *)rb_gc_location((VALUE)wrapper->ss->_private);
+  }
+}
+
 static const rb_data_type_t nokogiri_xslt_stylesheet_tuple_type = {
   .wrap_struct_name = "nokogiriXsltStylesheetTuple",
   .function = {
     .dmark = mark,
     .dfree = dealloc,
+    .dcompact = update_references,
   },
   .flags = RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -47,6 +71,29 @@ xslt_generic_error_handler(void *ctx, const char *msg, ...)
   rb_str_concat((VALUE)ctx, message);
 }
 
+PRINTFLIKE_DECL(2, 3)
+static void
+ignore_error(void *ctx, const char *msg, ...)
+{
+}
+
+/*
+ * A Ruby exception must not unwind through libxslt's stack frames, because that skips libxslt's
+ * cleanup and leaks memory, and skips the reset of the error handlers. So an extension function is
+ * called under rb_protect, and the exception is re-raised after the transform returns.
+ *
+ * Until then, no Ruby code may run: the pending exception lives only in the thread's errinfo,
+ * which a rescue elsewhere would overwrite.
+ */
+typedef struct {
+  int exception_state;
+} _noko_xslt_stylesheet__function_call_t;
+
+typedef struct {
+  xmlXPathParserContextPtr ctxt;
+  int nargs;
+} _noko_xslt_stylesheet__invoke_args_t;
+
 VALUE
 Nokogiri_wrap_xslt_stylesheet(xsltStylesheetPtr ss)
 {
@@ -137,15 +184,14 @@ rb_xslt_stylesheet_serialize(VALUE self, VALUE xmlobj)
 /*
  * Build the C-string params array passed to xsltApplyStylesheet.
  *
- * Note: params[j] is a raw pointer into a Ruby string's buffer, and we do not pin the underlying
- * VALUEs against GC compaction. This is safe (despite not pinning the VALUEs) because libxslt fully
- * processes params (interning names, evaluating values) before template execution begins, and Ruby
- * callbacks can only run during template execution. By the time GC compaction is reachable, libxslt
- * no longer reads params[].
+ * Note: params[j] is a copy of the Ruby string's bytes, not a pointer into its buffer, because GC
+ * compaction moves the bytes of short strings that are embedded in their object slots. Compaction
+ * can run during a #to_str conversion in this loop and, when libxml2 uses Ruby's allocator, during
+ * libxslt's own allocations. Free params with free_xslt_params.
  */
 typedef struct {
   VALUE rb_param;
-  long param_len;
+  rb_len_t param_len;
   const char **params;
 } build_xslt_params_args_t;
 
@@ -154,14 +200,23 @@ build_xslt_params(VALUE args_ptr)
 {
   build_xslt_params_args_t *args = (build_xslt_params_args_t *)args_ptr;
 
-  for (long j = 0; j < args->param_len; j++) {
+  for (rb_len_t j = 0; j < args->param_len; j++) {
     VALUE entry = rb_ary_entry(args->rb_param, j);
-    args->params[j] = StringValueCStr(entry);
+    args->params[j] = ruby_strdup(StringValueCStr(entry));
   }
 
   return Qnil;
 }
 
+static void
+free_xslt_params(const char **params, rb_len_t param_len)
+{
+  for (rb_len_t j = 0; j < param_len; j++) {
+    ruby_xfree((void *)params[j]);
+  }
+  ruby_xfree(params);
+}
+
 /*
  * call-seq:
  *   transform(document)
@@ -283,9 +338,10 @@ rb_xslt_stylesheet_transform(int argc, VALUE *argv, VALUE self)
   xmlDocPtr c_result_document ;
   nokogiriXsltStylesheetTuple *wrapper;
   const char **params ;
-  long param_len ;
+  rb_len_t param_len ;
   int parse_error_occurred ;
   int defensive_copy_p = 0;
+  _noko_xslt_stylesheet__function_call_t function_call = { 0 };
 
   rb_scan_args(argc, argv, "11", &rb_document, &rb_param);
   if (NIL_P(rb_param)) { rb_param = rb_ary_new2(0L) ; }
@@ -314,7 +370,7 @@ rb_xslt_stylesheet_transform(int argc, VALUE *argv, VALUE self)
 
     rb_protect(build_xslt_params, (VALUE)&args, &state);
     if (state) {
-      ruby_xfree(params);
+      free_xslt_params(params, param_len);
       rb_jump_tag(state);
     }
   }
@@ -329,13 +385,24 @@ rb_xslt_stylesheet_transform(int argc, VALUE *argv, VALUE self)
   }
   xsltFreeTransformContext(c_transform_context);
 
+  c_transform_context = xsltNewTransformContext(wrapper->ss, c_document);
+  if (c_transform_context == NULL) {
+    free_xslt_params(params, param_len);
+    if (defensive_copy_p) {
+      xmlFreeDoc(c_document);
+    }
+    rb_raise(rb_eRuntimeError, "could not create an XSLT transform context");
+  }
+  c_transform_context->_private = &function_call;
+
   rb_error_str = rb_str_new(0, 0);
   xsltSetGenericErrorFunc((void *)rb_error_str, xslt_generic_error_handler);
   xmlSetGenericErrorFunc((void *)rb_error_str, xslt_generic_error_handler);
 
-  c_result_document = xsltApplyStylesheet(wrapper->ss, c_document, params);
+  c_result_document = xsltApplyStylesheetUser(wrapper->ss, c_document, params, NULL, NULL, c_transform_context);
+  xsltFreeTransformContext(c_transform_context);
 
-  ruby_xfree(params);
+  free_xslt_params(params, param_len);
   if (defensive_copy_p) {
     xmlFreeDoc(c_document);
     c_document = NULL;
@@ -344,6 +411,11 @@ rb_xslt_stylesheet_transform(int argc, VALUE *argv, VALUE self)
   xsltSetGenericErrorFunc(NULL, NULL);
   xmlSetGenericErrorFunc(NULL, NULL);
 
+  if (function_call.exception_state != 0) {
+    xmlFreeDoc(c_result_document);
+    rb_jump_tag(function_call.exception_state);
+  }
+
   parse_error_occurred = (Qfalse == rb_funcall(rb_error_str, rb_intern("empty?"), 0));
 
   if (parse_error_occurred) {
@@ -353,25 +425,42 @@ rb_xslt_stylesheet_transform(int argc, VALUE *argv, VALUE self)
   return noko_xml_document_wrap((VALUE)0, c_result_document) ;
 }
 
-static void
-method_caller(xmlXPathParserContextPtr ctxt, int nargs)
+static VALUE
+invoke_function(VALUE data)
 {
-  VALUE handler;
-  const char *function_name;
-  xsltTransformContextPtr transform;
-  const xmlChar *functionURI;
-
-  transform = xsltXPathGetTransformContext(ctxt);
-  functionURI = ctxt->context->functionURI;
-  handler = (VALUE)xsltGetExtData(transform, functionURI);
-  function_name = (const char *)(ctxt->context->function);
+  _noko_xslt_stylesheet__invoke_args_t *args = (_noko_xslt_stylesheet__invoke_args_t *)data;
+  xsltTransformContextPtr transform = xsltXPathGetTransformContext(args->ctxt);
+  VALUE handler = (VALUE)xsltGetExtData(transform, args->ctxt->context->functionURI);
 
   Nokogiri_marshal_xpath_funcall_and_return_values(
-    ctxt,
-    nargs,
+    args->ctxt,
+    args->nargs,
     handler,
-    (const char *)function_name
+    (const char *)(args->ctxt->context->function)
   );
+
+  return Qnil;
+}
+
+static void
+method_caller(xmlXPathParserContextPtr ctxt, int nargs)
+{
+  xsltTransformContextPtr transform = xsltXPathGetTransformContext(ctxt);
+  _noko_xslt_stylesheet__function_call_t *function_call = transform->_private;
+  _noko_xslt_stylesheet__invoke_args_t args = { ctxt, nargs };
+
+  if (function_call->exception_state == 0) {
+    rb_protect(invoke_function, (VALUE)&args, &function_call->exception_state);
+  }
+
+  if (function_call->exception_state != 0) {
+    /* silence the errors libxslt reports while it stops, which would run Ruby code */
+    xsltSetGenericErrorFunc(NULL, ignore_error);
+    xmlSetGenericErrorFunc(NULL, ignore_error);
+
+    ctxt->error = XPATH_EXPR_ERROR;
+    transform->state = XSLT_STATE_STOPPED;
+  }
 }
 
 static void *
@@ -412,6 +501,7 @@ shutdownFunc(xsltTransformContextPtr ctxt,
              const xmlChar *uri, void *data)
 {
   nokogiriXsltStylesheetTuple *wrapper;
+  long i;
 
   TypedData_Get_Struct(
     (VALUE)ctxt->style->_private,
@@ -420,7 +510,13 @@ shutdownFunc(xsltTransformContextPtr ctxt,
     wrapper
   );
 
-  rb_ary_clear(wrapper->func_instances);
+  /* Other transform contexts, such as a nested transform's, may still use their instances. */
+  for (i = 0; i < RARRAY_LEN(wrapper->func_instances); i++) {
+    if (RARRAY_AREF(wrapper->func_instances, i) == (VALUE)data) {
+      rb_ary_delete_at(wrapper->func_instances, i);
+      break;
+    }
+  }
 }
 
 /* docstring is in lib/nokogiri/xslt.rb */