ruby2html 2.1.0-java

data/ext/ruby2html/attributes.c

@@ -0,0 +1,200 @@
+/*
+ * Attribute rendering, written straight into the output buffer.
+ *
+ *   nil                 -> omitted
+ *   true / false        -> bare attribute / omitted; data-*, aria-* and the
+ *                          enumerated draggable/spellcheck/contenteditable
+ *                          get "true" / "false" because there the value matters
+ *   Hash                -> expanded: data: { user_id: 1 } -> data-user-id="1"
+ *   Array               -> space-separated tokens, nil/false skipped
+ *   anything else       -> to_s, escaped
+ *
+ * Names are validated rather than escaped: a name containing quotes,
+ * whitespace, = < > or / could inject markup, so it raises ArgumentError.
+ * Nothing is cached: generating is cheaper than hashing the Hash for a cache
+ * lookup, and a cache keyed by #hash can return another hash's attributes.
+ */
+#include "buffer.h"
+
+/* Deeper nesting is a bug (or a self-referencing Hash/Array); refuse it
+ * instead of recursing until the C stack overflows. */
+#define R2H_MAX_NESTING 32
+
+typedef struct {
+    VALUE buf;
+    VALUE prefix; /* name of the enclosing Hash attribute, or Qnil */
+    int depth;
+} attr_ctx;
+
+static void check_nesting(int depth)
+{
+    if (depth > R2H_MAX_NESTING) rb_raise(rb_eArgError, "attributes nested more than %d levels deep", R2H_MAX_NESTING);
+}
+
+static int append_attribute(VALUE key, VALUE value, VALUE data);
+
+static int is_invalid_name_byte(unsigned char c)
+{
+    return c <= ' ' || c == 0x7F || c == '"' || c == '\'' || c == '<' || c == '>' || c == '/' || c == '=';
+}
+
+static VALUE key_to_str(VALUE key)
+{
+    if (SYMBOL_P(key)) return rb_sym2str(key);
+    if (RB_TYPE_P(key, T_STRING)) return key;
+    return rb_obj_as_string(key);
+}
+
+/*
+ * Writes ` name` (or ` prefix-name` with _ turned into -) and returns the
+ * offset of the name within buf so callers can inspect or roll it back.
+ */
+/* Error path only: report the full name as written (`data-x onclick`), like PureRuby. */
+NORETURN(static void raise_invalid_name(const attr_ctx *ctx, VALUE name));
+static void raise_invalid_name(const attr_ctx *ctx, VALUE name)
+{
+    VALUE full = name;
+    if (!NIL_P(ctx->prefix)) {
+        VALUE dashed = rb_funcall(name, rb_intern("tr"), 2, rb_str_new_cstr("_"), rb_str_new_cstr("-"));
+        full = rb_sprintf("%" PRIsVALUE "-%" PRIsVALUE, ctx->prefix, dashed);
+    }
+    rb_raise(rb_eArgError, "invalid attribute name: %+" PRIsVALUE, full);
+}
+
+static long append_name(const attr_ctx *ctx, VALUE key)
+{
+    VALUE name = r2h_utf8_compatible(key_to_str(key));
+    if (name == ctx->buf) name = rb_str_dup(name); /* reserve below may move buf's bytes */
+    const char *src = RSTRING_PTR(name);
+    const long len = RSTRING_LEN(name);
+    const int nested = !NIL_P(ctx->prefix);
+    const long prefix_len = nested ? RSTRING_LEN(ctx->prefix) + 1 : 0;
+
+    if (len == 0) rb_raise(rb_eArgError, "attribute name can't be empty");
+
+    const long start = RSTRING_LEN(ctx->buf) + 1;
+    char *out = r2h_buf_reserve(ctx->buf, 1 + prefix_len + len);
+    *out++ = ' ';
+    if (nested) {
+        memcpy(out, RSTRING_PTR(ctx->prefix), (size_t)(prefix_len - 1));
+        out += prefix_len - 1;
+        *out++ = '-';
+    }
+    for (long i = 0; i < len; i++) {
+        const unsigned char c = (unsigned char)src[i];
+        if (is_invalid_name_byte(c)) {
+            rb_str_set_len(ctx->buf, start - 1);
+            raise_invalid_name(ctx, name);
+        }
+        *out++ = (nested && c == '_') ? '-' : (char)c;
+    }
+    r2h_buf_commit(ctx->buf, out);
+    RB_GC_GUARD(name);
+    return start;
+}
+
+static int has_prefix(const char *name, long len, const char *prefix, long prefix_len)
+{
+    return len >= prefix_len && memcmp(name, prefix, (size_t)prefix_len) == 0;
+}
+
+static int is_named(const char *name, long len, const char *word, long word_len)
+{
+    return len == word_len && memcmp(name, word, (size_t)word_len) == 0;
+}
+
+#define R2H_PREFIX(name, len, lit) has_prefix((name), (len), (lit), (long)(sizeof(lit) - 1))
+#define R2H_NAMED(name, len, lit) is_named((name), (len), (lit), (long)(sizeof(lit) - 1))
+
+/* Attributes whose true/false is a string value rather than presence. */
+static int has_string_boolean(VALUE buf, long start)
+{
+    const char *name = RSTRING_PTR(buf) + start;
+    const long len = RSTRING_LEN(buf) - start;
+
+    return R2H_PREFIX(name, len, "data-") || R2H_PREFIX(name, len, "aria-") ||
+        R2H_NAMED(name, len, "draggable") || R2H_NAMED(name, len, "spellcheck") ||
+        R2H_NAMED(name, len, "contenteditable");
+}
+
+static void append_token_list(VALUE buf, VALUE tokens, int *first, int depth)
+{
+    check_nesting(depth);
+    for (long i = 0; i < RARRAY_LEN(tokens); i++) {
+        VALUE token = RARRAY_AREF(tokens, i);
+
+        if (!RTEST(token)) continue;
+        if (RB_TYPE_P(token, T_ARRAY)) {
+            append_token_list(buf, token, first, depth + 1);
+            continue;
+        }
+        if (!*first) R2H_BUF_CAT_LIT(buf, " ");
+        *first = 0;
+        r2h_append_escaped(buf, SYMBOL_P(token) ? rb_sym2str(token) : rb_obj_as_string(token));
+    }
+}
+
+static void append_value(VALUE buf, VALUE value)
+{
+    R2H_BUF_CAT_LIT(buf, "=\"");
+    switch (rb_type(value)) {
+    case T_STRING:
+        r2h_append_escaped(buf, value);
+        break;
+    case T_SYMBOL:
+        r2h_append_escaped(buf, rb_sym2str(value));
+        break;
+    case T_FIXNUM:
+        r2h_append_long(buf, FIX2LONG(value));
+        break;
+    case T_ARRAY: {
+        int first = 1;
+        append_token_list(buf, value, &first, 1);
+        break;
+    }
+    default:
+        r2h_append_escaped(buf, rb_obj_as_string(value));
+    }
+    R2H_BUF_CAT_LIT(buf, "\"");
+}
+
+static int append_attribute(VALUE key, VALUE value, VALUE data)
+{
+    const attr_ctx *ctx = (const attr_ctx *)data;
+    VALUE buf = ctx->buf;
+
+    if (NIL_P(value)) return ST_CONTINUE;
+
+    const long start = append_name(ctx, key);
+
+    switch (rb_type(value)) {
+    case T_TRUE:
+        if (has_string_boolean(buf, start)) R2H_BUF_CAT_LIT(buf, "=\"true\"");
+        break;
+    case T_FALSE:
+        if (has_string_boolean(buf, start)) {
+            R2H_BUF_CAT_LIT(buf, "=\"false\"");
+        } else {
+            rb_str_set_len(buf, start - 1);
+        }
+        break;
+    case T_HASH: {
+        /* The name just written becomes the prefix of the nested keys. */
+        attr_ctx nested = { buf, rb_str_new(RSTRING_PTR(buf) + start, RSTRING_LEN(buf) - start), ctx->depth + 1 };
+        rb_str_set_len(buf, start - 1);
+        check_nesting(nested.depth);
+        rb_hash_foreach(value, append_attribute, (VALUE)&nested);
+        RB_GC_GUARD(nested.prefix);
+        break;
+    }
+    default:
+        append_value(buf, value);
+    }
+    return ST_CONTINUE;
+}
+
+void r2h_append_attributes(VALUE buf, VALUE attrs)
+{
+    attr_ctx ctx = { buf, Qnil, 0 };
+    rb_hash_foreach(attrs, append_attribute, (VALUE)&ctx);
+}

data/ext/ruby2html/buffer.h

@@ -0,0 +1,43 @@
+#ifndef RUBY2HTML_BUFFER_H
+#define RUBY2HTML_BUFFER_H
+
+#include <string.h>
+#include "ruby2html.h"
+
+/*
+ * Output buffer primitives. Everything is written straight into the
+ * renderer's String: reserve room, memcpy, then commit the new length.
+ */
+
+/*
+ * Returns a write pointer with room for `n` more bytes. Grows at least 2x
+ * because rb_str_modify_expand alone grows to the exact size, which would
+ * make a long render quadratic. Both branches also unshare the string and
+ * clear its coderange, which keeps raw byte writes encoding-correct.
+ */
+static inline char *r2h_buf_reserve(VALUE buf, long n)
+{
+    long len = RSTRING_LEN(buf);
+
+    if ((long)rb_str_capacity(buf) - len < n) {
+        rb_str_modify_expand(buf, n > len ? n : len);
+    } else {
+        rb_str_modify(buf);
+    }
+    return RSTRING_PTR(buf) + len;
+}
+
+static inline void r2h_buf_commit(VALUE buf, const char *end)
+{
+    rb_str_set_len(buf, end - RSTRING_PTR(buf));
+}
+
+/* One libruby call; also grows geometrically and clears the coderange. */
+static inline void r2h_buf_cat(VALUE buf, const char *ptr, long len)
+{
+    rb_str_cat(buf, ptr, len);
+}
+
+#define R2H_BUF_CAT_LIT(buf, lit) r2h_buf_cat((buf), (lit), (long)(sizeof(lit) - 1))
+
+#endif

data/ext/ruby2html/content.c

@@ -0,0 +1,120 @@
+/*
+ * Text content: tag arguments, block return values, #plain and #component.
+ */
+#include "buffer.h"
+
+ID r2h_id_current_output;
+ID r2h_id_html_safe_p;
+static int utf8_index;
+
+/*
+ * The buffer tag methods write UTF-8 bytes into. A binary or US-ASCII
+ * buffer (e.g. a bare String.new swapped in to capture output) is relabelled
+ * UTF-8, as String#<< would do on the first non-ASCII append.
+ */
+VALUE r2h_current_buffer(VALUE self)
+{
+    VALUE buf = rb_ivar_get(self, r2h_id_current_output);
+
+    if (!RB_TYPE_P(buf, T_STRING)) rb_raise(rb_eTypeError, "ruby2html: @current_output must be a String");
+    if (RB_UNLIKELY(ENCODING_GET_INLINED(buf) != utf8_index)) {
+        rb_encoding *enc = rb_enc_get(buf);
+        if (enc != rb_ascii8bit_encoding() && enc != rb_usascii_encoding()) {
+            rb_raise(rb_eEncCompatError, "ruby2html: output buffer must be UTF-8, not %s", rb_enc_name(enc));
+        }
+        rb_enc_associate_index(buf, utf8_index);
+    }
+    return buf;
+}
+
+/* Formats without allocating a String (Integer#to_s would). */
+void r2h_append_long(VALUE buf, long value)
+{
+    char digits[24];
+    char *end = digits + sizeof(digits), *p = end;
+    unsigned long n = value < 0 ? 0UL - (unsigned long)value : (unsigned long)value;
+
+    do {
+        *--p = (char)('0' + n % 10);
+        n /= 10;
+    } while (n);
+    if (value < 0) *--p = '-';
+    r2h_buf_cat(buf, p, end - p);
+}
+
+/* ActiveSupport's html_safe?, false when ActiveSupport isn't loaded. */
+static int is_html_safe(VALUE obj)
+{
+    return rb_respond_to(obj, r2h_id_html_safe_p) && RTEST(rb_funcall(obj, r2h_id_html_safe_p, 0));
+}
+
+/* Escapes obj.to_s unless it is html_safe? (e.g. an ActiveSupport::SafeBuffer). */
+void r2h_append_text(VALUE buf, VALUE obj)
+{
+    switch (rb_type(obj)) {
+    case T_NIL:
+        return;
+    case T_STRING:
+        /*
+         * A plain String is never html_safe?; only subclasses need the call.
+         * rb_obj_class (not RBASIC_CLASS) so a String with a singleton
+         * html_safe? can't spoof safety (matches PureRuby's instance_of?).
+         */
+        if (rb_obj_class(obj) != rb_cString && is_html_safe(obj)) {
+            r2h_append_raw(buf, obj);
+        } else {
+            r2h_append_escaped(buf, obj);
+        }
+        return;
+    case T_SYMBOL:
+        r2h_append_escaped(buf, rb_sym2str(obj));
+        return;
+    case T_FIXNUM:
+        r2h_append_long(buf, FIX2LONG(obj));
+        return;
+    default:
+        if (is_html_safe(obj)) {
+            r2h_append_raw(buf, rb_obj_as_string(obj));
+        } else {
+            r2h_append_escaped(buf, rb_obj_as_string(obj));
+        }
+    }
+}
+
+/*
+ * A block that wrote nothing contributes its return value when that is a
+ * String, Symbol or Numeric (Integer, Float, BigDecimal, Rational, ...):
+ * `td { user.name }`. Anything else, such as the Array returned by
+ * `items.each`, nil or true, is ignored.
+ */
+void r2h_append_block_result(VALUE buf, VALUE result)
+{
+    if (RB_TYPE_P(result, T_STRING) || SYMBOL_P(result) || RB_INTEGER_TYPE_P(result) || RB_FLOAT_TYPE_P(result) ||
+        RTEST(rb_obj_is_kind_of(result, rb_cNumeric))) {
+        r2h_append_text(buf, result);
+    }
+}
+
+/* plain(text): escaped text, or raw when html_safe?. */
+static VALUE native_plain(VALUE self, VALUE text)
+{
+    r2h_append_text(r2h_current_buffer(self), text);
+    return Qnil;
+}
+
+/* component(html): already-rendered markup, appended as is. */
+static VALUE native_component(VALUE self, VALUE html)
+{
+    if (!NIL_P(html)) r2h_append_raw(r2h_current_buffer(self), rb_obj_as_string(html));
+    return Qnil;
+}
+
+void r2h_init_content(VALUE native)
+{
+    r2h_id_current_output = rb_intern("@current_output");
+    r2h_id_html_safe_p = rb_intern("html_safe?");
+    utf8_index = rb_utf8_encindex();
+
+    rb_define_method(native, "plain", native_plain, 1);
+    rb_define_method(native, "component", native_component, 1);
+}

data/ext/ruby2html/extconf.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# Builds Ruby2html::Native. When it can't or shouldn't be built, writes a
+# Makefile that does nothing so `gem install` still succeeds; the gem then
+# runs on its pure-Ruby renderer (see Ruby2html.native?).
+
+def skip_native_extension(reason)
+  warn "ruby2html: #{reason}; the pure-Ruby renderer will be used"
+  File.write('Makefile', "all:\n\ninstall:\n\nclean:\n\ndistclean:\n")
+  exit
+end
+
+skip_native_extension('RUBY2HTML_DISABLE_EXT=1') if ENV['RUBY2HTML_DISABLE_EXT'] == '1'
+skip_native_extension('JRuby does not load C extensions') if RUBY_ENGINE == 'jruby'
+# TruffleRuby runs C extensions through Sulong (an LLVM interpreter) but gives
+# pure Ruby the full Graal JIT, which here renders ~28x faster than the
+# extension. Building it would only slow TruffleRuby down, so don't.
+skip_native_extension('TruffleRuby is faster on the pure-Ruby renderer') if RUBY_ENGINE == 'truffleruby'
+
+require 'mkmf'
+
+skip_native_extension('no working C compiler') unless try_compile('int main(void) { return 0; }')
+
+# append_cflags keeps only flags the compiler accepts, so this works on gcc
+# and clang, Linux and macOS. No -march=native: the built gem may be copied
+# to another machine (Docker images). SIMD needs no flags: SSE2 is baseline
+# on x86_64 and NEON on arm64.
+append_cflags(%w[-O3 -std=gnu99 -fvisibility=hidden -Wall -Wextra -Wno-unused-parameter])
+# Direct calls into libruby instead of PLT stubs (ELF only).
+append_cflags('-fno-plt') if RbConfig::CONFIG['host_os'].include?('linux')
+# Scalar escape path, for benchmarking: RUBY2HTML_NO_SIMD=1 rake compile
+append_cflags('-DR2H_NO_SIMD') if ENV['RUBY2HTML_NO_SIMD'] == '1'
+
+skip_native_extension('ruby/encoding.h not found') unless have_header('ruby/encoding.h')
+
+# CRuby is the reference platform, so a broken build there should fail
+# loudly. Elsewhere (TruffleRuby, ...) compile every source first and fall
+# back if any of them doesn't build.
+unless RUBY_ENGINE == 'ruby'
+  Dir.glob(File.join(__dir__, '*.c')).each do |source|
+    next if try_compile(File.read(source), "-I#{__dir__}")
+
+    skip_native_extension("#{File.basename(source)} does not compile on #{RUBY_ENGINE}")
+  end
+end
+
+create_makefile('ruby2html/ruby2html')

data/ext/ruby2html/html_escape.c

@@ -0,0 +1,252 @@
+/*
+ * HTML escaping of & < > " ' (safe for text and for quoted attribute values).
+ *
+ * Strategy: find the first escapable byte with a vector scan. Clean strings
+ * (the common case) are then a single memcpy. Dirty strings get their exact
+ * escaped size computed once, and are written in one pass that bulk-copies
+ * the clean runs between escapable bytes.
+ */
+#include "buffer.h"
+
+static const char *const ESCAPES[256] = {
+    ['&'] = "&amp;", ['<'] = "&lt;", ['>'] = "&gt;", ['"'] = "&quot;", ['\''] = "&#39;",
+};
+
+/* Bytes added by escaping each character (0 = not escapable). */
+static const unsigned char EXTRA[256] = {
+    ['&'] = 4, ['<'] = 3, ['>'] = 3, ['"'] = 5, ['\''] = 4,
+};
+
+static int utf8_index, usascii_index, binary_index;
+
+/*
+ * 16-byte vector scan. The escapable bytes pair up so three compares cover
+ * all five:  0x26 '&' | 1 == 0x27 '\''   0x3C '<' | 2 == 0x3E '>'   0x22 '"'.
+ * The pairs also share their EXTRA value (4, 3, 5), which lets the counting
+ * pass sum a per-byte weight vector instead of looking each byte up.
+ */
+#if defined(__SSE2__) && !defined(R2H_NO_SIMD)
+#include <emmintrin.h>
+#define R2H_SIMD 1
+
+typedef __m128i r2h_vec;
+
+static inline void classify(const char *p, r2h_vec *amp, r2h_vec *ang, r2h_vec *quot)
+{
+    const __m128i v = _mm_loadu_si128((const __m128i *)p);
+    *amp = _mm_cmpeq_epi8(_mm_or_si128(v, _mm_set1_epi8(1)), _mm_set1_epi8(0x27));
+    *ang = _mm_cmpeq_epi8(_mm_or_si128(v, _mm_set1_epi8(2)), _mm_set1_epi8(0x3E));
+    *quot = _mm_cmpeq_epi8(v, _mm_set1_epi8(0x22));
+}
+
+/* Offset of the first escapable byte in the chunk, or 16. */
+static inline int chunk_first(const char *p)
+{
+    r2h_vec amp, ang, quot;
+    classify(p, &amp, &ang, &quot);
+    const int mask = _mm_movemask_epi8(_mm_or_si128(_mm_or_si128(amp, ang), quot));
+    return mask ? __builtin_ctz((unsigned)mask) : 16;
+}
+
+static inline long chunk_extra(const char *p)
+{
+    r2h_vec amp, ang, quot;
+    classify(p, &amp, &ang, &quot);
+    const __m128i weights = _mm_or_si128(
+        _mm_or_si128(_mm_and_si128(amp, _mm_set1_epi8(4)), _mm_and_si128(ang, _mm_set1_epi8(3))),
+        _mm_and_si128(quot, _mm_set1_epi8(5)));
+    const __m128i sums = _mm_sad_epu8(weights, _mm_setzero_si128());
+    return _mm_cvtsi128_si32(sums) + _mm_cvtsi128_si32(_mm_srli_si128(sums, 8));
+}
+
+#elif defined(__aarch64__) && defined(__ARM_NEON) && !defined(R2H_NO_SIMD)
+#include <arm_neon.h>
+#define R2H_SIMD 1
+
+typedef uint8x16_t r2h_vec;
+
+static inline void classify(const char *p, r2h_vec *amp, r2h_vec *ang, r2h_vec *quot)
+{
+    const uint8x16_t v = vld1q_u8((const uint8_t *)p);
+    *amp = vceqq_u8(vorrq_u8(v, vdupq_n_u8(1)), vdupq_n_u8(0x27));
+    *ang = vceqq_u8(vorrq_u8(v, vdupq_n_u8(2)), vdupq_n_u8(0x3E));
+    *quot = vceqq_u8(v, vdupq_n_u8(0x22));
+}
+
+static inline int chunk_first(const char *p)
+{
+    r2h_vec amp, ang, quot;
+    classify(p, &amp, &ang, &quot);
+    const uint8x16_t any = vorrq_u8(vorrq_u8(amp, ang), quot);
+    /* NEON has no movemask: narrow each byte to a nibble, giving 4 bits per lane. */
+    const uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(any), 4)), 0);
+    return bits ? __builtin_ctzll(bits) >> 2 : 16;
+}
+
+static inline long chunk_extra(const char *p)
+{
+    r2h_vec amp, ang, quot;
+    classify(p, &amp, &ang, &quot);
+    const uint8x16_t weights = vorrq_u8(
+        vorrq_u8(vandq_u8(amp, vdupq_n_u8(4)), vandq_u8(ang, vdupq_n_u8(3))),
+        vandq_u8(quot, vdupq_n_u8(5)));
+    return vaddvq_u8(weights); /* at most 16 * 5 = 80, no overflow */
+}
+#endif
+
+/* Offset of the first escapable byte, or len. */
+static inline long find_escapable(const char *p, long len)
+{
+    long i = 0;
+#ifdef R2H_SIMD
+    for (; i + 16 <= len; i += 16) {
+        const int at = chunk_first(p + i);
+        if (at < 16) return i + at;
+    }
+#endif
+    for (; i < len; i++) {
+        if (EXTRA[(unsigned char)p[i]]) return i;
+    }
+    return len;
+}
+
+/* Total bytes escaping adds to p[0, len). */
+static inline long escaped_extra(const char *p, long len)
+{
+    long i = 0, extra = 0;
+#ifdef R2H_SIMD
+    for (; i + 16 <= len; i += 16) extra += chunk_extra(p + i);
+#endif
+    for (; i < len; i++) extra += EXTRA[(unsigned char)p[i]];
+    return extra;
+}
+
+/*
+ * Escaping grows a string at most 6x ('"' -> "&quot;"). Refuse sizes whose
+ * worst case doesn't fit in a long (only reachable on 32-bit platforms).
+ */
+static inline void check_escaped_size(long len, long fixed)
+{
+    if (len > (LONG_MAX - fixed) / 6) rb_raise(rb_eArgError, "string too large to escape");
+}
+
+/* Writes the escaped form of p[0, len) to out; returns the new end. */
+static char *escape_into(char *out, const char *p, long len)
+{
+    const char *const end = p + len;
+
+    while (p < end) {
+        const long run = find_escapable(p, end - p);
+        memcpy(out, p, (size_t)run);
+        out += run;
+        p += run;
+        if (p == end) break;
+
+        const unsigned char c = (unsigned char)*p++;
+        const long size = EXTRA[c] + 1;
+        memcpy(out, ESCAPES[c], (size_t)size);
+        out += size;
+    }
+    return out;
+}
+
+/*
+ * The output buffer is UTF-8. UTF-8, US-ASCII and ASCII-only strings are
+ * copied byte for byte. Binary strings are assumed to hold UTF-8 bytes
+ * (what 1.x did). Anything else is transcoded, which raises if it can't be.
+ */
+VALUE r2h_utf8_compatible(VALUE str)
+{
+    const int index = ENCODING_GET_INLINED(str);
+
+    if (index == utf8_index || index == usascii_index || index == binary_index) return str;
+    if (rb_enc_str_asciionly_p(str)) return str;
+    return rb_str_encode(str, rb_enc_from_encoding(rb_utf8_encoding()), 0, Qnil);
+}
+
+/*
+ * Appends before + escaped(str) + after with a single buffer reservation:
+ * a whole `<li>text</li>` costs one capacity check instead of three.
+ */
+void r2h_append_escaped_wrapped(VALUE buf, const char *before, long before_len, VALUE str,
+                                const char *after, long after_len)
+{
+    str = r2h_utf8_compatible(str);
+    /* Growing buf would free the bytes we are reading if they are the same string. */
+    if (str == buf) str = rb_str_dup(str);
+
+    const char *p = RSTRING_PTR(str);
+    const long len = RSTRING_LEN(str);
+    check_escaped_size(len, before_len + after_len + RSTRING_LEN(buf));
+    const long first = find_escapable(p, len);
+    const long extra = first == len ? 0 : escaped_extra(p + first, len - first);
+
+    char *out = r2h_buf_reserve(buf, before_len + len + extra + after_len);
+    p = RSTRING_PTR(str); /* reserve may run GC; str is guarded below */
+    if (before_len) memcpy(out, before, (size_t)before_len);
+    out += before_len;
+    memcpy(out, p, (size_t)first);
+    out = escape_into(out + first, p + first, len - first);
+    if (after_len) memcpy(out, after, (size_t)after_len);
+    r2h_buf_commit(buf, out + after_len);
+    RB_GC_GUARD(str);
+}
+
+void r2h_append_escaped(VALUE buf, VALUE str)
+{
+    r2h_append_escaped_wrapped(buf, NULL, 0, str, NULL, 0);
+}
+
+void r2h_append_raw(VALUE buf, VALUE str)
+{
+    str = r2h_utf8_compatible(str);
+    if (str == buf) str = rb_str_dup(str);
+    r2h_buf_cat(buf, RSTRING_PTR(str), RSTRING_LEN(str));
+    RB_GC_GUARD(str);
+}
+
+/*
+ * Ruby2html::Native.escape_html(obj) -> String
+ *
+ * Never returns the caller's own mutable string: callers may mutate the
+ * result. Frozen input with nothing to escape is returned as is.
+ */
+static VALUE native_escape_html(VALUE mod, VALUE obj)
+{
+    VALUE str = r2h_utf8_compatible(rb_obj_as_string(obj));
+    const char *p = RSTRING_PTR(str);
+    const long len = RSTRING_LEN(str);
+    const long first = find_escapable(p, len);
+
+    /* Binary input holds UTF-8 bytes (see r2h_utf8_compatible): label the result UTF-8. */
+    const int binary = ENCODING_GET_INLINED(str) == binary_index;
+
+    if (first == len) {
+        if (!binary) return OBJ_FROZEN(str) ? str : rb_str_dup(str);
+        VALUE copy = rb_str_dup(str);
+        rb_enc_associate(copy, rb_utf8_encoding());
+        return copy;
+    }
+
+    check_escaped_size(len, 0);
+    VALUE result = rb_str_buf_new(len + escaped_extra(p + first, len - first));
+    if (binary) {
+        rb_enc_associate(result, rb_utf8_encoding());
+    } else {
+        rb_enc_copy(result, str);
+    }
+    char *out = RSTRING_PTR(result);
+    memcpy(out, p, (size_t)first);
+    r2h_buf_commit(result, escape_into(out + first, p + first, len - first));
+    RB_GC_GUARD(str);
+    return result;
+}
+
+void r2h_init_escape(VALUE native)
+{
+    utf8_index = rb_utf8_encindex();
+    usascii_index = rb_usascii_encindex();
+    binary_index = rb_ascii8bit_encindex();
+
+    rb_define_singleton_method(native, "escape_html", native_escape_html, 1);
+}

data/ext/ruby2html/ruby2html.c

@@ -0,0 +1,16 @@
+/*
+ * Native renderer core. Defines Ruby2html::Native, a module of instance
+ * methods (tag methods, plain, component) that Ruby2html::Render includes.
+ * Ruby2html::PureRuby (lib/gem/ruby2html/render/pure_ruby.rb) mirrors it.
+ */
+#include "ruby2html.h"
+
+RUBY_FUNC_EXPORTED void Init_ruby2html(void)
+{
+    VALUE ruby2html = rb_define_module("Ruby2html");
+    VALUE native = rb_define_module_under(ruby2html, "Native");
+
+    r2h_init_escape(native);
+    r2h_init_content(native);
+    r2h_init_tags(native);
+}