fix memsize_node when called on xmlAttrs

CHANGELOG.md

@@ -6,7 +6,7 @@ Nokogiri follows [Semantic Versioning](https://semver.org/), please see the [REA
 
 ## next / unreleased
 
-...
+* [CRuby] `ObjectSpace.memsize_of` is now safe to call on `Document`s with complex DTDs. In previous versions, this debugging method could result in a segfault. [[#2923](https://github.com/sparklemotion/nokogiri/issues/2923), [#2924](https://github.com/sparklemotion/nokogiri/issues/2924)]
 
 
 ## 1.15.3 / 2023-07-05

ext/nokogiri/xml_document.c

@@ -100,11 +100,15 @@ memsize_node(const xmlNodePtr node)
 {
   /* note we don't count namespace definitions, just going for a good-enough number here */
   xmlNodePtr child;
+  xmlAttrPtr property;
   size_t memsize = 0;
 
   memsize += xmlStrlen(node->name);
-  for (child = (xmlNodePtr)node->properties; child; child = child->next) {
-    memsize += sizeof(xmlAttr) + memsize_node(child);
+
+  if (node->type == XML_ELEMENT_NODE) {
+    for (property = node->properties; property; property = property->next) {
+      memsize += sizeof(xmlAttr) + memsize_node((xmlNodePtr)property);
+    }
   }
   if (node->type == XML_TEXT_NODE) {
     memsize += xmlStrlen(node->content);

test/test_memory_leak.rb

@@ -313,6 +313,21 @@ def test_object_space_memsize_of
     assert(bigger_name_size > base_size, "longer tags should increase memsize")
   end
 
+  def test_object_space_memsize_with_dtd
+    # https://github.com/sparklemotion/nokogiri/issues/2923
+    require "objspace"
+    skip("memsize_of not defined") unless ObjectSpace.respond_to?(:memsize_of)
+
+    doc = Nokogiri::XML(<<~XML)
+      <?xml version="1.0"?>
+      <!DOCTYPE staff PUBLIC "staff.dtd" [
+        <!ATTLIST payment type CDATA "check">
+      ]>
+      <staff></staff>
+    XML
+    ObjectSpace.memsize_of(doc) # assert_does_not_crash
+  end
+
   module MemInfo
     # from https://stackoverflow.com/questions/7220896/get-current-ruby-process-memory-usage
     # this is only going to work on linux