nosj 0.3.2 → 0.4.1

data/ext/nosj/src/gen/mod.rs

@@ -29,20 +29,25 @@ mod walker;
 
 use magnus::rb_sys::{AsRawValue, FromRawValue};
 use magnus::{Error, RString, Ruby, Value};
-use std::cell::RefCell;
+use std::cell::Cell;
 
+use crate::state::with_taken;
 use errors::raise_fail;
 use keys::GenKeyCache;
+pub(crate) use ruby::warm_up;
 use walker::Gen;
 
 /// Per-thread generate scratch: the pooled output buffer (capacity
-/// survives across calls) and the pre-escaped key cache. One
-/// thread_local, borrowed ONCE for the whole call: in a shared library
-/// every thread_local access is a `__tls_get_addr` call, and the old
-/// take/put-back shape paid two of them plus struct moves per call
-/// (measurable on 45-byte documents). A recursive generate via a user
-/// `to_json` hits the failed `try_borrow_mut` arm and runs on a fresh
-/// scratch instead of panicking the RefCell.
+/// survives across calls) and the pre-escaped key caches. A call takes
+/// the scratch OUT of the thread-local and stores it back afterwards:
+/// off the main Ractor, Ruby threads run M:N over a pool of native
+/// threads, so a thread resuming after a `to_json` / `as_json` callback
+/// may be on another native thread, where a reference into the old
+/// thread's cell would alias whatever that thread is running. An empty
+/// cell (a recursive generate holds the scratch, or a thread hop left
+/// it elsewhere) means a fresh one. The Box moves as one pointer; the
+/// cost over a plain borrow is one thread-local address lookup per
+/// call, measured at parity (feature/ractor, 2026-09).
 struct GenScratch {
     buf: Vec<u8>,
     keys: GenKeyCache,
@@ -52,12 +57,28 @@ struct GenScratch {
     html_keys: GenKeyCache,
 }
 
+impl GenScratch {
+    #[cold]
+    fn fresh() -> Box<Self> {
+        Box::new(GenScratch {
+            buf: Vec::new(),
+            keys: GenKeyCache::with_capacity(256),
+            html_keys: GenKeyCache::with_capacity(64),
+        })
+    }
+}
+
 thread_local! {
-    static GEN_SCRATCH: RefCell<GenScratch> = RefCell::new(GenScratch {
-        buf: Vec::new(),
-        keys: GenKeyCache::with_capacity(256),
-        html_keys: GenKeyCache::with_capacity(64),
-    });
+    static GEN_SCRATCH: Cell<Option<Box<GenScratch>>> = const { Cell::new(None) };
+}
+
+/// Run `f` on this thread's scratch (see [`with_taken`]). A recursive
+/// generate stores its own fresh scratch meanwhile; the outermost call's
+/// warm one replaces it (the replaced key cache keeps its shadow).
+fn with_scratch<R>(f: impl FnOnce(&mut GenScratch) -> R) -> R {
+    with_taken(&GEN_SCRATCH, |slot| {
+        f(slot.get_or_insert_with(GenScratch::fresh))
+    })
 }
 
 /// `NOSJ.generate(obj, opts = nil)`, registered as a variadic native
@@ -174,27 +195,18 @@ fn generate_scratched_into<R>(
     cap_hint: usize,
     finish: impl FnOnce(&Ruby, &[u8]) -> Result<R, Error>,
 ) -> Result<R, Error> {
-    GEN_SCRATCH.with(|cell| match cell.try_borrow_mut() {
-        Ok(mut scratch) => {
-            let scratch = &mut *scratch;
-            let GenScratch {
-                buf,
-                keys,
-                html_keys,
-                ..
-            } = scratch;
-            let keys = if cfg.mode == nosj::emit::EscapeMode::HtmlSafe {
-                html_keys
-            } else {
-                keys
-            };
-            generate_with(ruby, obj, cfg, cap_hint, buf, keys, finish)
-        }
-        Err(_) => {
-            let mut buf = Vec::new();
-            let mut keys = GenKeyCache::default();
-            generate_with(ruby, obj, cfg, cap_hint, &mut buf, &mut keys, finish)
-        }
+    with_scratch(|scratch| {
+        let GenScratch {
+            buf,
+            keys,
+            html_keys,
+        } = scratch;
+        let keys = if cfg.mode == nosj::emit::EscapeMode::HtmlSafe {
+            html_keys
+        } else {
+            keys
+        };
+        generate_with(ruby, obj, cfg, cap_hint, buf, keys, finish)
     })
 }
 
@@ -258,10 +270,7 @@ pub(crate) fn emit_into(
     cfg: &opts::GenConfig,
     out: &mut Vec<u8>,
 ) -> Result<(), Error> {
-    GEN_SCRATCH.with(|cell| match cell.try_borrow_mut() {
-        Ok(mut scratch) => emit_one(ruby, obj, cfg, out, &mut scratch.keys),
-        Err(_) => emit_one(ruby, obj, cfg, out, &mut GenKeyCache::default()),
-    })
+    with_scratch(|scratch| emit_one(ruby, obj, cfg, out, &mut scratch.keys))
 }
 
 /// Formatting strings holding a newline (or carriage return) would
@@ -313,17 +322,9 @@ pub(crate) fn generate_lines_bytes_into<R>(
             "formatting options containing newlines would break JSON Lines framing",
         ));
     }
-    GEN_SCRATCH.with(|cell| match cell.try_borrow_mut() {
-        Ok(mut scratch) => {
-            let scratch = &mut *scratch;
-            let GenScratch { buf, keys, .. } = scratch;
-            generate_lines_with(ruby, values, cfg, cap_hint, buf, keys, finish)
-        }
-        Err(_) => {
-            let mut buf = Vec::new();
-            let mut keys = GenKeyCache::default();
-            generate_lines_with(ruby, values, cfg, cap_hint, &mut buf, &mut keys, finish)
-        }
+    with_scratch(|scratch| {
+        let GenScratch { buf, keys, .. } = scratch;
+        generate_lines_with(ruby, values, cfg, cap_hint, buf, keys, finish)
     })
 }
 

data/ext/nosj/src/gen/ruby.rs

@@ -23,6 +23,21 @@ pub(super) fn protected_to_json(v: VALUE) -> Result<VALUE, Error> {
     magnus::rb_sys::protect(|| unsafe { rb_sys::rb_funcall(v, to_json_id(), 0) })
 }
 
+/// `v.to_json` if `v.respond_to?(:to_json)`, else `None`, under ONE
+/// protect: `rb_respond_to` dispatches to a user-defined `respond_to?` /
+/// `respond_to_missing?`, which may raise just like `to_json` itself.
+pub(super) fn protected_to_json_if_responds(v: VALUE) -> Result<Option<VALUE>, Error> {
+    const QUNDEF: VALUE = ruby_special_consts::RUBY_Qundef as VALUE;
+    let json = magnus::rb_sys::protect(|| unsafe {
+        if rb_sys::rb_respond_to(v, to_json_id()) != 0 {
+            rb_sys::rb_funcall(v, to_json_id(), 0)
+        } else {
+            QUNDEF
+        }
+    })?;
+    Ok((json != QUNDEF).then_some(json))
+}
+
 /// `v.as_json`, protected. Argument-less on purpose: ActiveSupport's
 /// JSONGemEncoder#jsonify recursion also calls as_json without
 /// options (only the top-level value receives them).
@@ -37,6 +52,15 @@ fn as_json_id() -> rb_sys::ID {
         as rb_sys::ID
 }
 
+/// Resolve the `OnceLock`s here now (init, main Ractor): an initializer
+/// that enters the VM must never race between Ractors (see lib.rs), and
+/// an initialized lock never blocks again.
+pub(crate) fn warm_up() {
+    as_json_id();
+    to_json_id();
+    utf8_encindexes();
+}
+
 /// Whether `v` is a `JSON::Fragment` (pre-rendered JSON to splice
 /// verbatim: the gem accepts fragments even under `strict`, and
 /// ActiveSupport's encoder passes them through). The class is resolved
@@ -44,33 +68,37 @@ fn as_json_id() -> rb_sys::ID {
 /// first generate is still found; a fragment instance existing implies
 /// its class does. The cached VALUE is a constant of the JSON module,
 /// so it can never be collected.
-pub(super) fn is_json_fragment(v: VALUE) -> bool {
+pub(super) fn is_json_fragment(v: VALUE) -> Result<bool, Error> {
     use std::sync::atomic::{AtomicUsize, Ordering};
     static FRAGMENT: AtomicUsize = AtomicUsize::new(0);
-    let mut cls = FRAGMENT.load(Ordering::Relaxed);
+    let mut cls = FRAGMENT.load(Ordering::Relaxed) as VALUE;
     if cls == 0 {
-        cls = resolve_json_fragment();
+        cls = resolve_json_fragment()?;
         if cls == 0 {
-            return false;
+            return Ok(false);
         }
-        FRAGMENT.store(cls, Ordering::Relaxed);
+        FRAGMENT.store(cls as usize, Ordering::Relaxed);
     }
-    unsafe { rb_sys::rb_obj_is_kind_of(v, cls as VALUE) != QFALSE }
+    Ok(unsafe { rb_sys::rb_obj_is_kind_of(v, cls) != QFALSE })
 }
 
-fn resolve_json_fragment() -> usize {
+/// `JSON::Fragment`, or 0 while undefined. Only the `rb_const_get`s are
+/// protected: fetching a constant can run its pending autoload (user
+/// code, whose raise propagates as any constant reference's would),
+/// while `rb_const_defined` never loads anything.
+fn resolve_json_fragment() -> Result<VALUE, Error> {
     unsafe {
         let object = rb_sys::rb_cObject;
         let json_id = rb_sys::rb_intern(c"JSON".as_ptr());
         if rb_sys::rb_const_defined(object, json_id) == 0 {
-            return 0;
+            return Ok(0);
         }
-        let json = rb_sys::rb_const_get(object, json_id);
+        let json = magnus::rb_sys::protect(|| rb_sys::rb_const_get(object, json_id))?;
         let fragment_id = rb_sys::rb_intern(c"Fragment".as_ptr());
         if rb_sys::rb_const_defined(json, fragment_id) == 0 {
-            return 0;
+            return Ok(0);
         }
-        rb_sys::rb_const_get(json, fragment_id) as usize
+        magnus::rb_sys::protect(|| rb_sys::rb_const_get(json, fragment_id))
     }
 }
 
@@ -86,7 +114,7 @@ pub(super) fn protected_encode_utf8(v: VALUE) -> Result<VALUE, Error> {
 }
 
 /// Interned `to_json` method ID, resolved once per process.
-pub(super) fn to_json_id() -> rb_sys::ID {
+fn to_json_id() -> rb_sys::ID {
     static TO_JSON: OnceLock<usize> = OnceLock::new();
     *TO_JSON.get_or_init(|| unsafe { rb_sys::rb_intern(c"to_json".as_ptr()) } as usize)
         as rb_sys::ID
@@ -100,12 +128,16 @@ pub(super) fn utf8_encindexes() -> (c_int, c_int) {
 // Coderange and encoding index live in RBasic flags (public ABI); reading
 // them inline instead of calling rb_enc_str_coderange / rb_enc_get_index is
 // how the gem avoids two C calls per string (RB_ENC_CODERANGE,
-// RB_ENCODING_GET_INLINED).
-const CR_MASK: u64 = 3 << 20;
-pub(super) const CR_7BIT: u64 = 1 << 20;
-pub(super) const CR_VALID: u64 = 2 << 20;
-const ENC_SHIFT: u64 = 22;
-const ENC_MASK: u64 = 127 << 22;
+// RB_ENCODING_GET_INLINED). The bit layout comes from rb-sys's bindings,
+// generated from the headers of the Ruby being built against, so it
+// follows any layout change instead of silently misreading flags.
+const CR_MASK: u64 = rb_sys::ruby_coderange_type::RUBY_ENC_CODERANGE_MASK as u64;
+pub(super) const CR_7BIT: u64 = rb_sys::ruby_coderange_type::RUBY_ENC_CODERANGE_7BIT as u64;
+pub(super) const CR_VALID: u64 = rb_sys::ruby_coderange_type::RUBY_ENC_CODERANGE_VALID as u64;
+const ENC_SHIFT: u64 = rb_sys::ruby_encoding_consts::RUBY_ENCODING_SHIFT as u64;
+const ENC_MASK: u64 = rb_sys::ruby_encoding_consts::RUBY_ENCODING_MASK as u64;
+/// Inline encoding-index sentinel: the real index is stored out of line.
+const ENC_INLINE_MAX: c_int = rb_sys::ruby_encoding_consts::RUBY_ENCODING_INLINE_MAX as c_int;
 
 #[inline(always)]
 pub(super) fn str_coderange(s: VALUE) -> u64 {
@@ -122,18 +154,18 @@ pub(super) fn str_coderange(s: VALUE) -> u64 {
 pub(super) fn str_enc_index(s: VALUE) -> c_int {
     let flags = unsafe { (*(s as *const rb_sys::RBasic)).flags };
     let idx = ((flags & ENC_MASK) >> ENC_SHIFT) as c_int;
-    if idx == 127 {
-        // RUBY_ENCODING_INLINE_MAX sentinel: index stored out of line.
+    if idx == ENC_INLINE_MAX {
         unsafe { rb_sys::rb_enc_get_index(s) }
     } else {
         idx
     }
 }
 
+/// `RB_SPECIAL_CONST_P` (immediates plus Qnil/Qfalse), through rb-sys's
+/// inline versioned stable API rather than a hand-copied bit test.
 #[inline(always)]
 pub(super) fn is_special_const(v: VALUE) -> bool {
-    // RB_SPECIAL_CONST_P: immediates plus Qnil/Qfalse.
-    (v & (ruby_special_consts::RUBY_IMMEDIATE_MASK as VALUE)) != 0 || v == QNIL || v == QFALSE
+    rb_sys::macros::SPECIAL_CONST_P(v)
 }
 
 /// Borrow a Ruby String's bytes.

data/ext/nosj/src/gen/walker.rs

@@ -3,6 +3,7 @@
 //! Compact and pretty modes are one const-generic body, so the compact
 //! hot path carries no formatting branches.
 
+use magnus::Error;
 use nosj::emit::{self, copy_short_raw, EscapeMode};
 use rb_sys::macros::{
     FIX2LONG, FIXNUM_P, FLONUM_P, RARRAY_CONST_PTR, RARRAY_LEN, RB_BUILTIN_TYPE, RHASH_SIZE,
@@ -15,8 +16,8 @@ use super::keys::GenKeyCache;
 use super::opts::GenConfig;
 use super::ruby::{
     is_json_fragment, is_special_const, protected_as_json, protected_encode_utf8,
-    protected_to_json, protected_to_s, rstring_bytes, str_coderange, str_enc_index, to_json_id,
-    utf8_encindexes, CR_7BIT, CR_VALID, QFALSE, QNIL, QTRUE,
+    protected_to_json, protected_to_json_if_responds, protected_to_s, rstring_bytes, str_coderange,
+    str_enc_index, utf8_encindexes, CR_7BIT, CR_VALID, QFALSE, QNIL, QTRUE,
 };
 
 /// Whether keys escaped under `mode` may be cached: the cached bytes
@@ -265,13 +266,15 @@ impl Gen<'_> {
             let s = unsafe { rb_sys::rb_sym2str(k) };
             return self.emit_rstring_quoted(s);
         }
-        match protected_to_s(k) {
-            Ok(s) => self.emit_rstring_quoted(s),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
-        }
+        let s = self.reraise(protected_to_s(k))?;
+        self.emit_rstring_quoted(s)
+    }
+
+    /// A protected Ruby call's outcome inside the walk: a raised
+    /// exception becomes this walk's failure, re-raised unchanged once
+    /// the walk has unwound.
+    fn reraise<T>(&mut self, r: Result<T, Error>) -> Result<T, ()> {
+        r.map_err(|exc| self.fail = Some(GenFail::Reraise(exc)))
     }
 
     /// Non-native type: strict raises (except `JSON::Fragment`, which
@@ -285,7 +288,7 @@ impl Gen<'_> {
             return self.emit_rails_fallback::<PRETTY>(raw, depth);
         }
         if self.cfg.strict {
-            if is_json_fragment(raw) {
+            if self.reraise(is_json_fragment(raw))? {
                 return self.splice_to_json(raw);
             }
             let name = unsafe {
@@ -296,53 +299,32 @@ impl Gen<'_> {
             self.fail = Some(GenFail::Generator(format!("{name} not allowed in JSON")));
             return Err(());
         }
-        if unsafe { rb_sys::rb_respond_to(raw, to_json_id()) } != 0 {
-            match protected_to_json(raw) {
-                Ok(json) => {
-                    if !is_special_const(json)
-                        && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING
-                    {
-                        self.append_rstring_raw(json);
-                        return Ok(());
-                    }
-                }
-                Err(exc) => {
-                    self.fail = Some(GenFail::Reraise(exc));
-                    return Err(());
-                }
-            }
-        }
-        match protected_to_s(raw) {
-            Ok(s) => self.emit_rstring_quoted(s),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
+        if let Some(json) = self.reraise(protected_to_json_if_responds(raw))? {
+            if !is_special_const(json)
+                && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING
+            {
+                self.append_rstring_raw(json);
+                return Ok(());
             }
         }
+        let s = self.reraise(protected_to_s(raw))?;
+        self.emit_rstring_quoted(s)
     }
 
     /// Splice `raw`'s `to_json` result verbatim: the JSON::Fragment
     /// path (pre-rendered JSON, trusted like the gem trusts it).
     fn splice_to_json(&mut self, raw: VALUE) -> Result<(), ()> {
-        match protected_to_json(raw) {
-            Ok(json)
-                if !is_special_const(json)
-                    && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING =>
-            {
-                self.append_rstring_raw(json);
-                Ok(())
-            }
-            Ok(_) => {
-                self.fail = Some(GenFail::Generator(
-                    "JSON::Fragment#to_json did not return a String".to_string(),
-                ));
-                Err(())
-            }
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
+        let json = self.reraise(protected_to_json(raw))?;
+        if is_special_const(json)
+            || unsafe { RB_BUILTIN_TYPE(json) } != ruby_value_type::RUBY_T_STRING
+        {
+            self.fail = Some(GenFail::Generator(
+                "JSON::Fragment#to_json did not return a String".to_string(),
+            ));
+            return Err(());
         }
+        self.append_rstring_raw(json);
+        Ok(())
     }
 
     /// Rails-mode fallback, mirroring JSONGemEncoder#jsonify:
@@ -356,27 +338,22 @@ impl Gen<'_> {
         raw: VALUE,
         depth: usize,
     ) -> Result<(), ()> {
-        if is_json_fragment(raw) {
+        if self.reraise(is_json_fragment(raw))? {
             return self.splice_to_json(raw);
         }
-        match protected_as_json(raw) {
-            Ok(json) if json == raw => {
-                let name = unsafe {
-                    std::ffi::CStr::from_ptr(rb_sys::rb_obj_classname(raw))
-                        .to_string_lossy()
-                        .into_owned()
-                };
-                self.fail = Some(GenFail::Generator(format!(
-                    "{name}#as_json returned the receiver"
-                )));
-                Err(())
-            }
-            Ok(json) => self.emit_value::<PRETTY>(json, depth),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
+        let json = self.reraise(protected_as_json(raw))?;
+        if json == raw {
+            let name = unsafe {
+                std::ffi::CStr::from_ptr(rb_sys::rb_obj_classname(raw))
+                    .to_string_lossy()
+                    .into_owned()
+            };
+            self.fail = Some(GenFail::Generator(format!(
+                "{name}#as_json returned the receiver"
+            )));
+            return Err(());
         }
+        self.emit_value::<PRETTY>(json, depth)
     }
 
     fn nesting_check(&mut self, inner: usize) -> Result<(), ()> {
@@ -390,14 +367,23 @@ impl Gen<'_> {
     fn emit_array<const PRETTY: bool>(&mut self, ary: VALUE, depth: usize) -> Result<(), ()> {
         let inner = depth + 1;
         self.nesting_check(inner)?;
-        let len = unsafe { RARRAY_LEN(ary) } as usize;
         self.out.push(b'[');
-        if len == 0 {
+        if unsafe { RARRAY_LEN(ary) } == 0 {
             self.out.push(b']');
             return Ok(());
         }
         let mut i = 0usize;
-        while i < len {
+        loop {
+            // Length and pointer are re-read every element, like the
+            // json gem: a user callback inside the recursion (to_json,
+            // to_s, as_json) may shrink the array (slots past the live
+            // length hold freed or reused VALUEs; growth is emitted),
+            // and any allocation may compact it elsewhere.
+            let len = unsafe { RARRAY_LEN(ary) } as usize;
+            if i >= len {
+                break;
+            }
+            let elem = unsafe { *RARRAY_CONST_PTR(ary).add(i) };
             if i > 0 {
                 self.out.push(b',');
             }
@@ -405,9 +391,6 @@ impl Gen<'_> {
                 self.out.extend_from_slice(&self.cfg.array_nl);
                 self.push_indent(inner);
             }
-            // Re-read the pointer every element: an allocation inside the
-            // recursion may trigger GC compaction and move the array.
-            let elem = unsafe { *RARRAY_CONST_PTR(ary).add(i) };
             // Numeric runs (compact mode) emit through a raw local
             // cursor under one chunked reservation: per-element Vec
             // operations round-trip length and pointer through memory