nosj 0.3.2 → 0.4.1

data/ext/nosj/src/lazy.rs

@@ -20,20 +20,20 @@ use magnus::{DataTypeFunctions, Error, RArray, RString, Ruby, TypedData, Value};
 use crate::errors::parser_error_at;
 use crate::parse::{materialize_at, parse_native_opts, span_of, utf8_input, ParseNativeOpts};
 use crate::pointer::{path_to_pointer, push_escaped_token};
-use crate::state::PULL_STATE;
+use crate::state::with_pull_state;
 
 /// The document bytes behind a node tree. A frozen Ruby source is
-/// borrowed zero-copy: freezing rules out mutation, and every node
-/// GC-marks the string with `rb_gc_mark` semantics, which both keeps it
-/// alive and pins it against compaction, so the captured pointer stays
-/// valid for as long as any node exists. Anything else is copied once.
+/// borrowed zero-copy: freezing rules out any change to its CONTENT,
+/// and every node GC-marks the string with `rb_gc_mark` semantics
+/// (alive, and pinned against compaction). Freezing does NOT pin the
+/// buffer, though: deduplicating a frozen String subclass or a string
+/// carrying ivars (`-str`) swaps in an identical shared buffer and
+/// frees the old one. So the bytes are re-read from the string on every
+/// access; same content means every span stays valid. Anything else is
+/// copied once.
 pub(crate) enum DocBytes {
     Owned(Vec<u8>),
-    Frozen {
-        source: rb_sys::VALUE,
-        ptr: *const u8,
-        len: usize,
-    },
+    Frozen(RString),
     /// A read-only file mapping (`NOSJ.load_lazy_file`): pages never
     /// touched are never read off disk. Concurrent modification of the
     /// mapped file by another process is documented as unsupported
@@ -48,23 +48,24 @@ struct DocInner {
     opts: ParseNativeOpts,
 }
 
-// SAFETY: the bytes are immutable for the document's whole life (an
+// SAFETY: the content is immutable for the document's whole life (an
 // owned Vec, or a frozen Ruby string pinned and kept alive by every
-// node's GC mark), so cross-thread reads are plain shared reads; the
-// raw VALUE is only dereferenced by the GC mark, which runs at
-// safepoints (the ShadowHandle contract in state.rs). There is no
-// interior mutability anywhere in the type.
+// node's GC mark), so cross-thread reads are plain shared reads of it.
+// There is no interior mutability anywhere in the type.
 unsafe impl Send for DocInner {}
 unsafe impl Sync for DocInner {}
 
 impl DocInner {
+    /// The document bytes. For a frozen source the slice is valid only
+    /// until the next Ruby call (which could swap the string's buffer;
+    /// see DocBytes): callers finish with it, or call this again,
+    /// before running Ruby code.
     fn bytes(&self) -> &[u8] {
         match &self.bytes {
             DocBytes::Owned(v) => v,
-            // SAFETY: the source string is frozen (no mutation, no
-            // buffer reallocation) and pinned+kept alive by every
-            // node's GC mark; see DocBytes.
-            DocBytes::Frozen { ptr, len, .. } => unsafe { std::slice::from_raw_parts(*ptr, *len) },
+            // SAFETY: a live string (kept alive and pinned by every
+            // node's GC mark), read fresh on each call; see DocBytes.
+            DocBytes::Frozen(source) => unsafe { source.as_slice() },
             DocBytes::Mmap(m) => m,
         }
     }
@@ -77,8 +78,16 @@ const KIND_ARRAY: u8 = b'[';
 /// come from the crate's resolver (token edges within the doc bytes),
 /// and never cross the Ruby boundary, so they cannot be forged from
 /// Ruby.
+///
+/// `wb_protected`: a node's only Ruby reference (a frozen source, in
+/// the shared `DocInner`) is set before the root node is wrapped and
+/// never written again, so there is no write to put a barrier on, and
+/// nodes promote to the old generation instead of being rescanned by
+/// every minor GC (children cache Ruby-side, in barrier-protected
+/// ivars). `free_immediately`: dropping a node calls no Ruby API (it
+/// releases a Vec, an mmap, or nothing).
 #[derive(TypedData)]
-#[magnus(class = "NOSJ::Lazy", mark)]
+#[magnus(class = "NOSJ::Lazy", free_immediately, mark, wb_protected)]
 pub struct LazyNode {
     doc: Arc<DocInner>,
     start: usize,
@@ -88,11 +97,10 @@ pub struct LazyNode {
 
 impl DataTypeFunctions for LazyNode {
     fn mark(&self, marker: &magnus::gc::Marker) {
-        if let DocBytes::Frozen { source, .. } = self.doc.bytes {
-            use magnus::rb_sys::FromRawValue;
-            // SAFETY: the VALUE was a live, frozen string at node
-            // creation and this mark is what keeps it that way.
-            marker.mark(unsafe { Value::from_raw(source) });
+        // The source was a live, frozen string at node creation, and
+        // this mark is what keeps it that way.
+        if let DocBytes::Frozen(source) = self.doc.bytes {
+            marker.mark(source);
         }
     }
 }
@@ -101,6 +109,13 @@ impl LazyNode {
     fn span(&self) -> &[u8] {
         &self.doc.bytes()[self.start..self.end]
     }
+
+    /// A Reader over this node's span, walking the grammar the document
+    /// was opened with (trailing commas, NaN keywords).
+    fn reader<'a, 'b>(&'a self, bufs: &'b mut nosj::Buffers) -> nosj::Reader<'a, 'b> {
+        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
+        unsafe { nosj::Reader::from_utf8_unchecked_with(self.span(), bufs, self.doc.opts.popts) }
+    }
 }
 
 /// Wrap a resolved raw-value slice: containers become new lazy nodes,
@@ -125,13 +140,19 @@ fn resolved_to_value(ruby: &Ruby, doc: &Arc<DocInner>, sub: &[u8]) -> Result<Val
 /// Resolve `pointer` within `node`'s span. Shared by `__get` and
 /// `__at_pointer`; both misses and negative-index paths return nil.
 fn resolve_in_span(ruby: &Ruby, node: &LazyNode, pointer: &str) -> Result<Value, Error> {
-    // Resolve first (one PULL_STATE borrow, slice borrows the doc, not
-    // the buffers), then materialize (which re-borrows internally).
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    // Resolve, then materialize, as two separate uses of the parse
+    // state; the resolved slice borrows the doc, not the state.
+    let resolved = with_pull_state(|state| {
         // SAFETY: doc bytes were coderange-gated at NOSJ.lazy creation,
         // and spans lie on token edges, so the span is valid UTF-8.
-        unsafe { nosj::pointer_utf8_unchecked(node.span(), pointer, &mut state.bufs) }
+        unsafe {
+            nosj::pointer_utf8_unchecked_with(
+                node.span(),
+                pointer,
+                &mut state.bufs,
+                node.doc.opts.popts,
+            )
+        }
     });
     match resolved {
         Ok(None) => Ok(ruby.qnil().as_value()),
@@ -165,12 +186,7 @@ pub fn lazy_native(
     // on the caller's machine stack, so it stays pinned through this
     // call, and the node's mark takes over from the first GC on.
     let bytes = if data.as_value().is_frozen() {
-        use magnus::rb_sys::AsRawValue;
-        DocBytes::Frozen {
-            source: data.as_raw(),
-            ptr: input.as_ptr(),
-            len: input.len(),
-        }
+        DocBytes::Frozen(data)
     } else {
         DocBytes::Owned(input.to_vec())
     };
@@ -288,10 +304,8 @@ pub fn lazy_keys(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
         ));
     }
     let out = ruby.ary_new();
-    PULL_STATE.with(|cell| -> Result<(), Error> {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    with_pull_state(|state| -> Result<(), Error> {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node().map_err(|e| reader_err(ruby, &rb_self, e))?;
         let mut has = match r
             .object_first_key()
@@ -324,10 +338,8 @@ pub fn lazy_keys(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
 /// `__size`: entry count (object pairs or array elements), one walk,
 /// nothing materialized.
 pub fn lazy_size(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<usize, Error> {
-    PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    with_pull_state(|state| {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node().map_err(|e| reader_err(ruby, &rb_self, e))?;
         let mut n = 0usize;
         if rb_self.kind == KIND_OBJECT {
@@ -366,14 +378,12 @@ struct ChildDesc {
 
 /// `__children`: every direct child in ONE walk. Objects yield
 /// `[key, child]` pairs, arrays yield children; containers wrap lazily,
-/// scalars materialize. Two phases so the Reader's buffer borrow ends
-/// before materialization re-borrows the thread state.
+/// scalars materialize. Two phases so the walk's use of the parse state
+/// ends before materialization needs it (nested, it would start fresh).
 pub fn lazy_children(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
     let base = rb_self.doc.bytes().as_ptr() as usize;
-    let descs: Result<Vec<ChildDesc>, nosj::ParseError> = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    let descs: Result<Vec<ChildDesc>, nosj::ParseError> = with_pull_state(|state| {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node()?;
         let mut out = Vec::new();
         if rb_self.kind == KIND_OBJECT {

data/ext/nosj/src/lib.rs

@@ -37,6 +37,14 @@ use magnus::{method, prelude::*, Error, Ruby};
 // "nosj/nosj"), not the package name nosj_native (see Cargo.toml).
 #[magnus::init(name = "nosj")]
 fn init(ruby: &Ruby) -> Result<(), Error> {
+    // Declared before any method exists: Ruby marks the methods defined
+    // after this call as callable from every Ractor. What backs it: the
+    // generate scratch is taken out of its thread-local for a call (see
+    // gen::GEN_SCRATCH), the key caches hold only shareable VALUEs
+    // (interned strings, static symbols), and the warm-up at the end of
+    // init resolves every lazily-initialized static on the main Ractor.
+    // SAFETY: a flag write on the VM's extension-load state.
+    unsafe { rb_sys::rb_ext_ractor_safe(true) };
     compile_info();
 
     let module = ruby.define_module("NOSJ")?;
@@ -104,6 +112,15 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     // its `generate` through a Ruby frame into C, so skipping our own
     // forwarder frame is a straight per-call win on small documents.
     module.define_singleton_method("generate", method!(gen::generate_entry, -1))?;
+
+    // Warm-up on the main Ractor: magnus resolves a TypedData class (and
+    // gen/ruby.rs its interned IDs) behind a blocking lazy initializer
+    // that calls into the VM, and two Ractors racing that first touch
+    // deadlock (the loser parks natively and never joins the VM barrier
+    // the winner needs).
+    let _ = <state::ShadowHandle as magnus::TypedData>::class(ruby);
+    let _ = <lazy::LazyNode as magnus::TypedData>::class(ruby);
+    gen::warm_up();
     Ok(())
 }
 

data/ext/nosj/src/lines.rs

@@ -24,22 +24,31 @@ fn blank(line: &[u8]) -> bool {
 /// Yield one parsed value per non-blank line. Each line parses through
 /// the shared sink machinery against the FULL source, so a malformed
 /// line raises the rich ParserError whose `#line` is the physical
-/// NDJSON line number. The thread state is borrowed per line, never
-/// across a yield: the block is free to call back into NOSJ.
-fn walk_lines(ruby: &Ruby, source: &[u8], o: &ParseNativeOpts) -> Result<(), Error> {
+/// NDJSON line number. No slice is held across a yield: the block runs
+/// arbitrary Ruby (even deduplicating a frozen source swaps its buffer,
+/// see `lazy::DocBytes`), so `source` hands out the bytes afresh for
+/// every line, with identical content and so identical offsets.
+fn walk_lines<'s>(
+    ruby: &Ruby,
+    source: impl Fn() -> &'s [u8],
+    o: &ParseNativeOpts,
+) -> Result<(), Error> {
     let mut pos = 0;
-    while pos < source.len() {
-        let line_end = source[pos..]
+    loop {
+        let bytes = source();
+        if pos >= bytes.len() {
+            return Ok(());
+        }
+        let line_end = bytes[pos..]
             .iter()
             .position(|&b| b == b'\n')
-            .map_or(source.len(), |p| pos + p);
-        if !blank(&source[pos..line_end]) {
-            let value = materialize_at(ruby, source, pos, line_end, o)?;
+            .map_or(bytes.len(), |p| pos + p);
+        if !blank(&bytes[pos..line_end]) {
+            let value = materialize_at(ruby, bytes, pos, line_end, o)?;
             let _: Value = ruby.yield_value(value)?;
         }
         pos = line_end + 1;
     }
-    Ok(())
 }
 
 /// `NOSJ.each_line(source, opts) { |value| }`: the Ruby wrapper
@@ -53,15 +62,16 @@ pub fn each_line_native(
     let o = parse_native_opts(ruby, opts)?;
     let input = utf8_input(ruby, &data)?;
     if data.as_value().is_frozen() {
-        // A frozen source cannot be mutated by the block, and `data`
-        // lives on this frame, so the borrow stays valid across yields.
-        walk_lines(ruby, input, &o)?;
+        // A frozen source keeps its content (never its buffer, see
+        // walk_lines), so it is re-read per line, zero-copy.
+        // SAFETY: validated UTF-8 above; `data` lives on this frame.
+        walk_lines(ruby, || unsafe { data.as_slice() }, &o)?;
     } else {
-        // The block could mutate (or free the buffer of) an unfrozen
-        // source mid-iteration; walk a private copy. Same policy as
-        // NOSJ.lazy: pass a frozen string for zero-copy.
+        // The block could rewrite an unfrozen source mid-iteration;
+        // walk a private copy. Same policy as NOSJ.lazy: pass a frozen
+        // string for zero-copy.
         let owned = input.to_vec();
-        walk_lines(ruby, &owned, &o)?;
+        walk_lines(ruby, || &owned, &o)?;
     }
     Ok(ruby.qnil().as_value())
 }
@@ -84,7 +94,7 @@ pub fn each_line_file_native(
         return Ok(ruby.qnil().as_value());
     }
     with_mapped_file(ruby, &p, |map| {
-        walk_lines(ruby, &map, &o)?;
+        walk_lines(ruby, || &map, &o)?;
         Ok(ruby.qnil().as_value())
     })
 }

data/ext/nosj/src/parse.rs

@@ -8,7 +8,7 @@ use magnus::{Error, RString, Ruby, Value};
 
 use crate::errors::{nesting_error, parser_error, parser_error_at};
 use crate::sink::{NullSink, RubyValueSink, SinkAbort, MAX_NESTING};
-use crate::state::{ensure_marked_shadow, PullState, PULL_STATE};
+use crate::state::{ensure_marked_shadow, with_pull_state, PullState};
 
 pub(crate) use crate::errors::parser_error as err;
 
@@ -22,6 +22,12 @@ pub(crate) fn span_of(source: &[u8], sub: &[u8]) -> (usize, usize) {
 
 /// Validate that `data` is UTF-8 (or US-ASCII) with intact coderange and
 /// hand out its byte slice.
+///
+/// The slice borrows the string's buffer, which Ruby may reallocate or
+/// swap (even for a frozen string: see `lazy::DocBytes`), so it must
+/// not be held across anything that can run Ruby code: user callbacks,
+/// yields, or option decoding (`to_int` and friends). Decode options
+/// first; re-borrow after callbacks.
 pub(crate) fn utf8_input<'a>(ruby: &Ruby, data: &'a RString) -> Result<&'a [u8], Error> {
     let raw = data.as_raw();
     unsafe {
@@ -178,8 +184,7 @@ pub(crate) fn materialize_at(
     end: usize,
     o: &ParseNativeOpts,
 ) -> Result<Value, Error> {
-    PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    with_pull_state(|state| {
         ensure_marked_shadow(&mut state.vstack);
         ensure_marked_shadow(&mut state.key_shadow);
 
@@ -190,7 +195,7 @@ pub(crate) fn materialize_at(
             vstack,
             key_shadow,
             ..
-        } = &mut *state;
+        } = state;
         let stack = &mut vstack.as_mut().unwrap().values;
         stack.clear();
 
@@ -238,8 +243,7 @@ pub fn valid_native(
     let Ok(input) = utf8_input(ruby, &data) else {
         return Ok(false);
     };
-    let ok = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let ok = with_pull_state(|state| {
         let mut sink = NullSink {
             depth: 0,
             max_nesting: o.max_nesting,

data/ext/nosj/src/patch.rs

@@ -16,7 +16,7 @@ use magnus::{Error, ExceptionClass, RArray, RHash, RString, Ruby, Value};
 use crate::errors::{nosj_exception, parser_error_at};
 use crate::gen::{self, opts::GenConfig};
 use crate::parse::{materialize_at, span_of, utf8_input, ParseNativeOpts};
-use crate::state::PULL_STATE;
+use crate::state::with_pull_state;
 
 const WS: [u8; 4] = *b" \t\n\r";
 
@@ -46,8 +46,7 @@ fn gen_config<'a>(
 /// Parse failures raise the rich ParserError (absolute positions);
 /// pointer syntax errors raise ArgumentError, like `at_pointer`.
 fn span_at(ruby: &Ruby, doc: &[u8], pointer: &str) -> Result<Option<(usize, usize)>, Error> {
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let resolved = with_pull_state(|state| {
         // SAFETY: every entry validated the document bytes as UTF-8.
         unsafe { nosj::pointer_utf8_unchecked(doc, pointer, &mut state.bufs) }
     });
@@ -82,8 +81,7 @@ fn container_children(
 ) -> Result<(u8, Vec<ChildSpan>), Error> {
     let span = &doc[start..end];
     let kind = span.first().copied().unwrap_or(0);
-    let walk: Result<Vec<ChildSpan>, nosj::ParseError> = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let walk: Result<Vec<ChildSpan>, nosj::ParseError> = with_pull_state(|state| {
         // SAFETY: doc validated UTF-8 by the entry; spans lie on token
         // edges.
         let mut r = unsafe { nosj::Reader::from_utf8_unchecked(span, &mut state.bufs) };
@@ -360,6 +358,12 @@ fn op_test(ruby: &Ruby, doc: &[u8], path: &str, expected: Value) -> Result<(), E
 /// `NOSJ.splice(json, edits, opts)`: batch pointer replacement. All
 /// targets resolve in ONE forward pass; the output is built in one
 /// sweep copying every byte outside the target spans untouched.
+///
+/// Every value is generated BEFORE the source bytes are borrowed:
+/// generation runs user code (`to_json`, `to_s`) that may mutate or
+/// reallocate the source, or drop the only Ruby reference to a later
+/// value. Rendering inside the edits iteration keeps each value a live
+/// argument while it runs, and nothing after the borrow calls Ruby.
 pub fn splice_native(
     ruby: &Ruby,
     _rb_self: Value,
@@ -369,21 +373,26 @@ pub fn splice_native(
 ) -> Result<RString, Error> {
     let mut slot = None;
     let cfg = gen_config(ruby, opts, &mut slot)?;
-    let input = utf8_input(ruby, &data)?;
+    // Validate the encoding up front (error precedence); the bytes are
+    // borrowed again only after every callback has run.
+    utf8_input(ruby, &data)?;
 
     let mut pointers: Vec<String> = Vec::with_capacity(edits.len());
-    let mut values: Vec<Value> = Vec::with_capacity(edits.len());
+    let mut rendered: Vec<u8> = Vec::new();
+    let mut ranges: Vec<(usize, usize)> = Vec::with_capacity(edits.len());
     edits.foreach(|k: Value, v: Value| {
         let ptr = RString::from_value(k)
             .ok_or_else(|| arg_error(ruby, "splice pointers must be Strings".into()))?;
         pointers.push(ptr.to_string()?);
-        values.push(v);
+        let start = rendered.len();
+        gen::emit_into(ruby, v, cfg, &mut rendered)?;
+        ranges.push((start, rendered.len()));
         Ok(magnus::r_hash::ForEach::Continue)
     })?;
 
+    let input = utf8_input(ruby, &data)?;
     let refs: Vec<&str> = pointers.iter().map(String::as_str).collect();
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let resolved = with_pull_state(|state| {
         // SAFETY: coderange verified by utf8_input.
         unsafe { nosj::pointers_utf8_unchecked(input, &refs, &mut state.bufs) }
     });
@@ -395,7 +404,7 @@ pub fn splice_native(
         Err(e) => return Err(parser_error_at(ruby, input, e.offset, e.to_string())),
     };
 
-    let mut spans: Vec<(usize, usize, Value)> = Vec::with_capacity(pointers.len());
+    let mut spans: Vec<(usize, usize, usize)> = Vec::with_capacity(pointers.len());
     for (i, hit) in hits.into_iter().enumerate() {
         let Some(slice) = hit else {
             let exc: ExceptionClass = ruby.exception_key_error();
@@ -405,7 +414,7 @@ pub fn splice_native(
             ));
         };
         let (s, e) = span_of(input, slice.as_bytes());
-        spans.push((s, e, values[i]));
+        spans.push((s, e, i));
     }
     spans.sort_unstable_by_key(|&(s, _, _)| s);
     for pair in spans.windows(2) {
@@ -417,11 +426,12 @@ pub fn splice_native(
         }
     }
 
-    let mut out = Vec::with_capacity(input.len() + 64);
+    let mut out = Vec::with_capacity(input.len() + rendered.len());
     let mut pos = 0;
-    for &(s, e, v) in &spans {
+    for &(s, e, edit) in &spans {
+        let (rs, re) = ranges[edit];
         out.extend_from_slice(&input[pos..s]);
-        gen::emit_into(ruby, v, cfg, &mut out)?;
+        out.extend_from_slice(&rendered[rs..re]);
         pos = e;
     }
     out.extend_from_slice(&input[pos..]);

data/ext/nosj/src/pointer.rs

@@ -7,7 +7,7 @@ use magnus::{Error, RString, Ruby, Value};
 
 use crate::errors::parser_error_at;
 use crate::parse::{materialize_at, parse_native_opts, span_of, utf8_input, ParseNativeOpts};
-use crate::state::PULL_STATE;
+use crate::state::with_pull_state;
 
 /// Resolve one JSON Pointer against `data`, materializing the matched
 /// subtree; `nil` when the pointer misses.
@@ -19,12 +19,11 @@ fn at_pointer_impl(
 ) -> Result<Value, Error> {
     use magnus::value::ReprValue;
     let input = utf8_input(ruby, &data)?;
-    // Resolve first (one PULL_STATE borrow), then materialize (a fresh
-    // borrow); the resolved slice borrows `input`, not the buffers.
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    // Resolve, then materialize, as two separate uses of the parse
+    // state; the resolved slice borrows `input`, not the state.
+    let resolved = with_pull_state(|state| {
         // Safety: coderange verified above.
-        unsafe { nosj::pointer_utf8_unchecked(input, pointer, &mut state.bufs) }
+        unsafe { nosj::pointer_utf8_unchecked_with(input, pointer, &mut state.bufs, o.popts) }
     });
     match resolved {
         Ok(None) => Ok(ruby.qnil().as_value()),
@@ -125,12 +124,11 @@ fn at_pointers_impl(
     let input = utf8_input(ruby, &data)?;
     let live: Vec<&str> = pointers.iter().flatten().map(String::as_str).collect();
 
-    // Resolve first (one PULL_STATE borrow); the resolved slices borrow
-    // `input`, not the buffers, so materializing can re-borrow freely.
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    // Resolve first (one use of the parse state); the resolved slices
+    // borrow `input`, not the state, so each materializes separately.
+    let resolved = with_pull_state(|state| {
         // Safety: coderange verified by utf8_input.
-        unsafe { nosj::pointers_utf8_unchecked(input, &live, &mut state.bufs) }
+        unsafe { nosj::pointers_utf8_unchecked_with(input, &live, &mut state.bufs, o.popts) }
     });
     let mut hits = match resolved {
         Ok(hits) => hits.into_iter(),

data/ext/nosj/src/reformat.rs

@@ -13,7 +13,7 @@
 //! canonical spelling (`1.50` becomes `1.5`), and string escapes are
 //! normalized by the emission kernels.
 
-use std::cell::RefCell;
+use std::cell::Cell;
 
 use magnus::value::ReprValue;
 use magnus::{Error, RString, Ruby, Value};
@@ -23,16 +23,15 @@ use nosj::{FloatFormat, WriteOptions, Writer};
 use crate::errors::{nesting_error, nosj_exception, parser_error, parser_error_at};
 use crate::files::with_mapped_file;
 use crate::gen::opts::{parse_gen_opts, GenConfig, DEFAULT_CONFIG};
-use crate::parse::{parse_native_opts, utf8_input};
+use crate::parse::{parse_native_opts, utf8_input, ParseNativeOpts};
 use crate::patch::finish_string;
 use crate::sink::SinkAbort;
-use crate::state::PULL_STATE;
+use crate::state::{with_pull_state, with_taken};
 
 thread_local! {
-    /// Pooled output buffer: capacity survives across calls. The pipe
-    /// never calls back into Ruby, so the borrow spans the whole drive
-    /// without any reentrancy concern.
-    static PIPE_BUF: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
+    /// Pooled output buffer: capacity survives across calls (see
+    /// `state::with_taken`).
+    static PIPE_BUF: Cell<Vec<u8>> = const { Cell::new(Vec::new()) };
 }
 
 /// The event-to-Writer pipe. Structure events forward to the Writer's
@@ -230,37 +229,50 @@ fn write_options(cfg: &GenConfig) -> WriteOptions {
     w
 }
 
+/// Decoded reformat options: parse acceptance plus generate formatting.
+/// Decoded before the source is borrowed, since decoding can run Ruby
+/// (an option value's `to_int`; see `parse::utf8_input`).
+struct ReformatOpts {
+    parse: ParseNativeOpts,
+    generate: Option<GenConfig>,
+}
+
+impl ReformatOpts {
+    fn decode(ruby: &Ruby, opts: Value) -> Result<Self, Error> {
+        Ok(Self {
+            parse: parse_native_opts(ruby, opts)?,
+            generate: if opts.is_nil() {
+                None
+            } else {
+                Some(parse_gen_opts(ruby, opts)?.0)
+            },
+        })
+    }
+}
+
 /// Run the pipe over already-UTF-8-vouched bytes.
-fn reformat_over(ruby: &Ruby, input: &[u8], opts: Value) -> Result<RString, Error> {
-    let po = parse_native_opts(ruby, opts)?;
-    let built;
-    let gcfg: &GenConfig = if opts.is_nil() {
-        &DEFAULT_CONFIG
-    } else {
-        built = parse_gen_opts(ruby, opts)?.0;
-        &built
-    };
+fn reformat_over(ruby: &Ruby, input: &[u8], opts: &ReformatOpts) -> Result<RString, Error> {
+    let po = &opts.parse;
+    let gcfg = opts.generate.as_ref().unwrap_or(&DEFAULT_CONFIG);
     let wopts = write_options(gcfg);
 
-    PIPE_BUF.with(|cell| {
-        let mut buf = cell.borrow_mut();
+    with_taken(&PIPE_BUF, |buf| {
         buf.clear();
         // The output is at least input-sized for minify-shaped runs.
         buf.reserve(input.len());
         let mut sink = PipeSink {
-            w: Writer::new(&mut buf, &wopts),
+            w: Writer::new(buf, &wopts),
             depth: 0,
             max_nesting: po.max_nesting,
             mode: gcfg.mode,
             allow_nan: gcfg.allow_nan,
         };
-        let result = PULL_STATE.with(|state_cell| {
-            let mut state = state_cell.borrow_mut();
+        let result = with_pull_state(|state| {
             // Safety: callers verified UTF-8 (coderange or full scan).
             unsafe { nosj::parse_utf8_unchecked_with(input, &mut state.bufs, &mut sink, po.popts) }
         });
         match result {
-            Ok(()) => finish_string(&buf),
+            Ok(()) => finish_string(buf),
             Err(nosj::DriveError::Sink(SinkAbort::TooDeep)) => Err(nesting_error(
                 ruby,
                 format!(
@@ -296,8 +308,9 @@ pub fn reformat_native(
     data: RString,
     opts: Value,
 ) -> Result<RString, Error> {
+    let opts = ReformatOpts::decode(ruby, opts)?;
     let input = utf8_input(ruby, &data)?;
-    reformat_over(ruby, input, opts)
+    reformat_over(ruby, input, &opts)
 }
 
 /// `NOSJ.reformat_file_native(path, opts)`: the pipe over a read-only
@@ -309,12 +322,13 @@ pub fn reformat_file_native(
     opts: Value,
 ) -> Result<RString, Error> {
     let p = path.to_string()?;
+    let opts = ReformatOpts::decode(ruby, opts)?;
     // Mapping a zero-length file fails with EINVAL on Linux; route an
     // empty file to the parser's own "unexpected end of input" so the
     // error class is deterministic across platforms. Metadata failures
     // fall through for the mapper's Errno.
     if std::fs::metadata(&p).is_ok_and(|m| m.len() == 0) {
-        return reformat_over(ruby, &[], opts);
+        return reformat_over(ruby, &[], &opts);
     }
-    with_mapped_file(ruby, &p, |map| reformat_over(ruby, &map, opts))
+    with_mapped_file(ruby, &p, |map| reformat_over(ruby, &map, &opts))
 }