nosj 0.4.0 → 0.4.1

data/ext/nosj/src/gen/walker.rs

@@ -3,6 +3,7 @@
 //! Compact and pretty modes are one const-generic body, so the compact
 //! hot path carries no formatting branches.
 
+use magnus::Error;
 use nosj::emit::{self, copy_short_raw, EscapeMode};
 use rb_sys::macros::{
     FIX2LONG, FIXNUM_P, FLONUM_P, RARRAY_CONST_PTR, RARRAY_LEN, RB_BUILTIN_TYPE, RHASH_SIZE,
@@ -15,8 +16,8 @@ use super::keys::GenKeyCache;
 use super::opts::GenConfig;
 use super::ruby::{
     is_json_fragment, is_special_const, protected_as_json, protected_encode_utf8,
-    protected_to_json, protected_to_s, rstring_bytes, str_coderange, str_enc_index, to_json_id,
-    utf8_encindexes, CR_7BIT, CR_VALID, QFALSE, QNIL, QTRUE,
+    protected_to_json, protected_to_json_if_responds, protected_to_s, rstring_bytes, str_coderange,
+    str_enc_index, utf8_encindexes, CR_7BIT, CR_VALID, QFALSE, QNIL, QTRUE,
 };
 
 /// Whether keys escaped under `mode` may be cached: the cached bytes
@@ -265,13 +266,15 @@ impl Gen<'_> {
             let s = unsafe { rb_sys::rb_sym2str(k) };
             return self.emit_rstring_quoted(s);
         }
-        match protected_to_s(k) {
-            Ok(s) => self.emit_rstring_quoted(s),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
-        }
+        let s = self.reraise(protected_to_s(k))?;
+        self.emit_rstring_quoted(s)
+    }
+
+    /// A protected Ruby call's outcome inside the walk: a raised
+    /// exception becomes this walk's failure, re-raised unchanged once
+    /// the walk has unwound.
+    fn reraise<T>(&mut self, r: Result<T, Error>) -> Result<T, ()> {
+        r.map_err(|exc| self.fail = Some(GenFail::Reraise(exc)))
     }
 
     /// Non-native type: strict raises (except `JSON::Fragment`, which
@@ -285,7 +288,7 @@ impl Gen<'_> {
             return self.emit_rails_fallback::<PRETTY>(raw, depth);
         }
         if self.cfg.strict {
-            if is_json_fragment(raw) {
+            if self.reraise(is_json_fragment(raw))? {
                 return self.splice_to_json(raw);
             }
             let name = unsafe {
@@ -296,53 +299,32 @@ impl Gen<'_> {
             self.fail = Some(GenFail::Generator(format!("{name} not allowed in JSON")));
             return Err(());
         }
-        if unsafe { rb_sys::rb_respond_to(raw, to_json_id()) } != 0 {
-            match protected_to_json(raw) {
-                Ok(json) => {
-                    if !is_special_const(json)
-                        && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING
-                    {
-                        self.append_rstring_raw(json);
-                        return Ok(());
-                    }
-                }
-                Err(exc) => {
-                    self.fail = Some(GenFail::Reraise(exc));
-                    return Err(());
-                }
-            }
-        }
-        match protected_to_s(raw) {
-            Ok(s) => self.emit_rstring_quoted(s),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
+        if let Some(json) = self.reraise(protected_to_json_if_responds(raw))? {
+            if !is_special_const(json)
+                && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING
+            {
+                self.append_rstring_raw(json);
+                return Ok(());
             }
         }
+        let s = self.reraise(protected_to_s(raw))?;
+        self.emit_rstring_quoted(s)
     }
 
     /// Splice `raw`'s `to_json` result verbatim: the JSON::Fragment
     /// path (pre-rendered JSON, trusted like the gem trusts it).
     fn splice_to_json(&mut self, raw: VALUE) -> Result<(), ()> {
-        match protected_to_json(raw) {
-            Ok(json)
-                if !is_special_const(json)
-                    && unsafe { RB_BUILTIN_TYPE(json) } == ruby_value_type::RUBY_T_STRING =>
-            {
-                self.append_rstring_raw(json);
-                Ok(())
-            }
-            Ok(_) => {
-                self.fail = Some(GenFail::Generator(
-                    "JSON::Fragment#to_json did not return a String".to_string(),
-                ));
-                Err(())
-            }
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
+        let json = self.reraise(protected_to_json(raw))?;
+        if is_special_const(json)
+            || unsafe { RB_BUILTIN_TYPE(json) } != ruby_value_type::RUBY_T_STRING
+        {
+            self.fail = Some(GenFail::Generator(
+                "JSON::Fragment#to_json did not return a String".to_string(),
+            ));
+            return Err(());
         }
+        self.append_rstring_raw(json);
+        Ok(())
     }
 
     /// Rails-mode fallback, mirroring JSONGemEncoder#jsonify:
@@ -356,27 +338,22 @@ impl Gen<'_> {
         raw: VALUE,
         depth: usize,
     ) -> Result<(), ()> {
-        if is_json_fragment(raw) {
+        if self.reraise(is_json_fragment(raw))? {
             return self.splice_to_json(raw);
         }
-        match protected_as_json(raw) {
-            Ok(json) if json == raw => {
-                let name = unsafe {
-                    std::ffi::CStr::from_ptr(rb_sys::rb_obj_classname(raw))
-                        .to_string_lossy()
-                        .into_owned()
-                };
-                self.fail = Some(GenFail::Generator(format!(
-                    "{name}#as_json returned the receiver"
-                )));
-                Err(())
-            }
-            Ok(json) => self.emit_value::<PRETTY>(json, depth),
-            Err(exc) => {
-                self.fail = Some(GenFail::Reraise(exc));
-                Err(())
-            }
+        let json = self.reraise(protected_as_json(raw))?;
+        if json == raw {
+            let name = unsafe {
+                std::ffi::CStr::from_ptr(rb_sys::rb_obj_classname(raw))
+                    .to_string_lossy()
+                    .into_owned()
+            };
+            self.fail = Some(GenFail::Generator(format!(
+                "{name}#as_json returned the receiver"
+            )));
+            return Err(());
         }
+        self.emit_value::<PRETTY>(json, depth)
     }
 
     fn nesting_check(&mut self, inner: usize) -> Result<(), ()> {
@@ -390,14 +367,23 @@ impl Gen<'_> {
     fn emit_array<const PRETTY: bool>(&mut self, ary: VALUE, depth: usize) -> Result<(), ()> {
         let inner = depth + 1;
         self.nesting_check(inner)?;
-        let len = unsafe { RARRAY_LEN(ary) } as usize;
         self.out.push(b'[');
-        if len == 0 {
+        if unsafe { RARRAY_LEN(ary) } == 0 {
             self.out.push(b']');
             return Ok(());
         }
         let mut i = 0usize;
-        while i < len {
+        loop {
+            // Length and pointer are re-read every element, like the
+            // json gem: a user callback inside the recursion (to_json,
+            // to_s, as_json) may shrink the array (slots past the live
+            // length hold freed or reused VALUEs; growth is emitted),
+            // and any allocation may compact it elsewhere.
+            let len = unsafe { RARRAY_LEN(ary) } as usize;
+            if i >= len {
+                break;
+            }
+            let elem = unsafe { *RARRAY_CONST_PTR(ary).add(i) };
             if i > 0 {
                 self.out.push(b',');
             }
@@ -405,9 +391,6 @@ impl Gen<'_> {
                 self.out.extend_from_slice(&self.cfg.array_nl);
                 self.push_indent(inner);
             }
-            // Re-read the pointer every element: an allocation inside the
-            // recursion may trigger GC compaction and move the array.
-            let elem = unsafe { *RARRAY_CONST_PTR(ary).add(i) };
             // Numeric runs (compact mode) emit through a raw local
             // cursor under one chunked reservation: per-element Vec
             // operations round-trip length and pointer through memory

data/ext/nosj/src/lazy.rs

@@ -20,20 +20,20 @@ use magnus::{DataTypeFunctions, Error, RArray, RString, Ruby, TypedData, Value};
 use crate::errors::parser_error_at;
 use crate::parse::{materialize_at, parse_native_opts, span_of, utf8_input, ParseNativeOpts};
 use crate::pointer::{path_to_pointer, push_escaped_token};
-use crate::state::PULL_STATE;
+use crate::state::with_pull_state;
 
 /// The document bytes behind a node tree. A frozen Ruby source is
-/// borrowed zero-copy: freezing rules out mutation, and every node
-/// GC-marks the string with `rb_gc_mark` semantics, which both keeps it
-/// alive and pins it against compaction, so the captured pointer stays
-/// valid for as long as any node exists. Anything else is copied once.
+/// borrowed zero-copy: freezing rules out any change to its CONTENT,
+/// and every node GC-marks the string with `rb_gc_mark` semantics
+/// (alive, and pinned against compaction). Freezing does NOT pin the
+/// buffer, though: deduplicating a frozen String subclass or a string
+/// carrying ivars (`-str`) swaps in an identical shared buffer and
+/// frees the old one. So the bytes are re-read from the string on every
+/// access; same content means every span stays valid. Anything else is
+/// copied once.
 pub(crate) enum DocBytes {
     Owned(Vec<u8>),
-    Frozen {
-        source: rb_sys::VALUE,
-        ptr: *const u8,
-        len: usize,
-    },
+    Frozen(RString),
     /// A read-only file mapping (`NOSJ.load_lazy_file`): pages never
     /// touched are never read off disk. Concurrent modification of the
     /// mapped file by another process is documented as unsupported
@@ -48,23 +48,24 @@ struct DocInner {
     opts: ParseNativeOpts,
 }
 
-// SAFETY: the bytes are immutable for the document's whole life (an
+// SAFETY: the content is immutable for the document's whole life (an
 // owned Vec, or a frozen Ruby string pinned and kept alive by every
-// node's GC mark), so cross-thread reads are plain shared reads; the
-// raw VALUE is only dereferenced by the GC mark, which runs at
-// safepoints (the ShadowHandle contract in state.rs). There is no
-// interior mutability anywhere in the type.
+// node's GC mark), so cross-thread reads are plain shared reads of it.
+// There is no interior mutability anywhere in the type.
 unsafe impl Send for DocInner {}
 unsafe impl Sync for DocInner {}
 
 impl DocInner {
+    /// The document bytes. For a frozen source the slice is valid only
+    /// until the next Ruby call (which could swap the string's buffer;
+    /// see DocBytes): callers finish with it, or call this again,
+    /// before running Ruby code.
     fn bytes(&self) -> &[u8] {
         match &self.bytes {
             DocBytes::Owned(v) => v,
-            // SAFETY: the source string is frozen (no mutation, no
-            // buffer reallocation) and pinned+kept alive by every
-            // node's GC mark; see DocBytes.
-            DocBytes::Frozen { ptr, len, .. } => unsafe { std::slice::from_raw_parts(*ptr, *len) },
+            // SAFETY: a live string (kept alive and pinned by every
+            // node's GC mark), read fresh on each call; see DocBytes.
+            DocBytes::Frozen(source) => unsafe { source.as_slice() },
             DocBytes::Mmap(m) => m,
         }
     }
@@ -77,8 +78,16 @@ const KIND_ARRAY: u8 = b'[';
 /// come from the crate's resolver (token edges within the doc bytes),
 /// and never cross the Ruby boundary, so they cannot be forged from
 /// Ruby.
+///
+/// `wb_protected`: a node's only Ruby reference (a frozen source, in
+/// the shared `DocInner`) is set before the root node is wrapped and
+/// never written again, so there is no write to put a barrier on, and
+/// nodes promote to the old generation instead of being rescanned by
+/// every minor GC (children cache Ruby-side, in barrier-protected
+/// ivars). `free_immediately`: dropping a node calls no Ruby API (it
+/// releases a Vec, an mmap, or nothing).
 #[derive(TypedData)]
-#[magnus(class = "NOSJ::Lazy", mark)]
+#[magnus(class = "NOSJ::Lazy", free_immediately, mark, wb_protected)]
 pub struct LazyNode {
     doc: Arc<DocInner>,
     start: usize,
@@ -88,11 +97,10 @@ pub struct LazyNode {
 
 impl DataTypeFunctions for LazyNode {
     fn mark(&self, marker: &magnus::gc::Marker) {
-        if let DocBytes::Frozen { source, .. } = self.doc.bytes {
-            use magnus::rb_sys::FromRawValue;
-            // SAFETY: the VALUE was a live, frozen string at node
-            // creation and this mark is what keeps it that way.
-            marker.mark(unsafe { Value::from_raw(source) });
+        // The source was a live, frozen string at node creation, and
+        // this mark is what keeps it that way.
+        if let DocBytes::Frozen(source) = self.doc.bytes {
+            marker.mark(source);
         }
     }
 }
@@ -101,6 +109,13 @@ impl LazyNode {
     fn span(&self) -> &[u8] {
         &self.doc.bytes()[self.start..self.end]
     }
+
+    /// A Reader over this node's span, walking the grammar the document
+    /// was opened with (trailing commas, NaN keywords).
+    fn reader<'a, 'b>(&'a self, bufs: &'b mut nosj::Buffers) -> nosj::Reader<'a, 'b> {
+        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
+        unsafe { nosj::Reader::from_utf8_unchecked_with(self.span(), bufs, self.doc.opts.popts) }
+    }
 }
 
 /// Wrap a resolved raw-value slice: containers become new lazy nodes,
@@ -125,13 +140,19 @@ fn resolved_to_value(ruby: &Ruby, doc: &Arc<DocInner>, sub: &[u8]) -> Result<Val
 /// Resolve `pointer` within `node`'s span. Shared by `__get` and
 /// `__at_pointer`; both misses and negative-index paths return nil.
 fn resolve_in_span(ruby: &Ruby, node: &LazyNode, pointer: &str) -> Result<Value, Error> {
-    // Resolve first (one PULL_STATE borrow, slice borrows the doc, not
-    // the buffers), then materialize (which re-borrows internally).
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    // Resolve, then materialize, as two separate uses of the parse
+    // state; the resolved slice borrows the doc, not the state.
+    let resolved = with_pull_state(|state| {
         // SAFETY: doc bytes were coderange-gated at NOSJ.lazy creation,
         // and spans lie on token edges, so the span is valid UTF-8.
-        unsafe { nosj::pointer_utf8_unchecked(node.span(), pointer, &mut state.bufs) }
+        unsafe {
+            nosj::pointer_utf8_unchecked_with(
+                node.span(),
+                pointer,
+                &mut state.bufs,
+                node.doc.opts.popts,
+            )
+        }
     });
     match resolved {
         Ok(None) => Ok(ruby.qnil().as_value()),
@@ -165,12 +186,7 @@ pub fn lazy_native(
     // on the caller's machine stack, so it stays pinned through this
     // call, and the node's mark takes over from the first GC on.
     let bytes = if data.as_value().is_frozen() {
-        use magnus::rb_sys::AsRawValue;
-        DocBytes::Frozen {
-            source: data.as_raw(),
-            ptr: input.as_ptr(),
-            len: input.len(),
-        }
+        DocBytes::Frozen(data)
     } else {
         DocBytes::Owned(input.to_vec())
     };
@@ -288,10 +304,8 @@ pub fn lazy_keys(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
         ));
     }
     let out = ruby.ary_new();
-    PULL_STATE.with(|cell| -> Result<(), Error> {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    with_pull_state(|state| -> Result<(), Error> {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node().map_err(|e| reader_err(ruby, &rb_self, e))?;
         let mut has = match r
             .object_first_key()
@@ -324,10 +338,8 @@ pub fn lazy_keys(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
 /// `__size`: entry count (object pairs or array elements), one walk,
 /// nothing materialized.
 pub fn lazy_size(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<usize, Error> {
-    PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    with_pull_state(|state| {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node().map_err(|e| reader_err(ruby, &rb_self, e))?;
         let mut n = 0usize;
         if rb_self.kind == KIND_OBJECT {
@@ -366,14 +378,12 @@ struct ChildDesc {
 
 /// `__children`: every direct child in ONE walk. Objects yield
 /// `[key, child]` pairs, arrays yield children; containers wrap lazily,
-/// scalars materialize. Two phases so the Reader's buffer borrow ends
-/// before materialization re-borrows the thread state.
+/// scalars materialize. Two phases so the walk's use of the parse state
+/// ends before materialization needs it (nested, it would start fresh).
 pub fn lazy_children(ruby: &Ruby, rb_self: Obj<LazyNode>) -> Result<RArray, Error> {
     let base = rb_self.doc.bytes().as_ptr() as usize;
-    let descs: Result<Vec<ChildDesc>, nosj::ParseError> = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
-        // SAFETY: spans are valid UTF-8 (see resolve_in_span).
-        let mut r = unsafe { nosj::Reader::from_utf8_unchecked(rb_self.span(), &mut state.bufs) };
+    let descs: Result<Vec<ChildDesc>, nosj::ParseError> = with_pull_state(|state| {
+        let mut r = rb_self.reader(&mut state.bufs);
         r.next_node()?;
         let mut out = Vec::new();
         if rb_self.kind == KIND_OBJECT {

data/ext/nosj/src/lines.rs

@@ -24,22 +24,31 @@ fn blank(line: &[u8]) -> bool {
 /// Yield one parsed value per non-blank line. Each line parses through
 /// the shared sink machinery against the FULL source, so a malformed
 /// line raises the rich ParserError whose `#line` is the physical
-/// NDJSON line number. The thread state is borrowed per line, never
-/// across a yield: the block is free to call back into NOSJ.
-fn walk_lines(ruby: &Ruby, source: &[u8], o: &ParseNativeOpts) -> Result<(), Error> {
+/// NDJSON line number. No slice is held across a yield: the block runs
+/// arbitrary Ruby (even deduplicating a frozen source swaps its buffer,
+/// see `lazy::DocBytes`), so `source` hands out the bytes afresh for
+/// every line, with identical content and so identical offsets.
+fn walk_lines<'s>(
+    ruby: &Ruby,
+    source: impl Fn() -> &'s [u8],
+    o: &ParseNativeOpts,
+) -> Result<(), Error> {
     let mut pos = 0;
-    while pos < source.len() {
-        let line_end = source[pos..]
+    loop {
+        let bytes = source();
+        if pos >= bytes.len() {
+            return Ok(());
+        }
+        let line_end = bytes[pos..]
             .iter()
             .position(|&b| b == b'\n')
-            .map_or(source.len(), |p| pos + p);
-        if !blank(&source[pos..line_end]) {
-            let value = materialize_at(ruby, source, pos, line_end, o)?;
+            .map_or(bytes.len(), |p| pos + p);
+        if !blank(&bytes[pos..line_end]) {
+            let value = materialize_at(ruby, bytes, pos, line_end, o)?;
             let _: Value = ruby.yield_value(value)?;
         }
         pos = line_end + 1;
     }
-    Ok(())
 }
 
 /// `NOSJ.each_line(source, opts) { |value| }`: the Ruby wrapper
@@ -53,15 +62,16 @@ pub fn each_line_native(
     let o = parse_native_opts(ruby, opts)?;
     let input = utf8_input(ruby, &data)?;
     if data.as_value().is_frozen() {
-        // A frozen source cannot be mutated by the block, and `data`
-        // lives on this frame, so the borrow stays valid across yields.
-        walk_lines(ruby, input, &o)?;
+        // A frozen source keeps its content (never its buffer, see
+        // walk_lines), so it is re-read per line, zero-copy.
+        // SAFETY: validated UTF-8 above; `data` lives on this frame.
+        walk_lines(ruby, || unsafe { data.as_slice() }, &o)?;
     } else {
-        // The block could mutate (or free the buffer of) an unfrozen
-        // source mid-iteration; walk a private copy. Same policy as
-        // NOSJ.lazy: pass a frozen string for zero-copy.
+        // The block could rewrite an unfrozen source mid-iteration;
+        // walk a private copy. Same policy as NOSJ.lazy: pass a frozen
+        // string for zero-copy.
         let owned = input.to_vec();
-        walk_lines(ruby, &owned, &o)?;
+        walk_lines(ruby, || &owned, &o)?;
     }
     Ok(ruby.qnil().as_value())
 }
@@ -84,7 +94,7 @@ pub fn each_line_file_native(
         return Ok(ruby.qnil().as_value());
     }
     with_mapped_file(ruby, &p, |map| {
-        walk_lines(ruby, &map, &o)?;
+        walk_lines(ruby, || &map, &o)?;
         Ok(ruby.qnil().as_value())
     })
 }

data/ext/nosj/src/parse.rs

@@ -8,7 +8,7 @@ use magnus::{Error, RString, Ruby, Value};
 
 use crate::errors::{nesting_error, parser_error, parser_error_at};
 use crate::sink::{NullSink, RubyValueSink, SinkAbort, MAX_NESTING};
-use crate::state::{ensure_marked_shadow, PullState, PULL_STATE};
+use crate::state::{ensure_marked_shadow, with_pull_state, PullState};
 
 pub(crate) use crate::errors::parser_error as err;
 
@@ -22,6 +22,12 @@ pub(crate) fn span_of(source: &[u8], sub: &[u8]) -> (usize, usize) {
 
 /// Validate that `data` is UTF-8 (or US-ASCII) with intact coderange and
 /// hand out its byte slice.
+///
+/// The slice borrows the string's buffer, which Ruby may reallocate or
+/// swap (even for a frozen string: see `lazy::DocBytes`), so it must
+/// not be held across anything that can run Ruby code: user callbacks,
+/// yields, or option decoding (`to_int` and friends). Decode options
+/// first; re-borrow after callbacks.
 pub(crate) fn utf8_input<'a>(ruby: &Ruby, data: &'a RString) -> Result<&'a [u8], Error> {
     let raw = data.as_raw();
     unsafe {
@@ -178,8 +184,7 @@ pub(crate) fn materialize_at(
     end: usize,
     o: &ParseNativeOpts,
 ) -> Result<Value, Error> {
-    PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    with_pull_state(|state| {
         ensure_marked_shadow(&mut state.vstack);
         ensure_marked_shadow(&mut state.key_shadow);
 
@@ -190,7 +195,7 @@ pub(crate) fn materialize_at(
             vstack,
             key_shadow,
             ..
-        } = &mut *state;
+        } = state;
         let stack = &mut vstack.as_mut().unwrap().values;
         stack.clear();
 
@@ -238,8 +243,7 @@ pub fn valid_native(
     let Ok(input) = utf8_input(ruby, &data) else {
         return Ok(false);
     };
-    let ok = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let ok = with_pull_state(|state| {
         let mut sink = NullSink {
             depth: 0,
             max_nesting: o.max_nesting,

data/ext/nosj/src/patch.rs

@@ -16,7 +16,7 @@ use magnus::{Error, ExceptionClass, RArray, RHash, RString, Ruby, Value};
 use crate::errors::{nosj_exception, parser_error_at};
 use crate::gen::{self, opts::GenConfig};
 use crate::parse::{materialize_at, span_of, utf8_input, ParseNativeOpts};
-use crate::state::PULL_STATE;
+use crate::state::with_pull_state;
 
 const WS: [u8; 4] = *b" \t\n\r";
 
@@ -46,8 +46,7 @@ fn gen_config<'a>(
 /// Parse failures raise the rich ParserError (absolute positions);
 /// pointer syntax errors raise ArgumentError, like `at_pointer`.
 fn span_at(ruby: &Ruby, doc: &[u8], pointer: &str) -> Result<Option<(usize, usize)>, Error> {
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let resolved = with_pull_state(|state| {
         // SAFETY: every entry validated the document bytes as UTF-8.
         unsafe { nosj::pointer_utf8_unchecked(doc, pointer, &mut state.bufs) }
     });
@@ -82,8 +81,7 @@ fn container_children(
 ) -> Result<(u8, Vec<ChildSpan>), Error> {
     let span = &doc[start..end];
     let kind = span.first().copied().unwrap_or(0);
-    let walk: Result<Vec<ChildSpan>, nosj::ParseError> = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let walk: Result<Vec<ChildSpan>, nosj::ParseError> = with_pull_state(|state| {
         // SAFETY: doc validated UTF-8 by the entry; spans lie on token
         // edges.
         let mut r = unsafe { nosj::Reader::from_utf8_unchecked(span, &mut state.bufs) };
@@ -360,6 +358,12 @@ fn op_test(ruby: &Ruby, doc: &[u8], path: &str, expected: Value) -> Result<(), E
 /// `NOSJ.splice(json, edits, opts)`: batch pointer replacement. All
 /// targets resolve in ONE forward pass; the output is built in one
 /// sweep copying every byte outside the target spans untouched.
+///
+/// Every value is generated BEFORE the source bytes are borrowed:
+/// generation runs user code (`to_json`, `to_s`) that may mutate or
+/// reallocate the source, or drop the only Ruby reference to a later
+/// value. Rendering inside the edits iteration keeps each value a live
+/// argument while it runs, and nothing after the borrow calls Ruby.
 pub fn splice_native(
     ruby: &Ruby,
     _rb_self: Value,
@@ -369,21 +373,26 @@ pub fn splice_native(
 ) -> Result<RString, Error> {
     let mut slot = None;
     let cfg = gen_config(ruby, opts, &mut slot)?;
-    let input = utf8_input(ruby, &data)?;
+    // Validate the encoding up front (error precedence); the bytes are
+    // borrowed again only after every callback has run.
+    utf8_input(ruby, &data)?;
 
     let mut pointers: Vec<String> = Vec::with_capacity(edits.len());
-    let mut values: Vec<Value> = Vec::with_capacity(edits.len());
+    let mut rendered: Vec<u8> = Vec::new();
+    let mut ranges: Vec<(usize, usize)> = Vec::with_capacity(edits.len());
     edits.foreach(|k: Value, v: Value| {
         let ptr = RString::from_value(k)
             .ok_or_else(|| arg_error(ruby, "splice pointers must be Strings".into()))?;
         pointers.push(ptr.to_string()?);
-        values.push(v);
+        let start = rendered.len();
+        gen::emit_into(ruby, v, cfg, &mut rendered)?;
+        ranges.push((start, rendered.len()));
         Ok(magnus::r_hash::ForEach::Continue)
     })?;
 
+    let input = utf8_input(ruby, &data)?;
     let refs: Vec<&str> = pointers.iter().map(String::as_str).collect();
-    let resolved = PULL_STATE.with(|cell| {
-        let mut state = cell.borrow_mut();
+    let resolved = with_pull_state(|state| {
         // SAFETY: coderange verified by utf8_input.
         unsafe { nosj::pointers_utf8_unchecked(input, &refs, &mut state.bufs) }
     });
@@ -395,7 +404,7 @@ pub fn splice_native(
         Err(e) => return Err(parser_error_at(ruby, input, e.offset, e.to_string())),
     };
 
-    let mut spans: Vec<(usize, usize, Value)> = Vec::with_capacity(pointers.len());
+    let mut spans: Vec<(usize, usize, usize)> = Vec::with_capacity(pointers.len());
     for (i, hit) in hits.into_iter().enumerate() {
         let Some(slice) = hit else {
             let exc: ExceptionClass = ruby.exception_key_error();
@@ -405,7 +414,7 @@ pub fn splice_native(
             ));
         };
         let (s, e) = span_of(input, slice.as_bytes());
-        spans.push((s, e, values[i]));
+        spans.push((s, e, i));
     }
     spans.sort_unstable_by_key(|&(s, _, _)| s);
     for pair in spans.windows(2) {
@@ -417,11 +426,12 @@ pub fn splice_native(
         }
     }
 
-    let mut out = Vec::with_capacity(input.len() + 64);
+    let mut out = Vec::with_capacity(input.len() + rendered.len());
     let mut pos = 0;
-    for &(s, e, v) in &spans {
+    for &(s, e, edit) in &spans {
+        let (rs, re) = ranges[edit];
         out.extend_from_slice(&input[pos..s]);
-        gen::emit_into(ruby, v, cfg, &mut out)?;
+        out.extend_from_slice(&rendered[rs..re]);
         pos = e;
     }
     out.extend_from_slice(&input[pos..]);