nosj 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d57a15d6dbdf7dc81518662ef44348f538b6dcf2a95098c3491c741b9e2517b6
-  data.tar.gz: e5508e9cf8ea61c51e21599ef4a887f024ab08a920a0c642dfcb3ac7fd7b4954
+  metadata.gz: 354e310be9d2d56119d2db1f9ad13052c9a6bc8fba5c8d7b7993b78abf345e1e
+  data.tar.gz: b21acc76a56a10a56c62c370ff1dfcaa8dc263a96958fcac6c4f3c213c4bb542
 SHA512:
-  metadata.gz: 9a7797c890345c879153069e63808fa916fe0e5944376680a86ba30696ef7eec16a6a0f45ae7c428c08783c56bb1a08bed448c27d3b7a7075caea064edee4205
-  data.tar.gz: 29113d820443054acafaeda1a976f4a388424466d79d09353fac5980cc80d803937a800b6384ed9395d9386735420cbd378cc8a6e6629cd5bdbefd1bd70fd5bd
+  metadata.gz: c672e8653239dc1600ce19b4b38c31ae298dbf40a79449fe12ccf05335144eed7d210a115e87a3a60e8b534b868d3c0080079072ed21a8e67b398e2e8d7e8fc4
+  data.tar.gz: 22aadd62a736d86fe310ed099d995fe6006e149103eb95d41d128adc6164e6c2f64c2de49e6652437bccefbef70379b27cc3700d45fcad7ae1e2003ac6f05f41

data/CHANGELOG.md

@@ -1,3 +1,108 @@
+## [0.5.0] - 2026-09-25
+
+**json 3.0 compatibility.** nosj now matches the behavior of the json
+gem 3.0, and stays compatible with both the json 2.x and 3.0
+interfaces: `NOSJ.parse`, `NOSJ.generate`, and the rest of nosj's own
+API follow json 3.0 semantics, while the `nosj/json` drop-in follows
+whichever json gem your application has installed, 2.x or 3.0, down to
+its calling conventions and the documents it accepts. Upgrading json
+(or not) is your choice; nosj works with either.
+
+Behavior changes in nosj's own API, for input that was accepted
+before:
+
+- Duplicate object keys raise `NOSJ::ParserError` (positioned at the
+  object repeating the key, like json 3) in `parse`, `load_file`,
+  `valid?` (returns false), `minify`/`reformat`, and everything that
+  materializes values. `allow_duplicate_key: true` restores the old
+  behavior: the last value wins (in `minify`, repeated keys pass
+  through).
+- Lone UTF-16 surrogates such as `"\udc00"` raise `NOSJ::ParserError`
+  everywhere, trailing ones included (they used to decode to raw
+  WTF-8 bytes, and `minify` re-escaped them).
+- `generate` raises `NOSJ::GeneratorError` for keys that render alike
+  (`{"a" => 1, :a => 2}`, `{1 => 1, "1" => 2}`), with json 3's exact
+  message; `allow_duplicate_key: true` emits them as before. Hashes
+  whose keys are all of one kind are never checked. The Rails encoder
+  is unchanged.
+- `stats` still describes such documents rather than refusing them.
+- Unknown options raise ArgumentError with json 3's message
+  (`unknown keyword: foo`) in every entry point, instead of being
+  ignored. json options nosj does not implement (`object_class`,
+  `array_class`, `decimal_class`, `on_load`, `create_additions`,
+  `allow_comments`, `allow_control_characters`,
+  `allow_invalid_escape`, `sort_keys`, `as_json`) raise unless falsy;
+  `on_load` and the newer ones used to be silently ignored.
+  `escape_slash` is gone, as in json 3: use `script_safe`.
+  `quirks_mode` is no longer accepted. `stats` takes only the options
+  it documents (`max_nesting`, `allow_nan`, `allow_trailing_comma`).
+
+The `nosj/json` drop-in follows the installed json gem:
+
+- With json 3.0, `JSON.parse` takes keyword options only, `JSON.dump`
+  uses json 3's defaults (nesting capped at 100), and whatever json 3
+  refuses (`quirks_mode`, `escape_slash`, `create_additions`, unknown
+  options, positional option hashes) raises exactly as json 3 raises.
+- With json 2.x, everything behaves as before, including json 2's
+  acceptance of duplicate keys, lone surrogates, and comments, and
+  its handling of keys that render alike.
+- Whenever the fast path refuses a call, the installed gem runs it
+  again and decides: exceptions are now the gem's own (message,
+  `json_path`, `invalid_object`) rather than nosj's messages re-raised
+  as JSON classes. The second pass happens on failures only, and a
+  `generate` run twice this way calls `to_json` again on the objects
+  visited before the refusal.
+- Fixed: `JSON.dump` raised NameError (`_dump_default_options`) with
+  json older than 2.11, which includes the json bundled with Ruby 3.3
+  and 3.4.
+- Fixed: `JSON.generate` (and `pretty_generate`, `dump`) with both
+  `ascii_only` and `script_safe` raised ArgumentError; that combination,
+  which nosj does not implement, now goes to the gem.
+
+## [0.4.1] - 2026-09-25
+
+- Fixed a crash in `NOSJ.generate`: an object whose `to_json` or
+  `to_s` shrank the array being generated (for example with
+  `Array#clear`) made the generator read freed memory, usually a
+  segfault. The array length is now re-read for every element, like
+  the json gem, so elements a callback appends are emitted too.
+- Fixed memory corruption in `NOSJ.splice`: a replacement value whose
+  `to_json` modified the source string, deduplicated a frozen String
+  subclass (`-str`), or removed entries from the edits hash could make
+  splice read freed memory, copying unrelated heap bytes into the
+  result or crashing. All values are now generated before the source
+  is read.
+- Fixed `NOSJ.lazy` and `NOSJ.each_line` reading freed memory when the
+  source is a frozen String subclass (such as
+  `ActiveSupport::SafeBuffer`) or a frozen string carrying instance
+  variables, and it is deduplicated with `-str` while the lazy
+  document is alive or between lines: Ruby swaps such a string's
+  buffer, and the old one kept being read (wrong values, or a crash).
+- Fixed a memory leak in `NOSJ.generate` and `NOSJ.write_file`: an
+  exception raised by user code the generator calls bypassed its
+  cleanup and leaked its output buffer (megabytes per call after large
+  documents). Affected: a raising `respond_to?` or
+  `respond_to_missing?`, a raising `to_s` on an encoding-conversion
+  error, a raising autoload of `JSON::Fragment` (strict and Rails
+  modes), and a raising `Errno` constructor for a failed write. The
+  exception still propagates unchanged.
+- Fixed: after a `NoMemoryError` in the middle of a parse (or
+  `minify`/`reformat`), the next call on that thread aborted the whole
+  process. Per-thread parser state is now recovered instead.
+- `NOSJ::Lazy` nodes now take part in generational GC: holding many
+  nodes no longer slows down every minor GC (200,000 live nodes: 2.9 ms
+  per minor GC before, 0.1 ms now), and they are freed immediately
+  when collected.
+- Fixed: lazy documents opened with `allow_trailing_comma: true` or
+  `allow_nan: true` could not be walked. `size`, `keys`, `each`, and
+  any lookup that missed or stepped over a trailing comma or a `NaN`
+  raised `NOSJ::ParserError`, even though `value` worked.
+- `NOSJ.at_pointer`, `NOSJ.at_pointers`, and `NOSJ.at_pointer_file`
+  now honor `allow_nan` and `allow_trailing_comma` while resolving the
+  pointer, not only when materializing the matched value.
+- Updated the nosj crate to 0.2.2.
+- Updated dependencies, Magnus bumped to 0.9.0.
+
 ## [0.4.0] - 2026-09-05
 
 - Ractors: on Ruby 4.0+, `NOSJ.parse`, `NOSJ.generate`, and every

data/Cargo.lock

@@ -44,9 +44,9 @@ dependencies = [
 
 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "cexpr"
@@ -59,9 +59,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "clang-sys"
@@ -137,9 +137,9 @@ dependencies = [
 
 [[package]]
 name = "magnus"
-version = "0.8.2"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b36a5b126bbe97eb0d02d07acfeb327036c6319fd816139a49824a83b7f9012"
+checksum = "379d50b6eea4ca84074ccd3e551eb9b07f7865194d5b3198325317e9ef78e5e9"
 dependencies = [
  "magnus-macros",
  "rb-sys",
@@ -149,9 +149,9 @@ dependencies = [
 
 [[package]]
 name = "magnus-macros"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47607461fd8e1513cb4f2076c197d8092d921a1ea75bd08af97398f593751892"
+checksum = "4ca70566af98184bb92d4d9853daaf533c1a3418b9570d0547ea44970035f3fe"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -191,16 +191,16 @@ dependencies = [
 
 [[package]]
 name = "nosj"
-version = "0.2.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d25913644b7871b36095cc3da27daf95ebf9508189c5d8ccfb16da3bdb9f802f"
+checksum = "3d398b0019f2d8bf39b10de6038451b0f3d96a9e3111748097192d8f57d6f120"
 dependencies = [
  "fast-float2",
 ]
 
 [[package]]
 name = "nosj_native"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "ahash",
  "magnus",
@@ -335,9 +335,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "version_check"
@@ -368,18 +368,18 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.56"
+version = "0.8.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+checksum = "c17e8fafad82b542ff3717217ecdc736231b59e387768c9630123b4ce4d2db44"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.56"
+version = "0.8.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+checksum = "595f56e044df4f46a0c9a626f65c3d99eb8488f7e8a8baa12dd76326d9710bf2"
 dependencies = [
  "proc-macro2",
  "quote",

data/README.md

@@ -65,6 +65,10 @@ through nosj:
 require "nosj/json"
 ```
 
+It works with json 2.x and 3.0 alike and follows whichever your app
+has installed: its calling conventions, its defaults, and the documents
+it accepts.
+
 In a Bundler app (Rails included) that can live entirely in the
 Gemfile you can do this:
 
@@ -108,9 +112,11 @@ The `json` gem API, on the `NOSJ` module:
 
 ```ruby
 NOSJ.parse(src, symbolize_names: true)   # also: freeze, max_nesting,
-                                         # allow_nan, allow_trailing_comma
+                                         # allow_nan, allow_trailing_comma,
+                                         # allow_duplicate_key
 NOSJ.generate(obj)                       # indent, space, object_nl, ...,
-NOSJ.pretty_generate(obj)                # ascii_only, script_safe, strict
+NOSJ.pretty_generate(obj)                # ascii_only, script_safe, strict,
+                                         # allow_duplicate_key
 ```
 
 ### Lazy documents
@@ -151,7 +157,8 @@ Example: an early field resolves in ~0.35µs where `JSON.parse(json).dig(...)`
 costs ~980µs on the same document—three orders of magnitude. A field
 at the far end of a 570 KB document costs ~71µs, still 13× faster
 than parse-then-dig. Misses return nil; matched subtrees materialize
-with the same options as `parse` (`symbolize_names:`, `freeze:`).
+with the same options as `parse` (`symbolize_names:`, `freeze:`), and
+`allow_nan:`/`allow_trailing_comma:` govern the walk to them too.
 
 ### Files API
 
@@ -188,10 +195,11 @@ NOSJ.reformat_file("big.json")           # straight off a memory map
 ```
 
 Output is exactly `generate(parse(json))`—canonical number spellings,
-normalized escapes, same formatting options—except duplicate keys pass
-through (a reformatter must not silently drop data) and lone-surrogate
-strings re-escape instead of raising. Acceptance options apply too:
-`minify(src, allow_trailing_comma: true)` normalizes the commas away.
+normalized escapes, same formatting options—and it accepts exactly what
+`parse` does. Acceptance options apply too:
+`minify(src, allow_trailing_comma: true)` normalizes the commas away,
+and under `allow_duplicate_key: true` repeated keys pass through (a
+reformatter must not silently drop data).
 
 ### Byte-splicing edits and JSON Patch
 
@@ -402,19 +410,28 @@ Reproduce with `rake bench` (the parity-gated comparison, after a PGO retrain—
 
 ## Switching from the json gem
 
-You mostly don't have to do anything. Some differences:
-
-- The legacy object-deserialization options (`create_additions`,
-  `object_class`, `array_class`, `decimal_class`) raise ArgumentError;
-  the `nosj/json` drop-in falls back to the original gem for them.
-- Behaviors the `json` gem itself deprecates (JS comments, raw invalid
-  UTF-8) follow the strict semantics instead.
+You mostly don't have to do anything. `NOSJ.*` follows json 3.0,
+whichever json your app runs; the `nosj/json` drop-in follows the
+installed one, 2.x or 3.0. Some differences:
+
+- json 3.0 semantics: duplicate keys, lone surrogates, JS comments,
+  and invalid UTF-8 are errors (`allow_duplicate_key: true` restores
+  last-key-wins), keys that render alike raise in `generate`, and
+  unknown options raise ArgumentError. With json 2.x installed, the
+  drop-in keeps json 2's leniency: when nosj refuses a call, the
+  installed gem runs it and has the last word.
+- The json options nosj doesn't implement (`create_additions`,
+  `object_class`, `array_class`, `decimal_class`, `on_load`,
+  `allow_comments`, `allow_control_characters`,
+  `allow_invalid_escape`, `sort_keys`, `as_json`) raise ArgumentError
+  unless falsy; the drop-in passes them to the original gem.
 - Unlike `Array#dig`, negative indices in `NOSJ.dig` return nil (JSON
   Pointer has no equivalent).
 - Parse errors raise `NOSJ::ParserError` (`NOSJ::NestingError` past
   `max_nesting`, like the gem); messages use byte offsets rather than
   the gem's phrasing, and the exception carries `#line`, `#column`,
-  and a caret `#snippet`.
+  and a caret `#snippet`. Through the drop-in, exceptions are the
+  installed gem's own (message, `json_path`, `invalid_object`).
 
 Everything else—including the gem's exact float formatting, which is
 not the shortest-round-trip form most libraries emit—matches

data/ext/nosj/Cargo.toml

@@ -5,7 +5,7 @@
 # required by lib/nosj.rb as "nosj/nosj" (Init_nosj set explicitly in
 # lib.rs). Gem name, module, and API are plain nosj.
 name = "nosj_native"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 authors = ["Yaroslav Markin <yaroslav@markin.net>"]
 license = "MIT"
@@ -16,13 +16,13 @@ name = "nosj"
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-magnus = { version = "0.8", features = ["rb-sys"] }
-rb-sys = { version = "0.9.124", default-features = false }
-ahash = "0.8.11"
+magnus = { version = "0.9", features = ["rb-sys"] }
+rb-sys = { version = "0.9.130", default-features = false }
+ahash = "0.8.12"
 # Read-only file mapping for the file entry points (load_lazy_file,
 # at_pointer_file, dig_file): pages never touched are never read.
-memmap2 = "0.9"
+memmap2 = "0.9.11"
 # First-party SIMD JSON parse/generate library (github.com/yaroslav/nosj).
 # For coordinated crate+gem work, temporarily flip to
 # { path = "../../../nosj" } and restore before any commit or release.
-nosj = "0.2.0"
+nosj = "0.2.2"

data/ext/nosj/fuzz/Cargo.toml

@@ -13,7 +13,7 @@ libfuzzer-sys = "0.4"
 # crate. Only this harness enables "embed" (rb-sys/link-ruby): fuzz
 # binaries host their own VM, while the extension must never link
 # libruby (its symbols resolve from the host process at load time).
-magnus = { version = "0.8", features = ["embed", "rb-sys"] }
+magnus = { version = "0.9", features = ["embed", "rb-sys"] }
 # The extension as an rlib; its lib target is named `nosj` (the bundle
 # name), so rename the dependency to keep fuzz code readable.
 nosj_ext = { path = "..", package = "nosj_native" }

data/ext/nosj/fuzz/src/prelude.rb

@@ -48,7 +48,14 @@ module NOSJFuzz
     rescue *PARSE_FAIL
       false
     end
-    raise "stats disagrees with parse on acceptance" unless stats_ok == (status == :ok)
+    # stats describes documents rather than refusing them: it accepts
+    # everything parse accepts, plus duplicate keys and lone surrogates
+    # (json 3 refusals parse makes on top of the grammar).
+    raise "stats refused what parse accepted" if status == :ok && !stats_ok
+    if status == :err && stats_ok &&
+        try_parse(s, {allow_duplicate_key: true})[0] != :ok && !s.include?("\\u")
+      raise "stats accepted what parse refused for a grammar reason"
+    end
 
     min_status, min = begin
       [:ok, NOSJ.reformat_native(s, nil)]
@@ -59,24 +66,17 @@ module NOSJFuzz
     end
 
     if status == :err
-      # The pipe may abort with GeneratorError (lone-surrogate key,
-      # non-finite float) before the parser reaches whatever made the
-      # whole document unparseable; any refusal is a refusal.
+      # The pipe may abort with GeneratorError (a non-finite float)
+      # before the parser reaches whatever made the whole document
+      # unparseable; any refusal is a refusal.
       raise "reformat accepted what parse refused" unless [:err, :generator].include?(min_status)
       return
     end
     if min_status == :generator
       # On a document parse accepts, only an overflow-to-Infinity
-      # float (1e999, a 300-digit integer with a small exponent, maybe
-      # hidden behind a duplicate key parse would discard) or a
-      # lone-surrogate object key may abort the pipe. Rerunning with
-      # allow_nan separates them: it lifts the float refusal but not
-      # the key refusal, and the key requires a \u escape.
-      begin
-        NOSJ.reformat_native(s, {allow_nan: true})
-      rescue NOSJ::GeneratorError
-        raise "GeneratorError without a \\u escape in source" unless s.include?("\\u")
-      end
+      # float (1e999, a 300-digit integer with a small exponent) may
+      # abort the pipe, and allow_nan lifts exactly that refusal.
+      stage("reformat with allow_nan") { NOSJ.reformat_native(s, {allow_nan: true}) }
       return
     end
     raise "reformat refused what parse accepted" unless min_status == :ok
@@ -140,11 +140,9 @@ module NOSJFuzz
     raise "yielded values diverge from per-line parses" unless yielded.eql?(reference)
 
     if status == :ok && !yielded.empty?
-      begin
-        ndjson = NOSJ.generate_lines_native(yielded, nil)
-      rescue NOSJ::GeneratorError
-        return # WTF-8 strings (lone surrogates) are not generable
-      end
+      # Parsed values are always generable: parse refuses lone
+      # surrogates, the only source of unencodable strings.
+      ndjson = stage("generate_lines") { NOSJ.generate_lines_native(yielded, nil) }
       back = []
       NOSJ.each_line_native(ndjson, nil) { |v| back << v }
       raise "generate_lines does not round-trip" unless back.eql?(yielded)
@@ -168,16 +166,11 @@ module NOSJFuzz
     doc = utf8(doc_bytes)
     spec_status, spec = try_parse(utf8(spec_bytes))
     return unless spec_status == :ok
-    # Replacement values with broken encoding (lone surrogates) raise
-    # GeneratorError on insertion; the reference cannot mirror that.
-    return unless deep_valid_encoding?(spec)
 
+    # Parsing refuses duplicate keys (raw-byte resolution would see the
+    # first occurrence, the tree the last) and lone surrogates, so an
+    # accepted tree and spec are free of both.
     tree_status, tree = try_parse(doc)
-    # Duplicate keys: raw-byte resolution sees the first occurrence,
-    # tree materialization keeps the last; the two sides cannot agree.
-    if tree_status == :ok && NOSJ.stats_native(doc, nil)[:keys] != count_keys(tree)
-      return
-    end
 
     case spec
     when Hash
@@ -380,21 +373,4 @@ module NOSJFuzz
     else v
     end
   end
-
-  def deep_valid_encoding?(v)
-    case v
-    when String then v.valid_encoding?
-    when Array then v.all? { |e| deep_valid_encoding?(e) }
-    when Hash then v.all? { |k, e| deep_valid_encoding?(k) && deep_valid_encoding?(e) }
-    else true
-    end
-  end
-
-  def count_keys(v)
-    case v
-    when Hash then v.size + v.sum { |_, e| count_keys(e) }
-    when Array then v.sum { |e| count_keys(e) }
-    else 0
-    end
-  end
 end

data/ext/nosj/src/files.rs

@@ -10,7 +10,7 @@
 //! I/O failures raise the mapped `Errno::*` exception, like `File`
 //! methods do.
 
-use std::cell::RefCell;
+use std::cell::Cell;
 use std::fs;
 use std::io::Read;
 
@@ -22,14 +22,15 @@ use crate::gen;
 use crate::lazy::{self, DocBytes};
 use crate::parse::{err, materialize, materialize_at, parse_native_opts, span_of, ParseNativeOpts};
 use crate::pointer::path_to_pointer;
-use crate::state::PULL_STATE;
+use crate::state::{with_pull_state, with_taken};
 
 const NOT_UTF8: &str = "input is not valid UTF-8";
 
 thread_local! {
     /// Reused read buffer for `load_file`: capacity survives across
-    /// calls, so a hot loop over files allocates nothing.
-    static FILE_BUF: RefCell<Vec<u8>> = const { RefCell::new(Vec::new()) };
+    /// calls, so a hot loop over files allocates nothing (see
+    /// `state::with_taken`).
+    static FILE_BUF: Cell<Vec<u8>> = const { Cell::new(Vec::new()) };
 }
 
 /// On Unix the raw OS error IS the errno `rb_syserr_new` expects.
@@ -58,6 +59,9 @@ fn errno_of(e: &std::io::Error) -> Option<i32> {
 
 /// Map an I/O failure onto the matching `Errno::*` exception (class
 /// parity with `File.read`/`File.write`; the message carries the path).
+/// Constructing it runs the class's `initialize` (overridable Ruby), so
+/// the call is protected; a raise there propagates in its place, as it
+/// would from `File.read`.
 fn io_error(ruby: &Ruby, path: &str, e: &std::io::Error) -> Error {
     use magnus::rb_sys::FromRawValue;
     let Some(errno) = errno_of(e) else {
@@ -66,8 +70,13 @@ fn io_error(ruby: &Ruby, path: &str, e: &std::io::Error) -> Error {
     let Ok(cpath) = std::ffi::CString::new(path) else {
         return runtime_error(ruby, format!("{e} - {path}"));
     };
+    let raw =
+        match magnus::rb_sys::protect(|| unsafe { rb_sys::rb_syserr_new(errno, cpath.as_ptr()) }) {
+            Ok(raw) => raw,
+            Err(raised) => return raised,
+        };
     // SAFETY: rb_syserr_new returns a live Errno exception instance.
-    let exc = unsafe { Value::from_raw(rb_sys::rb_syserr_new(errno, cpath.as_ptr())) };
+    let exc = unsafe { Value::from_raw(raw) };
     match magnus::Exception::from_value(exc) {
         Some(exc) => exc.into(),
         None => runtime_error(ruby, format!("{e} - {path}")),
@@ -84,23 +93,16 @@ pub fn load_file_native(
 ) -> Result<Value, Error> {
     let o = parse_native_opts(ruby, opts)?;
     let p = path.to_string()?;
-    FILE_BUF.with(|cell| {
-        let mut buf = cell
-            .try_borrow_mut()
-            .map_or_else(|_| Vec::new(), |mut b| std::mem::take(&mut *b));
+    with_taken(&FILE_BUF, |buf| {
         buf.clear();
-        let result = read_into(&mut buf, &p)
+        read_into(buf, &p)
             .map_err(|e| io_error(ruby, &p, &e))
             .and_then(|()| {
-                if std::str::from_utf8(&buf).is_err() {
+                if std::str::from_utf8(buf).is_err() {
                     return Err(err(ruby, NOT_UTF8.into()));
                 }
-                materialize(ruby, &buf, &o)
-            });
-        if let Ok(mut slot) = cell.try_borrow_mut() {
-            *slot = buf;
-        }
-        result
+                materialize(ruby, buf, &o)
+            })
     })
 }
 
@@ -190,10 +192,9 @@ fn resolve_file_pointer(
     o: &ParseNativeOpts,
 ) -> Result<Value, Error> {
     with_mapped_file(ruby, path, |map| {
-        let resolved = PULL_STATE.with(|cell| {
-            let mut state = cell.borrow_mut();
+        let resolved = with_pull_state(|state| {
             // SAFETY: UTF-8 checked by with_mapped_file.
-            unsafe { nosj::pointer_utf8_unchecked(&map, pointer, &mut state.bufs) }
+            unsafe { nosj::pointer_utf8_unchecked_with(&map, pointer, &mut state.bufs, o.popts) }
         });
         match resolved {
             Ok(None) => Ok(ruby.qnil().as_value()),

data/ext/nosj/src/gen/errors.rs

@@ -7,7 +7,7 @@ use magnus::rb_sys::AsRawValue;
 use magnus::value::ReprValue;
 use magnus::{Error, Ruby};
 
-use super::ruby::rstring_bytes;
+use super::ruby::{protected_to_s, rstring_bytes};
 use crate::errors::nosj_exception;
 
 pub(super) enum GenFail {
@@ -24,26 +24,28 @@ pub(super) enum GenFail {
 }
 
 /// The exception's `to_s` (its message), matching what the gem embeds
-/// when it wraps a secondary exception.
-fn error_message(err: &Error) -> String {
+/// when it wraps a secondary exception. Protected: an exception class
+/// may override `to_s`, and a raise there propagates in place of the
+/// GeneratorError (as it does from the gem).
+fn error_message(err: &Error) -> Result<String, Error> {
     if let ErrorType::Exception(exc) = err.error_type() {
-        let s = unsafe { rb_sys::rb_obj_as_string(exc.as_value().as_raw()) };
+        let s = protected_to_s(exc.as_value().as_raw())?;
         // Safety: rb_obj_as_string returns a T_STRING; the bytes are
         // copied into an owned String before any further Ruby call.
         let bytes = unsafe { rstring_bytes(s) };
-        return String::from_utf8_lossy(bytes).into_owned();
+        return Ok(String::from_utf8_lossy(bytes).into_owned());
     }
-    err.to_string()
+    Ok(err.to_string())
 }
 
 pub(super) fn raise_fail(ruby: &Ruby, fail: GenFail) -> Error {
     match fail {
         GenFail::Reraise(err) => err,
         GenFail::Generator(msg) => Error::new(nosj_exception(ruby, "GeneratorError"), msg),
-        GenFail::GeneratorFrom(err) => {
-            let msg = error_message(&err);
-            Error::new(nosj_exception(ruby, "GeneratorError"), msg)
-        }
+        GenFail::GeneratorFrom(err) => match error_message(&err) {
+            Ok(msg) => Error::new(nosj_exception(ruby, "GeneratorError"), msg),
+            Err(raised) => raised,
+        },
         GenFail::Nesting(limit) => Error::new(
             nosj_exception(ruby, "NestingError"),
             format!(

data/ext/nosj/src/gen/mod.rs

@@ -31,6 +31,7 @@ use magnus::rb_sys::{AsRawValue, FromRawValue};
 use magnus::{Error, RString, Ruby, Value};
 use std::cell::Cell;
 
+use crate::state::with_taken;
 use errors::raise_fail;
 use keys::GenKeyCache;
 pub(crate) use ruby::warm_up;
@@ -57,6 +58,7 @@ struct GenScratch {
 }
 
 impl GenScratch {
+    #[cold]
     fn fresh() -> Box<Self> {
         Box::new(GenScratch {
             buf: Vec::new(),
@@ -70,17 +72,13 @@ thread_local! {
     static GEN_SCRATCH: Cell<Option<Box<GenScratch>>> = const { Cell::new(None) };
 }
 
-/// Run `f` on this thread's scratch, then store it back, replacing one a
-/// recursive generate stored meanwhile (the outermost call's is the warm
-/// one; the replaced scratch's key cache keeps its shadow, exactly as
-/// the old fallback arm's did).
+/// Run `f` on this thread's scratch (see [`with_taken`]). A recursive
+/// generate stores its own fresh scratch meanwhile; the outermost call's
+/// warm one replaces it (the replaced key cache keeps its shadow).
 fn with_scratch<R>(f: impl FnOnce(&mut GenScratch) -> R) -> R {
-    let mut scratch = GEN_SCRATCH
-        .with(Cell::take)
-        .unwrap_or_else(GenScratch::fresh);
-    let result = f(&mut scratch);
-    GEN_SCRATCH.with(|cell| cell.set(Some(scratch)));
-    result
+    with_taken(&GEN_SCRATCH, |slot| {
+        f(slot.get_or_insert_with(GenScratch::fresh))
+    })
 }
 
 /// `NOSJ.generate(obj, opts = nil)`, registered as a variadic native