vibe_zstd 1.3.1 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2a7e3f6643d3fd14ebce10d77ba79770d44c11cd82775de3cf2c24eaa84f118
-  data.tar.gz: de1a91cfa51e4e49e4759cf39449c309d28c985d2cf9085e1b6e8faed2b07e8c
+  metadata.gz: 6e06ac31dfbfb1db79c69375a831303710877a6c07564c687a8f9cb394454060
+  data.tar.gz: 269506fc73069dca0dec661f8eca5beadafe397f0dfd8209bca310b6930eedaa
 SHA512:
-  metadata.gz: 8cb9a59f93e6167df9b7aa0a3ac466f37aae29aeb22aa191951714a694d6dc215f0f008e099f46f60c9e3941352d41c935e470e5301b9fa1cdefb980bf4372b8
-  data.tar.gz: 63bb4d19e418c713335da4ed48a05b11ff1af0d8ca025729234bb3416726667a0f2f75ae516918f879811dad3d7d1a2675ed605858ccfcf3b1a0934260b7a138
+  metadata.gz: b836f11bfaae0728bf417f30b6b1b91f90a573b6ad052d7a58cb00644d6510575034ee3e27dfc6d65714e85ee6045f95a96e8303a0f3e5a45b9102b1702a3a45
+  data.tar.gz: 7e474b085f2e2614ec6fc23ec708e0f0796b319b8dfed10a7fb79099aa04fc0b2f3e56dd3a97a66cf3b3dbf77cecaf334b79bd4b475f3f126c16650783adc275

data/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.2] - 2026-10-27
+
+### Fixed
+- Chilled string literals (Ruby 3.4+, files without `# frozen_string_literal`) no longer trigger "literal string will be frozen in the future" warnings when passed to `CCtx#compress`, `DCtx#decompress`, `VibeZstd.compress`/`.decompress`, or `CompressWriter#write`. 1.3.1 still called `rb_str_locktmp` on them, which Ruby counts as a write.
+- `DCtx#decompress` now snapshots its input before parsing options, so a keyword argument whose `to_int` mutates the input string can no longer leave a stale source pointer.
+
+### Changed
+- Source strings are no longer locked while the GVL is released. They are read from a frozen copy-on-write snapshot (`rb_str_new_frozen`) instead, the same approach `DecompressReader` already used for input chunks. Another thread (or an IO's `write`) mutating the caller's string mid-operation now succeeds, and the operation keeps reading the original bytes, instead of raising `RuntimeError` ("can't modify string; temporarily locked"). Likewise, a string another thread is concurrently reading into (`IO#read(n, buf)`) is no longer rejected; such a race now yields whatever bytes were in the buffer. Cost: the caller's string stays shared with the snapshot until its next mutation, so a buffer that is refilled and compressed in a loop (`io.read(n, buf); compress(buf)`) pays one copy of its contents per iteration. Fresh strings are unaffected.
+
 ## [1.3.1] - 2026-10-26
 
 ### Fixed

data/ext/vibe_zstd/cctx.c

@@ -158,24 +158,23 @@ vibe_zstd_cctx_compress(int argc, VALUE* argv, VALUE self) {
         }
     }
 
-    size_t srcSize = RSTRING_LEN(data);
+    // Read the source from a frozen snapshot (see vibe_zstd_source_snapshot):
+    // another Ruby thread mutating the caller's string cannot invalidate
+    // args.src while the GVL is released.
+    VALUE src_str = vibe_zstd_source_snapshot(data);
+    size_t srcSize = RSTRING_LEN(src_str);
     size_t dstCapacity = ZSTD_compressBound(srcSize);
     VALUE result_str = rb_str_new(NULL, dstCapacity);
     compress_args args = {
         .cctx = cctx->cctx,
-        .src = RSTRING_PTR(data),
+        .src = RSTRING_PTR(src_str),
         .srcSize = srcSize,
         .dst = RSTRING_PTR(result_str),
         .dstCapacity = dstCapacity,
         .result = 0
     };
-    // Lock the source string for the duration of the GVL-released compression.
-    // Without this, another Ruby thread holding the same String object could
-    // modify or reallocate it while compression reads from its buffer, causing
-    // a use-after-free read.  The helper unlocks via rb_ensure so the string
-    // is never left permanently locked, even if an async exception (e.g.
-    // Timeout, Thread#raise) is delivered when the GVL is reacquired.
-    vibe_zstd_nogvl_with_str_locked(compress_without_gvl, &args, data);
+    rb_thread_call_without_gvl(compress_without_gvl, &args, NULL, NULL);
+    RB_GC_GUARD(src_str);
 
     // Restore context state so repeated one-shot calls remain independent.
     if (cdict) ZSTD_CCtx_refCDict(cctx->cctx, NULL);

data/ext/vibe_zstd/dctx.c

@@ -411,19 +411,17 @@ typedef struct {
     ZSTD_DCtx* dctx;
     ZSTD_DDict* ddict;
     decompress_stream_nogvl_args* args;
-    VALUE data;
+    VALUE src_str;  // frozen snapshot of the source (vibe_zstd_source_snapshot)
     size_t max_size;
 } dctx_stream_decompress_state;
 
-// Body: run the no-GVL stream loop (source string locked), check the outcome,
-// and build the result string. Raising here is safe: cleanup always runs.
+// Body: run the no-GVL stream loop (source is a frozen snapshot), check the
+// outcome, and build the result string. Raising here is safe: cleanup always runs.
 static VALUE
 vibe_zstd_dctx_stream_decompress_body(VALUE p) {
     dctx_stream_decompress_state* state = (dctx_stream_decompress_state*)p;
 
-    // Lock the source string while the GVL is released: another Ruby thread
-    // holding the same string must not mutate or GC it mid-decompression.
-    vibe_zstd_nogvl_with_str_locked(decompress_stream_without_gvl, state->args, state->data);
+    rb_thread_call_without_gvl(decompress_stream_without_gvl, state->args, NULL, NULL);
 
     if (state->args->limit_exceeded) {
         rb_raise(rb_eDecompressedSizeExceeded,
@@ -443,10 +441,12 @@ vibe_zstd_dctx_stream_decompress_body(VALUE p) {
 }
 
 // Cleanup: free the C output buffer and return the context to no-dictionary
-// mode so subsequent calls on this DCtx are not affected.
+// mode so subsequent calls on this DCtx are not affected. The snapshot is
+// guarded here so it outlives every read of it in the body.
 static VALUE
 vibe_zstd_dctx_stream_decompress_cleanup(VALUE p) {
     dctx_stream_decompress_state* state = (dctx_stream_decompress_state*)p;
+    RB_GC_GUARD(state->src_str);
     if (state->args->dst) {
         free(state->args->dst);
         state->args->dst = NULL;
@@ -493,8 +493,12 @@ vibe_zstd_dctx_decompress(int argc, VALUE* argv, VALUE self) {
     vibe_zstd_dctx* dctx;
     TypedData_Get_Struct(self, vibe_zstd_dctx, &vibe_zstd_dctx_type, dctx);
     StringValue(data);
-    const char* src = RSTRING_PTR(data);
-    size_t srcSize = RSTRING_LEN(data);
+    // Snapshot the source before taking src: option parsing below can run
+    // Ruby code (to_int), and the GVL is released during decompression
+    // (see vibe_zstd_source_snapshot).
+    VALUE src_str = vibe_zstd_source_snapshot(data);
+    const char* src = RSTRING_PTR(src_str);
+    size_t srcSize = RSTRING_LEN(src_str);
     size_t offset = 0;
 
     // Magicless frames (format = ZSTD_f_zstd1_magicless) carry no magic number,
@@ -642,7 +646,7 @@ vibe_zstd_dctx_decompress(int argc, VALUE* argv, VALUE self) {
             .dctx = dctx->dctx,
             .ddict = ddict,
             .args = &stream_args,
-            .data = data,
+            .src_str = src_str,
             .max_size = max_size
         };
         return rb_ensure(vibe_zstd_dctx_stream_decompress_body, (VALUE)&state,
@@ -665,11 +669,10 @@ vibe_zstd_dctx_decompress(int argc, VALUE* argv, VALUE self) {
         .dstCapacity = contentSize,
         .result = 0
     };
-    // Lock the source string while the GVL is released: another Ruby thread
-    // holding the same string must not mutate or GC it mid-decompression.
-    // The helper unlocks via rb_ensure so an async exception cannot leave
-    // the string permanently locked.
-    vibe_zstd_nogvl_with_str_locked(decompress_without_gvl, &args, data);
+    // src points into the frozen snapshot src_str, so it stays valid while
+    // the GVL is released even if the caller's string is mutated.
+    rb_thread_call_without_gvl(decompress_without_gvl, &args, NULL, NULL);
+    RB_GC_GUARD(src_str);
     if (ZSTD_isError(args.result)) {
         rb_raise(rb_eRuntimeError, "Decompression failed: %s", ZSTD_getErrorName(args.result));
     }

data/ext/vibe_zstd/streaming.c

@@ -14,12 +14,6 @@ static VALUE vibe_zstd_reader_initialize(int argc, VALUE *argv, VALUE self);
 static VALUE vibe_zstd_reader_read(int argc, VALUE *argv, VALUE self);
 static VALUE vibe_zstd_reader_eof(VALUE self);
 
-// State struct for rb_ensure-based string lock/unlock in vibe_zstd_writer_write
-typedef struct {
-    vibe_zstd_cstream* cstream;
-    VALUE data;
-} vibe_zstd_write_state;
-
 // TypedData types - defined in vibe_zstd.c
 extern rb_data_type_t vibe_zstd_cstream_type;
 extern rb_data_type_t vibe_zstd_dstream_type;
@@ -106,19 +100,22 @@ vibe_zstd_writer_initialize(int argc, VALUE *argv, VALUE self) {
     return self;
 }
 
-// Body of the rb_ensure wrapper: runs the compress loop with data locked
 static VALUE
-vibe_zstd_writer_write_body(VALUE arg) {
-    vibe_zstd_write_state* state = (vibe_zstd_write_state*)arg;
-    vibe_zstd_cstream* cstream = state->cstream;
-    VALUE data = state->data;
+vibe_zstd_writer_write(VALUE self, VALUE data) {
+    Check_Type(data, T_STRING);
+
+    vibe_zstd_cstream* cstream;
+    TypedData_Get_Struct(self, vibe_zstd_cstream, &vibe_zstd_cstream_type, cstream);
+
+    // io.write (called inside the loop) can run Ruby code that mutates or
+    // resizes the caller's string. Reading from a frozen snapshot keeps
+    // input.src valid regardless (see vibe_zstd_source_snapshot).
+    VALUE src_str = vibe_zstd_source_snapshot(data);
 
     // Input buffer: pos advances as ZSTD consumes data.
-    // data is locked (rb_str_locktmp) for the duration of this call so that
-    // RSTRING_PTR remains valid even when rb_funcall runs arbitrary Ruby code.
     ZSTD_inBuffer input = {
-        .src = RSTRING_PTR(data),
-        .size = RSTRING_LEN(data),
+        .src = RSTRING_PTR(src_str),
+        .size = RSTRING_LEN(src_str),
         .pos = 0
     };
 
@@ -149,43 +146,12 @@ vibe_zstd_writer_write_body(VALUE arg) {
         if (output.pos > 0) {
             rb_str_set_len(outBuffer, output.pos);
             // rb_funcall may run arbitrary Ruby code, but input.src stays valid
-            // because data is locked against mutation/reallocation
+            // because it points into the frozen snapshot src_str
             rb_funcall(cstream->io, id_write, 1, outBuffer);
         }
     }
 
-    return Qnil;
-}
-
-// Ensure function: always unlocks data regardless of raise/return
-static VALUE
-vibe_zstd_writer_write_unlock(VALUE arg) {
-    rb_str_unlocktmp((VALUE)arg);
-    return Qnil;
-}
-
-static VALUE
-vibe_zstd_writer_write(VALUE self, VALUE data) {
-    Check_Type(data, T_STRING);
-
-    vibe_zstd_cstream* cstream;
-    TypedData_Get_Struct(self, vibe_zstd_cstream, &vibe_zstd_cstream_type, cstream);
-
-    // Lock data for the duration of the compress loop so that RSTRING_PTR(data)
-    // stays valid even when io.write (called inside the loop) runs Ruby code that
-    // could otherwise mutate or resize the string.  rb_str_locktmp raises if the
-    // string is already locked; the ensure always unlocks it.  Frozen strings
-    // are already immutable and Ruby 4.0+ refuses to lock them, so skip it.
-    vibe_zstd_write_state state = { cstream, data };
-    if (OBJ_FROZEN(data)) {
-        vibe_zstd_writer_write_body((VALUE)&state);
-        return self;
-    }
-
-    rb_str_locktmp(data);
-    rb_ensure(vibe_zstd_writer_write_body, (VALUE)&state,
-              vibe_zstd_writer_write_unlock, data);
-
+    RB_GC_GUARD(src_str);
     return self;
 }
 

data/ext/vibe_zstd/vibe_zstd.c

@@ -280,41 +280,32 @@ vibe_zstd_default_c_level(VALUE self) {
     return INT2NUM(ZSTD_defaultCLevel());
 }
 
-// Run func(arg) without the GVL while str is locked against mutation.
-// rb_thread_call_without_gvl can deliver a pending async exception (e.g.
-// Thread#raise, Timeout) after reacquiring the GVL, so the unlock must go
-// through rb_ensure or the string would be left permanently locked.
+// Source strings are read while the GVL is released (compress/decompress) or
+// while arbitrary Ruby code runs (CompressWriter#write calling io.write), so
+// the caller's String must not be mutated, resized or freed under us.
+// rb_str_locktmp did that through 1.3.1, but Ruby 4.0 raises FrozenError on
+// frozen strings and treats the lock as a write on chilled string literals
+// ("literal string will be frozen in the future"). Instead, borrow the bytes
+// through a frozen snapshot that shares the caller's buffer copy-on-write: a
+// mutation unshares the caller's string and the snapshot keeps the original.
 //
-// Frozen strings are skipped: they cannot be mutated or resized, so the
-// pointer is already stable, and Ruby 4.0+ raises FrozenError from
-// rb_str_locktmp on a frozen string.
-typedef struct {
-    void* (*func)(void*);
-    void* arg;
-} nogvl_locked_call;
-
-static VALUE
-nogvl_locked_body(VALUE p) {
-    nogvl_locked_call* call = (nogvl_locked_call*)p;
-    rb_thread_call_without_gvl(call->func, call->arg, NULL, NULL);
-    return Qnil;
-}
-
-static VALUE
-nogvl_locked_unlock(VALUE str) {
-    rb_str_unlocktmp(str);
-    return Qnil;
-}
-
-static void
-vibe_zstd_nogvl_with_str_locked(void* (*func)(void*), void* arg, VALUE str) {
-    nogvl_locked_call call = { func, arg };
-    if (OBJ_FROZEN(str)) {
-        nogvl_locked_body((VALUE)&call);
-        return;
-    }
-    rb_str_locktmp(str);
-    rb_ensure(nogvl_locked_body, (VALUE)&call, nogvl_locked_unlock, str);
+// The snapshot is a visible frozen String (rb_str_new_frozen) that owns the
+// buffer for as long as anything references it, so a dup/clone of the
+// caller's string taken mid-operation simply shares the same root. The
+// caller's string stays copy-on-write shared until its next mutation, which
+// then costs one copy; that is the price of this approach.
+//
+// Do NOT "optimize" this with rb_str_tmp_frozen_acquire/release (the IO#write
+// primitive) to hand the buffer back afterwards: on Ruby 3.3+ String#dup of
+// a string sharing a hidden root does not mark the root as borrowed, so
+// release un-shares the caller's string and empties the root while the dup
+// still points into the buffer. Any dup taken in io.write, or from another
+// thread during compression, then aliases freed memory (reproduced).
+//
+// Callers must RB_GC_GUARD the snapshot after their last read of it.
+static inline VALUE
+vibe_zstd_source_snapshot(VALUE str) {
+    return rb_str_new_frozen(str);
 }
 
 // Include the split implementation files

data/lib/vibe_zstd/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module VibeZstd
-  VERSION = "1.3.1"
+  VERSION = "1.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vibe_zstd
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
 platform: ruby
 authors:
 - Kelley Reynolds