[Bug #22383] Fix inverted STR_SHARED check in rb_str_tmp_frozen_release

45a2c95 mistakenly rewrote

    FL_TEST_RAW(orig, STR_SHARED) && !FL_TEST_RAW(orig, STR_TMPLOCK|RUBY_FL_FREEZE)

as

    FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_TMPLOCK

requiring orig to not be shared, the opposite of the original
condition.  orig always shares the buffer with tmp here, so the buffer
was never given back and the string stayed shared until its next
modification copied it.  The code then read aux.shared from strings
that are not shared, where the union holds aux.capa.

Backport of ruby#19018

Author: rwstauner

string.c

@@ -1592,7 +1592,7 @@ rb_str_tmp_frozen_release(VALUE orig, VALUE tmp)
     if (STR_EMBED_P(tmp)) {
         RUBY_ASSERT(OBJ_FROZEN_RAW(tmp));
     }
-    else if (FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_TMPLOCK &&
+    else if (FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_SHARED &&
             !OBJ_FROZEN_RAW(orig)) {
         VALUE shared = RSTRING(orig)->as.heap.aux.shared;
 

test/-ext-/string/test_capacity.rb

@@ -59,12 +59,35 @@ def test_capacity_fstring
     assert_equal(s.length, capa(s))
   end
 
+  # Writing a string to an IO temporarily hands its buffer over to a frozen
+  # shared root (rb_str_tmp_frozen_acquire), which is an internal ASCII-8BIT
+  # string.  Use UTF-16LE so that the terminator length of the root (1) differs
+  # from the terminator length of the string (2): releasing the root must
+  # restore the capacity in the string's own encoding, otherwise the string's
+  # idea of its buffer size (capa + terminator length) no longer matches the
+  # size the buffer was allocated with.
+  def test_frozen_root_capacity_with_multibyte_terminator
+    s = multibyte_terminator_string
+    capacity = capa(s)
+    assert_operator(capacity, :>=, s.bytesize)
+
+    # Multiple arguments go through the writev path, which uses
+    # rb_str_tmp_frozen_acquire.
+    IO.pipe {|r, w| w.write(s, "")}
+
+    assert_equal(capacity, capa(s))
+  end
+
   private
 
   def capa(str)
     Bug::String.capacity(str)
   end
 
+  def multibyte_terminator_string
+    ("\u{30AF}\u{30FC}\u{30DD}\u{30F3}\u{1F381}" * 100).encode("UTF-16LE")
+  end
+
   def embed_header_size
     GC::INTERNAL_CONSTANTS[:RBASIC_SIZE] + RbConfig::SIZEOF['void*']
   end