[Bug #22383] Fix inverted STR_SHARED check in rb_str_tmp_frozen_release

45a2c95 mistakenly rewrote

    FL_TEST_RAW(orig, STR_SHARED) && !FL_TEST_RAW(orig, STR_TMPLOCK|RUBY_FL_FREEZE)

as

    FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_TMPLOCK

requiring orig to not be shared, the opposite of the original
condition.  orig always shares the buffer with tmp here, so the buffer
was never given back and the string stayed shared until its next
modification copied it.  The code then read aux.shared from strings
that are not shared, where the union holds aux.capa.

This should be backported to 4.0

Author: rwstauner

ext/-test-/string/capacity.c

@@ -17,9 +17,18 @@ bug_str_new_shared(VALUE klass, VALUE str)
     return rb_str_new_shared(str);
 }
 
+static VALUE
+bug_str_tmp_frozen_acquire_release(VALUE klass, VALUE str)
+{
+    VALUE tmp = rb_str_tmp_frozen_acquire(str);
+    rb_str_tmp_frozen_release(str, tmp);
+    return str;
+}
+
 void
 Init_string_capacity(VALUE klass)
 {
     rb_define_singleton_method(klass, "capacity", bug_str_capacity, 1);
     rb_define_singleton_method(klass, "rb_str_new_shared", bug_str_new_shared, 1);
+    rb_define_singleton_method(klass, "tmp_frozen_acquire_release", bug_str_tmp_frozen_acquire_release, 1);
 }

string.c

@@ -1629,7 +1629,7 @@ rb_str_tmp_frozen_release(VALUE orig, VALUE tmp)
     if (STR_EMBED_P(tmp)) {
         RUBY_ASSERT(OBJ_FROZEN_RAW(tmp));
     }
-    else if (FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_TMPLOCK &&
+    else if (FL_TEST_RAW(orig, STR_SHARED | STR_TMPLOCK) == STR_SHARED &&
             !OBJ_FROZEN_RAW(orig)) {
         VALUE shared = RSTRING(orig)->as.heap.aux.shared;
 

test/-ext-/string/test_capacity.rb

@@ -60,12 +60,31 @@ def test_capacity_fstring
     assert_equal(s.length, capa(s))
   end
 
+  # Temporarily handing a string's buffer over to a frozen shared root
+  # (rb_str_tmp_frozen_acquire) uses an internal ASCII-8BIT string.  Use
+  # UTF-16LE so that the terminator length of the root differs from the
+  # terminator length of the string to verify that releasing the root restores
+  # the capacity in the string's own encoding.
+  def test_frozen_root_capacity_with_multibyte_terminator
+    s = multibyte_terminator_string
+    capacity = capa(s)
+    assert_operator(capacity, :>=, s.bytesize)
+
+    Bug::String.tmp_frozen_acquire_release(s)
+
+    assert_equal(capacity, capa(s))
+  end
+
   private
 
   def capa(str)
     Bug::String.capacity(str)
   end
 
+  def multibyte_terminator_string
+    ("\u{30AF}\u{30FC}\u{30DD}\u{30F3}\u{1F381}" * 100).encode("UTF-16LE")
+  end
+
   def embed_header_size
     GC::INTERNAL_CONSTANTS[:RBASIC_SIZE] + RbConfig::SIZEOF['void*']
   end