Singleton classes of unshareable objects are not shareable

Currently, all RClasses are created as shareable in `class_alloc0`,
which causes singleton classes of unshareable objects to be shareable
which allows passing unshareable objects by passing their singleton
class and getting their attached object.

This changes `singleton_class_of` to mark the singleton class as shareable
when the object is shareable, and inversely, to mark the singleton class as
unshareable if the object is unshareable.

We also need to not forcibly mark the class as shareable in
`shareable_p_enter`.

Additionally, if the object is not yet marked as shareable, but is
frozen (and `allow_frozen_shareable_p`), it becomes marked as shareable
through `rb_ractor_shareable_p`, and we need to also mark its singleton
class as shareable at that point.

This also requires changing GC.verify_internal_consistency to allow
these shareable-to-unshareable references:
- method entries to their owner and definition classes
- iclass to their class
- fields to their class

This is sound since these objects can't be accessed from Ruby.

Author: etiennebarrie

class.c

@@ -29,6 +29,7 @@
 #include "internal/string.h"
 #include "internal/variable.h"
 #include "ruby/st.h"
+#include "ruby/ractor.h"
 #include "vm_core.h"
 #include "ruby/ractor.h"
 #include "yjit.h"
@@ -2871,6 +2872,12 @@ singleton_class_of(VALUE obj, bool ensure_eigenclass)
             klass = rb_make_metaclass(obj, klass);
         }
         RB_FL_SET_RAW(klass, RB_OBJ_FROZEN_RAW(obj));
+        if (!RB_OBJ_SHAREABLE_P(obj) && RB_OBJ_SHAREABLE_P(klass)) {
+            RB_FL_UNSET_RAW(klass, RUBY_FL_SHAREABLE);
+        }
+        else if (RB_OBJ_SHAREABLE_P(obj) && !RB_OBJ_SHAREABLE_P(klass)) {
+            RB_FL_SET_RAW(klass, RUBY_FL_SHAREABLE);
+        }
         if (ensure_eigenclass && RB_TYPE_P(obj, T_CLASS)) {
             /* ensures an exposed class belongs to its own eigenclass */
             (void)ENSURE_EIGENCLASS(klass);

depend

@@ -12357,6 +12357,7 @@ ractor.$(OBJEXT): $(top_srcdir)/internal/basic_operators.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/bignum.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/bits.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/box.h
+ractor.$(OBJEXT): $(top_srcdir)/internal/class.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/compilers.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/complex.h
 ractor.$(OBJEXT): $(top_srcdir)/internal/error.h

gc.c

@@ -3278,7 +3278,11 @@ gc_mark_classext_iclass(rb_classext_t *ext, bool prime, VALUE box_value, void *a
         mark_m_tbl(objspace, RCLASSEXT_M_TBL(ext));
     }
     if (RCLASSEXT_INCLUDER(ext)) {
-        gc_mark_internal(RCLASSEXT_INCLUDER(ext));
+        if (LIKELY(!rb_gc_checking_shareable()) ||
+            !RB_TYPE_P(RCLASSEXT_INCLUDER(ext), T_CLASS) || !FL_TEST_RAW(RCLASSEXT_INCLUDER(ext), FL_SINGLETON)) {
+            // module can be included in an unshareable singleton class
+            gc_mark_internal(RCLASSEXT_INCLUDER(ext));
+        }
     }
     mark_m_tbl(objspace, RCLASSEXT_CALLABLE_M_TBL(ext));
     gc_mark_internal(RCLASSEXT_CC_TBL(ext));

imemo.c

@@ -296,8 +296,16 @@ mark_and_move_method_entry(rb_method_entry_t *ment, bool reference_updating)
 {
     rb_method_definition_t *def = ment->def;
 
-    rb_gc_mark_and_move(&ment->owner);
-    rb_gc_mark_and_move(&ment->defined_class);
+    if (LIKELY(!rb_gc_checking_shareable()) ||
+        !RB_TYPE_P(ment->owner, T_CLASS) || !FL_TEST_RAW(ment->owner, FL_SINGLETON)) {
+        // method entry can be owned by a singleton unshareable class
+        rb_gc_mark_and_move(&ment->owner);
+    }
+    if (LIKELY(!rb_gc_checking_shareable()) ||
+        !RB_TYPE_P(ment->defined_class, T_CLASS) || !FL_TEST_RAW(ment->defined_class, FL_SINGLETON)) {
+        // method entry can be defined in a singleton unshareable class
+        rb_gc_mark_and_move(&ment->defined_class);
+    }
 
     if (def) {
         switch (def->type) {
@@ -512,11 +520,10 @@ rb_imemo_mark_and_move(VALUE obj, bool reference_updating)
         break;
       }
       case imemo_fields: {
-        rb_gc_mark_and_move((VALUE *)&RBASIC(obj)->klass);
-
-        if (!rb_gc_checking_shareable()) {
+        if (LIKELY(!rb_gc_checking_shareable())) {
             // imemo_fields can refer unshareable objects
             // even if the imemo_fields is shareable.
+            rb_gc_mark_and_move((VALUE *)&RBASIC(obj)->klass);
 
             if (rb_shape_obj_too_complex_p(obj)) {
                 st_table *tbl = rb_imemo_fields_complex_tbl(obj);

ractor.c

@@ -8,6 +8,7 @@
 #include "vm_core.h"
 #include "vm_sync.h"
 #include "ractor_core.h"
+#include "internal/class.h"
 #include "internal/complex.h"
 #include "internal/error.h"
 #include "internal/gc.h"
@@ -1545,6 +1546,9 @@ mark_shareable(VALUE obj)
     }
 
     rb_obj_set_shareable_no_assert(obj);
+    if (RCLASS_SINGLETON_P(RBASIC(obj)->klass)) {
+        rb_obj_set_shareable_no_assert(RBASIC(obj)->klass);
+    }
     return traverse_cont;
 }
 
@@ -1592,9 +1596,14 @@ shareable_p_enter(VALUE obj)
     else if (RB_TYPE_P(obj, T_CLASS)  ||
              RB_TYPE_P(obj, T_MODULE) ||
              RB_TYPE_P(obj, T_ICLASS)) {
-        // TODO: remove it
-        mark_shareable(obj);
-        return traverse_skip;
+        if (RCLASS_SINGLETON_P(obj) && !RB_OBJ_SHAREABLE_P(RCLASS_ATTACHED_OBJECT(obj))) {
+            return traverse_stop;
+        }
+        else {
+            // TODO: remove it
+            mark_shareable(obj);
+            return traverse_skip;
+        }
     }
     else if (RB_OBJ_FROZEN_RAW(obj) &&
              allow_frozen_shareable_p(obj)) {

test/ruby/test_ractor.rb

@@ -231,6 +231,22 @@ def test_ractor_new_raises_isolation_error_if_proc_uses_yield
     end
   end
 
+  def test_singleton_class_of_unshareable_object_is_unshareable
+    obj = Object.new
+    obj.instance_variable_set(:@unshareable, ->{})
+    refute Ractor.shareable?(obj.freeze), "object with a unshareable Proc is shareable"
+    refute Ractor.shareable?(obj.singleton_class), "singleton class of unshareable object is shareable"
+    GC.verify_internal_consistency
+  end
+
+  def test_module_can_be_included_in_unshareable_object
+    obj = Object.new
+    obj.instance_variable_set(:@unshareable, ->{})
+    obj.extend(Module.new)
+    refute Ractor.shareable?(obj.freeze), "object with a unshareable Proc is shareable"
+    GC.verify_internal_consistency
+  end
+
   def assert_make_shareable(obj)
     refute Ractor.shareable?(obj), "object was already shareable"
     Ractor.make_shareable(obj)