Fix crash in rb_gc_register_address

	[Bug #19584]

	Some C extensions pass a pointer to a global variable to
	rb_gc_register_address. However, if a GC is triggered inside of
	rb_gc_register_address, then the object could get swept since it does
	not exist on the stack.

	[Bug #19584] Register global variable address before assignment

	[Bug #19584] Register global variables before assignment

	[Bug #19584] [DOC] Tweek description of `rb_gc_register_address`

	Crash when malloc during GC

	This feature was introduced in commit 2ccf6e5, but I realized that
	using rb_warn is a bad idea because it allocates objects, which causes
	a different crash ("object allocation during garbage collection phase").
	We should just hard crash here instead.

	restore the stack pointer on finalizer

	When error on finalizer, the exception will be ignored.
	To restart the code, we need to restore the stack pointer.

	fix [Bug #20042]
	---
	 gc.c                 | 4 ++++
	 test/ruby/test_gc.rb | 9 +++++++++
	 2 files changed, 13 insertions(+)

	[Bug #19896]

	fix memory leak in vm_method

	This introduces a unified reference_count to clarify who is referencing a method.
	This also allows us to treat the refinement method as the def owner since it counts itself as a reference

	Co-authored-by: Peter Zhu <peter@peterzhu.ca>
	---
	 gc.c                     |   4 +-
	 method.h                 |   6 +--
	 rjit_c.rb                |   6 +--
	 test/ruby/test_module.rb |   4 +-
	 vm_insnhelper.c          |   2 +-
	 vm_method.c              | 105 +++++++++++++++++++----------------------------
	 6 files changed, 54 insertions(+), 73 deletions(-)

	Use an st table for "too complex" objects

	st tables will maintain insertion order so we can marshal dump / load
	objects with instance variables in the same order they were set on that
	particular instance

	[ruby-core:112926] [Bug #19535]

	Co-Authored-By: Jemma Issroff <jemmaissroff@gmail.com>
	---
	 gc.c                     | 10 ++++------
	 include/ruby/st.h        |  2 ++
	 object.c                 |  2 +-
	 ractor.c                 | 43 ++++++++++++++++++++++---------------------
	 shape.h                  |  6 +++---
	 st.c                     |  6 ++++++
	 test/ruby/test_shapes.rb | 21 +++++++++++++++++++++
	 variable.c               | 28 ++++++++++++++--------------
	 vm_insnhelper.c          |  2 +-
	 9 files changed, 74 insertions(+), 46 deletions(-)

	ObjectSpace::WeakMap: clean inverse reference when an entry is
	 re-assigned

	[Bug #19531]

	```ruby
	wmap[1] = "A"
	wmap[1] = "B"
	```

	In the example above, we need to remove the `"A" => 1` inverse reference
	so that when `"A"` is GCed the `1` key isn't deleted.
	---
	 test/ruby/test_weakmap.rb | 17 +++++++++
	 weakmap.c                 | 91 ++++++++++++++++++++++++++++++++++++++---------
	 2 files changed, 91 insertions(+), 17 deletions(-)

	Ensure ruby_xfree won't segfault if called after vm_destruct

	[Bug #19580]

	The real-world scenario motivating this change is libxml2's pthread
	code which uses `pthread_key_create` to set up a destructor that is
	called at thread exit to free thread-local storage.

	There is a small window of time -- after ruby_vm_destruct but before
	the process exits -- in which a pthread may exit and the destructor is
	called, leading to a segfault.

	Please note that this window of time may be relatively large if
	`atexit` is being used.
	---
	 gc.c | 12 ++++++++++--
	 1 file changed, 10 insertions(+), 2 deletions(-)

	Fix memory leak for iclass

	[Bug #19550]

	If !RCLASS_EXT_EMBEDDED (e.g. 32 bit systems) then the rb_classext_t is
	allocated throug malloc so it must be freed.

	The issue can be seen in the following script:

	```
	20.times do
	  100_000.times do
	    mod = Module.new
	    Class.new do
	      include mod
	    end
	  end

	  # Output the Resident Set Size (memory usage, in KB) of the current Ruby process
	  puts `ps -o rss= -p #{$$}`
	end
	```

	Before this fix, the max RSS is 280MB, while after this change, it's
	30MB.
	---
	 gc.c                     |  2 +-
	 test/ruby/test_module.rb | 15 +++++++++++++++
	 2 files changed, 16 insertions(+), 1 deletion(-)

	Fix crash when allocating classes with newobj hook

	We need to zero out the whole slot when running the newobj hook for a
	newly allocated class because the slot could be filled with garbage,
	which would cause a crash if a GC runs inside of the newobj hook.

	For example, the following script crashes:

	```
	require "objspace"

	GC.stress = true

	ObjectSpace.trace_object_allocations {
	  100.times do
	    Class.new
	  end
	}
	```

	[Bug #19482]
	---
	 gc.c                           | 8 +++++++-
	 test/objspace/test_objspace.rb | 7 +++++++
	 2 files changed, 14 insertions(+), 1 deletion(-)

The class variable cache that was added in
https://github.com/ruby/ruby/pull/4544 changed the behavior of class
variables on cloned classes. As reported when a class is cloned AND a
class variable was set, and the class variable was read from the
original class, reading a class variable from the cloned class would
return the value from the original class.

This was happening because the IC (inline cache) is stored on the ISEQ
which is shared between the original and cloned class, therefore they
share the cache too.

To fix this we are now storing the `cref` in the cache so that we can
check if it's equal to the current `cref`. If it's different we don't
want to read from the cache. If it's the same we do. Cloned classes
don't share the same cref with their original class.

This will need to be backported to 3.1 in addition to 3.2 since the bug
exists in both versions.

We also added a marking function which was missing.

Fixes [Bug #19379]

Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>