Tag string shared roots to fix use-after-free

	The buffer deduplication codepath in rb_fstring can be used to free the buffer
	of shared string roots, which leads to use-after-free.

	Introudce a new flag to tag strings that at one point have been a shared root.
	Check for it in rb_fstring to avoid freeing buffers that are shared by
	multiple strings. This change is based on nobu's idea in [ruby-core:94838].

	The included test case test for the sequence of calls to internal functions
	that lead to this bug. See attached ticket for Ruby level repros.

	[Bug #16151]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67804 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	Get rid of indirect sharing

	* string.c (str_duplicate): share the root shared string if the
	  original string is already sharing, so that all shared strings
	  refer the root shared string directly.  indirect sharing can
	  cause a dangling pointer.

	[Bug #15792]

	str_duplicate: Don't share with a frozen shared string

	This is a follow up for 3f9562015e651735bfc2fdd14e8f6963b673e22a.
	Before this commit, it was possible to create a shared string which
	shares with another shared string by passing a frozen shared string
	to `str_duplicate`.

	Such string looks like:

	```
	 --------                    -----------------
	 | root | ------ owns -----> | root's buffer |
	 --------                    -----------------
	     ^                             ^   ^
	 -----------                       |   |
	 | shared1 | ------ references -----   |
	 -----------                           |
	     ^                                 |
	 -----------                           |
	 | shared2 | ------ references ---------
	 -----------
	```

	This is bad news because `rb_fstring(shared2)` can make `shared1`
	independent, which severs the reference from `shared1` to `root`:

	```c
	/* from fstr_update_callback() */
	str = str_new_frozen(rb_cString, shared2);  /* can return shared1 */
	if (STR_SHARED_P(str)) { /* shared1 is also a shared string */
	    str_make_independent(str);  /* no frozen check */
	}
	```

	If `shared1` was the only reference to `root`, then `root` can be
	reclaimed by the GC, leaving `shared2` in a corrupted state:

	```
	 -----------                         --------------------
	 | shared1 | -------- owns --------> | shared1's buffer |
	 -----------                         --------------------
	      ^
	      |
	 -----------                         -------------------------
	 | shared2 | ------ references ----> | root's buffer (freed) |
	 -----------                         -------------------------
	```

	Here is a reproduction script for the situation this commit fixes.

	```ruby
	a = ('a' * 24).strip.freeze.strip
	-a
	p a
	4.times { GC.start }
	p a
	```

	 - string.c (str_duplicate): always share with the root string when
	   the original is a shared string.
	 - test_rb_str_dup.rb: specifically test `rb_str_dup` to make
	   sure it does not try to share with a shared string.

	[Bug #15792]

	Closes: https://github.com/ruby/ruby/pull/2159

	Update dependencies


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67731 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

FrozenError will be used instead of RuntimeError for exceptions
raised when there is an attempt to modify a frozen object. The
reason for this change is to differentiate exceptions related
to frozen objects from generic exceptions such as those generated
by Kernel#raise without an exception class.

From: Jeremy Evans <code@jeremyevans.net>
Signed-off-by: Urabe Shyouhei <shyouhei@ruby-lang.org>


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61131 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60993 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* string.c (rb_external_str_new_with_enc): do not search non-ascii
  by NULL pointer.  [ruby-core:84055] [Bug #14150]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60979 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

  These are detected by https://github.com/client9/misspell

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60359 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* io.c (io_setstrbuf): return true if the buffer is newly created.

* io.c (io_set_read_length): shrink the read buffer if it is a new
  object and is too large.  [ruby-core:81370] [Bug #13597]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59701 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* test/-ext-/string/test_modify_expand.rb (test_integer_overflow):
  no longer happens on platforms where size_t is larger than long,
  e.g. 64bit windows, since r57122.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57156 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* test/-ext-/string/test_fstring.rb (test_singleton_class): fix
  expected exception class.  [ruby-dev:49867] [Bug #12923]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56754 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* class.c (singleton_class_of): prohibit fstrings from creating
  singleton classes.
  temporary measure for [ruby-dev:49867] [Bug #12923]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56747 b2dd03c8-39d4-4d8f-98ff-823fe69b080e