From bd786e78969f9d4a8699376ceafe10934b6ad533 Mon Sep 17 00:00:00 2001
From: Samuel Williams <samuel.williams@oriontransfer.co.nz>
Date: Mon, 22 May 2023 12:58:17 +0900
Subject: Fix mutation on shared strings. (#7837)

---
 io_buffer.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

(limited to 'io_buffer.c')

diff --git a/io_buffer.c b/io_buffer.c
index 5ffb79bc0c..04838f0033 100644
--- a/io_buffer.c
+++ b/io_buffer.c
@@ -300,19 +300,21 @@ rb_io_buffer_type_allocate(VALUE self)
     return instance;
 }
 
-static VALUE
-io_buffer_for_make_instance(VALUE klass, VALUE string)
+static VALUE io_buffer_for_make_instance(VALUE klass, VALUE string, enum rb_io_buffer_flags flags)
 {
     VALUE instance = rb_io_buffer_type_allocate(klass);
 
     struct rb_io_buffer *buffer = NULL;
     TypedData_Get_Struct(instance, struct rb_io_buffer, &rb_io_buffer_type, buffer);
 
-    enum rb_io_buffer_flags flags = RB_IO_BUFFER_EXTERNAL;
+    flags |= RB_IO_BUFFER_EXTERNAL;
 
     if (RB_OBJ_FROZEN(string))
         flags |= RB_IO_BUFFER_READONLY;
 
+    if (!(flags & RB_IO_BUFFER_READONLY))
+        rb_str_modify(string);
+
     io_buffer_initialize(buffer, RSTRING_PTR(string), RSTRING_LEN(string), flags, string);
 
     return instance;
@@ -322,6 +324,7 @@ struct io_buffer_for_yield_instance_arguments {
     VALUE klass;
     VALUE string;
     VALUE instance;
+    enum rb_io_buffer_flags flags;
 };
 
 static VALUE
@@ -329,9 +332,9 @@ io_buffer_for_yield_instance(VALUE _arguments)
 {
     struct io_buffer_for_yield_instance_arguments *arguments = (struct io_buffer_for_yield_instance_arguments *)_arguments;
 
-    rb_str_locktmp(arguments->string);
+    arguments->instance = io_buffer_for_make_instance(arguments->klass, arguments->string, arguments->flags);
 
-    arguments->instance = io_buffer_for_make_instance(arguments->klass, arguments->string);
+    rb_str_locktmp(arguments->string);
 
     return rb_yield(arguments->instance);
 }
@@ -365,7 +368,8 @@ io_buffer_for_yield_instance_ensure(VALUE _arguments)
  *  collector, the source string will be locked and cannot be modified.
  *
  *  If the string is frozen, it will create a read-only buffer which cannot be
- *  modified.
+ *  modified. If the string is shared, it may trigger a copy-on-write when
+ *  using the block form.
  *
  *    string = 'test'
  *    buffer = IO::Buffer.for(string)
@@ -397,6 +401,7 @@ rb_io_buffer_type_for(VALUE klass, VALUE string)
             .klass = klass,
             .string = string,
             .instance = Qnil,
+            .flags = 0,
         };
 
         return rb_ensure(io_buffer_for_yield_instance, (VALUE)&arguments, io_buffer_for_yield_instance_ensure, (VALUE)&arguments);
@@ -404,7 +409,7 @@ rb_io_buffer_type_for(VALUE klass, VALUE string)
     else {
         // This internally returns the source string if it's already frozen.
         string = rb_str_tmp_frozen_acquire(string);
-        return io_buffer_for_make_instance(klass, string);
+        return io_buffer_for_make_instance(klass, string, RB_IO_BUFFER_READONLY);
     }
 }
 
-- 
cgit v1.2.3