Apply ko1 patch

Author: Edouard-chin

bootstraptest/test_ractor.rb

@@ -845,8 +845,8 @@ def ractor_local_globals
   Ractor.new { inner = 99; eval("inner").to_s }.value
 }
 
-# ivar in shareable-objects are not allowed to access from non-main Ractor
-assert_equal "can not get unshareable values from instance variables of classes/modules from non-main Ractors (@iv from C)", <<~'RUBY', frozen_string_literal: false
+# ivar in shareable-objects are not allowed to access from non-owner Ractor
+assert_equal "can not get unshareable values from instance variables of classes/modules created by another Ractor (@iv from C)", <<~'RUBY', frozen_string_literal: false
   class C
     @iv = 'str'
   end
@@ -1189,7 +1189,7 @@ def self.cv?
 }
 
 # Getting non-shareable objects via constants by other Ractors is not allowed
-assert_equal 'can not access non-shareable objects in constant C::CONST by non-main Ractor.', <<~'RUBY', frozen_string_literal: false
+assert_equal 'can not access non-shareable objects in constant C::CONST of a class/module created by another Ractor.', <<~'RUBY', frozen_string_literal: false
   class C
     CONST = 'str'
   end
@@ -1204,7 +1204,7 @@ class C
   RUBY
 
 # Constant cache should care about non-shareable constants
-assert_equal "can not access non-shareable objects in constant Object::STR by non-main Ractor.", <<~'RUBY', frozen_string_literal: false
+assert_equal "can not access non-shareable objects in constant Object::STR of a class/module created by another Ractor.", <<~'RUBY', frozen_string_literal: false
   STR = "hello"
   def str; STR; end
   s = str() # fill const cache
@@ -1216,7 +1216,7 @@ def str; STR; end
 RUBY
 
 # The correct constant path shall be reported
-assert_equal "can not access non-shareable objects in constant Object::STR by non-main Ractor.", <<~'RUBY', frozen_string_literal: false
+assert_equal "can not access non-shareable objects in constant Object::STR of a class/module created by another Ractor.", <<~'RUBY', frozen_string_literal: false
   STR = "hello"
   module M
     def self.str; STR; end
@@ -1229,8 +1229,8 @@ def self.str; STR; end
   end
 RUBY
 
-# Setting non-shareable objects into constants by other Ractors is not allowed
-assert_equal 'can not set constants with non-shareable objects by non-main Ractors', <<~'RUBY', frozen_string_literal: false
+# Setting constants of classes created by other Ractors is not allowed
+assert_equal 'can not set constants of classes/modules created by another Ractor', <<~'RUBY', frozen_string_literal: false
   class C
   end
   r = Ractor.new do
@@ -1775,27 +1775,25 @@ class C8; def self.foo = 17; end
 }
 
 # check method cache invalidation
+# (the owner Ractor redefines methods while another Ractor calls them)
 assert_equal 'true', %q{
   class Foo
     def hello = nil
   end
 
-  r1 = Ractor.new do
-    1000.times do
-      class Foo
-        def hello = nil
-      end
-    end
-  end
-
   r2 = Ractor.new do
     1000.times do
       o = Foo.new
       o.hello
     end
   end
 
-  r1.value
+  1000.times do
+    class Foo
+      def hello = nil
+    end
+  end
+
   r2.value
 
   true
@@ -2640,21 +2638,23 @@ def call_test(obj)
 assert_equal 'ok', <<~'RUBY'
 
 begin
-  CLASSES = 1000.times.map { Class.new }.freeze
-
+  # Each Ractor creates its own class (it can only define bmethods on classes
+  # it owns) and returns it after defining the bmethod.
   # This would be better to run in parallel, but there's a bug with lambda
   # creation and YJIT causing crashes in dev mode
-  ractors = CLASSES.map do |klass|
-    Ractor.new(klass) do |klass|
+  ractors = 1000.times.map do
+    Ractor.new do
+      klass = Class.new
       Ractor.receive
       klass.define_method(:foo) {}
+      klass
     end
   end
 
-  ractors.each do |ractor|
+  CLASSES = ractors.map do |ractor|
     ractor << nil
-    ractor.join
-  end
+    ractor.value
+  end.freeze
 
   ractors.clear
   GC.start

class.c

@@ -31,6 +31,7 @@
 #include "ruby/st.h"
 #include "vm_core.h"
 #include "ruby/ractor.h"
+#include "ractor_core.h"
 #include "yjit.h"
 #include "zjit.h"
 
@@ -675,6 +676,13 @@ class_alloc0(enum ruby_value_type type, VALUE klass, bool boxable)
 
     memset(RCLASS_EXT_PRIME(obj), 0, sizeof(rb_classext_t));
 
+    // The creating Ractor owns the new class/module (owner_ractor == 0 means
+    // the main Ractor; iclasses have no meaningful owner). Singleton classes
+    // of classes/modules override this to inherit the attached object's owner.
+    if (type != T_ICLASS && UNLIKELY(!rb_ractor_main_p())) {
+        RCLASS_EXT_PRIME(obj)->owner_ractor = GET_RACTOR()->pub.self;
+    }
+
     /* ZALLOC
       RCLASS_CONST_TBL(obj) = 0;
       RCLASS_M_TBL(obj) = 0;
@@ -704,6 +712,36 @@ class_alloc(enum ruby_value_type type, VALUE klass)
     return class_alloc0(type, klass, boxable);
 }
 
+bool
+rb_class_owned_p(VALUE klass)
+{
+    // The owner Ractor object is marked from the classext, so the comparison
+    // is never against a dangling/reused reference. Classes whose owner
+    // Ractor has terminated are permanently read-only for everybody.
+    VALUE owner = RCLASS_OWNER_RACTOR(klass);
+    if (LIKELY(!owner)) {
+        // owner_ractor == 0 means the class is owned by the main Ractor.
+        // The main Ractor owns it unless the current thread is subject to
+        // Ractor isolation rules (a real non-main Ractor, or the main Ractor
+        // running under Ractor.check_isolation), in which case it is treated
+        // as owned by nobody.
+        return !rb_ractor_isolation_check_active();
+    }
+    else {
+        return owner == GET_RACTOR()->pub.self;
+    }
+}
+
+void
+rb_class_owner_check(VALUE klass)
+{
+    if (UNLIKELY(!rb_class_owned_p(klass))) {
+        rb_raise(rb_eRactorIsolationError,
+                 "can not modify %"PRIsVALUE" because it is created by another Ractor",
+                 rb_class_path(klass));
+    }
+}
+
 static VALUE
 class_associate_super(VALUE klass, VALUE super, bool init)
 {
@@ -1023,6 +1061,43 @@ rb_module_check_initializable(VALUE mod)
     }
 }
 
+static enum rb_id_table_iterator_result
+init_copy_check_const_i(ID id, VALUE v, void *data)
+{
+    const rb_const_entry_t *ce = (const rb_const_entry_t *)v;
+    if (!UNDEF_P(ce->value) && !rb_ractor_shareable_p(ce->value)) {
+        rb_raise(rb_eRactorIsolationError,
+                 "can not copy a class/module created by another Ractor because "
+                 "constant %"PRIsVALUE" refers to an unshareable object", rb_id2str(id));
+    }
+    return ID_TABLE_CONTINUE;
+}
+
+static int
+init_copy_check_field_i(ID id, VALUE val, st_data_t arg)
+{
+    if ((rb_is_instance_id(id) || rb_is_class_id(id)) && !rb_ractor_shareable_p(val)) {
+        rb_raise(rb_eRactorIsolationError,
+                 "can not copy a class/module created by another Ractor because "
+                 "variable %"PRIsVALUE" refers to an unshareable object", rb_id2str(id));
+    }
+    return ST_CONTINUE;
+}
+
+// When copying a class/module created by another Ractor, the copy belongs to
+// the current Ractor, so its tables must not leak unshareable objects owned
+// by the source's Ractor.
+static void
+init_copy_owner_check(VALUE orig)
+{
+    if (!rb_class_owned_p(orig)) {
+        if (RCLASS_CONST_TBL(orig)) {
+            rb_id_table_foreach(RCLASS_CONST_TBL(orig), init_copy_check_const_i, NULL);
+        }
+        rb_ivar_foreach_buffered(orig, init_copy_check_field_i, 0);
+    }
+}
+
 /* :nodoc: */
 VALUE
 rb_mod_init_copy(VALUE clone, VALUE orig)
@@ -1045,6 +1120,8 @@ rb_mod_init_copy(VALUE clone, VALUE orig)
     RUBY_ASSERT(RB_TYPE_P(orig, T_CLASS) || RB_TYPE_P(orig, T_MODULE));
     RUBY_ASSERT(BUILTIN_TYPE(clone) == BUILTIN_TYPE(orig));
 
+    init_copy_owner_check(orig);
+
     rb_class_set_initialized(clone);
 
     /* cloned flag is refer at constant inline cache
@@ -1274,6 +1351,9 @@ make_metaclass(VALUE klass)
     VALUE metaclass = class_boot_boxable(Qundef, FL_TEST_RAW(klass, RCLASS_BOXABLE));
 
     FL_SET(metaclass, FL_SINGLETON);
+    // A metaclass is owned by the owner of the class it is attached to,
+    // not by the Ractor which happened to trigger its lazy creation.
+    RCLASS_SET_OWNER_RACTOR(metaclass, RCLASS_OWNER_RACTOR(klass));
     rb_singleton_class_attached(metaclass, klass);
 
     if (META_CLASS_OF_CLASS_CLASS_P(klass)) {
@@ -1309,6 +1389,11 @@ make_singleton_class(VALUE obj)
     VALUE orig_class = METACLASS_OF(obj);
     VALUE klass = class_alloc0(T_CLASS, rb_cClass, FL_TEST_RAW(orig_class, RCLASS_BOXABLE));
     FL_SET(klass, FL_SINGLETON);
+    if (RB_TYPE_P(obj, T_MODULE)) {
+        // The singleton class of a module is owned by the module's owner,
+        // not by the Ractor which happened to trigger its lazy creation.
+        RCLASS_SET_OWNER_RACTOR(klass, RCLASS_OWNER_RACTOR(obj));
+    }
     class_initialize_method_table(klass);
     class_associate_super(klass, orig_class, true);
     if (orig_class && !UNDEF_P(orig_class)) {

doc/language/ractor.md

@@ -345,6 +345,52 @@ To isolate unshareable objects across ractors, we introduced additional language
 
 Note that when not using ractors, these additional semantics are not needed (100% compatible with Ruby 2).
 
+### Class and module ownership
+
+Every class/module records the Ractor that created it as its *owner*. Only the owner Ractor can modify the class/module:
+
+* defining, removing or undefining methods, `alias`, and changing method visibility
+* `include`/`prepend` into the class/module, and refining it with `Module#refine`
+* defining or removing constants, and registering `autoload`
+* setting instance variables of the class/module object
+
+Reading (calling methods, instantiating, reading constants and instance variables, subclassing, and so on) is allowed from any Ractor as before.
+
+All classes/modules defined at boot or by code run by the main Ractor (including `require`d libraries) are owned by the main Ractor, so non-main ractors can not monkey-patch them:
+
+```ruby
+r = Ractor.new do
+  class String            # reopening itself is harmless, but...
+    def foo; end          # ...defining a method on a class created by
+  end                     # another Ractor raises
+end
+begin
+  r.join
+rescue Ractor::RemoteError => e
+  e.cause.message #=> "can not modify String because it is created by another Ractor"
+end
+```
+
+In exchange, a Ractor can fully use the classes/modules it created itself, including things which were previously allowed only on the main Ractor:
+
+```ruby
+Ractor.new do
+  k = Class.new do
+    def hello = "hello"
+  end
+  k.const_set(:CONST, [1, 2, 3])       # even unshareable constant values
+  k.instance_variable_set(:@iv, [4, 5]) # even unshareable ivar values
+  k.new.hello
+end.value #=> "hello"
+```
+
+Notes:
+
+* A singleton class (and a metaclass) is owned by the owner of the object it is attached to, not by the Ractor which happened to trigger its lazy creation. So `def C.foo` is allowed exactly for the owner of `C`.
+* Classes/modules whose owner Ractor has terminated become permanently read-only for every Ractor.
+* Since defining a constant in a class/module created by another Ractor is prohibited, a non-main Ractor can not define a top-level class name (it would write a constant into `Object`). Define classes under your own namespace instead: `m = Module.new; m.const_set(:Foo, Class.new)`.
+* Copying a class/module created by another Ractor with `Class#dup`/`Object#clone` creates a copy owned by the copying Ractor; it raises `Ractor::IsolationError` if the source's constants or instance variables refer to unshareable objects.
+
 ### Global variables
 
 Only the main Ractor can access global variables.
@@ -366,7 +412,7 @@ Note that some special global variables, such as `$stdin`, `$stdout` and `$stder
 
 ### Instance variables of shareable objects
 
-Instance variables of classes/modules can be accessed from non-main ractors only if their values are shareable objects.
+Instance variables of classes/modules can be accessed from non-owner ractors only if their values are shareable objects.
 
 ```ruby
 class C
@@ -380,7 +426,7 @@ p Ractor.new do
 end.value #=> 1
 ```
 
-Otherwise, only the main Ractor can access instance variables of shareable objects.
+Otherwise, only the owner Ractor can access instance variables of classes/modules. Setting them is prohibited for non-owner ractors regardless of the value.
 
 ```ruby
 class C
@@ -393,14 +439,14 @@ Ractor.new do
       p @iv
     rescue Ractor::IsolationError
       p $!.message
-      #=> "can not get unshareable values from instance variables of classes/modules from non-main Ractors"
+      #=> "can not get unshareable values from instance variables of classes/modules created by another Ractor (@iv from C)"
     end
 
     begin
       @iv = 42
     rescue Ractor::IsolationError
       p $!.message
-      #=> "can not set instance variables of classes/modules by non-main Ractors"
+      #=> "can not set instance variables of classes/modules created by another Ractor"
     end
   end
 end.join
@@ -423,7 +469,7 @@ end
 
 ### Class variables
 
-Only the main Ractor can access class variables.
+Class variables are shared across the whole inheritance chain (and the class they are actually stored in can even change over time), so no single owner Ractor can be defined for them. Therefore they are not covered by the ownership relaxation above: only the main Ractor can write class variables, and only into classes/modules it owns. Non-shareable class variable values can only be read by the main Ractor.
 
 ```ruby
 class C
@@ -446,7 +492,7 @@ end
 
 ### Constants
 
-Only the main Ractor can read constants which refer to an unshareable object.
+Only the owner Ractor of the class/module the constant is defined in can read constants which refer to an unshareable object.
 
 ```ruby
 class C
@@ -462,7 +508,7 @@ rescue => e
 end
 ```
 
-Only the main Ractor can define constants which refer to an unshareable object.
+Defining constants in a class/module created by another Ractor is prohibited, regardless of the value. The owner can define constants with any values, but constants which refer to unshareable objects can only be read back by the owner.
 
 ```ruby
 class C

eval.c

@@ -441,6 +441,7 @@ rb_class_modify_check(VALUE klass)
         }
         rb_error_frozen_object(klass);
     }
+    rb_class_owner_check(klass);
 }
 
 NORETURN(static void rb_longjmp(rb_execution_context_t *, enum ruby_tag_type, volatile VALUE, VALUE));
@@ -1616,6 +1617,10 @@ rb_mod_refine(VALUE module, VALUE klass)
 
     ensure_class_or_module(klass);
 
+    // Refining a class physically installs refined method entries into the
+    // target class's method table, so the target must be owned.
+    rb_class_owner_check(klass);
+
     rb_refinement_setup(&data, module, klass);
 
     rb_yield_refine_block(data.refinement, data.refinements);