JRuby: make JSON::Coder thread-safe (#1064)

Author: redconfetti

CHANGES.md

@@ -6,6 +6,7 @@
 * Fix `JSON.generate` not detecting duplicate keys such as `{ "1" => 1, 1 => 2 }`.
 * JRuby: raise `TypeError` when a String subclass used as a Hash key has a `to_s` that doesn't return a String, like the C extension.
 * JRuby and TruffleRuby: fix a stack overflow in `JSON::Coder` when `as_json` returns a Symbol for a string with invalid encoding.
+* JRuby: fix `JSON::Coder` (and any frozen `JSON::State`) not being thread-safe. Each `#dump` call now uses its own nesting depth instead of mutating the shared state, which under concurrent use could make every later call raise `JSON::NestingError`.
 
 ### 2026-10-13 (3.1.0)
 

java/src/json/ext/Generator.java

@@ -54,8 +54,9 @@ static <T extends IRubyObject> RubyString generateJson(ThreadContext context, T
     }
 
     static <T extends IRubyObject> RubyString generateJson(ThreadContext context, T object, Handler<? super T> handler, IRubyObject arg0) {
-        Session session = new Session(arg0);
-        GeneratorState state = session.getState(context);
+        GeneratorState state = GeneratorState.fromState(context, arg0 == null || arg0.isNil() ? null : arg0)
+                .forGeneration(context);
+        Session session = new Session(state);
         state.validateRfc8785(context);
         int depth = state.depth;
         try {
@@ -86,8 +87,8 @@ static <T extends IRubyObject> RubyString generateJson(ThreadContext context, T
     public static <T extends IRubyObject> IRubyObject
             generateJson(ThreadContext context, T object,
                          GeneratorState config, IRubyObject io) {
-        Session session = new Session(config);
-        GeneratorState state = session.getState(context);
+        GeneratorState state = config.forGeneration(context);
+        Session session = new Session(state);
         state.validateRfc8785(context);
         int depth = state.depth;
 

java/src/json/ext/GeneratorState.java

@@ -666,6 +666,20 @@ public RubyHash to_h(ThreadContext context) {
         return result;
     }
 
+    /**
+     * Returns the state to mutate while generating a single document.
+     *
+     * <p>A frozen state (such as the one held by <code>JSON::Coder</code>) may be
+     * shared by concurrent calls, so generating with it must not touch its
+     * <code>depth</code>. In that case a private, unfrozen copy is returned.
+     */
+    GeneratorState forGeneration(ThreadContext context) {
+        if (!isFrozen()) return this;
+        GeneratorState copy = new GeneratorState(context.runtime, getMetaClass());
+        copy.initialize_copy(context, this);
+        return copy;
+    }
+
     public int increaseDepth(ThreadContext context) {
         checkMaxNesting(context);
         return ++depth;

test/json/json_coder_test.rb

@@ -259,4 +259,72 @@ def test_nesting_recovery
     end
     assert_equal '{"a":1}', coder.dump({ a: 1 })
   end
+
+  def test_dump_concurrently
+    coder = JSON::Coder.new
+    expected = '{"a":{"b":[1,{"c":2}]}}'
+    results = run_concurrently(20, 1000) { coder.dump({ a: { b: [1, { c: 2 }] } }) }
+    assert_equal [expected], results.uniq
+    assert_equal "[[]]", coder.dump([[]])
+  end
+
+  def test_dump_concurrently_with_thread_pass
+    custom = Struct.new(:value)
+    coder = JSON::Coder.new do |object|
+      Thread.pass
+      object.value
+    end
+    expected = '{"a":[{"b":[1]},2]}'
+    results = run_concurrently(10, 200) do
+      coder.dump({ a: [{ b: [custom.new(1)] }, custom.new(2)] })
+    end
+    assert_equal [expected], results.uniq
+    assert_equal "[[]]", coder.dump([[]])
+  end
+
+  def test_dump_concurrently_with_depth
+    coder = JSON::Coder.new(depth: 1, max_nesting: 3)
+    results = run_concurrently(10, 500) { coder.dump([[1]]) }
+    assert_equal ["[[1]]"], results.uniq
+    assert_raise(JSON::NestingError) { coder.dump([[[1]]]) }
+  end
+
+  def test_frozen_state_depth_unchanged
+    state = JSON::State.new.freeze
+    assert_equal "[[1]]", state.generate([[1]])
+    assert_equal 0, state.depth
+
+    ary = []
+    ary << ary
+    assert_raise(JSON::NestingError) { state.generate(ary) }
+    assert_equal 0, state.depth
+
+    results = run_concurrently(10, 500) { state.generate({ a: [1, { b: 2 }] }) }
+    assert_equal ['{"a":[1,{"b":2}]}'], results.uniq
+    assert_equal 0, state.depth
+  end
+
+  private
+
+  def run_concurrently(thread_count, iterations)
+    threads = thread_count.times.map do
+      Thread.new do
+        Thread.current.report_on_exception = false
+        Array.new(iterations) { yield }
+      end
+    end
+
+    begin
+      threads.flat_map(&:value)
+    rescue
+      threads.each do |thread|
+        if thread.alive?
+          thread.kill
+          thread.join rescue nil
+        end
+      end
+
+      raise
+    end
+  end
 end