test: growing a shared string detaches its buffer - #7167

mrb_str_cat() appends into a buffer it shares with other strings, because an append only writes [len, len + addlen), a range no other sharer can see. Growth through mrb_str_resize() looks like the same opportunity, and it is not. Nothing in the suite said so; these tests do.

mrb_str_resize() is a public API that hands the buffer back to its caller and lets it write wherever it likes, and its callers write from the front: String#insert memmoves from the insertion index, String#prepend moves the whole content up from 0, String#succ! writes over the string from 0, String#bytesplice writes from idx1, and the callers in mruby-pack and mruby-io fill their buffers from offset 0. Keeping the buffer shared across the growth lets any of them overwrite bytes another string is still reading.

Most of those call mrb_str_modify() themselves before resizing, so they detach for their own reasons. IO#sysread and BasicSocket#recv do not: both resize a buffer supplied from Ruby and then read into it from offset 0, io.c calling mrb_str_modify() only on the branch where the length already matches and no resize happens. So the invariant is load-bearing today, and untested.

Two variants of the optimisation were built to check that:

• A: str_modify_cat()'s logic in mrb_str_resize(), nothing else changed.
• B: A, plus dropping the now-redundant mrb_str_modify() in String#insert, String#prepend and String#bytesplice.

Both pass the pre-existing suite with KO: 0. Variant A silently rewrites a string through IO#sysread:

a = "a" * 100 + "z" * 100
a.bytesplice(100, 100, "")   # shorten, leaving spare capacity
buf = a.dup                  # shares that buffer
io.sysread(150, buf)         # grows it, then reads in from offset 0
a                            # overwritten, and never touched

and variant B additionally does it through String#insert(0, ...) and String#prepend:

$ ./build/host/bin/mruby -e 'a = "a"*100; a << "z"*100; b = a[0,150]; a.insert(0,"XXXX"); p b[0,8]'
"XXXXaaaa"      # expected "aaaaaaaa"

With the tests in this PR, variant A fails on IO#sysread into a shared buffer (KO: 1) and variant B fails on that plus String growth on a shared buffer and String#bytesplice on a shared buffer (KO: 3).

The optimisation was measured before being rejected: on s = ""; N.times { s.insert(-1, "...20 bytes..."); s[0, 30] } it is indistinguishable from master over 9 repetitions per point, and both remain quadratic. mrb_str_resize() sizes the buffer to exactly the requested length, so there is none of the geometric growth that makes mrb_str_cat()'s in-place append amortize.

Some assertions here pin the invariant on shapes that cannot currently distinguish the two behaviours: insert at the end writes above the other sharer, and succ! writes a terminator in place before it grows. They are kept as contract and marked as such in the comments.

Tests only, no behaviour change. rake -m test: mrbtest Total: 2078, OK: 2049, KO: 0, Crash: 0, Warning: 0, Skip: 29, up from 2075 by the three new blocks; bintest Total: 105, OK: 105, KO: 0.

Summary by CodeRabbit

• Tests
  • Added regression coverage for reading into resized, shared string buffers without altering the original string.
  • Added tests confirming string growth operations preserve independent contents when buffers are shared.
  • Added coverage for byte-level splicing with shared target and replacement strings.
  • Improved resource cleanup verification during I/O tests.