Fix crash caused by concurrent ObjectSpace.dump_all calls

Since the callback defined in the objspace module might give up the GVL,
we need to make sure the right cr->mfd value is set back after the GVL
is re-obtained.

gc.c

@@ -11935,7 +11935,11 @@ static void
 reachable_objects_from_callback(VALUE obj)
 {
     rb_ractor_t *cr = GET_RACTOR();
-    cr->mfd->mark_func(obj, cr->mfd->data);
+    struct gc_mark_func_data_struct *cur_mfd = cr->mfd;
+    cur_mfd->mark_func(obj, cr->mfd->data);
+    /* mark_func might give up the GVL, in which time some other thread might set
+       mfd. In that case, set it back to the right value for this thread. */
+    cr->mfd = cur_mfd;
 }
 
 void

test/objspace/test_objspace.rb

@@ -918,6 +918,14 @@ class TestObjSpace < Test::Unit::TestCase
     assert_equal 2, ObjectSpace.dump_shapes(output: :string, since: RubyVM.stat(:next_shape_id) - 2).lines.size
   end
 
+  def test_dump_all_in_parallel_bug_19922
+    dump_ten_times = ->() { 10.times { ObjectSpace.dump_all.tap { _1.close } } }
+    t = Thread.new { dump_ten_times.call }
+    dump_ten_times.call
+    t.value
+    # Bug #19922 would cause this test to crash.
+  end
+
   private
 
   def utf8_❨╯°□°❩╯︵┻━┻