sandboxes and rb_ensure

Been thinking about the ensure issue -- the thing is, right now, the
calling of the ensure block is wholly unconditional in rb_ensure.  We'd
need a direct interpreter hack to change that, and to be honest I don't
really feel good about weakening the ensure guarantees further.

The more I think about it, the more I think continuations (or something
like them) rather than exceptions could do the trick.  You could even,
in principle, use a continuation to ferry a "foreign" exception up
through a sandbox, unensured (though I'm still not sure subverting
ensure is a good idea unless you're forcibly terminating the eval in
response to a timeout).

(For YARV, we'd do fine with just setjmp-ish half-continuations, I
think.  But as long as Real Continuations are there we probably have to
use continuations for this too.)

The main difficulty is that you can't call a continuation "remotely"
like you can raise an exception remotely with Thread#raise ... in which
case we're back to interpreter hacks again for that.  Also, performance
for saving that snapshot of the stack for the continuation is not so
great.  So, I dunno.  But all that "unwind the stack to just this point,
bypassing ensure" machinery is already taken care of for them, and that
makes them appealing to me.

Thread#goto( cont ) anyone? :D

-mental