Fix the case of unmarshalling a String.clone instance

* In such a case, one cannot bind String#__allocate__ to that class,
  but they are the same implementation (CallTarget) anyway, using the
  same Layout, which is required for correctness.
* MRI also refuses binding a method on a module/class clone, even though
  that seems relatively safe.
* Use the same error as MRI in the broken case.

Author: eregon

src/main/ruby/core/marshal.rb

@@ -229,7 +229,19 @@ def construct_string
       bytes = get_byte_sequence.force_encoding(Encoding::ASCII_8BIT)
 
       if @user_class
-        obj = STRING_ALLOCATE.bind(get_user_class).call
+        cls = get_user_class
+        if cls < String
+          obj = STRING_ALLOCATE.bind(cls).call
+        else
+          allocate = cls.method(:__allocate__)
+          if allocate.unbind == STRING_ALLOCATE
+            # For example, String.clone falls in this case
+            obj = allocate.call
+          else
+            raise ArgumentError, 'dump format error (user class)'
+          end
+        end
+
         Truffle.invoke_primitive(:string_initialize, obj, bytes, Encoding::ASCII_8BIT)
       else
         obj = bytes