Re: Possible bug in Lua's Garbage Collector

[Edgar Toernig <froese@...>]

Patrick Donnelly wrote:
>
> I had a userdata that I pushed
> onto the stack, and later (while it was still on the stack), it was
> finalized unexpectedly.

> static int preparethreads (lua_State *L)
> {
>   Target *target = (Target *) lua_touserdata(L, 1);
>   Target **utarget;
> 
>   lua_settop(L, 0); // clear stack
> 
>   utarget = (Target **) lua_newuserdata(L, sizeof(Target *)); // index 1

I haven't read further as here's already a bug.

The settop(0) removes the reference to the passed userdata.
If that was the only reference to it, 'target' is now no
longer valid.  The following lua calls (like lua_newuserdata)
may invoke the GC, free the userdata, reuse the memory for
something else and 'target' points to garbage.

Ciao, ET.