__gc metamethod bug

Hi there

I’ve searched on the bugs list but can’t find this anywhere. Was wondering if somebody could advise if my interpretation of this issue is correct.

I spent the past day or so trying to track down weird memory trampling in our LUA integration. As you might expect, the __gc function for one of our object types wasn’t being called, and as a result various areas of the game still held a pointer to it, which eventually led to them attempting to access dodgy data.

As far as I can see, whether an object is added for finalisation depends on the result of the function luaC_checkfinalizer getting called, which checks for an __gc metafunction and if so, adds it to the finobj list. However, this is only done at the point at which you set the metatable, inside lua_setmetatable:

LUA_API int lua_setmetatable (lua_State *L, int objindex) {

TValue *obj;

Table *mt;

lua_lock(L);

api_checknelems(L, 1);

obj = index2addr(L, objindex);

if (ttisnil(L->top - 1))

mt = NULL;

else {

api_check(L, ttistable(L->top - 1), "table expected");

mt = hvalue(L->top - 1);

}

switch (ttypenv(obj)) {

case LUA_TTABLE: {

hvalue(obj)->metatable = mt;

if (mt) {

luaC_objbarrierback(L, gcvalue(obj), mt);

luaC_checkfinalizer(L, gcvalue(obj), mt);

}

break;

}

case LUA_TUSERDATA: {

uvalue(obj)->metatable = mt;

if (mt) {

luaC_objbarrier(L, rawuvalue(obj), mt);

luaC_checkfinalizer(L, gcvalue(obj), mt);

}

break;

}

default: {

G(L)->mt[ttypenv(obj)] = mt;

break;

}

L->top--;

lua_unlock(L);

return 1;

}

As a result, if you set the metatable of an object, then later modify that table, the __gc metamethod is never detected, and the object will not be marked for finalization.

The fix from my side is obviously just to set the meta table after filling it in, but it seems like a bit of an issue, as there’s nothing anywhere to stop you modifying the meta table after it’s been set.

Or have I totally missed something J

-Chris