Re: Bug report : A weak table reuse a string key that already free

[Roberto Ierusalimschy <roberto@...>]

> I think this issue only applies to long string keys, right?

Not exactly. Any key with a nil value will remain in the table,
even after collected. The special issue with long strings is that
it is the only object that must be dereferenced to be compared,
which causes the segfault. Note that the problem is not related
to the reuse of the string; different strings also cause problems.
For instance, the following chunk also does a memory access violation
(with valgrind), even using different keys:

-----------------
local a = setmetatable({}, {__mode = 'kv'})

a['ABCDEFGHIJKLMNOPQRSTUVWXYZ' .. 'abcdefghijklmnopqrstuvwxyz'] = {}
a[next(a)] = nil
collectgarbage()
print(a['BCDEFGHIJKLMNOPQRSTUVWXYZ' .. 'abcdefghijklmnopqrstuvwxyz'])
-----------------

Other kinds of keys will not do a memory access violation.
Nevertheless, they will also do comparisons with dealocated pointers,
which is dirty and possibly invalid in ISO C. (Some people argue that,
legally, a dealocated pointer could be a "trap representation".)


> The comment point out, `the string are 'values', so are never weak`.
> 
> So, I think it can be fixed by this patch, maybe:
>
> [...]
> -      if (!ttisnil(gval(n)) && (iscleared(g, gkey(n)))) {
> +      if ((iscleared(g, gkey(n))) && !ttisnil(gval(n))) {

Maybe a better fix should be

> +      if ((iscleared(g, gkey(n)))) {

so that any collected key is cleared, regardless its value,
but I have to check that more carefully.

-- Roberto