Re: Patch to fix Reference/natReference.

[David Daney <ddaney at avtrex dot com>]

Tom Tromey wrote:

> David> If Reference.clear() is called and then the Reference is finalized
> David> before its referent, a dangling pointer is created in the object_list
> David> structure in natReference.cc.  This happens because the 'copy' field
> David> of the Reference is cleared and that is what is used to find the slot
> David> in the object_list table.
>
> Could you try the appended patch instead?
We think that your patch will cause incorrect Reference semantics, so we 
did not try it.

There would be a race condition as follows:

1) GC decides that referent is collectable and puts it on the finalizer 
queue.

2) User program calles Reference.get() and obtains a valid hard 
reference to referent.

3) GC runs finalizer, causing the Reference to be cleared and put on the 
ReferenceQueue.

Step 3 should never have happened because there is a valid hard 
reference to the referent.

Disappearing links are cleared with the "World Stopped", so there is no 
race if they are used.

David.