Original bug ID: 5233
Reporter: bobot
Assigned to: @damiendoligez
Status: closed (set by @damiendoligez on 2012-06-21T14:31:52Z)
Resolution: fixed
Priority: normal
Severity: crash
Version: 3.13.0+dev
Target version: 4.01.0+dev
Fixed in version: 4.00.0+dev
Category: ~DO NOT USE (was: OCaml general)
Monitored by: mehdi @ygrek "Julien Signoles"

Bug description

In bytecode, if a weak pointer and the value it points are garbage collected at the same time, a finaliser which dereferences the weak pointer can access invalid memory.

For example the following code produces a segmentation fault :

===================
open Printf

let target = ref [2;3]

let t = ref (Weak.create 1)

let () = Weak.set !t 0 (Some !target);
Gc.finalise (fun w -> match Weak.get w 0 with
| None -> printf "Consistent\n"
| Some [] -> printf "How its possible?\n"
| Some (i::_) -> printf "Value not garbage collected : %i\n" i) !t

(** Force to grow the heap *)
let b = ref (Array.create 10000000 1)

let () =
(** release the target and the weak array )
target := [2];
t := (Weak.create 1);
(* Allow the heap to be reduced in order to point outside the heap )
b := Array.create 1 1;
(* Start a whole Gc phase *)
Gc.compact ()

Additional information

Reproducible with bytecode in 3.11.2

In native code the segmentation code doesn't appear but the target seems not to
be garbage collected. The example produces "Value not garbage collected : 2"