• via Digitalmars-d-bugs (32/32) Oct 20 2014 https://issues.dlang.org/show_bug.cgi?id=13642

via Digitalmars-d-bugs <digitalmars-d-bugs puremagic.com> writes:

https://issues.dlang.org/show_bug.cgi?id=13642

          Issue ID: 13642
           Summary: std.container.Array: change of length reallocates
                    without notifying GC
           Product: D
           Version: D2
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Phobos
          Assignee: nobody puremagic.com
          Reporter: dlang thedeemon.com

The Array.Payload.length setter calls realloc() when length increases, but
doesn't call GC.removeRange and GC.addRange. When data in the array contains
pointers to some managed objects, GC may collect those objects and now we have
dangling pointers in the array, which later causes Access Violations.

The following program crashes on 2.066:

module main;
import std.stdio, std.container.array, core.memory;

class C { void hi() { writeln("hi"); } }

void main(string[] argv) {
    Array!C arr;
    enum N = 10;
    //arr.reserve(N); // uncomment this and it will work fine
    arr.length = N;
    foreach(ref x; arr) x = new C;  // create N objects
    GC.collect();                   // do a GC
    arr[1].hi();                    // now this object is dead!
}

--