Re: NSHashTable with weak objects crashing

[David Chisnall]

On 30/07/2019 09:17, David Chisnall wrote:
> As I commented on the issue, I believe that one is caused by having too 
> many hash collisions and the table being unable to resize.  I plan at 
> some point to replace the hash table implementation, which should fix 
> that issue.
>
> If anyone has a test case for reproduceable segfaults, please file an 
> issue on GitHub.

While replacing the hash table, I managed to turn it into a 
reproduceable fault on at least one machine.  The bug is quite subtle:

We have a map from objects to weak reference structures.
The weak reference structure points to the object.
When we delete the last weak reference, we delete the object from the map.
We delete the object from the map using the object as the key.
But by the time a weak reference is deallocated, its object pointer has 
been zeroed...
...so we always remove a random element from the map and leave a 
dangling pointer in the table.

David