Bug: new metatable in weak table can fool the GC

roberto-ieru · roberto-ieru · commit 1b0f943da7df · 2025-06-16T16:33:02.000-03:00
All-weak tables are not being revisited after being visited during
propagation; if it gets a new metatable after that, the new metatable
may not be marked.
diff --git a/lgc.c b/lgc.c
@@ -553,8 +553,12 @@ static lu_mem traversetable (global_State *g, Table *h) {
       traverseweakvalue(g, h);
     else if (!weakvalue)  /* strong values? */
       traverseephemeron(g, h, 0);
-    else  /* all weak */
-      linkgclist(h, g->allweak);  /* nothing to traverse now */
+    else {  /* all weak */
+      if (g->gcstate == GCSpropagate)
+        linkgclist(h, g->grayagain);  /* must visit again its metatable */
+      else
+        linkgclist(h, g->allweak);  /* must clear collected entries */
+    }
   }
   else  /* not weak */
     traversestrongtable(g, h);
diff --git a/testes/gc.lua b/testes/gc.lua
@@ -301,6 +301,16 @@ collectgarbage()
 assert(next(a) == string.rep('$', 11))
 
 
+if T then   -- bug since 5.3: all-weak tables are not being revisited
+  T.gcstate("propagate")
+  local t = setmetatable({}, {__mode = "kv"})
+  T.gcstate("atomic")   -- 't' was visited
+  setmetatable(t, {__mode = "kv"})
+  T.gcstate("pause")  -- its new metatable is not being visited
+  assert(getmetatable(t).__mode == "kv")
+end
+
+
 -- 'bug' in 5.1
 a = {}
 local t = {x = 10}
