Fix read after free bug with GC sweep.

compile.c

@@ -70,8 +70,7 @@ struct Scope {
     Dictionary * literals;
     Array * literalsArray;
     Dictionary * locals;
-    Scope * nextScope;
-    Scope * previousScope;
+    Scope * parent;
 };
 
 /* Provides default FormOptions */
@@ -110,11 +109,9 @@ static Scope * CompilerPushScope(Compiler * c, int sameFunction) {
     scope->freeHeap = VMAlloc(c->vm, 10 * sizeof(uint16_t));
     scope->heapSize = 0;
     scope->heapCapacity = 10;
-    scope->nextScope = NULL;
-    scope->previousScope = c->tail;
+    scope->parent = c->tail;
     scope->frameSize = 0;
     if (c->tail) {
-        c->tail->nextScope = scope;
         scope->level = c->tail->level + (sameFunction ? 0 : 1);
     } else {
         scope->level = 0;
@@ -132,8 +129,6 @@ static Scope * CompilerPushScope(Compiler * c, int sameFunction) {
         scope->literalsArray = ArrayNew(c->vm, 10);
     }
     c->tail = scope;
-    if (!c->root)
-        c->root = scope;
     return scope;
 }
 
@@ -146,15 +141,11 @@ static void CompilerPopScope(Compiler * c) {
         if (last->nextLocal > last->frameSize) {
             last->frameSize = last->nextLocal;
         }
-        c->tail = last->previousScope;
+        c->tail = last->parent;
         if (c->tail) {
             if (last->frameSize > c->tail->frameSize) {
                 c->tail->frameSize = last->frameSize;
             }
-            c->tail->nextScope = NULL;
-        } else {
-            /* We deleted the last scope */
-            c->root = NULL;
         }
     }
 }
@@ -350,7 +341,7 @@ static int ScopeSymbolResolve(Scope * scope, Value x,
             *index = (uint16_t) check.data.number;
             return 1;
         }
-        scope = scope->previousScope;
+        scope = scope->parent;
     }
     return 0;
 }
@@ -1183,7 +1174,7 @@ void CompilerInit(Compiler * c, VM * vm) {
     c->vm = vm;
     c->buffer = BufferNew(vm, 128);
     c->env = ArrayNew(vm, 10);
-    c->tail = c->root = NULL;
+    c->tail = NULL;
     c->error = NULL;
     CompilerPushScope(c, 0);
 }
@@ -1192,7 +1183,7 @@ void CompilerInit(Compiler * c, VM * vm) {
 void CompilerAddGlobal(Compiler * c, const char * name, Value x) {
     Value sym = ValueLoadCString(c->vm, name);
     sym.type = TYPE_SYMBOL;
-    CompilerDeclareSymbol(c, c->root, sym);
+    CompilerDeclareSymbol(c, c->tail, sym);
     ArrayPush(c->vm, c->env, x);
 }
 
@@ -1211,8 +1202,8 @@ Func * CompilerCompile(Compiler * c, Value form) {
     FuncDef * def;
     if (setjmp(c->onError)) {
         /* Clear all but root scope */
-        c->tail = c->root;
-        c->root->nextScope = NULL;
+        if (c->tail)
+            c->tail->parent = NULL;
         return NULL;
     }
     /* Create a scope */

datatypes.h

@@ -167,7 +167,6 @@ struct Compiler {
     VM * vm;
     const char * error;
     jmp_buf onError;
-    Scope * root;
     Scope * tail;
     Array * env;
     Buffer * buffer;

main.c

@@ -37,7 +37,7 @@ void debugRepl() {
     for (;;) {
 
         /* Run garbage collection */
-/*    VMMaybeCollect(&vm);*/
+        VMMaybeCollect(&vm);
 
         /* Reset state */
         ParserInit(&p, &vm);

vm.c

@@ -41,7 +41,8 @@ static void VMMarkFuncEnv(VM * vm, FuncEnv * env) {
             temp.type = TYPE_THREAD;
             temp.data.array = env->thread;
             VMMark(vm, &temp);
-        } else if (env->values) {
+        }
+        if (env->values) {
             uint32_t count = env->stackOffset;
             uint32_t i;
             GCHeader(env->values)->color = vm->black;
@@ -126,8 +127,9 @@ static void VMMark(VM * vm, Value * x) {
             if (GCHeader(x->data.func)->color != vm->black) {
                 Func * f = x->data.func;
                 GCHeader(f)->color = vm->black;
-                VMMarkFuncEnv(vm, f->env);
                 VMMarkFuncDef(vm, f->def);
+                if (f->env)
+                    VMMarkFuncEnv(vm, f->env);
                 if (f->parent) {
                     Value temp;
                     temp.type = TYPE_FUNCTION;
@@ -169,18 +171,20 @@ static void VMMark(VM * vm, Value * x) {
 static void VMSweep(VM * vm) {
     GCMemoryHeader * previous = NULL;
     GCMemoryHeader * current = vm->blocks;
+    GCMemoryHeader * next;
     while (current) {
+        next = current->next;
         if (current->color != vm->black) {
             if (previous) {
-                previous->next = current->next;
+                previous->next = next;
             } else {
-                vm->blocks = current->next;
+                vm->blocks = next;
             }
             free(current);
         } else {
             previous = current;
         }
-        current = current->next;
+        current = next;
     }
     /* Rotate flag */
     vm->black = !vm->black;
@@ -216,10 +220,12 @@ void * VMZalloc(VM * vm, uint32_t size) {
 void VMCollect(VM * vm) {
     if (vm->lock > 0) return;
     /* Thread can be null */
+    if (vm->thread) {
         Value thread;
         thread.type = TYPE_THREAD;
         thread.data.array = vm->thread;
         VMMark(vm, &thread);
+    }
     VMMark(vm, &vm->ret);
     VMSweep(vm);
     vm->nextCollection = 0;