Garbage Collection Riddle

[Mark S. Miller <vlad!mark>]

What's wrong with the following code?  

Hint #1: It has to do with garbage collection.


CLASS(Foo,Heaper) {
  PUBLIC:
    LEAF int zip ();
    LEAF void zap ();
    ...
  PRIVATE:
    CHKPTR(Bar) myBar;
};

CLASS(Bar,Heaper) {
  PUBLIC:
    LEAF int zorch (Foo * foo);
    ...
    Bar ();
  PRIVATE:
    int myI;
};

int Foo::zip ()
{
    return myBar->zorch (this);
}

void Foo::zap ()
{
    myBar = new Bar();
}

Bar::zorch (Foo * foo)
{
    foo->zap ();
    foo->zap ();
    return myI;
}


Hint #2: Why does zorch need to call zap twice to encounter the
problem?

Hint #3: A similar problem happens with naive purging schemes.

Hint #4: I see *no way* to fix the garbage collector so the above code
will work!

Hint #5: I think it would be very difficult to have XLint spot the
problem in the above code.


If you're thinking "Gee, that's an amazingly normal/safe/vanilla
looking piece of code for there to be anything seriously broken",
you're correct.  That's why it's a serious problem.

I will postpone answering long enough for everyone to give it a shot.
Good luck.