What kind of pointer bug is this specifically?

Question

UncommentatedPannen's (pannenkoek2012) newest video describes a glitch in the Nintendo 64 game Super Mario 64, which allows an object to push Mario out of bounds, which isn't normally possible, by utilizing a stale/dangling pointer in Mario's structure that normally points the the floor Mario is currently above.

Pannen uses the term 'stale', but I think it could also be considered dangling, although I think neither completely describe how Mario and this pointer are behaving.

Definitions taken from their wikipedia articles:

Stale Pointer

If several pointers address (are "aliases for") a given chunk of storage, it may happen that the storage is freed or reallocated (and thus moved) through one alias and then referenced through another

Dangling Pointer

Dangling pointers arise during object destruction, when an object that has an incoming reference is deleted or deallocated, without modifying the value of the pointer, so that the pointer still points to the memory location of the deallocated memory. The system may reallocate the previously freed memory, and if the program then dereferences the (now) dangling pointer, unpredictable behavior may result, as the memory may now contain completely different data.

It isn't strictly a stale pointer because both floors are neither freed or reallocated, instead another object's (Mario's) "floor" pointer fails to update, allowing Mario to move according to the game physics while interacting with one floor as if it were a different floor.

It isn't strictly a dangling pointer because it is still guaranteed to point to a valid floor triangle that is still allocated. The problem behaviour arises because it is pointing to the wrong floor triangle, a previous floor triangle.

Answer 1

There are only two hard things in Computer Science: cache invalidation and naming things. -- Phil Karlton

See https://martinfowler.com/bliki/TwoHardThings.html

What you're describing is a form of the former: cache invalidation, if you take it in the broadest sense. In the broadest sense, it is a failure to either invalidate or update a non-authoritative copy of information that is otherwise derivable.

In computation, we use a cache, generally for performance. A cache stores a copy of information and is generally not the authoritative source of that information: something else is! Typically, that cache is at a distance from the authoritative source, which means that the cache and the authoritative source can be temporarily out of sync causing problems. In other cases, the cache can become out of sync due to logic errors in programming (e.g. invalidation not properly occurring).

However, there are many kinds of copies of information that constitute caching, without necessarily distance/network separation. One form is where a count is maintained that would otherwise be derivable from the data being stored, but again, for performance reasons, is separately maintained.

This one is that there is a copy of information, the level pointer, that is erroneously not updated when it should be. It is, in essence, a failure to update cached information: a non-authoritative copy of information (the pointer) that could have been computed, yet is captured/stored for performance enhancement.

If we must, I suppose, we can consider cache invalidation a subset of the problem of keeping copies up-to-date (since sometimes update is required and simpler invalidation not available), though I think of both of these as mostly being in the same problem category.

Thus, as Phil says, it is a problem in the category of cache invalidation.

---

We can also equate copies of data with the notions of denormalization. Denormalization is a form of caching, for performance, that introduces copies of the same data, which may lead to consistency issues, in that denormalized data can be prone to these kinds of logic errors (everyone who updates the data must also update all the copies where ever they are or else!). (In denormalized data, it may be difficult to even determine which data is the authoritative source!)

I would argue that this constitutes another case of cached/copied data not holding the right information, which evokes the notion of incorrect cache invalidation (incorrect cache/copy update).

---

From this perspective, stale is an operative term, more so than dangling, here, yet this staleness does not necessarily involve free'd memory as in your quote.