// HACKER NEWS — CYBERSECURITY
Zig: Pointer Stability for ArrayLists
This page contains a curated list of recent changes to main branch Zig.
This page contains entries for the year 2026. Other years are available in
the Devlog archive page.
Pointer Stability Locks were added to std’s Hash Map containers in 2024. A pull request initially opened by Leo Emar-Kar in 2025 now brings this technique for ensuring memory safety to std.ArrayList.
To make use of this in your code, add a call to lockPointers() when you first store a pointer to an element or a slice of elements backed by the ArrayList, and call unlockPointers() when those pointers are no longer needed.
Here’s a somewhat contrived example. Let’s suppose we are managing two ArrayLists, say one of which is holding in memory the contents of some input, while the other is storing chunks of interest; maybe each line. Here’s a version of this process which has a bug; see if you can spot it.
Did you spot the bug? The problem is that elements of Context.lines.items depend on the location of Context.history.items, but this location may change if Context.history needs to grow beyond its current capacity. Here’s a reproduction of the bug:
If I run this code with zig test, I get the following output (plus a little more).
Not great, right? This does tell us that we have a bug, but depending on your comfort debugging memory issues (and your choice of allocator, which will change how the bug manifests!), you might be lost for quite a while before you spot the fix.
Since we’ve stored pointers after the first call to parse in our test, what happens if we make this change?
We get a panic with a stack trace that shows us where our assumption about pointer stability was violated!