Is memory cleared before garbage collection?

Question

been having this discussion with a colleague. when languages such as c# or java garbage collect objects such as strings, returning them back to the heap, do they also clean out this memory block, for example overwriting with 0's or 1's?

my assumption is that the block is returned as is, unless one uses classes such as securestring with finalize overload, to 0 out the block.

Answer 1

Practically speaking, no, this doesn't happen. Overwriting memory you've just freed takes time, so there are performance penalties. "Secure" objects like SecureString are just wiping themselves, not relying on the GC.

More broadly, it depends very much on that particular implementation of that particular language. Every language that assumes the existence of a GC (like C#) specifies different rules about how and when garbage collection should happen.

To take your C# example, the C# specification does not require that objects be overwritten after being freed, and it doesn't forbid it either:

Finally, at some time after the object becomes eligible for collection, the garbage collector frees the memory associated with that object.

§3.9 C# 5.0 Language Specification

If the memory is later assigned to a reference type, you'll have a constructor that does your own custom initialization. If the memory is later assigned to a value type, it gets zeroed out before you can start reading from it:

Initialization to default values is typically done by having the memory manager or garbage collector initialize memory to all-bits-zero before it is allocated for use. For this reason, it is convenient to use all-bits-zero to represent the null reference.

§5.2 C# 5.0 Language Specification

Additionally, there's at least two implementations of C# -- Microsoft's implementation and Mono's implementation, so just saying "C#" isn't specific enough. Each implementation might decide to overwrite memory (or not).

Answer 2

To the extend of my knowledge there's not a single garbage collector who actually wipes memory with 0's or any number at all. C# and Java garbage collectors reclaim memory from unused objects and mark it as available. SecureString wipes itself at finalization but that is not a GC thing.