> Finalizers can likely be made safe enough if their code is more restricted; that would still allow many reasonable finalizers that calmly release external res

> Finalizers can likely be made safe enough if their code is more restricted; that would still allow many reasonable finalizers that calmly release external resources. If a finalizer calls external code to release external resources (a not uncommon use case), there’s no way static data flow analysis can determine that external code doesn’t make a call back into the VM that revives objects, is there?