Bug Summary

File:root/firefox-clang/js/src/ctypes/libffi/src/dlmalloc.c
Warning:line 3386, column 3
Addition of a null pointer and a nonzero integer value results in undefined behavior

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name closures.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/config/external/ffi -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/config/external/ffi -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG=1 -D TARGET=X86_64 -D X86_64 -D FFI_NO_RAW_API -D FFI_STATIC_BUILD -D FFI_DEBUG -D HAVE_HIDDEN_VISIBILITY_ATTRIBUTE -D HAVE_AS_X86_PCREL -D EH_FRAME_FLAGS="a" -D HAVE_AS_X86_64_UNWIND_SECTION_TYPE -D EXPORT_JS_API -D MOZ_HAS_MOZGLUE -D MOZ_SUPPORT_LEAKCHECKING -I /root/firefox-clang/config/external/ffi -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/config/external/ffi -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/js/src/ctypes/libffi -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/js/src/ctypes/libffi/include -I /root/firefox-clang/js/src/ctypes/libffi/include -I /root/firefox-clang/js/src/ctypes/libffi/src/x86 -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/js/src/ctypes/libffi/src/closures.c

/root/firefox-clang/js/src/ctypes/libffi/src/closures.c

→
1/* -----------------------------------------------------------------------
2 closures.c - Copyright (c) 2019, 2022, 2026 Anthony Green
3 Copyright (c) 2007, 2009, 2010 Red Hat, Inc.
4 Copyright (C) 2007, 2009, 2010 Free Software Foundation, Inc
5 Copyright (c) 2011 Plausible Labs Cooperative, Inc.
6
7 Code to allocate and deallocate memory for closures.
8
9 Permission is hereby granted, free of charge, to any person obtaining
10 a copy of this software and associated documentation files (the
11 ``Software''), to deal in the Software without restriction, including
12 without limitation the rights to use, copy, modify, merge, publish,
13 distribute, sublicense, and/or sell copies of the Software, and to
14 permit persons to whom the Software is furnished to do so, subject to
15 the following conditions:
16
17 The above copyright notice and this permission notice shall be included
18 in all copies or substantial portions of the Software.
19
20 THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,
21 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
22 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
23 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
24 HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
25 WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
26 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
27 DEALINGS IN THE SOFTWARE.
28 ----------------------------------------------------------------------- */
29
30#if (defined __linux__1 || defined __CYGWIN__) && !defined _GNU_SOURCE1
31#define _GNU_SOURCE1 1
32#endif
33
34#ifndef __EMSCRIPTEN__
35
36#include <fficonfig.h>
37#include <ffi.h>
38#include <ffi_common.h>
39#include <tramp.h>
40
41#ifdef __NetBSD__
42#include <sys/param.h>
43#endif
44
45#if __NetBSD_Version__ - 0 >= 799007200
46/* NetBSD with PROT_MPROTECT */
47#include <sys/mman.h>
48
49#include <stddef.h>
50#include <unistd.h>
51#ifdef HAVE_SYS_MEMFD_H
52#include <sys/memfd.h>
53#endif
54
55static const size_t overhead =
56 (sizeof(max_align_t) > sizeof(void *) + sizeof(size_t)) ?
57 sizeof(max_align_t)
58 : sizeof(void *) + sizeof(size_t);
59
60#define ADD_TO_POINTER(p, d) ((void *)((uintptr_t)(p) + (d)))
61
62void *
63ffi_closure_alloc (size_t size, void **code)
64{
65 static size_t page_size;
66 size_t rounded_size;
67 void *codeseg, *dataseg;
68 int prot;
69
70 /* Expect that PAX mprotect is active and a separate code mapping is necessary. */
71 if (!code)
72 return NULL((void*)0);
73
74 /* Obtain system page size. */
75 if (!page_size)
76 page_size = sysconf(_SC_PAGESIZE_SC_PAGESIZE);
77
78 /* Round allocation size up to the next page, keeping in mind the size field and pointer to code map. */
79 rounded_size = (size + overhead + page_size - 1) & ~(page_size - 1);
80
81 /* Primary mapping is RW, but request permission to switch to PROT_EXEC later. */
82 prot = PROT_READ0x1 | PROT_WRITE0x2 | PROT_MPROTECT(PROT_EXEC0x4);
83 dataseg = mmap(NULL((void*)0), rounded_size, prot, MAP_ANON0x20 | MAP_PRIVATE0x02, -1, 0);
84 if (dataseg == MAP_FAILED((void *) -1))
85 return NULL((void*)0);
86
87 /* Create secondary mapping and switch it to RX. */
88 codeseg = mremap(dataseg, rounded_size, NULL((void*)0), rounded_size, MAP_REMAPDUP);
89 if (codeseg == MAP_FAILED((void *) -1)) {
90 munmap(dataseg, rounded_size);
91 return NULL((void*)0);
92 }
93 if (mprotect(codeseg, rounded_size, PROT_READ0x1 | PROT_EXEC0x4) == -1) {
94 munmap(codeseg, rounded_size);
95 munmap(dataseg, rounded_size);
96 return NULL((void*)0);
97 }
98
99 /* Remember allocation size and location of the secondary mapping for ffi_closure_free. */
100 memcpy(dataseg, &rounded_size, sizeof(rounded_size));
101 memcpy(ADD_TO_POINTER(dataseg, sizeof(size_t)), &codeseg, sizeof(void *));
102 *code = ADD_TO_POINTER(codeseg, overhead);
103 return ADD_TO_POINTER(dataseg, overhead);
104}
105
106void
107ffi_closure_free (void *ptr)
108{
109 void *codeseg, *dataseg;
110 size_t rounded_size;
111
112 dataseg = ADD_TO_POINTER(ptr, -overhead);
113 memcpy(&rounded_size, dataseg, sizeof(rounded_size));
114 memcpy(&codeseg, ADD_TO_POINTER(dataseg, sizeof(size_t)), sizeof(void *));
115 munmap(dataseg, rounded_size);
116 munmap(codeseg, rounded_size);
117}
118
119int
120ffi_tramp_is_present (__attribute__((unused)) void *ptr)
121{
122 return 0;
123}
124#else /* !NetBSD with PROT_MPROTECT */
125
126#if !FFI_MMAP_EXEC_WRIT1 && !FFI_EXEC_TRAMPOLINE_TABLE
127# if __linux__1 && !defined(__ANDROID__)
128/* This macro indicates it may be forbidden to map anonymous memory
129 with both write and execute permission. Code compiled when this
130 option is defined will attempt to map such pages once, but if it
131 fails, it falls back to creating a temporary file in a writable and
132 executable filesystem and mapping pages from it into separate
133 locations in the virtual memory space, one location writable and
134 another executable. */
135# define FFI_MMAP_EXEC_WRIT1 1
136# define HAVE_MNTENT1 1
137# endif
138# if defined(__CYGWIN__) || defined(_WIN32) || defined(__OS2__)
139/* Windows systems may have Data Execution Protection (DEP) enabled,
140 which requires the use of VirtualMalloc/VirtualFree to alloc/free
141 executable memory. */
142# define FFI_MMAP_EXEC_WRIT1 1
143# endif
144#endif
145
146#if FFI_MMAP_EXEC_WRIT1 && defined(__linux__1) && !defined(__ANDROID__)
147# if !defined FFI_MMAP_EXEC_SELINUX1
148/* When defined to 1 check for SELinux and if SELinux is active,
149 don't attempt PROT_EXEC|PROT_WRITE mapping at all, as that
150 might cause audit messages. */
151# define FFI_MMAP_EXEC_SELINUX1 1
152# endif /* !defined FFI_MMAP_EXEC_SELINUX */
153# if !defined FFI_MMAP_PAX1
154/* Also check for PaX MPROTECT */
155# define FFI_MMAP_PAX1 1
156# endif /* !defined FFI_MMAP_PAX */
157#endif /* FFI_MMAP_EXEC_WRIT && defined(__linux__) && !defined(__ANDROID__) */
158
159#if FFI_CLOSURES1
160
161#if FFI_EXEC_TRAMPOLINE_TABLE
162
163#ifdef __MACH__
164
165#include <mach/mach.h>
166#include <pthread.h>
167#ifdef HAVE_ARM64E_PTRAUTH
168#include <ptrauth.h>
169#endif
170#include <stdio.h>
171#include <stdlib.h>
172
173extern void *ffi_closure_trampoline_table_page;
174
175typedef struct ffi_trampoline_table ffi_trampoline_table;
176typedef struct ffi_trampoline_table_entry ffi_trampoline_table_entry;
177
178struct ffi_trampoline_table
179{
180 /* contiguous writable and executable pages */
181 vm_address_t config_page;
182
183 /* free list tracking */
184 uint16_t free_count;
185 ffi_trampoline_table_entry *free_list;
186 ffi_trampoline_table_entry *free_list_pool;
187
188 ffi_trampoline_table *prev;
189 ffi_trampoline_table *next;
190};
191
192struct ffi_trampoline_table_entry
193{
194 void *(*trampoline) (void);
195 ffi_trampoline_table_entry *next;
196};
197
198/* Total number of trampolines that fit in one trampoline table */
199#define FFI_TRAMPOLINE_COUNT (PAGE_MAX_SIZE / FFI_TRAMPOLINE_SIZE32)
200
201static pthread_mutex_t ffi_trampoline_lock = PTHREAD_MUTEX_INITIALIZER{ { 0, 0, 0, 0, PTHREAD_MUTEX_TIMED_NP, 0, 0, { ((void*)0), (
(void*)0) } } };
202static ffi_trampoline_table *ffi_trampoline_tables = NULL((void*)0);
203
204static ffi_trampoline_table *
205ffi_trampoline_table_alloc (void)
206{
207 ffi_trampoline_table *table;
208 vm_address_t config_page;
209 vm_address_t trampoline_page;
210 vm_address_t trampoline_page_template;
211 vm_prot_t cur_prot;
212 vm_prot_t max_prot;
213 kern_return_t kt;
214 uint16_t i;
215
216 /* Allocate two pages -- a config page and a placeholder page */
217 config_page = 0x0;
218 kt = vm_allocate (mach_task_self (), &config_page, PAGE_MAX_SIZE * 2,
219 VM_FLAGS_ANYWHERE);
220 if (kt != KERN_SUCCESS)
221 return NULL((void*)0);
222
223 /* Remap the trampoline table on top of the placeholder page */
224 trampoline_page = config_page + PAGE_MAX_SIZE;
225
226#ifdef HAVE_ARM64E_PTRAUTH
227 trampoline_page_template = (vm_address_t)(uintptr_t)ptrauth_auth_data((void *)&ffi_closure_trampoline_table_page, ptrauth_key_function_pointer, 0);
228#else
229 trampoline_page_template = (vm_address_t)&ffi_closure_trampoline_table_page;
230#endif
231
232#ifdef __arm__
233 /* ffi_closure_trampoline_table_page can be thumb-biased on some ARM archs */
234 trampoline_page_template &= ~1UL;
235#endif
236 kt = vm_remap (mach_task_self (), &trampoline_page, PAGE_MAX_SIZE, 0x0,
237 VM_FLAGS_OVERWRITE, mach_task_self (), trampoline_page_template,
238 FALSE, &cur_prot, &max_prot, VM_INHERIT_SHARE);
239 if (kt != KERN_SUCCESS)
240 {
241 vm_deallocate (mach_task_self (), config_page, PAGE_MAX_SIZE * 2);
242 return NULL((void*)0);
243 }
244
245 if (!(cur_prot & VM_PROT_EXECUTE))
246 {
247 /* If VM_PROT_EXECUTE isn't set on the remapped trampoline page, set it */
248 kt = vm_protect (mach_task_self (), trampoline_page, PAGE_MAX_SIZE,
249 FALSE, cur_prot | VM_PROT_EXECUTE);
250 if (kt != KERN_SUCCESS)
251 {
252 vm_deallocate (mach_task_self (), config_page, PAGE_MAX_SIZE * 2);
253 return NULL((void*)0);
254 }
255 }
256
257 /* We have valid trampoline and config pages */
258 table = calloc (1, sizeof (ffi_trampoline_table));
259 table->free_count = FFI_TRAMPOLINE_COUNT;
260 table->config_page = config_page;
261
262 /* Create and initialize the free list */
263 table->free_list_pool =
264 calloc (FFI_TRAMPOLINE_COUNT, sizeof (ffi_trampoline_table_entry));
265
266 for (i = 0; i < table->free_count; i++)
267 {
268 ffi_trampoline_table_entry *entry = &table->free_list_pool[i];
269 entry->trampoline =
270 (void *) (trampoline_page + (i * FFI_TRAMPOLINE_SIZE32));
271#ifdef HAVE_ARM64E_PTRAUTH
272 entry->trampoline = ptrauth_sign_unauthenticated(entry->trampoline, ptrauth_key_function_pointer, 0);
273#endif
274
275 if (i < table->free_count - 1)
276 entry->next = &table->free_list_pool[i + 1];
277 }
278
279 table->free_list = table->free_list_pool;
280
281 return table;
282}
283
284static void
285ffi_trampoline_table_free (ffi_trampoline_table *table)
286{
287 /* Remove from the list */
288 if (table->prev != NULL((void*)0))
289 table->prev->next = table->next;
290
291 if (table->next != NULL((void*)0))
292 table->next->prev = table->prev;
293
294 /* Deallocate pages */
295 vm_deallocate (mach_task_self (), table->config_page, PAGE_MAX_SIZE * 2);
296
297 /* Deallocate free list */
298 free (table->free_list_pool);
299 free (table);
300}
301
302void *
303ffi_closure_alloc (size_t size, void **code)
304{
305 /* Create the closure */
306 ffi_closure *closure = malloc (size);
307 if (closure == NULL((void*)0))
308 return NULL((void*)0);
309
310 pthread_mutex_lock (&ffi_trampoline_lock);
311
312 /* Check for an active trampoline table with available entries. */
313 ffi_trampoline_table *table = ffi_trampoline_tables;
314 if (table == NULL((void*)0) || table->free_list == NULL((void*)0))
315 {
316 table = ffi_trampoline_table_alloc ();
317 if (table == NULL((void*)0))
318 {
319 pthread_mutex_unlock (&ffi_trampoline_lock);
320 free (closure);
321 return NULL((void*)0);
322 }
323
324 /* Insert the new table at the top of the list */
325 table->next = ffi_trampoline_tables;
326 if (table->next != NULL((void*)0))
327 table->next->prev = table;
328
329 ffi_trampoline_tables = table;
330 }
331
332 /* Claim the free entry */
333 ffi_trampoline_table_entry *entry = ffi_trampoline_tables->free_list;
334 ffi_trampoline_tables->free_list = entry->next;
335 ffi_trampoline_tables->free_count--;
336 entry->next = NULL((void*)0);
337
338 pthread_mutex_unlock (&ffi_trampoline_lock);
339
340 /* Initialize the return values */
341 *code = entry->trampoline;
342 closure->trampoline_table = table;
343 closure->trampoline_table_entry = entry;
344
345 return closure;
346}
347
348void
349ffi_closure_free (void *ptr)
350{
351 ffi_closure *closure = ptr;
352
353 pthread_mutex_lock (&ffi_trampoline_lock);
354
355 /* Fetch the table and entry references */
356 ffi_trampoline_table *table = closure->trampoline_table;
357 ffi_trampoline_table_entry *entry = closure->trampoline_table_entry;
358
359 /* Return the entry to the free list */
360 entry->next = table->free_list;
361 table->free_list = entry;
362 table->free_count++;
363
364 /* If all trampolines within this table are free, and at least one other table exists, deallocate
365 * the table */
366 if (table->free_count == FFI_TRAMPOLINE_COUNT
367 && ffi_trampoline_tables != table)
368 {
369 ffi_trampoline_table_free (table);
370 }
371 else if (ffi_trampoline_tables != table)
372 {
373 /* Otherwise, bump this table to the top of the list */
374 table->prev = NULL((void*)0);
375 table->next = ffi_trampoline_tables;
376 if (ffi_trampoline_tables != NULL((void*)0))
377 ffi_trampoline_tables->prev = table;
378
379 ffi_trampoline_tables = table;
380 }
381
382 pthread_mutex_unlock (&ffi_trampoline_lock);
383
384 /* Free the closure */
385 free (closure);
386}
387
388#endif
389
390// Per-target implementation; It's unclear what can reasonable be shared between two OS/architecture implementations.
391
392#elif FFI_MMAP_EXEC_WRIT1 /* !FFI_EXEC_TRAMPOLINE_TABLE */
393
394#define USE_LOCKS1 1
395#define USE_DL_PREFIX1 1
396/* dlmalloc's bit-index macros use __builtin_clz/__builtin_ctz directly on any
397 GNU-compatible compiler, so USE_BUILTIN_FFS (and pulling in <strings.h> for
398 ffs()) is no longer needed (libffi #754). */
399
400/* We need to use mmap, not sbrk. */
401#define HAVE_MORECORE0 0
402
403/* We could, in theory, support mremap, but it wouldn't buy us anything. */
404#define HAVE_MREMAP0 0
405
406/* We have no use for this, so save some code and data. */
407#define NO_MALLINFO1 1
408
409/* We need all allocations to be in regular segments, otherwise we
410 lose track of the corresponding code address. */
411#define DEFAULT_MMAP_THRESHOLD(~(size_t)0) MAX_SIZE_T(~(size_t)0)
412
413/* Don't allocate more than a page unless needed. */
414#define DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) ((size_t)malloc_getpagesizesysconf(_SC_PAGESIZE))
415
416#include <sys/types.h>
417#include <sys/stat.h>
418#include <fcntl.h>
419#include <errno(*__errno_location ()).h>
420#ifndef _MSC_VER
421#include <unistd.h>
422#endif
423#include <string.h>
424#include <stdio.h>
425#if !defined(_WIN32)
426#ifdef HAVE_MNTENT1
427#include <mntent.h>
428#endif /* HAVE_MNTENT */
429#include <sys/param.h>
430#include <pthread.h>
431
432/* We don't want sys/mman.h to be included after we redefine mmap and
433 dlmunmap. */
434#include <sys/mman.h>
435#define LACKS_SYS_MMAN_H1 1
436
437#if FFI_MMAP_EXEC_SELINUX1
438#include <sys/statfs.h>
439#include <stdlib.h>
440
441static int selinux_enabled = -1;
442
443static int
444selinux_enabled_check (void)
445{
446 struct statfs sfs;
447 FILE *f;
448 char *buf = NULL((void*)0);
449 size_t len = 0;
450
451 if (statfs ("/selinux", &sfs) >= 0
452 && (unsigned int) sfs.f_type == 0xf97cff8cU)
453 return 1;
454 f = fopen ("/proc/mounts", "r");
455 if (f == NULL((void*)0))
456 return 0;
457 while (getline (&buf, &len, f) >= 0)
458 {
459 char *p = strchr (buf, ' ')_Generic (0 ? (buf) : (void *) 1, const void *: (const char *
) (strchr (buf, ' ')), default: strchr (buf, ' '));
460 if (p == NULL((void*)0))
461 break;
462 p = strchr (p + 1, ' ')_Generic (0 ? (p + 1) : (void *) 1, const void *: (const char
*) (strchr (p + 1, ' ')), default: strchr (p + 1, ' '));
463 if (p == NULL((void*)0))
464 break;
465 if (strncmp (p + 1, "selinuxfs ", 10) == 0)
466 {
467 free (buf);
468 fclose (f);
469 return 1;
470 }
471 }
472 free (buf);
473 fclose (f);
474 return 0;
475}
476
477#define is_selinux_enabled()(selinux_enabled >= 0 ? selinux_enabled : (selinux_enabled
= selinux_enabled_check ())) (selinux_enabled >= 0 ? selinux_enabled \
478 : (selinux_enabled = selinux_enabled_check ()))
479
480#else
481
482#define is_selinux_enabled()(selinux_enabled >= 0 ? selinux_enabled : (selinux_enabled
= selinux_enabled_check ())) 0
483
484#endif /* !FFI_MMAP_EXEC_SELINUX */
485
486/* On PaX enable kernels that have MPROTECT enabled we can't use PROT_EXEC. */
487#if defined FFI_MMAP_PAX1
488#include <stdlib.h>
489
490enum {
491 PAX_MPROTECT = (1 << 0),
492 PAX_EMUTRAMP = (1 << 1),
493};
494static int cached_pax_flags = -1;
495
496static int
497pax_flags_check (void)
498{
499 char *buf = NULL((void*)0);
500 size_t len = 0;
501 FILE *f;
502 int ret;
503 f = fopen ("/proc/self/status", "r");
504 if (f == NULL((void*)0))
505 return 0;
506 ret = 0;
507
508 while (getline (&buf, &len, f) != -1)
509 if (!strncmp (buf, "PaX:", 4))
510 {
511 if (NULL((void*)0) != strchr (buf + 4, 'M')_Generic (0 ? (buf + 4) : (void *) 1, const void *: (const char
*) (strchr (buf + 4, 'M')), default: strchr (buf + 4, 'M')))
512 ret |= PAX_MPROTECT;
513 if (NULL((void*)0) != strchr (buf + 4, 'E')_Generic (0 ? (buf + 4) : (void *) 1, const void *: (const char
*) (strchr (buf + 4, 'E')), default: strchr (buf + 4, 'E')))
514 ret |= PAX_EMUTRAMP;
515 break;
516 }
517 free (buf);
518 fclose (f);
519 return ret;
520}
521
522#define get_pax_flags()(cached_pax_flags >= 0 ? cached_pax_flags : (cached_pax_flags
= pax_flags_check ())) (cached_pax_flags >= 0 ? cached_pax_flags \
523 : (cached_pax_flags = pax_flags_check ()))
524#define has_pax_flags(flags)((flags) == ((flags) & (cached_pax_flags >= 0 ? cached_pax_flags
: (cached_pax_flags = pax_flags_check ())))) ((flags) == ((flags) & get_pax_flags ()(cached_pax_flags >= 0 ? cached_pax_flags : (cached_pax_flags
= pax_flags_check ()))))
525#define is_mprotect_enabled()(((PAX_MPROTECT) == ((PAX_MPROTECT) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))) (has_pax_flags (PAX_MPROTECT)((PAX_MPROTECT) == ((PAX_MPROTECT) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
))))))
526#define is_emutramp_enabled()(((PAX_EMUTRAMP) == ((PAX_EMUTRAMP) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))) (has_pax_flags (PAX_EMUTRAMP)((PAX_EMUTRAMP) == ((PAX_EMUTRAMP) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
))))))
527
528#endif /* defined FFI_MMAP_PAX */
529
530#elif defined (__CYGWIN__) || defined(__INTERIX)
531
532#include <sys/mman.h>
533
534/* Cygwin is Linux-like, but not quite that Linux-like. */
535#define is_selinux_enabled()(selinux_enabled >= 0 ? selinux_enabled : (selinux_enabled
= selinux_enabled_check ())) 0
536
537#endif /* !defined(X86_WIN32) && !defined(X86_WIN64) */
538
539#if !defined FFI_MMAP_PAX1
540# define is_mprotect_enabled()(((PAX_MPROTECT) == ((PAX_MPROTECT) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))) 0
541# define is_emutramp_enabled()(((PAX_EMUTRAMP) == ((PAX_EMUTRAMP) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))) 0
542#endif /* !defined FFI_MMAP_PAX */
543
544/* Declare all functions defined in dlmalloc.c as static. */
545static void *dlmalloc(size_t);
546static void dlfree(void*);
547static void *dlcalloc(size_t, size_t) MAYBE_UNUSED__attribute__((__unused__));
548static void *dlrealloc(void *, size_t) MAYBE_UNUSED__attribute__((__unused__));
549static void *dlmemalign(size_t, size_t) MAYBE_UNUSED__attribute__((__unused__));
550static void *dlvalloc(size_t) MAYBE_UNUSED__attribute__((__unused__));
551static int dlmallopt(int, int) MAYBE_UNUSED__attribute__((__unused__));
552static size_t dlmalloc_footprint(void) MAYBE_UNUSED__attribute__((__unused__));
553static size_t dlmalloc_max_footprint(void) MAYBE_UNUSED__attribute__((__unused__));
554static void** dlindependent_calloc(size_t, size_t, void**) MAYBE_UNUSED__attribute__((__unused__));
555static void** dlindependent_comalloc(size_t, size_t*, void**) MAYBE_UNUSED__attribute__((__unused__));
556static void *dlpvalloc(size_t) MAYBE_UNUSED__attribute__((__unused__));
557static int dlmalloc_trim(size_t) MAYBE_UNUSED__attribute__((__unused__));
558static size_t dlmalloc_usable_size(void*) MAYBE_UNUSED__attribute__((__unused__));
559static void dlmalloc_stats(void) MAYBE_UNUSED__attribute__((__unused__));
560
561#if !(defined(_WIN32) || defined(__OS2__)) || defined (__CYGWIN__) || defined(__INTERIX)
562/* Use these for mmap and munmap within dlmalloc.c. */
563static void *dlmmap(void *, size_t, int, int, int, off_t);
564static int dlmunmap(void *, size_t);
565#endif /* !(defined(_WIN32) || defined(__OS2__)) || defined (__CYGWIN__) || defined(__INTERIX) */
566
567#define mmap dlmmap
568#define munmap dlmunmap
569
570#include "dlmalloc.c"
571
572#undef mmap
573#undef munmap
574
575#if !(defined(_WIN32) || defined(__OS2__)) || defined (__CYGWIN__) || defined(__INTERIX)
576
577/* A mutex used to synchronize access to *exec* variables in this file. */
578static pthread_mutex_t open_temp_exec_file_mutex = PTHREAD_MUTEX_INITIALIZER{ { 0, 0, 0, 0, PTHREAD_MUTEX_TIMED_NP, 0, 0, { ((void*)0), (
(void*)0) } } };
579
580/* A file descriptor of a temporary file from which we'll map
581 executable pages. */
582static int execfd = -1;
583
584/* The amount of space already allocated from the temporary file. */
585static size_t execsize = 0;
586
587#ifdef HAVE_MEMFD_CREATE1
588/* Open a temporary file name, and immediately unlink it. */
589static int
590open_temp_exec_file_memfd (const char *name)
591{
592 int fd;
593 fd = memfd_create (name, MFD_CLOEXEC1U);
594 return fd;
595}
596#endif
597
598/* Open a temporary file name, and immediately unlink it. */
599static int
600open_temp_exec_file_name (char *name, int flags MAYBE_UNUSED__attribute__((__unused__)))
601{
602 int fd;
603
604#ifdef HAVE_MKOSTEMP
605 fd = mkostemp (name, flags);
606#else
607 fd = mkstemp (name);
608#endif
609
610 if (fd != -1)
611 unlink (name);
612
613 return fd;
614}
615
616/* Open a temporary file in the named directory. */
617static int
618open_temp_exec_file_dir (const char *dir)
619{
620 static const char suffix[] = "/ffiXXXXXX";
621 int lendir, flags;
622 char *tempname;
623#ifdef O_TMPFILE(020000000 | 0200000)
624 int fd;
625#endif
626
627#ifdef O_CLOEXEC02000000
628 flags = O_CLOEXEC02000000;
629#else
630 flags = 0;
631#endif
632
633#ifdef O_TMPFILE(020000000 | 0200000)
634 fd = open (dir, flags | O_RDWR02 | O_EXCL0200 | O_TMPFILE(020000000 | 0200000), 0700);
635 /* If the running system does not support the O_TMPFILE flag then retry without it. */
636 if (fd != -1 || (errno(*__errno_location ()) != EINVAL22 && errno(*__errno_location ()) != EISDIR21 && errno(*__errno_location ()) != EOPNOTSUPP95)) {
637 return fd;
638 } else {
639 errno(*__errno_location ()) = 0;
640 }
641#endif
642
643 lendir = (int) strlen (dir);
644 tempname = __builtin_alloca (lendir + sizeof (suffix));
645
646 if (!tempname)
647 return -1;
648
649 memcpy (tempname, dir, lendir);
650 memcpy (tempname + lendir, suffix, sizeof (suffix));
651
652 return open_temp_exec_file_name (tempname, flags);
653}
654
655/* Open a temporary file in the directory in the named environment
656 variable. */
657static int
658open_temp_exec_file_env (const char *envvar)
659{
660 const char *value = getenv (envvar);
661
662 if (!value)
663 return -1;
664
665 return open_temp_exec_file_dir (value);
666}
667
668#ifdef HAVE_MNTENT1
669/* Open a temporary file in an executable and writable mount point
670 listed in the mounts file. Subsequent calls with the same mounts
671 keep searching for mount points in the same file. Providing NULL
672 as the mounts file closes the file. */
673static int
674open_temp_exec_file_mnt (const char *mounts)
675{
676 static const char *last_mounts;
677 static FILE *last_mntent;
678
679 if (mounts != last_mounts)
680 {
681 if (last_mntent)
682 endmntent (last_mntent);
683
684 last_mounts = mounts;
685
686 if (mounts)
687 last_mntent = setmntent (mounts, "r");
688 else
689 last_mntent = NULL((void*)0);
690 }
691
692 if (!last_mntent)
693 return -1;
694
695 for (;;)
696 {
697 int fd;
698 struct mntent mnt;
699 char buf[MAXPATHLEN4096 * 3];
700
701 if (getmntent_r (last_mntent, &mnt, buf, sizeof (buf)) == NULL((void*)0))
702 return -1;
703
704 if (hasmntopt (&mnt, "ro")
705 || hasmntopt (&mnt, "noexec")
706 || access (mnt.mnt_dir, W_OK2))
707 continue;
708
709 fd = open_temp_exec_file_dir (mnt.mnt_dir);
710
711 if (fd != -1)
712 return fd;
713 }
714}
715#endif /* HAVE_MNTENT */
716
717/* Instructions to look for a location to hold a temporary file that
718 can be mapped in for execution. */
719static struct
720{
721 int (*func)(const char *);
722 const char *arg;
723 int repeat;
724} open_temp_exec_file_opts[] = {
725#ifdef HAVE_MEMFD_CREATE1
726 { open_temp_exec_file_memfd, "libffi", 0 },
727#endif
728 { open_temp_exec_file_env, "LIBFFI_TMPDIR", 0 },
729 { open_temp_exec_file_env, "TMPDIR", 0 },
730 { open_temp_exec_file_dir, "/tmp", 0 },
731 { open_temp_exec_file_dir, "/var/tmp", 0 },
732 { open_temp_exec_file_dir, "/dev/shm", 0 },
733 { open_temp_exec_file_env, "HOME", 0 },
734#ifdef HAVE_MNTENT1
735 { open_temp_exec_file_mnt, "/etc/mtab", 1 },
736 { open_temp_exec_file_mnt, "/proc/mounts", 1 },
737#endif /* HAVE_MNTENT */
738};
739
740/* Current index into open_temp_exec_file_opts. */
741static int open_temp_exec_file_opts_idx = 0;
742
743/* Reset a current multi-call func, then advances to the next entry.
744 If we're at the last, go back to the first and return nonzero,
745 otherwise return zero. */
746static int
747open_temp_exec_file_opts_next (void)
748{
749 if (open_temp_exec_file_opts[open_temp_exec_file_opts_idx].repeat)
750 open_temp_exec_file_opts[open_temp_exec_file_opts_idx].func (NULL((void*)0));
751
752 open_temp_exec_file_opts_idx++;
753 if (open_temp_exec_file_opts_idx
754 == (sizeof (open_temp_exec_file_opts)
755 / sizeof (*open_temp_exec_file_opts)))
756 {
757 open_temp_exec_file_opts_idx = 0;
758 return 1;
759 }
760
761 return 0;
762}
763
764/* Return a file descriptor of a temporary zero-sized file in a
765 writable and executable filesystem. */
766int
767open_temp_exec_file (void)
768{
769 int fd;
770
771 do
772 {
773 fd = open_temp_exec_file_opts[open_temp_exec_file_opts_idx].func
774 (open_temp_exec_file_opts[open_temp_exec_file_opts_idx].arg);
775
776 if (!open_temp_exec_file_opts[open_temp_exec_file_opts_idx].repeat
777 || fd == -1)
778 {
779 if (open_temp_exec_file_opts_next ())
780 break;
781 }
782 }
783 while (fd == -1);
784
785 return fd;
786}
787
788/* We need to allocate space in a file that will be backing a writable
789 mapping. Several problems exist with the usual approaches:
790 - fallocate() is Linux-only
791 - posix_fallocate() is not available on all platforms
792 - ftruncate() does not allocate space on filesystems with sparse files
793 Failure to allocate the space will cause SIGBUS to be thrown when
794 the mapping is subsequently written to. */
795static int
796allocate_space (int fd, off_t len)
797{
798 static long page_size;
799
800 /* Obtain system page size. */
801 if (!page_size)
802 page_size = sysconf(_SC_PAGESIZE_SC_PAGESIZE);
803
804 unsigned char buf[page_size];
805 memset (buf, 0, page_size);
806
807 while (len > 0)
808 {
809 off_t to_write = (len < page_size) ? len : page_size;
810 if (write (fd, buf, to_write) < to_write)
811 return -1;
812 len -= to_write;
813 }
814
815 return 0;
816}
817
818/* Map in a chunk of memory from the temporary exec file into separate
819 locations in the virtual memory address space, one writable and one
820 executable. Returns the address of the writable portion, after
821 storing an offset to the corresponding executable portion at the
822 last word of the requested chunk. */
823static void *
824dlmmap_locked (void *start, size_t length, int prot, int flags, off_t offset)
825{
826 void *ptr;
827
828 if (execfd == -1)
829 {
830 open_temp_exec_file_opts_idx = 0;
831 retry_open:
832 execfd = open_temp_exec_file ();
833 if (execfd == -1)
834 return MFAIL((void*)((~(size_t)0)));
835 }
836
837 offset = execsize;
838
839 if (allocate_space (execfd, length))
840 return MFAIL((void*)((~(size_t)0)));
841
842 flags &= ~(MAP_PRIVATE0x02 | MAP_ANONYMOUS0x20);
843 flags |= MAP_SHARED0x01;
844
845 ptr = mmap (NULL((void*)0), length, (prot & ~PROT_WRITE0x2) | PROT_EXEC0x4,
846 flags, execfd, offset);
847 if (ptr == MFAIL((void*)((~(size_t)0))))
848 {
849 if (!offset)
850 {
851 close (execfd);
852 goto retry_open;
853 }
854 if (ftruncate (execfd, offset) != 0)
855 {
856 /* Fixme : Error logs can be added here. Returning an error for
857 * ftruncte() will not add any advantage as it is being
858 * validating in the error case. */
859 }
860
861 return MFAIL((void*)((~(size_t)0)));
862 }
863 else if (!offset
864 && open_temp_exec_file_opts[open_temp_exec_file_opts_idx].repeat)
865 open_temp_exec_file_opts_next ();
866
867 start = mmap (start, length, prot, flags, execfd, offset);
868
869 if (start == MFAIL((void*)((~(size_t)0))))
870 {
871 munmap (ptr, length);
872 if (ftruncate (execfd, offset) != 0)
873 {
874 /* Fixme : Error logs can be added here. Returning an error for
875 * ftruncte() will not add any advantage as it is being
876 * validating in the error case. */
877 }
878 return start;
879 }
880
881 mmap_exec_offset ((char *)start, length)(*(ptrdiff_t*)(((char *)start)+(length)-sizeof(ptrdiff_t))) = (char*)ptr - (char*)start;
882
883 execsize += length;
884
885 return start;
886}
887
888/* Map in a writable and executable chunk of memory if possible.
889 Failing that, fall back to dlmmap_locked. */
890static void *
891dlmmap (void *start, size_t length, int prot,
892 int flags, int fd, off_t offset)
893{
894 void *ptr;
895
896 assert (start == NULL && length % malloc_getpagesize == 0if(!(start == ((void*)0) && length % sysconf(_SC_PAGESIZE
) == 0 && prot == (0x1 | 0x2) && flags == (0x02
| 0x20) && fd == -1 && offset == 0)) abort()
897 && prot == (PROT_READ | PROT_WRITE)if(!(start == ((void*)0) && length % sysconf(_SC_PAGESIZE
) == 0 && prot == (0x1 | 0x2) && flags == (0x02
| 0x20) && fd == -1 && offset == 0)) abort()
898 && flags == (MAP_PRIVATE | MAP_ANONYMOUS)if(!(start == ((void*)0) && length % sysconf(_SC_PAGESIZE
) == 0 && prot == (0x1 | 0x2) && flags == (0x02
| 0x20) && fd == -1 && offset == 0)) abort()
899 && fd == -1 && offset == 0)if(!(start == ((void*)0) && length % sysconf(_SC_PAGESIZE
) == 0 && prot == (0x1 | 0x2) && flags == (0x02
| 0x20) && fd == -1 && offset == 0)) abort();
900
901 if (execfd == -1 && ffi_tramp_is_supported ())
902 {
903 ptr = mmap (start, length, prot & ~PROT_EXEC0x4, flags, fd, offset);
904 return ptr;
905 }
906
907 /* -1 != execfd hints that we already decided to use dlmmap_locked
908 last time. */
909 if (execfd == -1 && is_mprotect_enabled ()(((PAX_MPROTECT) == ((PAX_MPROTECT) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))))
910 {
911#ifdef FFI_MMAP_EXEC_EMUTRAMP_PAX
912 if (is_emutramp_enabled ()(((PAX_EMUTRAMP) == ((PAX_EMUTRAMP) & (cached_pax_flags >=
0 ? cached_pax_flags : (cached_pax_flags = pax_flags_check (
)))))))
913 {
914 /* emutramp requires the kernel recognizing the trampoline pattern
915 generated by ffi_prep_closure_loc; there is no way to test
916 in advance whether this will work, so this is experimental. */
917 ptr = mmap (start, length, prot & ~PROT_EXEC0x4, flags, fd, offset);
918 return ptr;
919 }
920#endif
921 /* fallback to dlmmap_locked. */
922 }
923 else if (execfd == -1 && !is_selinux_enabled ()(selinux_enabled >= 0 ? selinux_enabled : (selinux_enabled
= selinux_enabled_check ())))
924 {
925 ptr = mmap (start, length, prot | PROT_EXEC0x4, flags, fd, offset);
926
927 if (ptr != MFAIL((void*)((~(size_t)0))) || (errno(*__errno_location ()) != EPERM1 && errno(*__errno_location ()) != EACCES13))
928 /* Cool, no need to mess with separate segments. */
929 return ptr;
930
931 /* If MREMAP_DUP is ever introduced and implemented, try mmap
932 with ((prot & ~PROT_WRITE) | PROT_EXEC) and mremap with
933 MREMAP_DUP and prot at this point. */
934 }
935
936 pthread_mutex_lock (&open_temp_exec_file_mutex);
937 ptr = dlmmap_locked (start, length, prot, flags, offset);
938 pthread_mutex_unlock (&open_temp_exec_file_mutex);
939
940 return ptr;
941}
942
943/* Release memory at the given address, as well as the corresponding
944 executable page if it's separate. */
945static int
946dlmunmap (void *start, size_t length)
947{
948 /* We don't bother decreasing execsize or truncating the file, since
949 we can't quite tell whether we're unmapping the end of the file.
950 We don't expect frequent deallocation anyway. If we did, we
951 could locate pages in the file by writing to the pages being
952 deallocated and checking that the file contents change.
953 Yuck. */
954 msegmentptr seg = segment_holding (gm(&_gm_), start);
955 void *code;
956
957 if (seg && (code = add_segment_exec_offset (start, seg)((char*)(start) + (seg)->exec_offset)) != start)
958 {
959 int ret = munmap (code, length);
960 if (ret)
961 return ret;
962 }
963
964 return munmap (start, length);
965}
966
967#if FFI_CLOSURE_FREE_CODE
968/* Return segment holding given code address. */
969static msegmentptr
970segment_holding_code (mstate m, char* addr)
971{
972 msegmentptr sp = &m->seg;
973 for (;;) {
974 if (addr >= add_segment_exec_offset (sp->base, sp)((char*)(sp->base) + (sp)->exec_offset)
975 && addr < add_segment_exec_offset (sp->base, sp)((char*)(sp->base) + (sp)->exec_offset) + sp->size)
976 return sp;
977 if ((sp = sp->next) == 0)
978 return 0;
979 }
980}
981#endif
982
983#endif /* !(defined(_WIN32) || defined(__OS2__)) || defined (__CYGWIN__) || defined(__INTERIX) */
984
985/* Allocate a chunk of memory with the given size. Returns a pointer
986 to the writable address, and sets *CODE to the executable
987 corresponding virtual address. */
988void *
989ffi_closure_alloc (size_t size, void **code)
990{
991 void *ptr, *ftramp;
992
993 if (!code)
1
Assuming 'code' is non-null
→
2
←
Taking false branch
→
994 return NULL((void*)0);
995
996 ptr = dlmalloc (size);
3
←
Calling 'dlmalloc'
→
997
998 if (ptr)
999 {
1000 msegmentptr seg = segment_holding (gm(&_gm_), ptr);
1001
1002 *code = FFI_FN (add_segment_exec_offset (ptr, seg))((void (*)(void))((char*)(ptr) + (seg)->exec_offset));
1003 if (!ffi_tramp_is_supported ())
1004 return ptr;
1005
1006 ftramp = ffi_tramp_alloc (0);
1007 if (ftramp == NULL((void*)0))
1008 {
1009 dlfree (ptr);
1010 return NULL((void*)0);
1011 }
1012 *code = FFI_FN (ffi_tramp_get_addr (ftramp))((void (*)(void))ffi_tramp_get_addr (ftramp));
1013 ((ffi_closure *) ptr)->ftramp = ftramp;
1014 }
1015
1016 return ptr;
1017}
1018
1019void *
1020ffi_data_to_code_pointer (void *data)
1021{
1022 msegmentptr seg = segment_holding (gm(&_gm_), data);
1023 /* We expect closures to be allocated with ffi_closure_alloc(), in
1024 which case seg will be non-NULL. However, some users take on the
1025 burden of managing this memory themselves, in which case this
1026 we'll just return data. */
1027 if (seg)
1028 {
1029 if (!ffi_tramp_is_supported ())
1030 return add_segment_exec_offset (data, seg)((char*)(data) + (seg)->exec_offset);
1031 return ffi_tramp_get_addr (((ffi_closure *) data)->ftramp);
1032 }
1033 else
1034 return data;
1035}
1036
1037/* Release a chunk of memory allocated with ffi_closure_alloc. If
1038 FFI_CLOSURE_FREE_CODE is nonzero, the given address can be the
1039 writable or the executable address given. Otherwise, only the
1040 writable address can be provided here. */
1041void
1042ffi_closure_free (void *ptr)
1043{
1044#if FFI_CLOSURE_FREE_CODE
1045 msegmentptr seg = segment_holding_code (gm(&_gm_), ptr);
1046
1047 if (seg)
1048 ptr = sub_segment_exec_offset (ptr, seg)((char*)(ptr) - (seg)->exec_offset);
1049#endif
1050 if (ffi_tramp_is_supported ())
1051 ffi_tramp_free (((ffi_closure *) ptr)->ftramp);
1052
1053 dlfree (ptr);
1054}
1055
1056int
1057ffi_tramp_is_present (void *ptr)
1058{
1059 msegmentptr seg = segment_holding (gm(&_gm_), ptr);
1060 return seg != NULL((void*)0) && ffi_tramp_is_supported();
1061}
1062
1063# else /* ! FFI_MMAP_EXEC_WRIT */
1064
1065/* On many systems, memory returned by malloc is writable and
1066 executable, so just use it. */
1067
1068#include <stdlib.h>
1069
1070void *
1071ffi_closure_alloc (size_t size, void **code)
1072{
1073 void *c;
1074
1075 if (!code)
1076 return NULL((void*)0);
1077
1078 c = malloc (size);
1079 *code = FFI_FN (c)((void (*)(void))c);
1080 return c;
1081}
1082
1083void
1084ffi_closure_free (void *ptr)
1085{
1086 free (ptr);
1087}
1088
1089void *
1090ffi_data_to_code_pointer (void *data)
1091{
1092 return data;
1093}
1094
1095int
1096ffi_tramp_is_present (__attribute__((unused)) void *ptr)
1097{
1098 return 0;
1099}
1100
1101# endif /* ! FFI_MMAP_EXEC_WRIT */
1102#endif /* FFI_CLOSURES */
1103
1104#endif /* NetBSD with PROT_MPROTECT */
1105#endif /* __EMSCRIPTEN__ */
←

/root/firefox-clang/js/src/ctypes/libffi/src/dlmalloc.c

1/*
2 This is a version (aka dlmalloc) of malloc/free/realloc written by
3 Doug Lea and released to the public domain, as explained at
4 http://creativecommons.org/publicdomain/zero/1.0/ Send questions,
5 comments, complaints, performance data, etc to dl@cs.oswego.edu
6
7* Version 2.8.6 Wed Aug 29 06:57:58 2012 Doug Lea
8 Note: There may be an updated version of this malloc obtainable at
9 ftp://gee.cs.oswego.edu/pub/misc/malloc.c
10 Check before installing!
11
12* Quickstart
13
14 This library is all in one file to simplify the most common usage:
15 ftp it, compile it (-O3), and link it into another program. All of
16 the compile-time options default to reasonable values for use on
17 most platforms. You might later want to step through various
18 compile-time and dynamic tuning options.
19
20 For convenience, an include file for code using this malloc is at:
21 ftp://gee.cs.oswego.edu/pub/misc/malloc-2.8.6.h
22 You don't really need this .h file unless you call functions not
23 defined in your system include files. The .h file contains only the
24 excerpts from this file needed for using this malloc on ANSI C/C++
25 systems, so long as you haven't changed compile-time options about
26 naming and tuning parameters. If you do, then you can create your
27 own malloc.h that does include all settings by cutting at the point
28 indicated below. Note that you may already by default be using a C
29 library containing a malloc that is based on some version of this
30 malloc (for example in linux). You might still want to use the one
31 in this file to customize settings or to avoid overheads associated
32 with library versions.
33
34* Vital statistics:
35
36 Supported pointer/size_t representation: 4 or 8 bytes
37 size_t MUST be an unsigned type of the same width as
38 pointers. (If you are using an ancient system that declares
39 size_t as a signed type, or need it to be a different width
40 than pointers, you can use a previous release of this malloc
41 (e.g. 2.7.2) supporting these.)
42
43 Alignment: 8 bytes (minimum)
44 This suffices for nearly all current machines and C compilers.
45 However, you can define MALLOC_ALIGNMENT to be wider than this
46 if necessary (up to 128bytes), at the expense of using more space.
47
48 Minimum overhead per allocated chunk: 4 or 8 bytes (if 4byte sizes)
49 8 or 16 bytes (if 8byte sizes)
50 Each malloced chunk has a hidden word of overhead holding size
51 and status information, and additional cross-check word
52 if FOOTERS is defined.
53
54 Minimum allocated size: 4-byte ptrs: 16 bytes (including overhead)
55 8-byte ptrs: 32 bytes (including overhead)
56
57 Even a request for zero bytes (i.e., malloc(0)) returns a
58 pointer to something of the minimum allocatable size.
59 The maximum overhead wastage (i.e., number of extra bytes
60 allocated than were requested in malloc) is less than or equal
61 to the minimum size, except for requests >= mmap_threshold that
62 are serviced via mmap(), where the worst case wastage is about
63 32 bytes plus the remainder from a system page (the minimal
64 mmap unit); typically 4096 or 8192 bytes.
65
66 Security: static-safe; optionally more or less
67 The "security" of malloc refers to the ability of malicious
68 code to accentuate the effects of errors (for example, freeing
69 space that is not currently malloc'ed or overwriting past the
70 ends of chunks) in code that calls malloc. This malloc
71 guarantees not to modify any memory locations below the base of
72 heap, i.e., static variables, even in the presence of usage
73 errors. The routines additionally detect most improper frees
74 and reallocs. All this holds as long as the static bookkeeping
75 for malloc itself is not corrupted by some other means. This
76 is only one aspect of security -- these checks do not, and
77 cannot, detect all possible programming errors.
78
79 If FOOTERS is defined nonzero, then each allocated chunk
80 carries an additional check word to verify that it was malloced
81 from its space. These check words are the same within each
82 execution of a program using malloc, but differ across
83 executions, so externally crafted fake chunks cannot be
84 freed. This improves security by rejecting frees/reallocs that
85 could corrupt heap memory, in addition to the checks preventing
86 writes to statics that are always on. This may further improve
87 security at the expense of time and space overhead. (Note that
88 FOOTERS may also be worth using with MSPACES.)
89
90 By default detected errors cause the program to abort (calling
91 "abort()"). You can override this to instead proceed past
92 errors by defining PROCEED_ON_ERROR. In this case, a bad free
93 has no effect, and a malloc that encounters a bad address
94 caused by user overwrites will ignore the bad address by
95 dropping pointers and indices to all known memory. This may
96 be appropriate for programs that should continue if at all
97 possible in the face of programming errors, although they may
98 run out of memory because dropped memory is never reclaimed.
99
100 If you don't like either of these options, you can define
101 CORRUPTION_ERROR_ACTION and USAGE_ERROR_ACTION to do anything
102 else. And if if you are sure that your program using malloc has
103 no errors or vulnerabilities, you can define INSECURE to 1,
104 which might (or might not) provide a small performance improvement.
105
106 It is also possible to limit the maximum total allocatable
107 space, using malloc_set_footprint_limit. This is not
108 designed as a security feature in itself (calls to set limits
109 are not screened or privileged), but may be useful as one
110 aspect of a secure implementation.
111
112 Thread-safety: NOT thread-safe unless USE_LOCKS defined non-zero
113 When USE_LOCKS is defined, each public call to malloc, free,
114 etc is surrounded with a lock. By default, this uses a plain
115 pthread mutex, win32 critical section, or a spin-lock if if
116 available for the platform and not disabled by setting
117 USE_SPIN_LOCKS=0. However, if USE_RECURSIVE_LOCKS is defined,
118 recursive versions are used instead (which are not required for
119 base functionality but may be needed in layered extensions).
120 Using a global lock is not especially fast, and can be a major
121 bottleneck. It is designed only to provide minimal protection
122 in concurrent environments, and to provide a basis for
123 extensions. If you are using malloc in a concurrent program,
124 consider instead using nedmalloc
125 (http://www.nedprod.com/programs/portable/nedmalloc/) or
126 ptmalloc (See http://www.malloc.de), which are derived from
127 versions of this malloc.
128
129 System requirements: Any combination of MORECORE and/or MMAP/MUNMAP
130 This malloc can use unix sbrk or any emulation (invoked using
131 the CALL_MORECORE macro) and/or mmap/munmap or any emulation
132 (invoked using CALL_MMAP/CALL_MUNMAP) to get and release system
133 memory. On most unix systems, it tends to work best if both
134 MORECORE and MMAP are enabled. On Win32, it uses emulations
135 based on VirtualAlloc. It also uses common C library functions
136 like memset.
137
138 Compliance: I believe it is compliant with the Single Unix Specification
139 (See http://www.unix.org). Also SVID/XPG, ANSI C, and probably
140 others as well.
141
142* Overview of algorithms
143
144 This is not the fastest, most space-conserving, most portable, or
145 most tunable malloc ever written. However it is among the fastest
146 while also being among the most space-conserving, portable and
147 tunable. Consistent balance across these factors results in a good
148 general-purpose allocator for malloc-intensive programs.
149
150 In most ways, this malloc is a best-fit allocator. Generally, it
151 chooses the best-fitting existing chunk for a request, with ties
152 broken in approximately least-recently-used order. (This strategy
153 normally maintains low fragmentation.) However, for requests less
154 than 256bytes, it deviates from best-fit when there is not an
155 exactly fitting available chunk by preferring to use space adjacent
156 to that used for the previous small request, as well as by breaking
157 ties in approximately most-recently-used order. (These enhance
158 locality of series of small allocations.) And for very large requests
159 (>= 256Kb by default), it relies on system memory mapping
160 facilities, if supported. (This helps avoid carrying around and
161 possibly fragmenting memory used only for large chunks.)
162
163 All operations (except malloc_stats and mallinfo) have execution
164 times that are bounded by a constant factor of the number of bits in
165 a size_t, not counting any clearing in calloc or copying in realloc,
166 or actions surrounding MORECORE and MMAP that have times
167 proportional to the number of non-contiguous regions returned by
168 system allocation routines, which is often just 1. In real-time
169 applications, you can optionally suppress segment traversals using
170 NO_SEGMENT_TRAVERSAL, which assures bounded execution even when
171 system allocators return non-contiguous spaces, at the typical
172 expense of carrying around more memory and increased fragmentation.
173
174 The implementation is not very modular and seriously overuses
175 macros. Perhaps someday all C compilers will do as good a job
176 inlining modular code as can now be done by brute-force expansion,
177 but now, enough of them seem not to.
178
179 Some compilers issue a lot of warnings about code that is
180 dead/unreachable only on some platforms, and also about intentional
181 uses of negation on unsigned types. All known cases of each can be
182 ignored.
183
184 For a longer but out of date high-level description, see
185 http://gee.cs.oswego.edu/dl/html/malloc.html
186
187* MSPACES
188 If MSPACES is defined, then in addition to malloc, free, etc.,
189 this file also defines mspace_malloc, mspace_free, etc. These
190 are versions of malloc routines that take an "mspace" argument
191 obtained using create_mspace, to control all internal bookkeeping.
192 If ONLY_MSPACES is defined, only these versions are compiled.
193 So if you would like to use this allocator for only some allocations,
194 and your system malloc for others, you can compile with
195 ONLY_MSPACES and then do something like...
196 static mspace mymspace = create_mspace(0,0); // for example
197 #define mymalloc(bytes) mspace_malloc(mymspace, bytes)
198
199 (Note: If you only need one instance of an mspace, you can instead
200 use "USE_DL_PREFIX" to relabel the global malloc.)
201
202 You can similarly create thread-local allocators by storing
203 mspaces as thread-locals. For example:
204 static __thread mspace tlms = 0;
205 void* tlmalloc(size_t bytes) {
206 if (tlms == 0) tlms = create_mspace(0, 0);
207 return mspace_malloc(tlms, bytes);
208 }
209 void tlfree(void* mem) { mspace_free(tlms, mem); }
210
211 Unless FOOTERS is defined, each mspace is completely independent.
212 You cannot allocate from one and free to another (although
213 conformance is only weakly checked, so usage errors are not always
214 caught). If FOOTERS is defined, then each chunk carries around a tag
215 indicating its originating mspace, and frees are directed to their
216 originating spaces. Normally, this requires use of locks.
217
218 ------------------------- Compile-time options ---------------------------
219
220Be careful in setting #define values for numerical constants of type
221size_t. On some systems, literal values are not automatically extended
222to size_t precision unless they are explicitly casted. You can also
223use the symbolic values MAX_SIZE_T, SIZE_T_ONE, etc below.
224
225WIN32 default: defined if _WIN32 defined
226 Defining WIN32 sets up defaults for MS environment and compilers.
227 Otherwise defaults are for unix. Beware that there seem to be some
228 cases where this malloc might not be a pure drop-in replacement for
229 Win32 malloc: Random-looking failures from Win32 GDI API's (eg;
230 SetDIBits()) may be due to bugs in some video driver implementations
231 when pixel buffers are malloc()ed, and the region spans more than
232 one VirtualAlloc()ed region. Because dlmalloc uses a small (64Kb)
233 default granularity, pixel buffers may straddle virtual allocation
234 regions more often than when using the Microsoft allocator. You can
235 avoid this by using VirtualAlloc() and VirtualFree() for all pixel
236 buffers rather than using malloc(). If this is not possible,
237 recompile this malloc with a larger DEFAULT_GRANULARITY. Note:
238 in cases where MSC and gcc (cygwin) are known to differ on WIN32,
239 conditions use _MSC_VER to distinguish them.
240
241DLMALLOC_EXPORT default: extern
242 Defines how public APIs are declared. If you want to export via a
243 Windows DLL, you might define this as
244 #define DLMALLOC_EXPORT extern __declspec(dllexport)
245 If you want a POSIX ELF shared object, you might use
246 #define DLMALLOC_EXPORT extern __attribute__((visibility("default")))
247
248MALLOC_ALIGNMENT default: (size_t)(2 * sizeof(void *))
249 Controls the minimum alignment for malloc'ed chunks. It must be a
250 power of two and at least 8, even on machines for which smaller
251 alignments would suffice. It may be defined as larger than this
252 though. Note however that code and data structures are optimized for
253 the case of 8-byte alignment.
254
255MSPACES default: 0 (false)
256 If true, compile in support for independent allocation spaces.
257 This is only supported if HAVE_MMAP is true.
258
259ONLY_MSPACES default: 0 (false)
260 If true, only compile in mspace versions, not regular versions.
261
262USE_LOCKS default: 0 (false)
263 Causes each call to each public routine to be surrounded with
264 pthread or WIN32 mutex lock/unlock. (If set true, this can be
265 overridden on a per-mspace basis for mspace versions.) If set to a
266 non-zero value other than 1, locks are used, but their
267 implementation is left out, so lock functions must be supplied manually,
268 as described below.
269
270USE_SPIN_LOCKS default: 1 iff USE_LOCKS and spin locks available
271 If true, uses custom spin locks for locking. This is currently
272 supported only gcc >= 4.1, older gccs on x86 platforms, and recent
273 MS compilers. Otherwise, posix locks or win32 critical sections are
274 used.
275
276USE_RECURSIVE_LOCKS default: not defined
277 If defined nonzero, uses recursive (aka reentrant) locks, otherwise
278 uses plain mutexes. This is not required for malloc proper, but may
279 be needed for layered allocators such as nedmalloc.
280
281LOCK_AT_FORK default: not defined
282 If defined nonzero, performs pthread_atfork upon initialization
283 to initialize child lock while holding parent lock. The implementation
284 assumes that pthread locks (not custom locks) are being used. In other
285 cases, you may need to customize the implementation.
286
287FOOTERS default: 0
288 If true, provide extra checking and dispatching by placing
289 information in the footers of allocated chunks. This adds
290 space and time overhead.
291
292INSECURE default: 0
293 If true, omit checks for usage errors and heap space overwrites.
294
295USE_DL_PREFIX default: NOT defined
296 Causes compiler to prefix all public routines with the string 'dl'.
297 This can be useful when you only want to use this malloc in one part
298 of a program, using your regular system malloc elsewhere.
299
300MALLOC_INSPECT_ALL default: NOT defined
301 If defined, compiles malloc_inspect_all and mspace_inspect_all, that
302 perform traversal of all heap space. Unless access to these
303 functions is otherwise restricted, you probably do not want to
304 include them in secure implementations.
305
306ABORT default: defined as abort()
307 Defines how to abort on failed checks. On most systems, a failed
308 check cannot die with an "assert" or even print an informative
309 message, because the underlying print routines in turn call malloc,
310 which will fail again. Generally, the best policy is to simply call
311 abort(). It's not very useful to do more than this because many
312 errors due to overwriting will show up as address faults (null, odd
313 addresses etc) rather than malloc-triggered checks, so will also
314 abort. Also, most compilers know that abort() does not return, so
315 can better optimize code conditionally calling it.
316
317PROCEED_ON_ERROR default: defined as 0 (false)
318 Controls whether detected bad addresses cause them to bypassed
319 rather than aborting. If set, detected bad arguments to free and
320 realloc are ignored. And all bookkeeping information is zeroed out
321 upon a detected overwrite of freed heap space, thus losing the
322 ability to ever return it from malloc again, but enabling the
323 application to proceed. If PROCEED_ON_ERROR is defined, the
324 static variable malloc_corruption_error_count is compiled in
325 and can be examined to see if errors have occurred. This option
326 generates slower code than the default abort policy.
327
328DEBUG default: NOT defined
329 The DEBUG setting is mainly intended for people trying to modify
330 this code or diagnose problems when porting to new platforms.
331 However, it may also be able to better isolate user errors than just
332 using runtime checks. The assertions in the check routines spell
333 out in more detail the assumptions and invariants underlying the
334 algorithms. The checking is fairly extensive, and will slow down
335 execution noticeably. Calling malloc_stats or mallinfo with DEBUG
336 set will attempt to check every non-mmapped allocated and free chunk
337 in the course of computing the summaries.
338
339ABORT_ON_ASSERT_FAILURE default: defined as 1 (true)
340 Debugging assertion failures can be nearly impossible if your
341 version of the assert macro causes malloc to be called, which will
342 lead to a cascade of further failures, blowing the runtime stack.
343 ABORT_ON_ASSERT_FAILURE cause assertions failures to call abort(),
344 which will usually make debugging easier.
345
346MALLOC_FAILURE_ACTION default: sets errno to ENOMEM, or no-op on win32
347 The action to take before "return 0" when malloc fails to be able to
348 return memory because there is none available.
349
350HAVE_MORECORE default: 1 (true) unless win32 or ONLY_MSPACES
351 True if this system supports sbrk or an emulation of it.
352
353MORECORE default: sbrk
354 The name of the sbrk-style system routine to call to obtain more
355 memory. See below for guidance on writing custom MORECORE
356 functions. The type of the argument to sbrk/MORECORE varies across
357 systems. It cannot be size_t, because it supports negative
358 arguments, so it is normally the signed type of the same width as
359 size_t (sometimes declared as "intptr_t"). It doesn't much matter
360 though. Internally, we only call it with arguments less than half
361 the max value of a size_t, which should work across all reasonable
362 possibilities, although sometimes generating compiler warnings.
363
364MORECORE_CONTIGUOUS default: 1 (true) if HAVE_MORECORE
365 If true, take advantage of fact that consecutive calls to MORECORE
366 with positive arguments always return contiguous increasing
367 addresses. This is true of unix sbrk. It does not hurt too much to
368 set it true anyway, since malloc copes with non-contiguities.
369 Setting it false when definitely non-contiguous saves time
370 and possibly wasted space it would take to discover this though.
371
372MORECORE_CANNOT_TRIM default: NOT defined
373 True if MORECORE cannot release space back to the system when given
374 negative arguments. This is generally necessary only if you are
375 using a hand-crafted MORECORE function that cannot handle negative
376 arguments.
377
378NO_SEGMENT_TRAVERSAL default: 0
379 If non-zero, suppresses traversals of memory segments
380 returned by either MORECORE or CALL_MMAP. This disables
381 merging of segments that are contiguous, and selectively
382 releasing them to the OS if unused, but bounds execution times.
383
384HAVE_MMAP default: 1 (true)
385 True if this system supports mmap or an emulation of it. If so, and
386 HAVE_MORECORE is not true, MMAP is used for all system
387 allocation. If set and HAVE_MORECORE is true as well, MMAP is
388 primarily used to directly allocate very large blocks. It is also
389 used as a backup strategy in cases where MORECORE fails to provide
390 space from system. Note: A single call to MUNMAP is assumed to be
391 able to unmap memory that may have be allocated using multiple calls
392 to MMAP, so long as they are adjacent.
393
394HAVE_MREMAP default: 1 on linux, else 0
395 If true realloc() uses mremap() to re-allocate large blocks and
396 extend or shrink allocation spaces.
397
398MMAP_CLEARS default: 1 except on WINCE.
399 True if mmap clears memory so calloc doesn't need to. This is true
400 for standard unix mmap using /dev/zero and on WIN32 except for WINCE.
401
402USE_BUILTIN_FFS default: 0 (i.e., not used)
403 Causes malloc to use the builtin ffs() function to compute indices.
404 Some compilers may recognize and intrinsify ffs to be faster than the
405 supplied C version. Also, the case of x86 using gcc is special-cased
406 to an asm instruction, so is already as fast as it can be, and so
407 this setting has no effect. Similarly for Win32 under recent MS compilers.
408 (On most x86s, the asm version is only slightly faster than the C version.)
409
410malloc_getpagesize default: derive from system includes, or 4096.
411 The system page size. To the extent possible, this malloc manages
412 memory from the system in page-size units. This may be (and
413 usually is) a function rather than a constant. This is ignored
414 if WIN32, where page size is determined using getSystemInfo during
415 initialization.
416
417USE_DEV_RANDOM default: 0 (i.e., not used)
418 Causes malloc to use /dev/random to initialize secure magic seed for
419 stamping footers. Otherwise, the current time is used.
420
421NO_MALLINFO default: 0
422 If defined, don't compile "mallinfo". This can be a simple way
423 of dealing with mismatches between system declarations and
424 those in this file.
425
426MALLINFO_FIELD_TYPE default: size_t
427 The type of the fields in the mallinfo struct. This was originally
428 defined as "int" in SVID etc, but is more usefully defined as
429 size_t. The value is used only if HAVE_USR_INCLUDE_MALLOC_H is not set
430
431NO_MALLOC_STATS default: 0
432 If defined, don't compile "malloc_stats". This avoids calls to
433 fprintf and bringing in stdio dependencies you might not want.
434
435REALLOC_ZERO_BYTES_FREES default: not defined
436 This should be set if a call to realloc with zero bytes should
437 be the same as a call to free. Some people think it should. Otherwise,
438 since this malloc returns a unique pointer for malloc(0), so does
439 realloc(p, 0).
440
441LACKS_UNISTD_H, LACKS_FCNTL_H, LACKS_SYS_PARAM_H, LACKS_SYS_MMAN_H
442LACKS_STRINGS_H, LACKS_STRING_H, LACKS_SYS_TYPES_H, LACKS_ERRNO_H
443LACKS_STDLIB_H LACKS_SCHED_H LACKS_TIME_H default: NOT defined unless on WIN32
444 Define these if your system does not have these header files.
445 You might need to manually insert some of the declarations they provide.
446
447DEFAULT_GRANULARITY default: page size if MORECORE_CONTIGUOUS,
448 system_info.dwAllocationGranularity in WIN32,
449 otherwise 64K.
450 Also settable using mallopt(M_GRANULARITY, x)
451 The unit for allocating and deallocating memory from the system. On
452 most systems with contiguous MORECORE, there is no reason to
453 make this more than a page. However, systems with MMAP tend to
454 either require or encourage larger granularities. You can increase
455 this value to prevent system allocation functions to be called so
456 often, especially if they are slow. The value must be at least one
457 page and must be a power of two. Setting to 0 causes initialization
458 to either page size or win32 region size. (Note: In previous
459 versions of malloc, the equivalent of this option was called
460 "TOP_PAD")
461
462DEFAULT_TRIM_THRESHOLD default: 2MB
463 Also settable using mallopt(M_TRIM_THRESHOLD, x)
464 The maximum amount of unused top-most memory to keep before
465 releasing via malloc_trim in free(). Automatic trimming is mainly
466 useful in long-lived programs using contiguous MORECORE. Because
467 trimming via sbrk can be slow on some systems, and can sometimes be
468 wasteful (in cases where programs immediately afterward allocate
469 more large chunks) the value should be high enough so that your
470 overall system performance would improve by releasing this much
471 memory. As a rough guide, you might set to a value close to the
472 average size of a process (program) running on your system.
473 Releasing this much memory would allow such a process to run in
474 memory. Generally, it is worth tuning trim thresholds when a
475 program undergoes phases where several large chunks are allocated
476 and released in ways that can reuse each other's storage, perhaps
477 mixed with phases where there are no such chunks at all. The trim
478 value must be greater than page size to have any useful effect. To
479 disable trimming completely, you can set to MAX_SIZE_T. Note that the trick
480 some people use of mallocing a huge space and then freeing it at
481 program startup, in an attempt to reserve system memory, doesn't
482 have the intended effect under automatic trimming, since that memory
483 will immediately be returned to the system.
484
485DEFAULT_MMAP_THRESHOLD default: 256K
486 Also settable using mallopt(M_MMAP_THRESHOLD, x)
487 The request size threshold for using MMAP to directly service a
488 request. Requests of at least this size that cannot be allocated
489 using already-existing space will be serviced via mmap. (If enough
490 normal freed space already exists it is used instead.) Using mmap
491 segregates relatively large chunks of memory so that they can be
492 individually obtained and released from the host system. A request
493 serviced through mmap is never reused by any other request (at least
494 not directly; the system may just so happen to remap successive
495 requests to the same locations). Segregating space in this way has
496 the benefits that: Mmapped space can always be individually released
497 back to the system, which helps keep the system level memory demands
498 of a long-lived program low. Also, mapped memory doesn't become
499 `locked' between other chunks, as can happen with normally allocated
500 chunks, which means that even trimming via malloc_trim would not
501 release them. However, it has the disadvantage that the space
502 cannot be reclaimed, consolidated, and then used to service later
503 requests, as happens with normal chunks. The advantages of mmap
504 nearly always outweigh disadvantages for "large" chunks, but the
505 value of "large" may vary across systems. The default is an
506 empirically derived value that works well in most systems. You can
507 disable mmap by setting to MAX_SIZE_T.
508
509MAX_RELEASE_CHECK_RATE default: 4095 unless not HAVE_MMAP
510 The number of consolidated frees between checks to release
511 unused segments when freeing. When using non-contiguous segments,
512 especially with multiple mspaces, checking only for topmost space
513 doesn't always suffice to trigger trimming. To compensate for this,
514 free() will, with a period of MAX_RELEASE_CHECK_RATE (or the
515 current number of segments, if greater) try to release unused
516 segments to the OS when freeing chunks that result in
517 consolidation. The best value for this parameter is a compromise
518 between slowing down frees with relatively costly checks that
519 rarely trigger versus holding on to unused memory. To effectively
520 disable, set to MAX_SIZE_T. This may lead to a very slight speed
521 improvement at the expense of carrying around more memory.
522*/
523
524/* Version identifier to allow people to support multiple versions */
525#ifndef DLMALLOC_VERSION20806
526#define DLMALLOC_VERSION20806 20806
527#endif /* DLMALLOC_VERSION */
528
529#ifndef DLMALLOC_EXPORTextern
530#define DLMALLOC_EXPORTextern extern
531#endif
532
533#if defined __linux__1 && !defined _GNU_SOURCE1
534/* mremap() on Linux requires this via sys/mman.h */
535#define _GNU_SOURCE1 1
536#endif
537
538#ifndef WIN32
539#ifdef _WIN32
540#define WIN32 1
541#endif /* _WIN32 */
542#ifdef _WIN32_WCE
543#define LACKS_FCNTL_H
544#define WIN32 1
545#endif /* _WIN32_WCE */
546#endif /* WIN32 */
547#ifdef WIN32
548#define WIN32_LEAN_AND_MEAN
549#include <windows.h>
550#include <tchar.h>
551#define HAVE_MMAP1 1
552#define HAVE_MORECORE0 0
553#define LACKS_UNISTD_H
554#define LACKS_SYS_PARAM_H
555#define LACKS_SYS_MMAN_H1
556#define LACKS_STRING_H
557#define LACKS_STRINGS_H
558#define LACKS_SYS_TYPES_H
559#define LACKS_ERRNO_H
560#define LACKS_SCHED_H
561#ifndef MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;
562#define MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;
563#endif /* MALLOC_FAILURE_ACTION */
564#ifndef MMAP_CLEARS1
565#ifdef _WIN32_WCE /* WINCE reportedly does not clear */
566#define MMAP_CLEARS1 0
567#else
568#define MMAP_CLEARS1 1
569#endif /* _WIN32_WCE */
570#endif /*MMAP_CLEARS */
571#endif /* WIN32 */
572
573#ifdef __OS2__
574#define INCL_DOS
575#include <os2.h>
576#define HAVE_MMAP1 1
577#define HAVE_MORECORE0 0
578#define LACKS_SYS_MMAN_H1
579#endif /* __OS2__ */
580
581#if defined(DARWIN) || defined(_DARWIN)
582/* Mac OSX docs advise not to use sbrk; it seems better to use mmap */
583#ifndef HAVE_MORECORE0
584#define HAVE_MORECORE0 0
585#define HAVE_MMAP1 1
586/* OSX allocators provide 16 byte alignment */
587#ifndef MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *)))
588#define MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) ((size_t)16U)
589#endif
590#endif /* HAVE_MORECORE */
591#endif /* DARWIN */
592
593#ifndef LACKS_SYS_TYPES_H
594#include <sys/types.h> /* For size_t */
595#endif /* LACKS_SYS_TYPES_H */
596
597/* The maximum possible size_t value has all bits set */
598#define MAX_SIZE_T(~(size_t)0) (~(size_t)0)
599
600#ifndef USE_LOCKS1 /* ensure true if spin or recursive locks set */
601#define USE_LOCKS1 ((defined(USE_SPIN_LOCKS1) && USE_SPIN_LOCKS1 != 0) || \
602 (defined(USE_RECURSIVE_LOCKS) && USE_RECURSIVE_LOCKS != 0))
603#endif /* USE_LOCKS */
604
605#if USE_LOCKS1 /* Spin locks for gcc >= 4.1, older gcc on x86, MSC >= 1310 */
606#if ((defined(__GNUC__4) && \
607 ((__GNUC__4 > 4 || (__GNUC__4 == 4 && __GNUC_MINOR__2 >= 1)) || \
608 defined(__i386__) || defined(__x86_64__1))) || \
609 (defined(_MSC_VER) && _MSC_VER>=1310))
610#ifndef USE_SPIN_LOCKS1
611#define USE_SPIN_LOCKS1 1
612#endif /* USE_SPIN_LOCKS */
613#elif USE_SPIN_LOCKS1
614#error "USE_SPIN_LOCKS defined without implementation"
615#endif /* ... locks available... */
616#elif !defined(USE_SPIN_LOCKS1)
617#define USE_SPIN_LOCKS1 0
618#endif /* USE_LOCKS */
619
620#ifndef ONLY_MSPACES0
621#define ONLY_MSPACES0 0
622#endif /* ONLY_MSPACES */
623#ifndef MSPACES0
624#if ONLY_MSPACES0
625#define MSPACES0 1
626#else /* ONLY_MSPACES */
627#define MSPACES0 0
628#endif /* ONLY_MSPACES */
629#endif /* MSPACES */
630#ifndef MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *)))
631#define MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) ((size_t)(2 * sizeof(void *)))
632#endif /* MALLOC_ALIGNMENT */
633#ifndef FOOTERS0
634#define FOOTERS0 0
635#endif /* FOOTERS */
636#ifndef ABORTabort()
637#define ABORTabort() abort()
638#endif /* ABORT */
639#ifndef ABORT_ON_ASSERT_FAILURE1
640#define ABORT_ON_ASSERT_FAILURE1 1
641#endif /* ABORT_ON_ASSERT_FAILURE */
642#ifndef PROCEED_ON_ERROR0
643#define PROCEED_ON_ERROR0 0
644#endif /* PROCEED_ON_ERROR */
645
646#ifndef INSECURE0
647#define INSECURE0 0
648#endif /* INSECURE */
649#ifndef MALLOC_INSPECT_ALL0
650#define MALLOC_INSPECT_ALL0 0
651#endif /* MALLOC_INSPECT_ALL */
652#ifndef HAVE_MMAP1
653#define HAVE_MMAP1 1
654#endif /* HAVE_MMAP */
655#ifndef MMAP_CLEARS1
656#define MMAP_CLEARS1 1
657#endif /* MMAP_CLEARS */
658#ifndef HAVE_MREMAP0
659#ifdef linux1
660#define HAVE_MREMAP0 1
661#define _GNU_SOURCE1 /* Turns on mremap() definition */
662#else /* linux */
663#define HAVE_MREMAP0 0
664#endif /* linux */
665#endif /* HAVE_MREMAP */
666#ifndef MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;
667#define MALLOC_FAILURE_ACTION(*__errno_location ()) = 12; errno(*__errno_location ()) = ENOMEM12;
668#endif /* MALLOC_FAILURE_ACTION */
669#ifndef HAVE_MORECORE0
670#if ONLY_MSPACES0
671#define HAVE_MORECORE0 0
672#else /* ONLY_MSPACES */
673#define HAVE_MORECORE0 1
674#endif /* ONLY_MSPACES */
675#endif /* HAVE_MORECORE */
676#if !HAVE_MORECORE0
677#define MORECORE_CONTIGUOUS0 0
678#else /* !HAVE_MORECORE */
679#define MORECORE_DEFAULT sbrk
680#ifndef MORECORE_CONTIGUOUS0
681#define MORECORE_CONTIGUOUS0 1
682#endif /* MORECORE_CONTIGUOUS */
683#endif /* HAVE_MORECORE */
684#ifndef DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE))
685#if (MORECORE_CONTIGUOUS0 || defined(WIN32))
686#define DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) (0) /* 0 means to compute in init_mparams */
687#else /* MORECORE_CONTIGUOUS */
688#define DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) ((size_t)64U * (size_t)1024U)
689#endif /* MORECORE_CONTIGUOUS */
690#endif /* DEFAULT_GRANULARITY */
691#ifndef DEFAULT_TRIM_THRESHOLD((size_t)2U * (size_t)1024U * (size_t)1024U)
692#ifndef MORECORE_CANNOT_TRIM
693#define DEFAULT_TRIM_THRESHOLD((size_t)2U * (size_t)1024U * (size_t)1024U) ((size_t)2U * (size_t)1024U * (size_t)1024U)
694#else /* MORECORE_CANNOT_TRIM */
695#define DEFAULT_TRIM_THRESHOLD((size_t)2U * (size_t)1024U * (size_t)1024U) MAX_SIZE_T(~(size_t)0)
696#endif /* MORECORE_CANNOT_TRIM */
697#endif /* DEFAULT_TRIM_THRESHOLD */
698#ifndef DEFAULT_MMAP_THRESHOLD(~(size_t)0)
699#if HAVE_MMAP1
700#define DEFAULT_MMAP_THRESHOLD(~(size_t)0) ((size_t)256U * (size_t)1024U)
701#else /* HAVE_MMAP */
702#define DEFAULT_MMAP_THRESHOLD(~(size_t)0) MAX_SIZE_T(~(size_t)0)
703#endif /* HAVE_MMAP */
704#endif /* DEFAULT_MMAP_THRESHOLD */
705#ifndef MAX_RELEASE_CHECK_RATE4095
706#if HAVE_MMAP1
707#define MAX_RELEASE_CHECK_RATE4095 4095
708#else
709#define MAX_RELEASE_CHECK_RATE4095 MAX_SIZE_T(~(size_t)0)
710#endif /* HAVE_MMAP */
711#endif /* MAX_RELEASE_CHECK_RATE */
712#ifndef USE_BUILTIN_FFS0
713#define USE_BUILTIN_FFS0 0
714#endif /* USE_BUILTIN_FFS */
715#ifndef USE_DEV_RANDOM0
716#define USE_DEV_RANDOM0 0
717#endif /* USE_DEV_RANDOM */
718#ifndef NO_MALLINFO1
719#define NO_MALLINFO1 0
720#endif /* NO_MALLINFO */
721#ifndef MALLINFO_FIELD_TYPEsize_t
722#define MALLINFO_FIELD_TYPEsize_t size_t
723#endif /* MALLINFO_FIELD_TYPE */
724#ifndef NO_MALLOC_STATS0
725#define NO_MALLOC_STATS0 0
726#endif /* NO_MALLOC_STATS */
727#ifndef NO_SEGMENT_TRAVERSAL0
728#define NO_SEGMENT_TRAVERSAL0 0
729#endif /* NO_SEGMENT_TRAVERSAL */
730
731/*
732 mallopt tuning options. SVID/XPG defines four standard parameter
733 numbers for mallopt, normally defined in malloc.h. None of these
734 are used in this malloc, so setting them has no effect. But this
735 malloc does support the following options.
736*/
737
738/* The system's malloc.h may have conflicting defines. */
739#undef M_TRIM_THRESHOLD(-1)
740#undef M_GRANULARITY(-2)
741#undef M_MMAP_THRESHOLD(-3)
742
743#define M_TRIM_THRESHOLD(-1) (-1)
744#define M_GRANULARITY(-2) (-2)
745#define M_MMAP_THRESHOLD(-3) (-3)
746
747/* ------------------------ Mallinfo declarations ------------------------ */
748
749#if !NO_MALLINFO1
750/*
751 This version of malloc supports the standard SVID/XPG mallinfo
752 routine that returns a struct containing usage properties and
753 statistics. It should work on any system that has a
754 /usr/include/malloc.h defining struct mallinfo. The main
755 declaration needed is the mallinfo struct that is returned (by-copy)
756 by mallinfo(). The malloinfo struct contains a bunch of fields that
757 are not even meaningful in this version of malloc. These fields are
758 are instead filled by mallinfo() with other numbers that might be of
759 interest.
760
761 HAVE_USR_INCLUDE_MALLOC_H should be set if you have a
762 /usr/include/malloc.h file that includes a declaration of struct
763 mallinfo. If so, it is included; else a compliant version is
764 declared below. These must be precisely the same for mallinfo() to
765 work. The original SVID version of this struct, defined on most
766 systems with mallinfo, declares all fields as ints. But some others
767 define as unsigned long. If your system defines the fields using a
768 type of different width than listed here, you MUST #include your
769 system version and #define HAVE_USR_INCLUDE_MALLOC_H.
770*/
771
772/* #define HAVE_USR_INCLUDE_MALLOC_H */
773
774#ifdef HAVE_USR_INCLUDE_MALLOC_H
775#include "/usr/include/malloc.h"
776#else /* HAVE_USR_INCLUDE_MALLOC_H */
777#ifndef STRUCT_MALLINFO_DECLARED
778/* HP-UX (and others?) redefines mallinfo unless _STRUCT_MALLINFO is defined */
779#define _STRUCT_MALLINFO
780#define STRUCT_MALLINFO_DECLARED 1
781struct mallinfo {
782 MALLINFO_FIELD_TYPEsize_t arena; /* non-mmapped space allocated from system */
783 MALLINFO_FIELD_TYPEsize_t ordblks; /* number of free chunks */
784 MALLINFO_FIELD_TYPEsize_t smblks; /* always 0 */
785 MALLINFO_FIELD_TYPEsize_t hblks; /* always 0 */
786 MALLINFO_FIELD_TYPEsize_t hblkhd; /* space in mmapped regions */
787 MALLINFO_FIELD_TYPEsize_t usmblks; /* maximum total allocated space */
788 MALLINFO_FIELD_TYPEsize_t fsmblks; /* always 0 */
789 MALLINFO_FIELD_TYPEsize_t uordblks; /* total allocated space */
790 MALLINFO_FIELD_TYPEsize_t fordblks; /* total free space */
791 MALLINFO_FIELD_TYPEsize_t keepcost; /* releasable (via malloc_trim) space */
792};
793#endif /* STRUCT_MALLINFO_DECLARED */
794#endif /* HAVE_USR_INCLUDE_MALLOC_H */
795#endif /* NO_MALLINFO */
796
797/*
798 Try to persuade compilers to inline. The most critical functions for
799 inlining are defined as macros, so these aren't used for them.
800*/
801
802#ifndef FORCEINLINE__inline __attribute__ ((always_inline))
803 #if defined(__GNUC__4)
804#define FORCEINLINE__inline __attribute__ ((always_inline)) __inline __attribute__ ((always_inline))
805 #elif defined(_MSC_VER)
806 #define FORCEINLINE__inline __attribute__ ((always_inline)) __forceinline
807 #endif
808#endif
809#ifndef NOINLINE__attribute__ ((noinline))
810 #if defined(__GNUC__4)
811 #define NOINLINE__attribute__ ((noinline)) __attribute__ ((noinline))
812 #elif defined(_MSC_VER)
813 #define NOINLINE__attribute__ ((noinline)) __declspec(noinline)
814 #else
815 #define NOINLINE__attribute__ ((noinline))
816 #endif
817#endif
818
819#ifdef __cplusplus
820extern "C" {
821#ifndef FORCEINLINE__inline __attribute__ ((always_inline))
822 #define FORCEINLINE__inline __attribute__ ((always_inline)) inline
823#endif
824#endif /* __cplusplus */
825#ifndef FORCEINLINE__inline __attribute__ ((always_inline))
826 #define FORCEINLINE__inline __attribute__ ((always_inline))
827#endif
828
829#if !ONLY_MSPACES0
830
831/* ------------------- Declarations of public routines ------------------- */
832
833#ifndef USE_DL_PREFIX1
834#define dlcalloc calloc
835#define dlfree free
836#define dlmalloc malloc
837#define dlmemalign memalign
838#define dlposix_memalign posix_memalign
839#define dlrealloc realloc
840#define dlrealloc_in_place realloc_in_place
841#define dlvalloc valloc
842#define dlpvalloc pvalloc
843#define dlmallinfo mallinfo
844#define dlmallopt mallopt
845#define dlmalloc_trim malloc_trim
846#define dlmalloc_stats malloc_stats
847#define dlmalloc_usable_size malloc_usable_size
848#define dlmalloc_footprint malloc_footprint
849#define dlmalloc_max_footprint malloc_max_footprint
850#define dlmalloc_footprint_limit malloc_footprint_limit
851#define dlmalloc_set_footprint_limit malloc_set_footprint_limit
852#define dlmalloc_inspect_all malloc_inspect_all
853#define dlindependent_calloc independent_calloc
854#define dlindependent_comalloc independent_comalloc
855#define dlbulk_free bulk_free
856#endif /* USE_DL_PREFIX */
857
858/*
859 malloc(size_t n)
860 Returns a pointer to a newly allocated chunk of at least n bytes, or
861 null if no space is available, in which case errno is set to ENOMEM
862 on ANSI C systems.
863
864 If n is zero, malloc returns a minimum-sized chunk. (The minimum
865 size is 16 bytes on most 32bit systems, and 32 bytes on 64bit
866 systems.) Note that size_t is an unsigned type, so calls with
867 arguments that would be negative if signed are interpreted as
868 requests for huge amounts of space, which will often fail. The
869 maximum supported value of n differs across systems, but is in all
870 cases less than the maximum representable value of a size_t.
871*/
872DLMALLOC_EXPORTextern void* dlmalloc(size_t);
873
874/*
875 free(void* p)
876 Releases the chunk of memory pointed to by p, that had been previously
877 allocated using malloc or a related routine such as realloc.
878 It has no effect if p is null. If p was not malloced or already
879 freed, free(p) will by default cause the current program to abort.
880*/
881DLMALLOC_EXPORTextern void dlfree(void*);
882
883/*
884 calloc(size_t n_elements, size_t element_size);
885 Returns a pointer to n_elements * element_size bytes, with all locations
886 set to zero.
887*/
888DLMALLOC_EXPORTextern void* dlcalloc(size_t, size_t);
889
890/*
891 realloc(void* p, size_t n)
892 Returns a pointer to a chunk of size n that contains the same data
893 as does chunk p up to the minimum of (n, p's size) bytes, or null
894 if no space is available.
895
896 The returned pointer may or may not be the same as p. The algorithm
897 prefers extending p in most cases when possible, otherwise it
898 employs the equivalent of a malloc-copy-free sequence.
899
900 If p is null, realloc is equivalent to malloc.
901
902 If space is not available, realloc returns null, errno is set (if on
903 ANSI) and p is NOT freed.
904
905 if n is for fewer bytes than already held by p, the newly unused
906 space is lopped off and freed if possible. realloc with a size
907 argument of zero (re)allocates a minimum-sized chunk.
908
909 The old unix realloc convention of allowing the last-free'd chunk
910 to be used as an argument to realloc is not supported.
911*/
912DLMALLOC_EXPORTextern void* dlrealloc(void*, size_t);
913
914/*
915 realloc_in_place(void* p, size_t n)
916 Resizes the space allocated for p to size n, only if this can be
917 done without moving p (i.e., only if there is adjacent space
918 available if n is greater than p's current allocated size, or n is
919 less than or equal to p's size). This may be used instead of plain
920 realloc if an alternative allocation strategy is needed upon failure
921 to expand space; for example, reallocation of a buffer that must be
922 memory-aligned or cleared. You can use realloc_in_place to trigger
923 these alternatives only when needed.
924
925 Returns p if successful; otherwise null.
926*/
927DLMALLOC_EXPORTextern void* dlrealloc_in_place(void*, size_t);
928
929/*
930 memalign(size_t alignment, size_t n);
931 Returns a pointer to a newly allocated chunk of n bytes, aligned
932 in accord with the alignment argument.
933
934 The alignment argument should be a power of two. If the argument is
935 not a power of two, the nearest greater power is used.
936 8-byte alignment is guaranteed by normal malloc calls, so don't
937 bother calling memalign with an argument of 8 or less.
938
939 Overreliance on memalign is a sure way to fragment space.
940*/
941DLMALLOC_EXPORTextern void* dlmemalign(size_t, size_t);
942
943/*
944 int posix_memalign(void** pp, size_t alignment, size_t n);
945 Allocates a chunk of n bytes, aligned in accord with the alignment
946 argument. Differs from memalign only in that it (1) assigns the
947 allocated memory to *pp rather than returning it, (2) fails and
948 returns EINVAL if the alignment is not a power of two (3) fails and
949 returns ENOMEM if memory cannot be allocated.
950*/
951DLMALLOC_EXPORTextern int dlposix_memalign(void**, size_t, size_t);
952
953/*
954 valloc(size_t n);
955 Equivalent to memalign(pagesize, n), where pagesize is the page
956 size of the system. If the pagesize is unknown, 4096 is used.
957*/
958DLMALLOC_EXPORTextern void* dlvalloc(size_t);
959
960/*
961 mallopt(int parameter_number, int parameter_value)
962 Sets tunable parameters The format is to provide a
963 (parameter-number, parameter-value) pair. mallopt then sets the
964 corresponding parameter to the argument value if it can (i.e., so
965 long as the value is meaningful), and returns 1 if successful else
966 0. To workaround the fact that mallopt is specified to use int,
967 not size_t parameters, the value -1 is specially treated as the
968 maximum unsigned size_t value.
969
970 SVID/XPG/ANSI defines four standard param numbers for mallopt,
971 normally defined in malloc.h. None of these are use in this malloc,
972 so setting them has no effect. But this malloc also supports other
973 options in mallopt. See below for details. Briefly, supported
974 parameters are as follows (listed defaults are for "typical"
975 configurations).
976
977 Symbol param # default allowed param values
978 M_TRIM_THRESHOLD -1 2*1024*1024 any (-1 disables)
979 M_GRANULARITY -2 page size any power of 2 >= page size
980 M_MMAP_THRESHOLD -3 256*1024 any (or 0 if no MMAP support)
981*/
982DLMALLOC_EXPORTextern int dlmallopt(int, int);
983
984/*
985 malloc_footprint();
986 Returns the number of bytes obtained from the system. The total
987 number of bytes allocated by malloc, realloc etc., is less than this
988 value. Unlike mallinfo, this function returns only a precomputed
989 result, so can be called frequently to monitor memory consumption.
990 Even if locks are otherwise defined, this function does not use them,
991 so results might not be up to date.
992*/
993DLMALLOC_EXPORTextern size_t dlmalloc_footprint(void);
994
995/*
996 malloc_max_footprint();
997 Returns the maximum number of bytes obtained from the system. This
998 value will be greater than current footprint if deallocated space
999 has been reclaimed by the system. The peak number of bytes allocated
1000 by malloc, realloc etc., is less than this value. Unlike mallinfo,
1001 this function returns only a precomputed result, so can be called
1002 frequently to monitor memory consumption. Even if locks are
1003 otherwise defined, this function does not use them, so results might
1004 not be up to date.
1005*/
1006DLMALLOC_EXPORTextern size_t dlmalloc_max_footprint(void);
1007
1008/*
1009 malloc_footprint_limit();
1010 Returns the number of bytes that the heap is allowed to obtain from
1011 the system, returning the last value returned by
1012 malloc_set_footprint_limit, or the maximum size_t value if
1013 never set. The returned value reflects a permission. There is no
1014 guarantee that this number of bytes can actually be obtained from
1015 the system.
1016*/
1017DLMALLOC_EXPORTextern size_t dlmalloc_footprint_limit();
1018
1019/*
1020 malloc_set_footprint_limit();
1021 Sets the maximum number of bytes to obtain from the system, causing
1022 failure returns from malloc and related functions upon attempts to
1023 exceed this value. The argument value may be subject to page
1024 rounding to an enforceable limit; this actual value is returned.
1025 Using an argument of the maximum possible size_t effectively
1026 disables checks. If the argument is less than or equal to the
1027 current malloc_footprint, then all future allocations that require
1028 additional system memory will fail. However, invocation cannot
1029 retroactively deallocate existing used memory.
1030*/
1031DLMALLOC_EXPORTextern size_t dlmalloc_set_footprint_limit(size_t bytes);
1032
1033#if MALLOC_INSPECT_ALL0
1034/*
1035 malloc_inspect_all(void(*handler)(void *start,
1036 void *end,
1037 size_t used_bytes,
1038 void* callback_arg),
1039 void* arg);
1040 Traverses the heap and calls the given handler for each managed
1041 region, skipping all bytes that are (or may be) used for bookkeeping
1042 purposes. Traversal does not include include chunks that have been
1043 directly memory mapped. Each reported region begins at the start
1044 address, and continues up to but not including the end address. The
1045 first used_bytes of the region contain allocated data. If
1046 used_bytes is zero, the region is unallocated. The handler is
1047 invoked with the given callback argument. If locks are defined, they
1048 are held during the entire traversal. It is a bad idea to invoke
1049 other malloc functions from within the handler.
1050
1051 For example, to count the number of in-use chunks with size greater
1052 than 1000, you could write:
1053 static int count = 0;
1054 void count_chunks(void* start, void* end, size_t used, void* arg) {
1055 if (used >= 1000) ++count;
1056 }
1057 then:
1058 malloc_inspect_all(count_chunks, NULL);
1059
1060 malloc_inspect_all is compiled only if MALLOC_INSPECT_ALL is defined.
1061*/
1062DLMALLOC_EXPORTextern void dlmalloc_inspect_all(void(*handler)(void*, void *, size_t, void*),
1063 void* arg);
1064
1065#endif /* MALLOC_INSPECT_ALL */
1066
1067#if !NO_MALLINFO1
1068/*
1069 mallinfo()
1070 Returns (by copy) a struct containing various summary statistics:
1071
1072 arena: current total non-mmapped bytes allocated from system
1073 ordblks: the number of free chunks
1074 smblks: always zero.
1075 hblks: current number of mmapped regions
1076 hblkhd: total bytes held in mmapped regions
1077 usmblks: the maximum total allocated space. This will be greater
1078 than current total if trimming has occurred.
1079 fsmblks: always zero
1080 uordblks: current total allocated space (normal or mmapped)
1081 fordblks: total free space
1082 keepcost: the maximum number of bytes that could ideally be released
1083 back to system via malloc_trim. ("ideally" means that
1084 it ignores page restrictions etc.)
1085
1086 Because these fields are ints, but internal bookkeeping may
1087 be kept as longs, the reported values may wrap around zero and
1088 thus be inaccurate.
1089*/
1090DLMALLOC_EXPORTextern struct mallinfo dlmallinfo(void);
1091#endif /* NO_MALLINFO */
1092
1093/*
1094 independent_calloc(size_t n_elements, size_t element_size, void* chunks[]);
1095
1096 independent_calloc is similar to calloc, but instead of returning a
1097 single cleared space, it returns an array of pointers to n_elements
1098 independent elements that can hold contents of size elem_size, each
1099 of which starts out cleared, and can be independently freed,
1100 realloc'ed etc. The elements are guaranteed to be adjacently
1101 allocated (this is not guaranteed to occur with multiple callocs or
1102 mallocs), which may also improve cache locality in some
1103 applications.
1104
1105 The "chunks" argument is optional (i.e., may be null, which is
1106 probably the most typical usage). If it is null, the returned array
1107 is itself dynamically allocated and should also be freed when it is
1108 no longer needed. Otherwise, the chunks array must be of at least
1109 n_elements in length. It is filled in with the pointers to the
1110 chunks.
1111
1112 In either case, independent_calloc returns this pointer array, or
1113 null if the allocation failed. If n_elements is zero and "chunks"
1114 is null, it returns a chunk representing an array with zero elements
1115 (which should be freed if not wanted).
1116
1117 Each element must be freed when it is no longer needed. This can be
1118 done all at once using bulk_free.
1119
1120 independent_calloc simplifies and speeds up implementations of many
1121 kinds of pools. It may also be useful when constructing large data
1122 structures that initially have a fixed number of fixed-sized nodes,
1123 but the number is not known at compile time, and some of the nodes
1124 may later need to be freed. For example:
1125
1126 struct Node { int item; struct Node* next; };
1127
1128 struct Node* build_list() {
1129 struct Node** pool;
1130 int n = read_number_of_nodes_needed();
1131 if (n <= 0) return 0;
1132 pool = (struct Node**)(independent_calloc(n, sizeof(struct Node), 0);
1133 if (pool == 0) die();
1134 // organize into a linked list...
1135 struct Node* first = pool[0];
1136 for (i = 0; i < n-1; ++i)
1137 pool[i]->next = pool[i+1];
1138 free(pool); // Can now free the array (or not, if it is needed later)
1139 return first;
1140 }
1141*/
1142DLMALLOC_EXPORTextern void** dlindependent_calloc(size_t, size_t, void**);
1143
1144/*
1145 independent_comalloc(size_t n_elements, size_t sizes[], void* chunks[]);
1146
1147 independent_comalloc allocates, all at once, a set of n_elements
1148 chunks with sizes indicated in the "sizes" array. It returns
1149 an array of pointers to these elements, each of which can be
1150 independently freed, realloc'ed etc. The elements are guaranteed to
1151 be adjacently allocated (this is not guaranteed to occur with
1152 multiple callocs or mallocs), which may also improve cache locality
1153 in some applications.
1154
1155 The "chunks" argument is optional (i.e., may be null). If it is null
1156 the returned array is itself dynamically allocated and should also
1157 be freed when it is no longer needed. Otherwise, the chunks array
1158 must be of at least n_elements in length. It is filled in with the
1159 pointers to the chunks.
1160
1161 In either case, independent_comalloc returns this pointer array, or
1162 null if the allocation failed. If n_elements is zero and chunks is
1163 null, it returns a chunk representing an array with zero elements
1164 (which should be freed if not wanted).
1165
1166 Each element must be freed when it is no longer needed. This can be
1167 done all at once using bulk_free.
1168
1169 independent_comallac differs from independent_calloc in that each
1170 element may have a different size, and also that it does not
1171 automatically clear elements.
1172
1173 independent_comalloc can be used to speed up allocation in cases
1174 where several structs or objects must always be allocated at the
1175 same time. For example:
1176
1177 struct Head { ... }
1178 struct Foot { ... }
1179
1180 void send_message(char* msg) {
1181 int msglen = strlen(msg);
1182 size_t sizes[3] = { sizeof(struct Head), msglen, sizeof(struct Foot) };
1183 void* chunks[3];
1184 if (independent_comalloc(3, sizes, chunks) == 0)
1185 die();
1186 struct Head* head = (struct Head*)(chunks[0]);
1187 char* body = (char*)(chunks[1]);
1188 struct Foot* foot = (struct Foot*)(chunks[2]);
1189 // ...
1190 }
1191
1192 In general though, independent_comalloc is worth using only for
1193 larger values of n_elements. For small values, you probably won't
1194 detect enough difference from series of malloc calls to bother.
1195
1196 Overuse of independent_comalloc can increase overall memory usage,
1197 since it cannot reuse existing noncontiguous small chunks that
1198 might be available for some of the elements.
1199*/
1200DLMALLOC_EXPORTextern void** dlindependent_comalloc(size_t, size_t*, void**);
1201
1202/*
1203 bulk_free(void* array[], size_t n_elements)
1204 Frees and clears (sets to null) each non-null pointer in the given
1205 array. This is likely to be faster than freeing them one-by-one.
1206 If footers are used, pointers that have been allocated in different
1207 mspaces are not freed or cleared, and the count of all such pointers
1208 is returned. For large arrays of pointers with poor locality, it
1209 may be worthwhile to sort this array before calling bulk_free.
1210*/
1211DLMALLOC_EXPORTextern size_t dlbulk_free(void**, size_t n_elements);
1212
1213/*
1214 pvalloc(size_t n);
1215 Equivalent to valloc(minimum-page-that-holds(n)), that is,
1216 round up n to nearest pagesize.
1217 */
1218DLMALLOC_EXPORTextern void* dlpvalloc(size_t);
1219
1220/*
1221 malloc_trim(size_t pad);
1222
1223 If possible, gives memory back to the system (via negative arguments
1224 to sbrk) if there is unused memory at the `high' end of the malloc
1225 pool or in unused MMAP segments. You can call this after freeing
1226 large blocks of memory to potentially reduce the system-level memory
1227 requirements of a program. However, it cannot guarantee to reduce
1228 memory. Under some allocation patterns, some large free blocks of
1229 memory will be locked between two used chunks, so they cannot be
1230 given back to the system.
1231
1232 The `pad' argument to malloc_trim represents the amount of free
1233 trailing space to leave untrimmed. If this argument is zero, only
1234 the minimum amount of memory to maintain internal data structures
1235 will be left. Non-zero arguments can be supplied to maintain enough
1236 trailing space to service future expected allocations without having
1237 to re-obtain memory from the system.
1238
1239 Malloc_trim returns 1 if it actually released any memory, else 0.
1240*/
1241DLMALLOC_EXPORTextern int dlmalloc_trim(size_t);
1242
1243/*
1244 malloc_stats();
1245 Prints on stderr the amount of space obtained from the system (both
1246 via sbrk and mmap), the maximum amount (which may be more than
1247 current if malloc_trim and/or munmap got called), and the current
1248 number of bytes allocated via malloc (or realloc, etc) but not yet
1249 freed. Note that this is the number of bytes allocated, not the
1250 number requested. It will be larger than the number requested
1251 because of alignment and bookkeeping overhead. Because it includes
1252 alignment wastage as being in use, this figure may be greater than
1253 zero even when no user-level chunks are allocated.
1254
1255 The reported current and maximum system memory can be inaccurate if
1256 a program makes other calls to system memory allocation functions
1257 (normally sbrk) outside of malloc.
1258
1259 malloc_stats prints only the most commonly interesting statistics.
1260 More information can be obtained by calling mallinfo.
1261*/
1262DLMALLOC_EXPORTextern void dlmalloc_stats(void);
1263
1264/*
1265 malloc_usable_size(void* p);
1266
1267 Returns the number of bytes you can actually use in
1268 an allocated chunk, which may be more than you requested (although
1269 often not) due to alignment and minimum size constraints.
1270 You can use this many bytes without worrying about
1271 overwriting other allocated objects. This is not a particularly great
1272 programming practice. malloc_usable_size can be more useful in
1273 debugging and assertions, for example:
1274
1275 p = malloc(n);
1276 assert(malloc_usable_size(p) >= 256);
1277*/
1278size_t dlmalloc_usable_size(void*);
1279
1280#endif /* ONLY_MSPACES */
1281
1282#if MSPACES0
1283
1284/*
1285 mspace is an opaque type representing an independent
1286 region of space that supports mspace_malloc, etc.
1287*/
1288typedef void* mspace;
1289
1290/*
1291 create_mspace creates and returns a new independent space with the
1292 given initial capacity, or, if 0, the default granularity size. It
1293 returns null if there is no system memory available to create the
1294 space. If argument locked is non-zero, the space uses a separate
1295 lock to control access. The capacity of the space will grow
1296 dynamically as needed to service mspace_malloc requests. You can
1297 control the sizes of incremental increases of this space by
1298 compiling with a different DEFAULT_GRANULARITY or dynamically
1299 setting with mallopt(M_GRANULARITY, value).
1300*/
1301DLMALLOC_EXPORTextern mspace create_mspace(size_t capacity, int locked);
1302
1303/*
1304 destroy_mspace destroys the given space, and attempts to return all
1305 of its memory back to the system, returning the total number of
1306 bytes freed. After destruction, the results of access to all memory
1307 used by the space become undefined.
1308*/
1309DLMALLOC_EXPORTextern size_t destroy_mspace(mspace msp);
1310
1311/*
1312 create_mspace_with_base uses the memory supplied as the initial base
1313 of a new mspace. Part (less than 128*sizeof(size_t) bytes) of this
1314 space is used for bookkeeping, so the capacity must be at least this
1315 large. (Otherwise 0 is returned.) When this initial space is
1316 exhausted, additional memory will be obtained from the system.
1317 Destroying this space will deallocate all additionally allocated
1318 space (if possible) but not the initial base.
1319*/
1320DLMALLOC_EXPORTextern mspace create_mspace_with_base(void* base, size_t capacity, int locked);
1321
1322/*
1323 mspace_track_large_chunks controls whether requests for large chunks
1324 are allocated in their own untracked mmapped regions, separate from
1325 others in this mspace. By default large chunks are not tracked,
1326 which reduces fragmentation. However, such chunks are not
1327 necessarily released to the system upon destroy_mspace. Enabling
1328 tracking by setting to true may increase fragmentation, but avoids
1329 leakage when relying on destroy_mspace to release all memory
1330 allocated using this space. The function returns the previous
1331 setting.
1332*/
1333DLMALLOC_EXPORTextern int mspace_track_large_chunks(mspace msp, int enable);
1334
1335
1336/*
1337 mspace_malloc behaves as malloc, but operates within
1338 the given space.
1339*/
1340DLMALLOC_EXPORTextern void* mspace_malloc(mspace msp, size_t bytes);
1341
1342/*
1343 mspace_free behaves as free, but operates within
1344 the given space.
1345
1346 If compiled with FOOTERS==1, mspace_free is not actually needed.
1347 free may be called instead of mspace_free because freed chunks from
1348 any space are handled by their originating spaces.
1349*/
1350DLMALLOC_EXPORTextern void mspace_free(mspace msp, void* mem);
1351
1352/*
1353 mspace_realloc behaves as realloc, but operates within
1354 the given space.
1355
1356 If compiled with FOOTERS==1, mspace_realloc is not actually
1357 needed. realloc may be called instead of mspace_realloc because
1358 realloced chunks from any space are handled by their originating
1359 spaces.
1360*/
1361DLMALLOC_EXPORTextern void* mspace_realloc(mspace msp, void* mem, size_t newsize);
1362
1363/*
1364 mspace_calloc behaves as calloc, but operates within
1365 the given space.
1366*/
1367DLMALLOC_EXPORTextern void* mspace_calloc(mspace msp, size_t n_elements, size_t elem_size);
1368
1369/*
1370 mspace_memalign behaves as memalign, but operates within
1371 the given space.
1372*/
1373DLMALLOC_EXPORTextern void* mspace_memalign(mspace msp, size_t alignment, size_t bytes);
1374
1375/*
1376 mspace_independent_calloc behaves as independent_calloc, but
1377 operates within the given space.
1378*/
1379DLMALLOC_EXPORTextern void** mspace_independent_calloc(mspace msp, size_t n_elements,
1380 size_t elem_size, void* chunks[]);
1381
1382/*
1383 mspace_independent_comalloc behaves as independent_comalloc, but
1384 operates within the given space.
1385*/
1386DLMALLOC_EXPORTextern void** mspace_independent_comalloc(mspace msp, size_t n_elements,
1387 size_t sizes[], void* chunks[]);
1388
1389/*
1390 mspace_footprint() returns the number of bytes obtained from the
1391 system for this space.
1392*/
1393DLMALLOC_EXPORTextern size_t mspace_footprint(mspace msp);
1394
1395/*
1396 mspace_max_footprint() returns the peak number of bytes obtained from the
1397 system for this space.
1398*/
1399DLMALLOC_EXPORTextern size_t mspace_max_footprint(mspace msp);
1400
1401
1402#if !NO_MALLINFO1
1403/*
1404 mspace_mallinfo behaves as mallinfo, but reports properties of
1405 the given space.
1406*/
1407DLMALLOC_EXPORTextern struct mallinfo mspace_mallinfo(mspace msp);
1408#endif /* NO_MALLINFO */
1409
1410/*
1411 malloc_usable_size(void* p) behaves the same as malloc_usable_size;
1412*/
1413DLMALLOC_EXPORTextern size_t mspace_usable_size(const void* mem);
1414
1415/*
1416 mspace_malloc_stats behaves as malloc_stats, but reports
1417 properties of the given space.
1418*/
1419DLMALLOC_EXPORTextern void mspace_malloc_stats(mspace msp);
1420
1421/*
1422 mspace_trim behaves as malloc_trim, but
1423 operates within the given space.
1424*/
1425DLMALLOC_EXPORTextern int mspace_trim(mspace msp, size_t pad);
1426
1427/*
1428 An alias for mallopt.
1429*/
1430DLMALLOC_EXPORTextern int mspace_mallopt(int, int);
1431
1432#endif /* MSPACES */
1433
1434#ifdef __cplusplus
1435} /* end of extern "C" */
1436#endif /* __cplusplus */
1437
1438/*
1439 ========================================================================
1440 To make a fully customizable malloc.h header file, cut everything
1441 above this line, put into file malloc.h, edit to suit, and #include it
1442 on the next line, as well as in programs that use this malloc.
1443 ========================================================================
1444*/
1445
1446/* #include "malloc.h" */
1447
1448/*------------------------------ internal #includes ---------------------- */
1449
1450#ifdef _MSC_VER
1451#pragma warning( disable : 4146 ) /* no "unsigned" warnings */
1452#endif /* _MSC_VER */
1453#if !NO_MALLOC_STATS0
1454#include <stdio.h> /* for printing in malloc_stats */
1455#endif /* NO_MALLOC_STATS */
1456#ifndef LACKS_ERRNO_H
1457#include <errno(*__errno_location ()).h> /* for MALLOC_FAILURE_ACTION */
1458#endif /* LACKS_ERRNO_H */
1459#ifdef DEBUG1
1460#if ABORT_ON_ASSERT_FAILURE1
1461#undef assert
1462#define assert(x)if(!(x)) abort() if(!(x)) ABORTabort()
1463#else /* ABORT_ON_ASSERT_FAILURE */
1464#include <assert.h>
1465#endif /* ABORT_ON_ASSERT_FAILURE */
1466#else /* DEBUG */
1467#ifndef assert
1468#define assert(x)if(!(x)) abort()
1469#endif
1470#define DEBUG1 0
1471#endif /* DEBUG */
1472#if !defined(WIN32) && !defined(LACKS_TIME_H)
1473#include <time.h> /* for magic initialization */
1474#endif /* WIN32 */
1475#ifndef LACKS_STDLIB_H
1476#include <stdlib.h> /* for abort() */
1477#endif /* LACKS_STDLIB_H */
1478#ifndef LACKS_STRING_H
1479#include <string.h> /* for memset etc */
1480#endif /* LACKS_STRING_H */
1481#if USE_BUILTIN_FFS0
1482#ifndef LACKS_STRINGS_H
1483#include <strings.h> /* for ffs */
1484#endif /* LACKS_STRINGS_H */
1485#endif /* USE_BUILTIN_FFS */
1486#if HAVE_MMAP1
1487#ifndef LACKS_SYS_MMAN_H1
1488/* On some versions of linux, mremap decl in mman.h needs __USE_GNU set */
1489#if (defined(linux1) && !defined(__USE_GNU1))
1490#define __USE_GNU1 1
1491#include <sys/mman.h> /* for mmap */
1492#undef __USE_GNU1
1493#else
1494#include <sys/mman.h> /* for mmap */
1495#endif /* linux */
1496#endif /* LACKS_SYS_MMAN_H */
1497#ifndef LACKS_FCNTL_H
1498#include <fcntl.h>
1499#endif /* LACKS_FCNTL_H */
1500#endif /* HAVE_MMAP */
1501#ifndef LACKS_UNISTD_H
1502#include <unistd.h> /* for sbrk, sysconf */
1503#else /* LACKS_UNISTD_H */
1504#if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__NetBSD__)
1505extern void* sbrk(ptrdiff_t);
1506#endif /* FreeBSD etc */
1507#endif /* LACKS_UNISTD_H */
1508
1509/* Declarations for locking */
1510#if USE_LOCKS1
1511#ifndef WIN32
1512#if defined (__SVR4) && defined (__sun) /* solaris */
1513#include <thread.h>
1514#elif !defined(LACKS_SCHED_H)
1515#include <sched.h>
1516#endif /* solaris or LACKS_SCHED_H */
1517#if (defined(USE_RECURSIVE_LOCKS) && USE_RECURSIVE_LOCKS != 0) || !USE_SPIN_LOCKS1
1518#include <pthread.h>
1519#endif /* USE_RECURSIVE_LOCKS ... */
1520#elif defined(_MSC_VER)
1521#ifndef _M_AMD64
1522/* These are already defined on AMD64 builds */
1523#ifdef __cplusplus
1524extern "C" {
1525#endif /* __cplusplus */
1526LONG __cdecl _InterlockedCompareExchange(LONG volatile *Dest, LONG Exchange, LONG Comp);
1527LONG __cdecl _InterlockedExchange(LONG volatile *Target, LONG Value);
1528#ifdef __cplusplus
1529}
1530#endif /* __cplusplus */
1531#endif /* _M_AMD64 */
1532#pragma intrinsic (_InterlockedCompareExchange)
1533#pragma intrinsic (_InterlockedExchange)
1534#define interlockedcompareexchange _InterlockedCompareExchange
1535#define interlockedexchange _InterlockedExchange
1536#elif defined(WIN32) && defined(__GNUC__4)
1537#define interlockedcompareexchange(a, b, c) __sync_val_compare_and_swap(a, c, b)
1538#define interlockedexchange __sync_lock_test_and_set
1539#endif /* Win32 */
1540#else /* USE_LOCKS */
1541#endif /* USE_LOCKS */
1542
1543#ifndef LOCK_AT_FORK0
1544#define LOCK_AT_FORK0 0
1545#endif
1546
1547/* Declarations for bit scanning on win32 */
1548#if defined(_MSC_VER) && _MSC_VER>=1300
1549#ifndef BitScanForward /* Try to avoid pulling in WinNT.h */
1550#ifdef __cplusplus
1551extern "C" {
1552#endif /* __cplusplus */
1553unsigned char _BitScanForward(unsigned long *index, unsigned long mask);
1554unsigned char _BitScanReverse(unsigned long *index, unsigned long mask);
1555#ifdef __cplusplus
1556}
1557#endif /* __cplusplus */
1558
1559#define BitScanForward _BitScanForward
1560#define BitScanReverse _BitScanReverse
1561#pragma intrinsic(_BitScanForward)
1562#pragma intrinsic(_BitScanReverse)
1563#endif /* BitScanForward */
1564#endif /* defined(_MSC_VER) && _MSC_VER>=1300 */
1565
1566#ifndef WIN32
1567#ifndef malloc_getpagesizesysconf(_SC_PAGESIZE)
1568# ifdef _SC_PAGESIZE_SC_PAGESIZE /* some SVR4 systems omit an underscore */
1569# ifndef _SC_PAGE_SIZE_SC_PAGESIZE
1570# define _SC_PAGE_SIZE_SC_PAGESIZE _SC_PAGESIZE_SC_PAGESIZE
1571# endif
1572# endif
1573# ifdef _SC_PAGE_SIZE_SC_PAGESIZE
1574# define malloc_getpagesizesysconf(_SC_PAGESIZE) sysconf(_SC_PAGE_SIZE_SC_PAGESIZE)
1575# else
1576# if defined(BSD) || defined(DGUX) || defined(HAVE_GETPAGESIZE1)
1577 extern size_t getpagesize();
1578# define malloc_getpagesizesysconf(_SC_PAGESIZE) getpagesize()
1579# else
1580# ifdef WIN32 /* use supplied emulation of getpagesize */
1581# define malloc_getpagesizesysconf(_SC_PAGESIZE) getpagesize()
1582# else
1583# ifndef LACKS_SYS_PARAM_H
1584# include <sys/param.h>
1585# endif
1586# ifdef EXEC_PAGESIZE4096
1587# define malloc_getpagesizesysconf(_SC_PAGESIZE) EXEC_PAGESIZE4096
1588# else
1589# ifdef NBPG
1590# ifndef CLSIZE
1591# define malloc_getpagesizesysconf(_SC_PAGESIZE) NBPG
1592# else
1593# define malloc_getpagesizesysconf(_SC_PAGESIZE) (NBPG * CLSIZE)
1594# endif
1595# else
1596# ifdef NBPC
1597# define malloc_getpagesizesysconf(_SC_PAGESIZE) NBPC
1598# else
1599# ifdef PAGESIZE
1600# define malloc_getpagesizesysconf(_SC_PAGESIZE) PAGESIZE
1601# else /* just guess */
1602# define malloc_getpagesizesysconf(_SC_PAGESIZE) ((size_t)4096U)
1603# endif
1604# endif
1605# endif
1606# endif
1607# endif
1608# endif
1609# endif
1610#endif
1611#endif
1612
1613/* libffi: the upstream malloc_getpagesize definition above is gated on
1614 !WIN32 (WIN32 builds use GetSystemInfo in init_mparams instead). Guarantee
1615 the symbol is always defined so the !WIN32 init_mparams branch still compiles
1616 on toolchains where it is not preprocessed out as expected (e.g. MSVC). */
1617#ifndef malloc_getpagesizesysconf(_SC_PAGESIZE)
1618#define malloc_getpagesizesysconf(_SC_PAGESIZE) ((size_t)4096U)
1619#endif
1620
1621/* ------------------- size_t and alignment properties -------------------- */
1622
1623/* The byte and bit size of a size_t */
1624#define SIZE_T_SIZE(sizeof(size_t)) (sizeof(size_t))
1625#define SIZE_T_BITSIZE(sizeof(size_t) << 3) (sizeof(size_t) << 3)
1626
1627/* Some constants coerced to size_t */
1628/* Annoying but necessary to avoid errors on some platforms */
1629#define SIZE_T_ZERO((size_t)0) ((size_t)0)
1630#define SIZE_T_ONE((size_t)1) ((size_t)1)
1631#define SIZE_T_TWO((size_t)2) ((size_t)2)
1632#define SIZE_T_FOUR((size_t)4) ((size_t)4)
1633#define TWO_SIZE_T_SIZES((sizeof(size_t))<<1) (SIZE_T_SIZE(sizeof(size_t))<<1)
1634#define FOUR_SIZE_T_SIZES((sizeof(size_t))<<2) (SIZE_T_SIZE(sizeof(size_t))<<2)
1635#define SIX_SIZE_T_SIZES(((sizeof(size_t))<<2)+((sizeof(size_t))<<1)) (FOUR_SIZE_T_SIZES((sizeof(size_t))<<2)+TWO_SIZE_T_SIZES((sizeof(size_t))<<1))
1636#define HALF_MAX_SIZE_T((~(size_t)0) / 2U) (MAX_SIZE_T(~(size_t)0) / 2U)
1637
1638/* The bit mask value corresponding to MALLOC_ALIGNMENT */
1639#define CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)) (MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) - SIZE_T_ONE((size_t)1))
1640
1641/* True if address a has acceptable alignment */
1642#define is_aligned(A)(((size_t)((A)) & ((((size_t)(2 * sizeof(void *))) - ((size_t
)1)))) == 0) (((size_t)((A)) & (CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) == 0)
1643
1644/* the number of bytes to offset an address to align it */
1645#define align_offset(A)((((size_t)(A) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)
(A) & (((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &
(((size_t)(2 * sizeof(void *))) - ((size_t)1))))\
1646 ((((size_t)(A) & CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1))) == 0)? 0 :\
1647 ((MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) - ((size_t)(A) & CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) & CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
1648
1649/* -------------------------- MMAP preliminaries ------------------------- */
1650
1651/*
1652 If HAVE_MORECORE or HAVE_MMAP are false, we just define calls and
1653 checks to fail so compiler optimizer can delete code rather than
1654 using so many "#if"s.
1655*/
1656
1657
1658/* MORECORE and MMAP must return MFAIL on failure */
1659#define MFAIL((void*)((~(size_t)0))) ((void*)(MAX_SIZE_T(~(size_t)0)))
1660#define CMFAIL((char*)(((void*)((~(size_t)0))))) ((char*)(MFAIL((void*)((~(size_t)0))))) /* defined for convenience */
1661
1662#if HAVE_MMAP1
1663
1664#if !defined(WIN32) && !defined (__OS2__)
1665#define MUNMAP_DEFAULT(a, s)munmap((a), (s)) munmap((a), (s))
1666#define MMAP_PROT(0x1|0x2) (PROT_READ0x1|PROT_WRITE0x2)
1667#if !defined(MAP_ANONYMOUS0x20) && defined(MAP_ANON0x20)
1668#define MAP_ANONYMOUS0x20 MAP_ANON0x20
1669#endif /* MAP_ANON */
1670#ifdef MAP_ANONYMOUS0x20
1671#define MMAP_FLAGS(0x02|0x20) (MAP_PRIVATE0x02|MAP_ANONYMOUS0x20)
1672#define MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) mmap(0, (s), MMAP_PROT(0x1|0x2), MMAP_FLAGS(0x02|0x20), -1, 0)
1673#else /* MAP_ANONYMOUS */
1674/*
1675 Nearly all versions of mmap support MAP_ANONYMOUS, so the following
1676 is unlikely to be needed, but is supplied just in case.
1677*/
1678#define MMAP_FLAGS(0x02|0x20) (MAP_PRIVATE0x02)
1679static int dev_zero_fd = -1; /* Cached file descriptor for /dev/zero. */
1680#define MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) ((dev_zero_fd < 0) ? \
1681 (dev_zero_fd = open("/dev/zero", O_RDWR02), \
1682 mmap(0, (s), MMAP_PROT(0x1|0x2), MMAP_FLAGS(0x02|0x20), dev_zero_fd, 0)) : \
1683 mmap(0, (s), MMAP_PROT(0x1|0x2), MMAP_FLAGS(0x02|0x20), dev_zero_fd, 0))
1684#endif /* MAP_ANONYMOUS */
1685
1686#define DIRECT_MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0)
1687
1688#elif defined(__OS2__)
1689
1690/* OS/2 MMAP via DosAllocMem */
1691static void* os2mmap(size_t size) {
1692 void* ptr;
1693 if (DosAllocMem(&ptr, size, OBJ_ANY|PAG_COMMIT|PAG_READ|PAG_WRITE) &&
1694 DosAllocMem(&ptr, size, PAG_COMMIT|PAG_READ|PAG_WRITE))
1695 return MFAIL((void*)((~(size_t)0)));
1696 return ptr;
1697}
1698
1699#define os2direct_mmap(n) os2mmap(n)
1700
1701/* This function supports releasing coalesed segments */
1702static int os2munmap(void* ptr, size_t size) {
1703 while (size) {
1704 ULONG ulSize = size;
1705 ULONG ulFlags = 0;
1706 if (DosQueryMem(ptr, &ulSize, &ulFlags) != 0)
1707 return -1;
1708 if ((ulFlags & PAG_BASE) == 0 ||(ulFlags & PAG_COMMIT) == 0 ||
1709 ulSize > size)
1710 return -1;
1711 if (DosFreeMem(ptr) != 0)
1712 return -1;
1713 ptr = ( void * ) ( ( char * ) ptr + ulSize );
1714 size -= ulSize;
1715 }
1716 return 0;
1717}
1718
1719#define MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) os2mmap(s)
1720#define MUNMAP_DEFAULT(a, s)munmap((a), (s)) os2munmap((a), (s))
1721#define DIRECT_MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) os2direct_mmap(s)
1722
1723#else /* WIN32 */
1724
1725/* Win32 MMAP via VirtualAlloc */
1726/* libffi: plain static (not FORCEINLINE) -- mingw's <windows.h> defines
1727 FORCEINLINE with an 'extern' storage class, which clashes with 'static'. */
1728static void* win32mmap(size_t size) {
1729 void* ptr = VirtualAlloc(0, size, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
1730 return (ptr != 0)? ptr: MFAIL((void*)((~(size_t)0)));
1731}
1732
1733/* For direct MMAP, use MEM_TOP_DOWN to minimize interference */
1734static void* win32direct_mmap(size_t size) {
1735 void* ptr = VirtualAlloc(0, size, MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN,
1736 PAGE_EXECUTE_READWRITE);
1737 return (ptr != 0)? ptr: MFAIL((void*)((~(size_t)0)));
1738}
1739
1740/* This function supports releasing coalesed segments */
1741static int win32munmap(void* ptr, size_t size) {
1742 MEMORY_BASIC_INFORMATION minfo;
1743 char* cptr = (char*)ptr;
1744 while (size) {
1745 if (VirtualQuery(cptr, &minfo, sizeof(minfo)) == 0)
1746 return -1;
1747 if (minfo.BaseAddress != cptr || minfo.AllocationBase != cptr ||
1748 minfo.State != MEM_COMMIT || minfo.RegionSize > size)
1749 return -1;
1750 if (VirtualFree(cptr, 0, MEM_RELEASE) == 0)
1751 return -1;
1752 cptr += minfo.RegionSize;
1753 size -= minfo.RegionSize;
1754 }
1755 return 0;
1756}
1757
1758#define MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) win32mmap(s)
1759#define MUNMAP_DEFAULT(a, s)munmap((a), (s)) win32munmap((a), (s))
1760#define DIRECT_MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) win32direct_mmap(s)
1761#endif /* WIN32 */
1762#endif /* HAVE_MMAP */
1763
1764#if HAVE_MREMAP0
1765#ifndef WIN32
1766#define MREMAP_DEFAULT(addr, osz, nsz, mv) mremap((addr), (osz), (nsz), (mv))
1767#endif /* WIN32 */
1768#endif /* HAVE_MREMAP */
1769
1770/**
1771 * Define CALL_MORECORE
1772 */
1773#if HAVE_MORECORE0
1774 #ifdef MORECORE
1775 #define CALL_MORECORE(S)((void*)((~(size_t)0))) MORECORE(S)
1776 #else /* MORECORE */
1777 #define CALL_MORECORE(S)((void*)((~(size_t)0))) MORECORE_DEFAULT(S)
1778 #endif /* MORECORE */
1779#else /* HAVE_MORECORE */
1780 #define CALL_MORECORE(S)((void*)((~(size_t)0))) MFAIL((void*)((~(size_t)0)))
1781#endif /* HAVE_MORECORE */
1782
1783/**
1784 * Define CALL_MMAP/CALL_MUNMAP/CALL_DIRECT_MMAP
1785 */
1786#if HAVE_MMAP1
1787 #define USE_MMAP_BIT(((size_t)1)) (SIZE_T_ONE((size_t)1))
1788
1789 #ifdef MMAP
1790 #define CALL_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) MMAP(s)
1791 #else /* MMAP */
1792 #define CALL_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0)
1793 #endif /* MMAP */
1794 #ifdef MUNMAP
1795 #define CALL_MUNMAP(a, s)munmap(((a)), ((s))) MUNMAP((a), (s))
1796 #else /* MUNMAP */
1797 #define CALL_MUNMAP(a, s)munmap(((a)), ((s))) MUNMAP_DEFAULT((a), (s))munmap(((a)), ((s)))
1798 #endif /* MUNMAP */
1799 #ifdef DIRECT_MMAP
1800 #define CALL_DIRECT_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) DIRECT_MMAP(s)
1801 #else /* DIRECT_MMAP */
1802 #define CALL_DIRECT_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) DIRECT_MMAP_DEFAULT(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0)
1803 #endif /* DIRECT_MMAP */
1804#else /* HAVE_MMAP */
1805 #define USE_MMAP_BIT(((size_t)1)) (SIZE_T_ZERO((size_t)0))
1806
1807 #define MMAP(s) MFAIL((void*)((~(size_t)0)))
1808 #define MUNMAP(a, s) (-1)
1809 #define DIRECT_MMAP(s) MFAIL((void*)((~(size_t)0)))
1810 #define CALL_DIRECT_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) DIRECT_MMAP(s)
1811 #define CALL_MMAP(s)mmap(0, (s), (0x1|0x2), (0x02|0x20), -1, 0) MMAP(s)
1812 #define CALL_MUNMAP(a, s)munmap(((a)), ((s))) MUNMAP((a), (s))
1813#endif /* HAVE_MMAP */
1814
1815/**
1816 * Define CALL_MREMAP
1817 */
1818#if HAVE_MMAP1 && HAVE_MREMAP0
1819 #ifdef MREMAP
1820 #define CALL_MREMAP(addr, osz, nsz, mv)((void*)((~(size_t)0))) MREMAP((addr), (osz), (nsz), (mv))
1821 #else /* MREMAP */
1822 #define CALL_MREMAP(addr, osz, nsz, mv)((void*)((~(size_t)0))) MREMAP_DEFAULT((addr), (osz), (nsz), (mv))
1823 #endif /* MREMAP */
1824#else /* HAVE_MMAP && HAVE_MREMAP */
1825 #define CALL_MREMAP(addr, osz, nsz, mv)((void*)((~(size_t)0))) MFAIL((void*)((~(size_t)0)))
1826#endif /* HAVE_MMAP && HAVE_MREMAP */
1827
1828/* mstate bit set if contiguous morecore disabled or failed */
1829#define USE_NONCONTIGUOUS_BIT(4U) (4U)
1830
1831/* segment bit set in create_mspace_with_base */
1832#define EXTERN_BIT(8U) (8U)
1833
1834
1835/* --------------------------- Lock preliminaries ------------------------ */
1836
1837/*
1838 When locks are defined, there is one global lock, plus
1839 one per-mspace lock.
1840
1841 The global lock_ensures that mparams.magic and other unique
1842 mparams values are initialized only once. It also protects
1843 sequences of calls to MORECORE. In many cases sys_alloc requires
1844 two calls, that should not be interleaved with calls by other
1845 threads. This does not protect against direct calls to MORECORE
1846 by other threads not using this lock, so there is still code to
1847 cope the best we can on interference.
1848
1849 Per-mspace locks surround calls to malloc, free, etc.
1850 By default, locks are simple non-reentrant mutexes.
1851
1852 Because lock-protected regions generally have bounded times, it is
1853 OK to use the supplied simple spinlocks. Spinlocks are likely to
1854 improve performance for lightly contended applications, but worsen
1855 performance under heavy contention.
1856
1857 If USE_LOCKS is > 1, the definitions of lock routines here are
1858 bypassed, in which case you will need to define the type MLOCK_T,
1859 and at least INITIAL_LOCK, DESTROY_LOCK, ACQUIRE_LOCK, RELEASE_LOCK
1860 and TRY_LOCK. You must also declare a
1861 static MLOCK_T malloc_global_mutex = { initialization values };.
1862
1863*/
1864
1865#if !USE_LOCKS1
1866#define USE_LOCK_BIT(2U) (0U)
1867#define INITIAL_LOCK(l)(*l = 0) (0)
1868#define DESTROY_LOCK(l)(0) (0)
1869#define ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);
1870#define RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex);
1871
1872#else
1873#if USE_LOCKS1 > 1
1874/* ----------------------- User-defined locks ------------------------ */
1875/* Define your own lock implementation here */
1876/* #define INITIAL_LOCK(lk) ... */
1877/* #define DESTROY_LOCK(lk) ... */
1878/* #define ACQUIRE_LOCK(lk) ... */
1879/* #define RELEASE_LOCK(lk) ... */
1880/* #define TRY_LOCK(lk) ... */
1881/* static MLOCK_T malloc_global_mutex = ... */
1882
1883#elif USE_SPIN_LOCKS1
1884
1885/* First, define CAS_LOCK and CLEAR_LOCK on ints */
1886/* Note CAS_LOCK defined to return 0 on success */
1887
1888#if defined(__GNUC__4)&& (__GNUC__4 > 4 || (__GNUC__4 == 4 && __GNUC_MINOR__2 >= 1))
1889#define CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1) __sync_lock_test_and_set(sl, 1)
1890#define CLEAR_LOCK(sl)__sync_lock_release(sl) __sync_lock_release(sl)
1891
1892#elif (defined(__GNUC__4) && (defined(__i386__) || defined(__x86_64__1)))
1893/* Custom spin locks for older gcc on x86 */
1894static FORCEINLINE__inline __attribute__ ((always_inline)) int x86_cas_lock(int *sl) {
1895 int ret;
1896 int val = 1;
1897 int cmp = 0;
1898 __asm__ __volatile__ ("lock; cmpxchgl %1, %2"
1899 : "=a" (ret)
1900 : "r" (val), "m" (*(sl)), "0"(cmp)
1901 : "memory", "cc");
1902 return ret;
1903}
1904
1905static FORCEINLINE__inline __attribute__ ((always_inline)) void x86_clear_lock(int* sl) {
1906 assert(*sl != 0)if(!(*sl != 0)) abort();
1907 int prev = 0;
1908 int ret;
1909 __asm__ __volatile__ ("lock; xchgl %0, %1"
1910 : "=r" (ret)
1911 : "m" (*(sl)), "0"(prev)
1912 : "memory");
1913}
1914
1915#define CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1) x86_cas_lock(sl)
1916#define CLEAR_LOCK(sl)__sync_lock_release(sl) x86_clear_lock(sl)
1917
1918#else /* Win32 MSC */
1919#define CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1) interlockedexchange((LONG volatile *)(sl), (LONG)1)
1920#define CLEAR_LOCK(sl)__sync_lock_release(sl) interlockedexchange ((LONG volatile *)(sl), (LONG)0)
1921
1922#endif /* ... gcc spins locks ... */
1923
1924/* How to yield for a spin lock */
1925#define SPINS_PER_YIELD63 63
1926#if defined(_MSC_VER)
1927#define SLEEP_EX_DURATION 50 /* delay for yield/sleep */
1928#define SPIN_LOCK_YIELDsched_yield(); SleepEx(SLEEP_EX_DURATION, FALSE)
1929#elif defined (__SVR4) && defined (__sun) /* solaris */
1930#define SPIN_LOCK_YIELDsched_yield(); thr_yield();
1931#elif !defined(LACKS_SCHED_H)
1932#define SPIN_LOCK_YIELDsched_yield(); sched_yield();
1933#else
1934#define SPIN_LOCK_YIELDsched_yield();
1935#endif /* ... yield ... */
1936
1937/* libffi: read the spin-lock word with a relaxed atomic load for the lock-free
1938 "is it held?" peek, so ThreadSanitizer does not flag it as racing with the
1939 atomic CLEAR_LOCK release on unlock. Relaxed ordering is sufficient: the
1940 peek is only a hint to avoid a costly CAS, and CAS_LOCK still provides the
1941 acquire ordering on success. Falls back to the original volatile read when
1942 atomic builtins are unavailable. */
1943#if defined(__ATOMIC_RELAXED0)
1944# define ffi_spin_peek(sl)__atomic_load_n((sl), 0) __atomic_load_n((sl), __ATOMIC_RELAXED0)
1945#elif defined(_MSC_VER)
1946# define ffi_spin_peek(sl)__atomic_load_n((sl), 0) \
1947 ((int)_InterlockedCompareExchange((LONG volatile *)(sl), (LONG)0, (LONG)0))
1948#else
1949# define ffi_spin_peek(sl)__atomic_load_n((sl), 0) (*(volatile int *)(sl))
1950#endif
1951
1952#if !defined(USE_RECURSIVE_LOCKS) || USE_RECURSIVE_LOCKS == 0
1953/* Plain spin locks use single word (embedded in malloc_states) */
1954static int spin_acquire_lock(int *sl) {
1955 int spins = 0;
1956 while (ffi_spin_peek(sl)__atomic_load_n((sl), 0) != 0 || CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1)) {
1957 if ((++spins & SPINS_PER_YIELD63) == 0) {
1958 SPIN_LOCK_YIELDsched_yield();;
1959 }
1960 }
1961 return 0;
1962}
1963
1964#define MLOCK_Tint int
1965#define TRY_LOCK(sl)!__sync_lock_test_and_set(sl, 1) !CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1)
1966#define RELEASE_LOCK(sl)__sync_lock_release(sl) CLEAR_LOCK(sl)__sync_lock_release(sl)
1967#define ACQUIRE_LOCK(sl)(__sync_lock_test_and_set(sl, 1)? spin_acquire_lock(sl) : 0) (CAS_LOCK(sl)__sync_lock_test_and_set(sl, 1)? spin_acquire_lock(sl) : 0)
1968#define INITIAL_LOCK(sl)(*sl = 0) (*sl = 0)
1969#define DESTROY_LOCK(sl)(0) (0)
1970static MLOCK_Tint malloc_global_mutex = 0;
1971
1972#else /* USE_RECURSIVE_LOCKS */
1973/* types for lock owners */
1974#ifdef WIN32
1975#define THREAD_ID_T DWORD
1976#define CURRENT_THREAD GetCurrentThreadId()
1977#define EQ_OWNER(X,Y) ((X) == (Y))
1978#else
1979/*
1980 Note: the following assume that pthread_t is a type that can be
1981 initialized to (casted) zero. If this is not the case, you will need to
1982 somehow redefine these or not use spin locks.
1983*/
1984#define THREAD_ID_T pthread_t
1985#define CURRENT_THREAD pthread_self()
1986#define EQ_OWNER(X,Y) pthread_equal(X, Y)
1987#endif
1988
1989struct malloc_recursive_lock {
1990 int sl;
1991 unsigned int c;
1992 THREAD_ID_T threadid;
1993};
1994
1995#define MLOCK_Tint struct malloc_recursive_lock
1996static MLOCK_Tint malloc_global_mutex = { 0, 0, (THREAD_ID_T)0};
1997
1998static FORCEINLINE__inline __attribute__ ((always_inline)) void recursive_release_lock(MLOCK_Tint *lk) {
1999 assert(lk->sl != 0)if(!(lk->sl != 0)) abort();
2000 if (--lk->c == 0) {
2001 CLEAR_LOCK(&lk->sl)__sync_lock_release(&lk->sl);
2002 }
2003}
2004
2005static FORCEINLINE__inline __attribute__ ((always_inline)) int recursive_acquire_lock(MLOCK_Tint *lk) {
2006 THREAD_ID_T mythreadid = CURRENT_THREAD;
2007 int spins = 0;
2008 for (;;) {
2009 if (ffi_spin_peek(&lk->sl)__atomic_load_n((&lk->sl), 0) == 0) {
2010 if (!CAS_LOCK(&lk->sl)__sync_lock_test_and_set(&lk->sl, 1)) {
2011 lk->threadid = mythreadid;
2012 lk->c = 1;
2013 return 0;
2014 }
2015 }
2016 else if (EQ_OWNER(lk->threadid, mythreadid)) {
2017 ++lk->c;
2018 return 0;
2019 }
2020 if ((++spins & SPINS_PER_YIELD63) == 0) {
2021 SPIN_LOCK_YIELDsched_yield();;
2022 }
2023 }
2024}
2025
2026static FORCEINLINE__inline __attribute__ ((always_inline)) int recursive_try_lock(MLOCK_Tint *lk) {
2027 THREAD_ID_T mythreadid = CURRENT_THREAD;
2028 if (ffi_spin_peek(&lk->sl)__atomic_load_n((&lk->sl), 0) == 0) {
2029 if (!CAS_LOCK(&lk->sl)__sync_lock_test_and_set(&lk->sl, 1)) {
2030 lk->threadid = mythreadid;
2031 lk->c = 1;
2032 return 1;
2033 }
2034 }
2035 else if (EQ_OWNER(lk->threadid, mythreadid)) {
2036 ++lk->c;
2037 return 1;
2038 }
2039 return 0;
2040}
2041
2042#define RELEASE_LOCK(lk)__sync_lock_release(lk) recursive_release_lock(lk)
2043#define TRY_LOCK(lk)!__sync_lock_test_and_set(lk, 1) recursive_try_lock(lk)
2044#define ACQUIRE_LOCK(lk)(__sync_lock_test_and_set(lk, 1)? spin_acquire_lock(lk) : 0) recursive_acquire_lock(lk)
2045#define INITIAL_LOCK(lk)(*lk = 0) ((lk)->threadid = (THREAD_ID_T)0, (lk)->sl = 0, (lk)->c = 0)
2046#define DESTROY_LOCK(lk)(0) (0)
2047#endif /* USE_RECURSIVE_LOCKS */
2048
2049#elif defined(WIN32) /* Win32 critical sections */
2050#define MLOCK_Tint CRITICAL_SECTION
2051#define ACQUIRE_LOCK(lk)(__sync_lock_test_and_set(lk, 1)? spin_acquire_lock(lk) : 0) (EnterCriticalSection(lk), 0)
2052#define RELEASE_LOCK(lk)__sync_lock_release(lk) LeaveCriticalSection(lk)
2053#define TRY_LOCK(lk)!__sync_lock_test_and_set(lk, 1) TryEnterCriticalSection(lk)
2054#define INITIAL_LOCK(lk)(*lk = 0) (!InitializeCriticalSectionAndSpinCount((lk), 0x80000000|4000))
2055#define DESTROY_LOCK(lk)(0) (DeleteCriticalSection(lk), 0)
2056#define NEED_GLOBAL_LOCK_INIT
2057
2058static MLOCK_Tint malloc_global_mutex;
2059static volatile LONG malloc_global_mutex_status;
2060
2061/* Use spin loop to initialize global lock */
2062static void init_malloc_global_mutex() {
2063 for (;;) {
2064 long stat = malloc_global_mutex_status;
2065 if (stat > 0)
2066 return;
2067 /* transition to < 0 while initializing, then to > 0) */
2068 if (stat == 0 &&
2069 interlockedcompareexchange(&malloc_global_mutex_status, (LONG)-1, (LONG)0) == 0) {
2070 InitializeCriticalSection(&malloc_global_mutex);
2071 interlockedexchange(&malloc_global_mutex_status, (LONG)1);
2072 return;
2073 }
2074 SleepEx(0, FALSE);
2075 }
2076}
2077
2078#else /* pthreads-based locks */
2079#define MLOCK_Tint pthread_mutex_t
2080#define ACQUIRE_LOCK(lk)(__sync_lock_test_and_set(lk, 1)? spin_acquire_lock(lk) : 0) pthread_mutex_lock(lk)
2081#define RELEASE_LOCK(lk)__sync_lock_release(lk) pthread_mutex_unlock(lk)
2082#define TRY_LOCK(lk)!__sync_lock_test_and_set(lk, 1) (!pthread_mutex_trylock(lk))
2083#define INITIAL_LOCK(lk)(*lk = 0) pthread_init_lock(lk)
2084#define DESTROY_LOCK(lk)(0) pthread_mutex_destroy(lk)
2085
2086#if defined(USE_RECURSIVE_LOCKS) && USE_RECURSIVE_LOCKS != 0 && defined(linux1) && !defined(PTHREAD_MUTEX_RECURSIVE)
2087/* Cope with old-style linux recursive lock initialization by adding */
2088/* skipped internal declaration from pthread.h */
2089extern int pthread_mutexattr_setkind_np __P ((pthread_mutexattr_t *__attr,(pthread_mutexattr_t *__attr, int __kind)
2090 int __kind))(pthread_mutexattr_t *__attr, int __kind);
2091#define PTHREAD_MUTEX_RECURSIVE PTHREAD_MUTEX_RECURSIVE_NP
2092#define pthread_mutexattr_settype(x,y) pthread_mutexattr_setkind_np(x,y)
2093#endif /* USE_RECURSIVE_LOCKS ... */
2094
2095static MLOCK_Tint malloc_global_mutex = PTHREAD_MUTEX_INITIALIZER{ { 0, 0, 0, 0, PTHREAD_MUTEX_TIMED_NP, 0, 0, { ((void*)0), (
(void*)0) } } };
2096
2097static int pthread_init_lock (MLOCK_Tint *lk) {
2098 pthread_mutexattr_t attr;
2099 if (pthread_mutexattr_init(&attr)) return 1;
2100#if defined(USE_RECURSIVE_LOCKS) && USE_RECURSIVE_LOCKS != 0
2101 if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE)) return 1;
2102#endif
2103 if (pthread_mutex_init(lk, &attr)) return 1;
2104 if (pthread_mutexattr_destroy(&attr)) return 1;
2105 return 0;
2106}
2107
2108#endif /* ... lock types ... */
2109
2110/* Common code for all lock types */
2111#define USE_LOCK_BIT(2U) (2U)
2112
2113#ifndef ACQUIRE_MALLOC_GLOBAL_LOCK
2114#define ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0); ACQUIRE_LOCK(&malloc_global_mutex)(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);
2115#endif
2116
2117#ifndef RELEASE_MALLOC_GLOBAL_LOCK
2118#define RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex); RELEASE_LOCK(&malloc_global_mutex)__sync_lock_release(&malloc_global_mutex);
2119#endif
2120
2121#endif /* USE_LOCKS */
2122
2123/* ----------------------- Chunk representations ------------------------ */
2124
2125/*
2126 (The following includes lightly edited explanations by Colin Plumb.)
2127
2128 The malloc_chunk declaration below is misleading (but accurate and
2129 necessary). It declares a "view" into memory allowing access to
2130 necessary fields at known offsets from a given base.
2131
2132 Chunks of memory are maintained using a `boundary tag' method as
2133 originally described by Knuth. (See the paper by Paul Wilson
2134 ftp://ftp.cs.utexas.edu/pub/garbage/allocsrv.ps for a survey of such
2135 techniques.) Sizes of free chunks are stored both in the front of
2136 each chunk and at the end. This makes consolidating fragmented
2137 chunks into bigger chunks fast. The head fields also hold bits
2138 representing whether chunks are free or in use.
2139
2140 Here are some pictures to make it clearer. They are "exploded" to
2141 show that the state of a chunk can be thought of as extending from
2142 the high 31 bits of the head field of its header through the
2143 prev_foot and PINUSE_BIT bit of the following chunk header.
2144
2145 A chunk that's in use looks like:
2146
2147 chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2148 | Size of previous chunk (if P = 0) |
2149 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2150 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |P|
2151 | Size of this chunk 1| +-+
2152 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2153 | |
2154 +- -+
2155 | |
2156 +- -+
2157 | :
2158 +- size - sizeof(size_t) available payload bytes -+
2159 : |
2160 chunk-> +- -+
2161 | |
2162 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2163 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |1|
2164 | Size of next chunk (may or may not be in use) | +-+
2165 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2166
2167 And if it's free, it looks like this:
2168
2169 chunk-> +- -+
2170 | User payload (must be in use, or we would have merged!) |
2171 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2172 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |P|
2173 | Size of this chunk 0| +-+
2174 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2175 | Next pointer |
2176 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2177 | Prev pointer |
2178 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2179 | :
2180 +- size - sizeof(struct chunk) unused bytes -+
2181 : |
2182 chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2183 | Size of this chunk |
2184 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2185 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0|
2186 | Size of next chunk (must be in use, or we would have merged)| +-+
2187 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2188 | :
2189 +- User payload -+
2190 : |
2191 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2192 |0|
2193 +-+
2194 Note that since we always merge adjacent free chunks, the chunks
2195 adjacent to a free chunk must be in use.
2196
2197 Given a pointer to a chunk (which can be derived trivially from the
2198 payload pointer) we can, in O(1) time, find out whether the adjacent
2199 chunks are free, and if so, unlink them from the lists that they
2200 are on and merge them with the current chunk.
2201
2202 Chunks always begin on even word boundaries, so the mem portion
2203 (which is returned to the user) is also on an even word boundary, and
2204 thus at least double-word aligned.
2205
2206 The P (PINUSE_BIT) bit, stored in the unused low-order bit of the
2207 chunk size (which is always a multiple of two words), is an in-use
2208 bit for the *previous* chunk. If that bit is *clear*, then the
2209 word before the current chunk size contains the previous chunk
2210 size, and can be used to find the front of the previous chunk.
2211 The very first chunk allocated always has this bit set, preventing
2212 access to non-existent (or non-owned) memory. If pinuse is set for
2213 any given chunk, then you CANNOT determine the size of the
2214 previous chunk, and might even get a memory addressing fault when
2215 trying to do so.
2216
2217 The C (CINUSE_BIT) bit, stored in the unused second-lowest bit of
2218 the chunk size redundantly records whether the current chunk is
2219 inuse (unless the chunk is mmapped). This redundancy enables usage
2220 checks within free and realloc, and reduces indirection when freeing
2221 and consolidating chunks.
2222
2223 Each freshly allocated chunk must have both cinuse and pinuse set.
2224 That is, each allocated chunk borders either a previously allocated
2225 and still in-use chunk, or the base of its memory arena. This is
2226 ensured by making all allocations from the `lowest' part of any
2227 found chunk. Further, no free chunk physically borders another one,
2228 so each free chunk is known to be preceded and followed by either
2229 inuse chunks or the ends of memory.
2230
2231 Note that the `foot' of the current chunk is actually represented
2232 as the prev_foot of the NEXT chunk. This makes it easier to
2233 deal with alignments etc but can be very confusing when trying
2234 to extend or adapt this code.
2235
2236 The exceptions to all this are
2237
2238 1. The special chunk `top' is the top-most available chunk (i.e.,
2239 the one bordering the end of available memory). It is treated
2240 specially. Top is never included in any bin, is used only if
2241 no other chunk is available, and is released back to the
2242 system if it is very large (see M_TRIM_THRESHOLD). In effect,
2243 the top chunk is treated as larger (and thus less well
2244 fitting) than any other available chunk. The top chunk
2245 doesn't update its trailing size field since there is no next
2246 contiguous chunk that would have to index off it. However,
2247 space is still allocated for it (TOP_FOOT_SIZE) to enable
2248 separation or merging when space is extended.
2249
2250 3. Chunks allocated via mmap, have both cinuse and pinuse bits
2251 cleared in their head fields. Because they are allocated
2252 one-by-one, each must carry its own prev_foot field, which is
2253 also used to hold the offset this chunk has within its mmapped
2254 region, which is needed to preserve alignment. Each mmapped
2255 chunk is trailed by the first two fields of a fake next-chunk
2256 for sake of usage checks.
2257
2258*/
2259
2260struct malloc_chunk {
2261 size_t prev_foot; /* Size of previous chunk (if free). */
2262 size_t head; /* Size and inuse bits. */
2263 struct malloc_chunk* fd; /* double links -- used only if free. */
2264 struct malloc_chunk* bk;
2265};
2266
2267typedef struct malloc_chunk mchunk;
2268typedef struct malloc_chunk* mchunkptr;
2269typedef struct malloc_chunk* sbinptr; /* The type of bins of chunks */
2270typedef unsigned int bindex_t; /* Described below */
2271typedef unsigned int binmap_t; /* Described below */
2272typedef unsigned int flag_t; /* The type of various bit flag sets */
2273
2274/* ------------------- Chunks sizes and alignments ----------------------- */
2275
2276#define MCHUNK_SIZE(sizeof(mchunk)) (sizeof(mchunk))
2277
2278#if FOOTERS0
2279#define CHUNK_OVERHEAD((sizeof(size_t))) (TWO_SIZE_T_SIZES((sizeof(size_t))<<1))
2280#else /* FOOTERS */
2281#define CHUNK_OVERHEAD((sizeof(size_t))) (SIZE_T_SIZE(sizeof(size_t)))
2282#endif /* FOOTERS */
2283
2284/* MMapped chunks need a second word of overhead ... */
2285#define MMAP_CHUNK_OVERHEAD(((sizeof(size_t))<<1)) (TWO_SIZE_T_SIZES((sizeof(size_t))<<1))
2286/* ... and additional padding for fake next-chunk at foot */
2287#define MMAP_FOOT_PAD(((sizeof(size_t))<<2)) (FOUR_SIZE_T_SIZES((sizeof(size_t))<<2))
2288
2289/* The smallest size we can malloc is an aligned minimal chunk */
2290#define MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))\
2291 ((MCHUNK_SIZE(sizeof(mchunk)) + CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)))
2292
2293/* conversion from malloc headers to user pointers, and back */
2294#define chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1))) ((void*)((char*)(p) + TWO_SIZE_T_SIZES((sizeof(size_t))<<1)))
2295#define mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1))) ((mchunkptr)((char*)(mem) - TWO_SIZE_T_SIZES((sizeof(size_t))<<1)))
2296/* chunk associated with aligned address A */
2297#define align_as_chunk(A)(mchunkptr)((A) + ((((size_t)(((void*)((char*)(A) + ((sizeof(
size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *))) - (
(size_t)(((void*)((char*)(A) + ((sizeof(size_t))<<1))))
& (((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &
(((size_t)(2 * sizeof(void *))) - ((size_t)1))))) (mchunkptr)((A) + align_offset(chunk2mem(A))((((size_t)(((void*)((char*)(A) + ((sizeof(size_t))<<1)
))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) == 0
)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*)(
(char*)(A) + ((sizeof(size_t))<<1)))) & (((size_t)(
2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1)))))
2298
2299/* Bounds on request (not chunk) sizes. */
2300#define MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2) ((-MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) << 2)
2301#define MIN_REQUEST((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) -
((sizeof(size_t))) - ((size_t)1)) (MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) - CHUNK_OVERHEAD((sizeof(size_t))) - SIZE_T_ONE((size_t)1))
2302
2303/* pad request bytes into a usable size */
2304#define pad_request(req)(((req) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))
) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((
size_t)1))) \
2305 (((req) + CHUNK_OVERHEAD((sizeof(size_t))) + CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)))
2306
2307/* pad request, checking for minimum (but not maximum) */
2308#define request2size(req)(((req) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((req) +
((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) \
2309 (((req) < MIN_REQUEST((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) -
((sizeof(size_t))) - ((size_t)1)))? MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : pad_request(req)(((req) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))
) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((
size_t)1))))
2310
2311
2312/* ------------------ Operations on head and foot fields ----------------- */
2313
2314/*
2315 The head field of a chunk is or'ed with PINUSE_BIT when previous
2316 adjacent chunk in use, and or'ed with CINUSE_BIT if this chunk is in
2317 use, unless mmapped, in which case both bits are cleared.
2318
2319 FLAG4_BIT is not used by this malloc, but might be useful in extensions.
2320*/
2321
2322#define PINUSE_BIT(((size_t)1)) (SIZE_T_ONE((size_t)1))
2323#define CINUSE_BIT(((size_t)2)) (SIZE_T_TWO((size_t)2))
2324#define FLAG4_BIT(((size_t)4)) (SIZE_T_FOUR((size_t)4))
2325#define INUSE_BITS((((size_t)1))|(((size_t)2))) (PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2)))
2326#define FLAG_BITS((((size_t)1))|(((size_t)2))|(((size_t)4))) (PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2))|FLAG4_BIT(((size_t)4)))
2327
2328/* Head value for fenceposts */
2329#define FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t))) (INUSE_BITS((((size_t)1))|(((size_t)2)))|SIZE_T_SIZE(sizeof(size_t)))
2330
2331/* extraction of fields from head words */
2332#define cinuse(p)((p)->head & (((size_t)2))) ((p)->head & CINUSE_BIT(((size_t)2)))
2333#define pinuse(p)((p)->head & (((size_t)1))) ((p)->head & PINUSE_BIT(((size_t)1)))
2334#define flag4inuse(p)((p)->head & (((size_t)4))) ((p)->head & FLAG4_BIT(((size_t)4)))
2335#define is_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) (((p)->head & INUSE_BITS((((size_t)1))|(((size_t)2)))) != PINUSE_BIT(((size_t)1)))
2336#define is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0) (((p)->head & INUSE_BITS((((size_t)1))|(((size_t)2)))) == 0)
2337
2338#define chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) ((p)->head & ~(FLAG_BITS((((size_t)1))|(((size_t)2))|(((size_t)4)))))
2339
2340#define clear_pinuse(p)((p)->head &= ~(((size_t)1))) ((p)->head &= ~PINUSE_BIT(((size_t)1)))
2341#define set_flag4(p)((p)->head |= (((size_t)4))) ((p)->head |= FLAG4_BIT(((size_t)4)))
2342#define clear_flag4(p)((p)->head &= ~(((size_t)4))) ((p)->head &= ~FLAG4_BIT(((size_t)4)))
2343
2344/* Treat space at ptr +/- offset as a chunk */
2345#define chunk_plus_offset(p, s)((mchunkptr)(((char*)(p)) + (s))) ((mchunkptr)(((char*)(p)) + (s)))
2346#define chunk_minus_offset(p, s)((mchunkptr)(((char*)(p)) - (s))) ((mchunkptr)(((char*)(p)) - (s)))
2347
2348/* Ptr to next or previous physical malloc_chunk. */
2349#define next_chunk(p)((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4)))))) ((mchunkptr)( ((char*)(p)) + ((p)->head & ~FLAG_BITS((((size_t)1))|(((size_t)2))|(((size_t)4))))))
2350#define prev_chunk(p)((mchunkptr)( ((char*)(p)) - ((p)->prev_foot) )) ((mchunkptr)( ((char*)(p)) - ((p)->prev_foot) ))
2351
2352/* extract next chunk's pinuse bit */
2353#define next_pinuse(p)((((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((size_t
)1))|(((size_t)2))|(((size_t)4))))))->head) & (((size_t
)1))) ((next_chunk(p)((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))))->head) & PINUSE_BIT(((size_t)1)))
2354
2355/* Get/set size at footer */
2356#define get_foot(p, s)(((mchunkptr)((char*)(p) + (s)))->prev_foot) (((mchunkptr)((char*)(p) + (s)))->prev_foot)
2357#define set_foot(p, s)(((mchunkptr)((char*)(p) + (s)))->prev_foot = (s)) (((mchunkptr)((char*)(p) + (s)))->prev_foot = (s))
2358
2359/* Set size, pinuse bit, and foot */
2360#define set_size_and_pinuse_of_free_chunk(p, s)((p)->head = (s|(((size_t)1))), (((mchunkptr)((char*)(p) +
(s)))->prev_foot = (s)))\
2361 ((p)->head = (s|PINUSE_BIT(((size_t)1))), set_foot(p, s)(((mchunkptr)((char*)(p) + (s)))->prev_foot = (s)))
2362
2363/* Set size, pinuse bit, foot, and clear next pinuse */
2364#define set_free_with_pinuse(p, s, n)(((n)->head &= ~(((size_t)1))), ((p)->head = (s|(((
size_t)1))), (((mchunkptr)((char*)(p) + (s)))->prev_foot =
(s))))\
2365 (clear_pinuse(n)((n)->head &= ~(((size_t)1))), set_size_and_pinuse_of_free_chunk(p, s)((p)->head = (s|(((size_t)1))), (((mchunkptr)((char*)(p) +
(s)))->prev_foot = (s))))
2366
2367/* Get the internal overhead associated with chunk p */
2368#define overhead_for(p)((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)? (
((sizeof(size_t))<<1)) : ((sizeof(size_t))))\
2369 (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)? MMAP_CHUNK_OVERHEAD(((sizeof(size_t))<<1)) : CHUNK_OVERHEAD((sizeof(size_t))))
2370
2371/* Return true if malloced space is not necessarily cleared */
2372#if MMAP_CLEARS1
2373#define calloc_must_clear(p)(!(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) (!is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0))
2374#else /* MMAP_CLEARS */
2375#define calloc_must_clear(p)(!(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) (1)
2376#endif /* MMAP_CLEARS */
2377
2378/* ---------------------- Overlaid data structures ----------------------- */
2379
2380/*
2381 When chunks are not in use, they are treated as nodes of either
2382 lists or trees.
2383
2384 "Small" chunks are stored in circular doubly-linked lists, and look
2385 like this:
2386
2387 chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2388 | Size of previous chunk |
2389 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2390 `head:' | Size of chunk, in bytes |P|
2391 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2392 | Forward pointer to next chunk in list |
2393 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2394 | Back pointer to previous chunk in list |
2395 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2396 | Unused space (may be 0 bytes long) .
2397 . .
2398 . |
2399nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2400 `foot:' | Size of chunk, in bytes |
2401 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2402
2403 Larger chunks are kept in a form of bitwise digital trees (aka
2404 tries) keyed on chunksizes. Because malloc_tree_chunks are only for
2405 free chunks greater than 256 bytes, their size doesn't impose any
2406 constraints on user chunk sizes. Each node looks like:
2407
2408 chunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2409 | Size of previous chunk |
2410 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2411 `head:' | Size of chunk, in bytes |P|
2412 mem-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2413 | Forward pointer to next chunk of same size |
2414 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2415 | Back pointer to previous chunk of same size |
2416 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2417 | Pointer to left child (child[0]) |
2418 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2419 | Pointer to right child (child[1]) |
2420 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2421 | Pointer to parent |
2422 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2423 | bin index of this chunk |
2424 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2425 | Unused space .
2426 . |
2427nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2428 `foot:' | Size of chunk, in bytes |
2429 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2430
2431 Each tree holding treenodes is a tree of unique chunk sizes. Chunks
2432 of the same size are arranged in a circularly-linked list, with only
2433 the oldest chunk (the next to be used, in our FIFO ordering)
2434 actually in the tree. (Tree members are distinguished by a non-null
2435 parent pointer.) If a chunk with the same size an an existing node
2436 is inserted, it is linked off the existing node using pointers that
2437 work in the same way as fd/bk pointers of small chunks.
2438
2439 Each tree contains a power of 2 sized range of chunk sizes (the
2440 smallest is 0x100 <= x < 0x180), which is is divided in half at each
2441 tree level, with the chunks in the smaller half of the range (0x100
2442 <= x < 0x140 for the top nose) in the left subtree and the larger
2443 half (0x140 <= x < 0x180) in the right subtree. This is, of course,
2444 done by inspecting individual bits.
2445
2446 Using these rules, each node's left subtree contains all smaller
2447 sizes than its right subtree. However, the node at the root of each
2448 subtree has no particular ordering relationship to either. (The
2449 dividing line between the subtree sizes is based on trie relation.)
2450 If we remove the last chunk of a given size from the interior of the
2451 tree, we need to replace it with a leaf node. The tree ordering
2452 rules permit a node to be replaced by any leaf below it.
2453
2454 The smallest chunk in a tree (a common operation in a best-fit
2455 allocator) can be found by walking a path to the leftmost leaf in
2456 the tree. Unlike a usual binary tree, where we follow left child
2457 pointers until we reach a null, here we follow the right child
2458 pointer any time the left one is null, until we reach a leaf with
2459 both child pointers null. The smallest chunk in the tree will be
2460 somewhere along that path.
2461
2462 The worst case number of steps to add, find, or remove a node is
2463 bounded by the number of bits differentiating chunks within
2464 bins. Under current bin calculations, this ranges from 6 up to 21
2465 (for 32 bit sizes) or up to 53 (for 64 bit sizes). The typical case
2466 is of course much better.
2467*/
2468
2469struct malloc_tree_chunk {
2470 /* The first four fields must be compatible with malloc_chunk */
2471 size_t prev_foot;
2472 size_t head;
2473 struct malloc_tree_chunk* fd;
2474 struct malloc_tree_chunk* bk;
2475
2476 struct malloc_tree_chunk* child[2];
2477 struct malloc_tree_chunk* parent;
2478 bindex_t index;
2479};
2480
2481typedef struct malloc_tree_chunk tchunk;
2482typedef struct malloc_tree_chunk* tchunkptr;
2483typedef struct malloc_tree_chunk* tbinptr; /* The type of bins of trees */
2484
2485/* A little helper macro for trees */
2486#define leftmost_child(t)((t)->child[0] != 0? (t)->child[0] : (t)->child[1]) ((t)->child[0] != 0? (t)->child[0] : (t)->child[1])
2487
2488/* ----------------------------- Segments -------------------------------- */
2489
2490/*
2491 Each malloc space may include non-contiguous segments, held in a
2492 list headed by an embedded malloc_segment record representing the
2493 top-most space. Segments also include flags holding properties of
2494 the space. Large chunks that are directly allocated by mmap are not
2495 included in this list. They are instead independently created and
2496 destroyed without otherwise keeping track of them.
2497
2498 Segment management mainly comes into play for spaces allocated by
2499 MMAP. Any call to MMAP might or might not return memory that is
2500 adjacent to an existing segment. MORECORE normally contiguously
2501 extends the current space, so this space is almost always adjacent,
2502 which is simpler and faster to deal with. (This is why MORECORE is
2503 used preferentially to MMAP when both are available -- see
2504 sys_alloc.) When allocating using MMAP, we don't use any of the
2505 hinting mechanisms (inconsistently) supported in various
2506 implementations of unix mmap, or distinguish reserving from
2507 committing memory. Instead, we just ask for space, and exploit
2508 contiguity when we get it. It is probably possible to do
2509 better than this on some systems, but no general scheme seems
2510 to be significantly better.
2511
2512 Management entails a simpler variant of the consolidation scheme
2513 used for chunks to reduce fragmentation -- new adjacent memory is
2514 normally prepended or appended to an existing segment. However,
2515 there are limitations compared to chunk consolidation that mostly
2516 reflect the fact that segment processing is relatively infrequent
2517 (occurring only when getting memory from system) and that we
2518 don't expect to have huge numbers of segments:
2519
2520 * Segments are not indexed, so traversal requires linear scans. (It
2521 would be possible to index these, but is not worth the extra
2522 overhead and complexity for most programs on most platforms.)
2523 * New segments are only appended to old ones when holding top-most
2524 memory; if they cannot be prepended to others, they are held in
2525 different segments.
2526
2527 Except for the top-most segment of an mstate, each segment record
2528 is kept at the tail of its segment. Segments are added by pushing
2529 segment records onto the list headed by &mstate.seg for the
2530 containing mstate.
2531
2532 Segment flags control allocation/merge/deallocation policies:
2533 * If EXTERN_BIT set, then we did not allocate this segment,
2534 and so should not try to deallocate or merge with others.
2535 (This currently holds only for the initial segment passed
2536 into create_mspace_with_base.)
2537 * If USE_MMAP_BIT set, the segment may be merged with
2538 other surrounding mmapped segments and trimmed/de-allocated
2539 using munmap.
2540 * If neither bit is set, then the segment was obtained using
2541 MORECORE so can be merged with surrounding MORECORE'd segments
2542 and deallocated/trimmed using MORECORE with negative arguments.
2543*/
2544
2545struct malloc_segment {
2546 char* base; /* base address */
2547 size_t size; /* allocated size */
2548 struct malloc_segment* next; /* ptr to next segment */
2549#if FFI_MMAP_EXEC_WRIT1
2550 /* The mmap magic is supposed to store the address of the executable
2551 segment at the very end of the requested block. */
2552
2553# define mmap_exec_offset(b,s)(*(ptrdiff_t*)((b)+(s)-sizeof(ptrdiff_t))) (*(ptrdiff_t*)((b)+(s)-sizeof(ptrdiff_t)))
2554
2555 /* We can only merge segments if their corresponding executable
2556 segments are at identical offsets. */
2557# define check_segment_merge(S,b,s)((*(ptrdiff_t*)(((b))+((s))-sizeof(ptrdiff_t))) == (S)->exec_offset
) \
2558 (mmap_exec_offset((b),(s))(*(ptrdiff_t*)(((b))+((s))-sizeof(ptrdiff_t))) == (S)->exec_offset)
2559
2560# define add_segment_exec_offset(p,S)((char*)(p) + (S)->exec_offset) ((char*)(p) + (S)->exec_offset)
2561# define sub_segment_exec_offset(p,S)((char*)(p) - (S)->exec_offset) ((char*)(p) - (S)->exec_offset)
2562
2563 /* The removal of sflags only works with HAVE_MORECORE == 0. */
2564
2565# define get_segment_flags(S)((((size_t)1))) (USE_MMAP_BIT(((size_t)1)))
2566# define set_segment_flags(S,v)(((v) != (((size_t)1))) ? (abort(), (v)) : (((S)->exec_offset
= (*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof(ptrdiff_t
)))), ((*(ptrdiff_t*)(((S)->base + (S)->exec_offset)+((
S)->size)-sizeof(ptrdiff_t))) != (S)->exec_offset) ? (abort
(), (v)) : ((*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof
(ptrdiff_t))) = 0), (v))) \
2567 (((v) != USE_MMAP_BIT(((size_t)1))) ? (ABORTabort(), (v)) : \
2568 (((S)->exec_offset = \
2569 mmap_exec_offset((S)->base, (S)->size)(*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof(ptrdiff_t
)))), \
2570 (mmap_exec_offset((S)->base + (S)->exec_offset, (S)->size)(*(ptrdiff_t*)(((S)->base + (S)->exec_offset)+((S)->
size)-sizeof(ptrdiff_t))) != \
2571 (S)->exec_offset) ? (ABORTabort(), (v)) : \
2572 (mmap_exec_offset((S)->base, (S)->size)(*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof(ptrdiff_t
))) = 0), (v)))
2573
2574 /* We use an offset here, instead of a pointer, because then, when
2575 base changes, we don't have to modify this. On architectures
2576 with segmented addresses, this might not work. */
2577 ptrdiff_t exec_offset;
2578#else
2579
2580# define get_segment_flags(S)((((size_t)1))) ((S)->sflags)
2581# define set_segment_flags(S,v)(((v) != (((size_t)1))) ? (abort(), (v)) : (((S)->exec_offset
= (*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof(ptrdiff_t
)))), ((*(ptrdiff_t*)(((S)->base + (S)->exec_offset)+((
S)->size)-sizeof(ptrdiff_t))) != (S)->exec_offset) ? (abort
(), (v)) : ((*(ptrdiff_t*)(((S)->base)+((S)->size)-sizeof
(ptrdiff_t))) = 0), (v))) ((S)->sflags = (v))
2582# define check_segment_merge(S,b,s)((*(ptrdiff_t*)(((b))+((s))-sizeof(ptrdiff_t))) == (S)->exec_offset
) (1)
2583
2584 flag_t sflags; /* mmap and extern flag */
2585#endif
2586};
2587
2588#define is_mmapped_segment(S)(((((size_t)1))) & (((size_t)1))) (get_segment_flags(S)((((size_t)1))) & USE_MMAP_BIT(((size_t)1)))
2589#define is_extern_segment(S)(((((size_t)1))) & (8U)) (get_segment_flags(S)((((size_t)1))) & EXTERN_BIT(8U))
2590
2591typedef struct malloc_segment msegment;
2592typedef struct malloc_segment* msegmentptr;
2593
2594/* ---------------------------- malloc_state ----------------------------- */
2595
2596/*
2597 A malloc_state holds all of the bookkeeping for a space.
2598 The main fields are:
2599
2600 Top
2601 The topmost chunk of the currently active segment. Its size is
2602 cached in topsize. The actual size of topmost space is
2603 topsize+TOP_FOOT_SIZE, which includes space reserved for adding
2604 fenceposts and segment records if necessary when getting more
2605 space from the system. The size at which to autotrim top is
2606 cached from mparams in trim_check, except that it is disabled if
2607 an autotrim fails.
2608
2609 Designated victim (dv)
2610 This is the preferred chunk for servicing small requests that
2611 don't have exact fits. It is normally the chunk split off most
2612 recently to service another small request. Its size is cached in
2613 dvsize. The link fields of this chunk are not maintained since it
2614 is not kept in a bin.
2615
2616 SmallBins
2617 An array of bin headers for free chunks. These bins hold chunks
2618 with sizes less than MIN_LARGE_SIZE bytes. Each bin contains
2619 chunks of all the same size, spaced 8 bytes apart. To simplify
2620 use in double-linked lists, each bin header acts as a malloc_chunk
2621 pointing to the real first node, if it exists (else pointing to
2622 itself). This avoids special-casing for headers. But to avoid
2623 waste, we allocate only the fd/bk pointers of bins, and then use
2624 repositioning tricks to treat these as the fields of a chunk.
2625
2626 TreeBins
2627 Treebins are pointers to the roots of trees holding a range of
2628 sizes. There are 2 equally spaced treebins for each power of two
2629 from TREE_SHIFT to TREE_SHIFT+16. The last bin holds anything
2630 larger.
2631
2632 Bin maps
2633 There is one bit map for small bins ("smallmap") and one for
2634 treebins ("treemap). Each bin sets its bit when non-empty, and
2635 clears the bit when empty. Bit operations are then used to avoid
2636 bin-by-bin searching -- nearly all "search" is done without ever
2637 looking at bins that won't be selected. The bit maps
2638 conservatively use 32 bits per map word, even if on 64bit system.
2639 For a good description of some of the bit-based techniques used
2640 here, see Henry S. Warren Jr's book "Hacker's Delight" (and
2641 supplement at http://hackersdelight.org/). Many of these are
2642 intended to reduce the branchiness of paths through malloc etc, as
2643 well as to reduce the number of memory locations read or written.
2644
2645 Segments
2646 A list of segments headed by an embedded malloc_segment record
2647 representing the initial space.
2648
2649 Address check support
2650 The least_addr field is the least address ever obtained from
2651 MORECORE or MMAP. Attempted frees and reallocs of any address less
2652 than this are trapped (unless INSECURE is defined).
2653
2654 Magic tag
2655 A cross-check field that should always hold same value as mparams.magic.
2656
2657 Max allowed footprint
2658 The maximum allowed bytes to allocate from system (zero means no limit)
2659
2660 Flags
2661 Bits recording whether to use MMAP, locks, or contiguous MORECORE
2662
2663 Statistics
2664 Each space keeps track of current and maximum system memory
2665 obtained via MORECORE or MMAP.
2666
2667 Trim support
2668 Fields holding the amount of unused topmost memory that should trigger
2669 trimming, and a counter to force periodic scanning to release unused
2670 non-topmost segments.
2671
2672 Locking
2673 If USE_LOCKS is defined, the "mutex" lock is acquired and released
2674 around every public call using this mspace.
2675
2676 Extension support
2677 A void* pointer and a size_t field that can be used to help implement
2678 extensions to this malloc.
2679*/
2680
2681/* Bin types, widths and sizes */
2682#define NSMALLBINS(32U) (32U)
2683#define NTREEBINS(32U) (32U)
2684#define SMALLBIN_SHIFT(3U) (3U)
2685#define SMALLBIN_WIDTH(((size_t)1) << (3U)) (SIZE_T_ONE((size_t)1) << SMALLBIN_SHIFT(3U))
2686#define TREEBIN_SHIFT(8U) (8U)
2687#define MIN_LARGE_SIZE(((size_t)1) << (8U)) (SIZE_T_ONE((size_t)1) << TREEBIN_SHIFT(8U))
2688#define MAX_SMALL_SIZE((((size_t)1) << (8U)) - ((size_t)1)) (MIN_LARGE_SIZE(((size_t)1) << (8U)) - SIZE_T_ONE((size_t)1))
2689#define MAX_SMALL_REQUEST(((((size_t)1) << (8U)) - ((size_t)1)) - (((size_t)(2 *
sizeof(void *))) - ((size_t)1)) - ((sizeof(size_t)))) (MAX_SMALL_SIZE((((size_t)1) << (8U)) - ((size_t)1)) - CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)) - CHUNK_OVERHEAD((sizeof(size_t))))
2690
2691struct malloc_state {
2692 binmap_t smallmap;
2693 binmap_t treemap;
2694 size_t dvsize;
2695 size_t topsize;
2696 char* least_addr;
2697 mchunkptr dv;
2698 mchunkptr top;
2699 size_t trim_check;
2700 size_t release_checks;
2701 size_t magic;
2702 mchunkptr smallbins[(NSMALLBINS(32U)+1)*2];
2703 tbinptr treebins[NTREEBINS(32U)];
2704 size_t footprint;
2705 size_t max_footprint;
2706 size_t footprint_limit; /* zero means no limit */
2707 flag_t mflags;
2708#if USE_LOCKS1
2709 MLOCK_Tint mutex; /* locate lock among fields that rarely change */
2710#endif /* USE_LOCKS */
2711 msegment seg;
2712 void* extp; /* Unused but available for extensions */
2713 size_t exts;
2714};
2715
2716typedef struct malloc_state* mstate;
2717
2718/* ------------- Global malloc_state and malloc_params ------------------- */
2719
2720/*
2721 malloc_params holds global properties, including those that can be
2722 dynamically set using mallopt. There is a single instance, mparams,
2723 initialized in init_mparams. Note that the non-zeroness of "magic"
2724 also serves as an initialization flag.
2725*/
2726
2727struct malloc_params {
2728 size_t magic;
2729 size_t page_size;
2730 size_t granularity;
2731 size_t mmap_threshold;
2732 size_t trim_threshold;
2733 flag_t default_mflags;
2734};
2735
2736static struct malloc_params mparams;
2737
2738/* libffi: mparams is initialized exactly once (under the malloc global lock),
2739 but mparams.magic is read on every allocation's fast path WITHOUT a lock to
2740 decide whether initialization already happened. Upstream writes magic
2741 through a `volatile` cast, which is not a synchronizing operation, so
2742 ThreadSanitizer reports a data race (libffi issue #873) between that one-time
2743 write and the lock-free readers. Access magic with acquire/release ordering
2744 instead: a thread that observes magic != 0 via the acquire load is then
2745 guaranteed to see all the other initialization writes (page_size, mflags,
2746 ...) performed before the release store. Fall back to the original volatile
2747 access when no supported compiler atomic operations are available. */
2748#if USE_LOCKS1 && defined(__ATOMIC_ACQUIRE2)
2749# define ffi_mparams_magic_load()__atomic_load_n(&mparams.magic, 2) __atomic_load_n(&mparams.magic, __ATOMIC_ACQUIRE2)
2750# define ffi_mparams_magic_store(v)__atomic_store_n(&mparams.magic, (size_t)(v), 3) __atomic_store_n(&mparams.magic, (size_t)(v), __ATOMIC_RELEASE3)
2751#elif USE_LOCKS1 && defined(_MSC_VER)
2752# if defined(_WIN64)
2753# define ffi_mparams_magic_load()__atomic_load_n(&mparams.magic, 2) \
2754 ((size_t)_InterlockedCompareExchange64((__int64 volatile *)&mparams.magic, \
2755 (__int64)0, (__int64)0))
2756# define ffi_mparams_magic_store(v)__atomic_store_n(&mparams.magic, (size_t)(v), 3) \
2757 ((void)_InterlockedExchange64((__int64 volatile *)&mparams.magic, \
2758 (__int64)(v)))
2759# else
2760# define ffi_mparams_magic_load()__atomic_load_n(&mparams.magic, 2) \
2761 ((size_t)_InterlockedCompareExchange((LONG volatile *)&mparams.magic, \
2762 (LONG)0, (LONG)0))
2763# define ffi_mparams_magic_store(v)__atomic_store_n(&mparams.magic, (size_t)(v), 3) \
2764 ((void)_InterlockedExchange((LONG volatile *)&mparams.magic, (LONG)(v)))
2765# endif
2766#else
2767# define ffi_mparams_magic_load()__atomic_load_n(&mparams.magic, 2) (mparams.magic)
2768# define ffi_mparams_magic_store(v)__atomic_store_n(&mparams.magic, (size_t)(v), 3) (*(volatile size_t *)(&(mparams.magic)) = (size_t)(v))
2769#endif
2770
2771/* Ensure mparams initialized */
2772#define ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
()) (void)(ffi_mparams_magic_load()__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams())
2773
2774#if !ONLY_MSPACES0
2775
2776/* The global malloc_state used for all non-"mspace" calls */
2777static struct malloc_state _gm_;
2778#define gm(&_gm_) (&_gm_)
2779#define is_global(M)((M) == &_gm_) ((M) == &_gm_)
2780
2781#endif /* !ONLY_MSPACES */
2782
2783#define is_initialized(M)((M)->top != 0) ((M)->top != 0)
2784
2785/* -------------------------- system alloc setup ------------------------- */
2786
2787/* Operations on mflags */
2788
2789#define use_lock(M)((M)->mflags & (2U)) ((M)->mflags & USE_LOCK_BIT(2U))
2790#define enable_lock(M)((M)->mflags |= (2U)) ((M)->mflags |= USE_LOCK_BIT(2U))
2791#if USE_LOCKS1
2792#define disable_lock(M)((M)->mflags &= ~(2U)) ((M)->mflags &= ~USE_LOCK_BIT(2U))
2793#else
2794#define disable_lock(M)((M)->mflags &= ~(2U))
2795#endif
2796
2797#define use_mmap(M)((M)->mflags & (((size_t)1))) ((M)->mflags & USE_MMAP_BIT(((size_t)1)))
2798#define enable_mmap(M)((M)->mflags |= (((size_t)1))) ((M)->mflags |= USE_MMAP_BIT(((size_t)1)))
2799#if HAVE_MMAP1
2800#define disable_mmap(M)((M)->mflags &= ~(((size_t)1))) ((M)->mflags &= ~USE_MMAP_BIT(((size_t)1)))
2801#else
2802#define disable_mmap(M)((M)->mflags &= ~(((size_t)1)))
2803#endif
2804
2805#define use_noncontiguous(M)((M)->mflags & (4U)) ((M)->mflags & USE_NONCONTIGUOUS_BIT(4U))
2806#define disable_contiguous(M)((M)->mflags |= (4U)) ((M)->mflags |= USE_NONCONTIGUOUS_BIT(4U))
2807
2808#define set_lock(M,L)((M)->mflags = (L)? ((M)->mflags | (2U)) : ((M)->mflags
& ~(2U)))\
2809 ((M)->mflags = (L)?\
2810 ((M)->mflags | USE_LOCK_BIT(2U)) :\
2811 ((M)->mflags & ~USE_LOCK_BIT(2U)))
2812
2813/* page-align a size */
2814#define page_align(S)(((S) + (mparams.page_size - ((size_t)1))) & ~(mparams.page_size
- ((size_t)1)))\
2815 (((S) + (mparams.page_size - SIZE_T_ONE((size_t)1))) & ~(mparams.page_size - SIZE_T_ONE((size_t)1)))
2816
2817/* granularity-align a size */
2818#define granularity_align(S)(((S) + (mparams.granularity - ((size_t)1))) & ~(mparams.
granularity - ((size_t)1)))\
2819 (((S) + (mparams.granularity - SIZE_T_ONE((size_t)1)))\
2820 & ~(mparams.granularity - SIZE_T_ONE((size_t)1)))
2821
2822
2823/* For mmap, use granularity alignment on windows, else page-align */
2824#ifdef WIN32
2825#define mmap_align(S)(((S) + (mparams.page_size - ((size_t)1))) & ~(mparams.page_size
- ((size_t)1))) granularity_align(S)(((S) + (mparams.granularity - ((size_t)1))) & ~(mparams.
granularity - ((size_t)1)))
2826#else
2827#define mmap_align(S)(((S) + (mparams.page_size - ((size_t)1))) & ~(mparams.page_size
- ((size_t)1))) page_align(S)(((S) + (mparams.page_size - ((size_t)1))) & ~(mparams.page_size
- ((size_t)1)))
2828#endif
2829
2830/* For sys_alloc, enough padding to ensure can malloc request on success */
2831#define SYS_ALLOC_PADDING((((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<
1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
+ ((size_t)(2 * sizeof(void *)))) (TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) + MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))))
2832
2833#define is_page_aligned(S)(((size_t)(S) & (mparams.page_size - ((size_t)1))) == 0)\
2834 (((size_t)(S) & (mparams.page_size - SIZE_T_ONE((size_t)1))) == 0)
2835#define is_granularity_aligned(S)(((size_t)(S) & (mparams.granularity - ((size_t)1))) == 0
)\
2836 (((size_t)(S) & (mparams.granularity - SIZE_T_ONE((size_t)1))) == 0)
2837
2838/* True if segment S holds address A */
2839#define segment_holds(S, A)((char*)(A) >= S->base && (char*)(A) < S->
base + S->size)\
2840 ((char*)(A) >= S->base && (char*)(A) < S->base + S->size)
2841
2842/* Return segment holding given address */
2843static msegmentptr segment_holding(mstate m, char* addr) {
2844 msegmentptr sp = &m->seg;
2845 for (;;) {
2846 if (addr >= sp->base && addr < sp->base + sp->size)
2847 return sp;
2848 if ((sp = sp->next) == 0)
2849 return 0;
2850 }
2851}
2852
2853/* Return true if segment contains a segment link */
2854static int has_segment_link(mstate m, msegmentptr ss) {
2855 msegmentptr sp = &m->seg;
2856 for (;;) {
2857 if ((char*)sp >= ss->base && (char*)sp < ss->base + ss->size)
2858 return 1;
2859 if ((sp = sp->next) == 0)
2860 return 0;
2861 }
2862}
2863
2864#ifndef MORECORE_CANNOT_TRIM
2865#define should_trim(M,s)((s) > (M)->trim_check) ((s) > (M)->trim_check)
2866#else /* MORECORE_CANNOT_TRIM */
2867#define should_trim(M,s)((s) > (M)->trim_check) (0)
2868#endif /* MORECORE_CANNOT_TRIM */
2869
2870/*
2871 TOP_FOOT_SIZE is padding at the end of a segment, including space
2872 that may be needed to place segment records and fenceposts when new
2873 noncontiguous segments are added.
2874*/
2875#define TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))\
2876 (align_offset(chunk2mem(0))((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1)
))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) == 0
)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*)(
(char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t)(
2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+pad_request(sizeof(struct malloc_segment))(((sizeof(struct malloc_segment)) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)))+MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
2877
2878
2879/* ------------------------------- Hooks -------------------------------- */
2880
2881/*
2882 PREACTION should be defined to return 0 on success, and nonzero on
2883 failure. If you are not using locking, you can redefine these to do
2884 anything you like.
2885*/
2886
2887#if USE_LOCKS1
2888#define PREACTION(M)((((M)->mflags & (2U)))? (__sync_lock_test_and_set(&
(M)->mutex, 1)? spin_acquire_lock(&(M)->mutex) : 0)
: 0) ((use_lock(M)((M)->mflags & (2U)))? ACQUIRE_LOCK(&(M)->mutex)(__sync_lock_test_and_set(&(M)->mutex, 1)? spin_acquire_lock
(&(M)->mutex) : 0) : 0)
2889#define POSTACTION(M){ if (((M)->mflags & (2U))) __sync_lock_release(&(
M)->mutex); } { if (use_lock(M)((M)->mflags & (2U))) RELEASE_LOCK(&(M)->mutex)__sync_lock_release(&(M)->mutex); }
2890#else /* USE_LOCKS */
2891
2892#ifndef PREACTION
2893#define PREACTION(M)((((M)->mflags & (2U)))? (__sync_lock_test_and_set(&
(M)->mutex, 1)? spin_acquire_lock(&(M)->mutex) : 0)
: 0) (0)
2894#endif /* PREACTION */
2895
2896#ifndef POSTACTION
2897#define POSTACTION(M){ if (((M)->mflags & (2U))) __sync_lock_release(&(
M)->mutex); }
2898#endif /* POSTACTION */
2899
2900#endif /* USE_LOCKS */
2901
2902/*
2903 CORRUPTION_ERROR_ACTION is triggered upon detected bad addresses.
2904 USAGE_ERROR_ACTION is triggered on detected bad frees and
2905 reallocs. The argument p is an address that might have triggered the
2906 fault. It is ignored by the two predefined actions, but might be
2907 useful in custom actions that try to help diagnose errors.
2908*/
2909
2910#if PROCEED_ON_ERROR0
2911
2912/* A count of the number of corruption errors causing resets */
2913int malloc_corruption_error_count;
2914
2915/* default corruption action */
2916static void reset_on_error(mstate m);
2917
2918#define CORRUPTION_ERROR_ACTION(m)abort() reset_on_error(m)
2919#define USAGE_ERROR_ACTION(m, p)abort()
2920
2921#else /* PROCEED_ON_ERROR */
2922
2923#ifndef CORRUPTION_ERROR_ACTION
2924#define CORRUPTION_ERROR_ACTION(m)abort() ABORTabort()
2925#endif /* CORRUPTION_ERROR_ACTION */
2926
2927#ifndef USAGE_ERROR_ACTION
2928#define USAGE_ERROR_ACTION(m,p)abort() ABORTabort()
2929#endif /* USAGE_ERROR_ACTION */
2930
2931#endif /* PROCEED_ON_ERROR */
2932
2933
2934/* -------------------------- Debugging setup ---------------------------- */
2935
2936#if ! DEBUG1
2937
2938#define check_free_chunk(M,P)do_check_free_chunk(M,P)
2939#define check_inuse_chunk(M,P)do_check_inuse_chunk(M,P)
2940#define check_malloced_chunk(M,P,N)do_check_malloced_chunk(M,P,N)
2941#define check_mmapped_chunk(M,P)do_check_mmapped_chunk(M,P)
2942#define check_malloc_state(M)do_check_malloc_state(M)
2943#define check_top_chunk(M,P)do_check_top_chunk(M,P)
2944
2945#else /* DEBUG */
2946#define check_free_chunk(M,P)do_check_free_chunk(M,P) do_check_free_chunk(M,P)
2947#define check_inuse_chunk(M,P)do_check_inuse_chunk(M,P) do_check_inuse_chunk(M,P)
2948#define check_top_chunk(M,P)do_check_top_chunk(M,P) do_check_top_chunk(M,P)
2949#define check_malloced_chunk(M,P,N)do_check_malloced_chunk(M,P,N) do_check_malloced_chunk(M,P,N)
2950#define check_mmapped_chunk(M,P)do_check_mmapped_chunk(M,P) do_check_mmapped_chunk(M,P)
2951#define check_malloc_state(M)do_check_malloc_state(M) do_check_malloc_state(M)
2952
2953static void do_check_any_chunk(mstate m, mchunkptr p);
2954static void do_check_top_chunk(mstate m, mchunkptr p);
2955static void do_check_mmapped_chunk(mstate m, mchunkptr p);
2956static void do_check_inuse_chunk(mstate m, mchunkptr p);
2957static void do_check_free_chunk(mstate m, mchunkptr p);
2958static void do_check_malloced_chunk(mstate m, void* mem, size_t s);
2959static void do_check_tree(mstate m, tchunkptr t);
2960static void do_check_treebin(mstate m, bindex_t i);
2961static void do_check_smallbin(mstate m, bindex_t i);
2962static void do_check_malloc_state(mstate m);
2963static int bin_find(mstate m, mchunkptr x);
2964static size_t traverse_and_check(mstate m);
2965#endif /* DEBUG */
2966
2967/* ---------------------------- Indexing Bins ---------------------------- */
2968
2969#define is_small(s)(((s) >> (3U)) < (32U)) (((s) >> SMALLBIN_SHIFT(3U)) < NSMALLBINS(32U))
2970#define small_index(s)(bindex_t)((s) >> (3U)) (bindex_t)((s) >> SMALLBIN_SHIFT(3U))
2971#define small_index2size(i)((i) << (3U)) ((i) << SMALLBIN_SHIFT(3U))
2972#define MIN_SMALL_INDEX((bindex_t)(((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)))) >> (3U))) (small_index(MIN_CHUNK_SIZE)(bindex_t)(((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)))) >> (3U)))
2973
2974/* addressing by index. See above about smallbin repositioning */
2975#define smallbin_at(M, i)((sbinptr)((char*)&((M)->smallbins[(i)<<1]))) ((sbinptr)((char*)&((M)->smallbins[(i)<<1])))
2976#define treebin_at(M,i)(&((M)->treebins[i])) (&((M)->treebins[i]))
2977
2978/* assign tree index for size S to variable I.
2979 libffi: enable the __builtin_clz path on any GNU-compatible compiler, not
2980 only x86, so the log2 is an intrinsic rather than the generic C idiom that
2981 the compiler can't always recognize (libffi #754). */
2982#if defined(__GNUC__4)
2983#define compute_tree_index(S, I){ unsigned int X = S >> (8U); if (X == 0) I = 0; else if
(X > 0xFFFF) I = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); I = (bindex_t
)((K << 1) + ((S >> (K + ((8U)-1)) & 1))); }}\
2984{\
2985 unsigned int X = S >> TREEBIN_SHIFT(8U);\
2986 if (X == 0)\
2987 I = 0;\
2988 else if (X > 0xFFFF)\
2989 I = NTREEBINS(32U)-1;\
2990 else {\
2991 unsigned int K = (unsigned) sizeof(X)*__CHAR_BIT__8 - 1 - (unsigned) __builtin_clz(X); \
2992 I = (bindex_t)((K << 1) + ((S >> (K + (TREEBIN_SHIFT(8U)-1)) & 1)));\
2993 }\
2994}
2995
2996#elif defined (__INTEL_COMPILER)
2997#define compute_tree_index(S, I){ unsigned int X = S >> (8U); if (X == 0) I = 0; else if
(X > 0xFFFF) I = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); I = (bindex_t
)((K << 1) + ((S >> (K + ((8U)-1)) & 1))); }}\
2998{\
2999 size_t X = S >> TREEBIN_SHIFT(8U);\
3000 if (X == 0)\
3001 I = 0;\
3002 else if (X > 0xFFFF)\
3003 I = NTREEBINS(32U)-1;\
3004 else {\
3005 unsigned int K = _bit_scan_reverse (X); \
3006 I = (bindex_t)((K << 1) + ((S >> (K + (TREEBIN_SHIFT(8U)-1)) & 1)));\
3007 }\
3008}
3009
3010#elif defined(_MSC_VER) && _MSC_VER>=1300
3011#define compute_tree_index(S, I){ unsigned int X = S >> (8U); if (X == 0) I = 0; else if
(X > 0xFFFF) I = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); I = (bindex_t
)((K << 1) + ((S >> (K + ((8U)-1)) & 1))); }}\
3012{\
3013 size_t X = S >> TREEBIN_SHIFT(8U);\
3014 if (X == 0)\
3015 I = 0;\
3016 else if (X > 0xFFFF)\
3017 I = NTREEBINS(32U)-1;\
3018 else {\
3019 unsigned int K;\
3020 _BitScanReverse((DWORD *) &K, (DWORD) X);\
3021 I = (bindex_t)((K << 1) + ((S >> (K + (TREEBIN_SHIFT(8U)-1)) & 1)));\
3022 }\
3023}
3024
3025#else /* GNUC */
3026#define compute_tree_index(S, I){ unsigned int X = S >> (8U); if (X == 0) I = 0; else if
(X > 0xFFFF) I = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); I = (bindex_t
)((K << 1) + ((S >> (K + ((8U)-1)) & 1))); }}\
3027{\
3028 size_t X = S >> TREEBIN_SHIFT(8U);\
3029 if (X == 0)\
3030 I = 0;\
3031 else if (X > 0xFFFF)\
3032 I = NTREEBINS(32U)-1;\
3033 else {\
3034 unsigned int Y = (unsigned int)X;\
3035 unsigned int N = ((Y - 0x100) >> 16) & 8;\
3036 unsigned int K = (((Y <<= N) - 0x1000) >> 16) & 4;\
3037 N += K;\
3038 N += K = (((Y <<= K) - 0x4000) >> 16) & 2;\
3039 K = 14 - N + ((Y <<= K) >> 15);\
3040 I = (K << 1) + ((S >> (K + (TREEBIN_SHIFT(8U)-1)) & 1));\
3041 }\
3042}
3043#endif /* GNUC */
3044
3045/* Bit representing maximum resolved size in a treebin at i */
3046#define bit_for_tree_index(i)(i == (32U)-1)? ((sizeof(size_t) << 3)-1) : (((i) >>
1) + (8U) - 2) \
3047 (i == NTREEBINS(32U)-1)? (SIZE_T_BITSIZE(sizeof(size_t) << 3)-1) : (((i) >> 1) + TREEBIN_SHIFT(8U) - 2)
3048
3049/* Shift placing maximum resolved bit in a treebin at i as sign bit */
3050#define leftshift_for_tree_index(i)((i == (32U)-1)? 0 : (((sizeof(size_t) << 3)-((size_t)1
)) - (((i) >> 1) + (8U) - 2))) \
3051 ((i == NTREEBINS(32U)-1)? 0 : \
3052 ((SIZE_T_BITSIZE(sizeof(size_t) << 3)-SIZE_T_ONE((size_t)1)) - (((i) >> 1) + TREEBIN_SHIFT(8U) - 2)))
3053
3054/* The size of the smallest chunk held in bin with index i */
3055#define minsize_for_tree_index(i)((((size_t)1) << (((i) >> 1) + (8U))) | (((size_t
)((i) & ((size_t)1))) << (((i) >> 1) + (8U) -
1))) \
3056 ((SIZE_T_ONE((size_t)1) << (((i) >> 1) + TREEBIN_SHIFT(8U))) | \
3057 (((size_t)((i) & SIZE_T_ONE((size_t)1))) << (((i) >> 1) + TREEBIN_SHIFT(8U) - 1)))
3058
3059
3060/* ------------------------ Operations on bin maps ----------------------- */
3061
3062/* bit corresponding to given index */
3063#define idx2bit(i)((binmap_t)(1) << (i)) ((binmap_t)(1) << (i))
3064
3065/* Mark/Clear bits with given index */
3066#define mark_smallmap(M,i)((M)->smallmap |= ((binmap_t)(1) << (i))) ((M)->smallmap |= idx2bit(i)((binmap_t)(1) << (i)))
3067#define clear_smallmap(M,i)((M)->smallmap &= ~((binmap_t)(1) << (i))) ((M)->smallmap &= ~idx2bit(i)((binmap_t)(1) << (i)))
3068#define smallmap_is_marked(M,i)((M)->smallmap & ((binmap_t)(1) << (i))) ((M)->smallmap & idx2bit(i)((binmap_t)(1) << (i)))
3069
3070#define mark_treemap(M,i)((M)->treemap |= ((binmap_t)(1) << (i))) ((M)->treemap |= idx2bit(i)((binmap_t)(1) << (i)))
3071#define clear_treemap(M,i)((M)->treemap &= ~((binmap_t)(1) << (i))) ((M)->treemap &= ~idx2bit(i)((binmap_t)(1) << (i)))
3072#define treemap_is_marked(M,i)((M)->treemap & ((binmap_t)(1) << (i))) ((M)->treemap & idx2bit(i)((binmap_t)(1) << (i)))
3073
3074/* isolate the least set bit of a bitmap */
3075#define least_bit(x)((x) & -(x)) ((x) & -(x))
3076
3077/* mask with all bits to left of least bit of x on */
3078#define left_bits(x)((x<<1) | -(x<<1)) ((x<<1) | -(x<<1))
3079
3080/* mask with all bits to left of or equal to least bit of x on */
3081#define same_or_left_bits(x)((x) | -(x)) ((x) | -(x))
3082
3083/* index corresponding to given bit.
3084 libffi: use __builtin_ctz on any GNU-compatible compiler, not only x86
3085 (libffi #754). */
3086
3087#if defined(__GNUC__4)
3088#define compute_bit2idx(X, I){ unsigned int J; J = __builtin_ctz(X); I = (bindex_t)J;}\
3089{\
3090 unsigned int J;\
3091 J = __builtin_ctz(X); \
3092 I = (bindex_t)J;\
3093}
3094
3095#elif defined (__INTEL_COMPILER)
3096#define compute_bit2idx(X, I){ unsigned int J; J = __builtin_ctz(X); I = (bindex_t)J;}\
3097{\
3098 unsigned int J;\
3099 J = _bit_scan_forward (X); \
3100 I = (bindex_t)J;\
3101}
3102
3103#elif defined(_MSC_VER) && _MSC_VER>=1300
3104#define compute_bit2idx(X, I){ unsigned int J; J = __builtin_ctz(X); I = (bindex_t)J;}\
3105{\
3106 unsigned int J;\
3107 _BitScanForward((DWORD *) &J, X);\
3108 I = (bindex_t)J;\
3109}
3110
3111#elif USE_BUILTIN_FFS0
3112#define compute_bit2idx(X, I){ unsigned int J; J = __builtin_ctz(X); I = (bindex_t)J;} I = ffs(X)-1
3113
3114#else
3115#define compute_bit2idx(X, I){ unsigned int J; J = __builtin_ctz(X); I = (bindex_t)J;}\
3116{\
3117 unsigned int Y = X - 1;\
3118 unsigned int K = Y >> (16-4) & 16;\
3119 unsigned int N = K; Y >>= K;\
3120 N += K = Y >> (8-3) & 8; Y >>= K;\
3121 N += K = Y >> (4-2) & 4; Y >>= K;\
3122 N += K = Y >> (2-1) & 2; Y >>= K;\
3123 N += K = Y >> (1-0) & 1; Y >>= K;\
3124 I = (bindex_t)(N + Y);\
3125}
3126#endif /* GNUC */
3127
3128
3129/* ----------------------- Runtime Check Support ------------------------- */
3130
3131/*
3132 For security, the main invariant is that malloc/free/etc never
3133 writes to a static address other than malloc_state, unless static
3134 malloc_state itself has been corrupted, which cannot occur via
3135 malloc (because of these checks). In essence this means that we
3136 believe all pointers, sizes, maps etc held in malloc_state, but
3137 check all of those linked or offsetted from other embedded data
3138 structures. These checks are interspersed with main code in a way
3139 that tends to minimize their run-time cost.
3140
3141 When FOOTERS is defined, in addition to range checking, we also
3142 verify footer fields of inuse chunks, which can be used guarantee
3143 that the mstate controlling malloc/free is intact. This is a
3144 streamlined version of the approach described by William Robertson
3145 et al in "Run-time Detection of Heap-based Overflows" LISA'03
3146 http://www.usenix.org/events/lisa03/tech/robertson.html The footer
3147 of an inuse chunk holds the xor of its mstate and a random seed,
3148 that is checked upon calls to free() and realloc(). This is
3149 (probabalistically) unguessable from outside the program, but can be
3150 computed by any code successfully malloc'ing any chunk, so does not
3151 itself provide protection against code that has already broken
3152 security through some other means. Unlike Robertson et al, we
3153 always dynamically check addresses of all offset chunks (previous,
3154 next, etc). This turns out to be cheaper than relying on hashes.
3155*/
3156
3157#if !INSECURE0
3158/* Check if address a is at least as high as any from MORECORE or MMAP */
3159#define ok_address(M, a)((char*)(a) >= (M)->least_addr) ((char*)(a) >= (M)->least_addr)
3160/* Check if address of next chunk n is higher than base chunk p */
3161#define ok_next(p, n)((char*)(p) < (char*)(n)) ((char*)(p) < (char*)(n))
3162/* Check if p has inuse status */
3163#define ok_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) is_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1)))
3164/* Check if p has its pinuse bit on */
3165#define ok_pinuse(p)((p)->head & (((size_t)1))) pinuse(p)((p)->head & (((size_t)1)))
3166
3167#else /* !INSECURE */
3168#define ok_address(M, a)((char*)(a) >= (M)->least_addr) (1)
3169#define ok_next(b, n)((char*)(b) < (char*)(n)) (1)
3170#define ok_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) (1)
3171#define ok_pinuse(p)((p)->head & (((size_t)1))) (1)
3172#endif /* !INSECURE */
3173
3174#if (FOOTERS0 && !INSECURE0)
3175/* Check if (alleged) mstate m has expected magic field */
3176#define ok_magic(M)(1) ((M)->magic == mparams.magic)
3177#else /* (FOOTERS && !INSECURE) */
3178#define ok_magic(M)(1) (1)
3179#endif /* (FOOTERS && !INSECURE) */
3180
3181/* In gcc, use __builtin_expect to minimize impact of checks */
3182#if !INSECURE0
3183#if defined(__GNUC__4) && __GNUC__4 >= 3
3184#define RTCHECK(e)__builtin_expect(e, 1) __builtin_expect(e, 1)
3185#else /* GNUC */
3186#define RTCHECK(e)__builtin_expect(e, 1) (e)
3187#endif /* GNUC */
3188#else /* !INSECURE */
3189#define RTCHECK(e)__builtin_expect(e, 1) (1)
3190#endif /* !INSECURE */
3191
3192/* macros to set up inuse chunks with or without footers */
3193
3194#if !FOOTERS0
3195
3196#define mark_inuse_foot(M,p,s)
3197
3198/* Macros for setting head/foot of non-mmapped chunks */
3199
3200/* Set cinuse bit and pinuse bit of next chunk */
3201#define set_inuse(M,p,s)((p)->head = (((p)->head & (((size_t)1)))|s|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (s)))->head |= (((size_t
)1)))\
3202 ((p)->head = (((p)->head & PINUSE_BIT(((size_t)1)))|s|CINUSE_BIT(((size_t)2))),\
3203 ((mchunkptr)(((char*)(p)) + (s)))->head |= PINUSE_BIT(((size_t)1)))
3204
3205/* Set cinuse and pinuse of this chunk and pinuse of next chunk */
3206#define set_inuse_and_pinuse(M,p,s)((p)->head = (s|(((size_t)1))|(((size_t)2))), ((mchunkptr)
(((char*)(p)) + (s)))->head |= (((size_t)1)))\
3207 ((p)->head = (s|PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2))),\
3208 ((mchunkptr)(((char*)(p)) + (s)))->head |= PINUSE_BIT(((size_t)1)))
3209
3210/* Set size, cinuse and pinuse bit of this chunk */
3211#define set_size_and_pinuse_of_inuse_chunk(M, p, s)((p)->head = (s|(((size_t)1))|(((size_t)2))))\
3212 ((p)->head = (s|PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2))))
3213
3214#else /* FOOTERS */
3215
3216/* Set foot of inuse chunk to be xor of mstate and seed */
3217#define mark_inuse_foot(M,p,s)\
3218 (((mchunkptr)((char*)(p) + (s)))->prev_foot = ((size_t)(M) ^ mparams.magic))
3219
3220#define get_mstate_for(p)\
3221 ((mstate)(((mchunkptr)((char*)(p) +\
3222 (chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))))))->prev_foot ^ mparams.magic))
3223
3224#define set_inuse(M,p,s)((p)->head = (((p)->head & (((size_t)1)))|s|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (s)))->head |= (((size_t
)1)))\
3225 ((p)->head = (((p)->head & PINUSE_BIT(((size_t)1)))|s|CINUSE_BIT(((size_t)2))),\
3226 (((mchunkptr)(((char*)(p)) + (s)))->head |= PINUSE_BIT(((size_t)1))), \
3227 mark_inuse_foot(M,p,s))
3228
3229#define set_inuse_and_pinuse(M,p,s)((p)->head = (s|(((size_t)1))|(((size_t)2))), ((mchunkptr)
(((char*)(p)) + (s)))->head |= (((size_t)1)))\
3230 ((p)->head = (s|PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2))),\
3231 (((mchunkptr)(((char*)(p)) + (s)))->head |= PINUSE_BIT(((size_t)1))),\
3232 mark_inuse_foot(M,p,s))
3233
3234#define set_size_and_pinuse_of_inuse_chunk(M, p, s)((p)->head = (s|(((size_t)1))|(((size_t)2))))\
3235 ((p)->head = (s|PINUSE_BIT(((size_t)1))|CINUSE_BIT(((size_t)2))),\
3236 mark_inuse_foot(M, p, s))
3237
3238#endif /* !FOOTERS */
3239
3240/* ---------------------------- setting mparams -------------------------- */
3241
3242#if LOCK_AT_FORK0
3243static void pre_fork(void) { ACQUIRE_LOCK(&(gm)->mutex)(__sync_lock_test_and_set(&((&_gm_))->mutex, 1)? spin_acquire_lock
(&((&_gm_))->mutex) : 0); }
3244static void post_fork_parent(void) { RELEASE_LOCK(&(gm)->mutex)__sync_lock_release(&((&_gm_))->mutex); }
3245static void post_fork_child(void) { INITIAL_LOCK(&(gm)->mutex)(*&((&_gm_))->mutex = 0); }
3246#endif /* LOCK_AT_FORK */
3247
3248/* Initialize mparams */
3249static int init_mparams(void) {
3250#ifdef NEED_GLOBAL_LOCK_INIT
3251 if (malloc_global_mutex_status <= 0)
3252 init_malloc_global_mutex();
3253#endif
3254
3255 ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);;
3256 if (mparams.magic == 0) {
3257 size_t magic;
3258 size_t psize;
3259 size_t gsize;
3260
3261#if !defined(WIN32) && !defined(__OS2__)
3262 psize = malloc_getpagesizesysconf(_SC_PAGESIZE);
3263 gsize = ((DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) != 0)? DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) : psize);
3264#elif defined (__OS2__)
3265 /* if low-memory is used, os2munmap() would break
3266 if it were anything other than 64k */
3267 psize = 4096u;
3268 gsize = 65536u;
3269#else /* WIN32 */
3270 {
3271 SYSTEM_INFO system_info;
3272 GetSystemInfo(&system_info);
3273 psize = system_info.dwPageSize;
3274 gsize = ((DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) != 0)?
3275 DEFAULT_GRANULARITY((size_t)sysconf(_SC_PAGESIZE)) : system_info.dwAllocationGranularity);
3276 }
3277#endif /* WIN32 */
3278
3279 /* Sanity-check configuration:
3280 size_t must be unsigned and as wide as pointer type.
3281 ints must be at least 4 bytes.
3282 alignment must be at least 8.
3283 Alignment, min chunk size, and page size must all be powers of 2.
3284 */
3285 if ((sizeof(size_t) != sizeof(char*)) ||
3286 (MAX_SIZE_T(~(size_t)0) < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) ||
3287 (sizeof(int) < 4) ||
3288 (MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) < (size_t)8U) ||
3289 ((MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) & (MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *)))-SIZE_T_ONE((size_t)1))) != 0) ||
3290 ((MCHUNK_SIZE(sizeof(mchunk)) & (MCHUNK_SIZE(sizeof(mchunk))-SIZE_T_ONE((size_t)1))) != 0) ||
3291 ((gsize & (gsize-SIZE_T_ONE((size_t)1))) != 0) ||
3292 ((psize & (psize-SIZE_T_ONE((size_t)1))) != 0))
3293 ABORTabort();
3294 mparams.granularity = gsize;
3295 mparams.page_size = psize;
3296 mparams.mmap_threshold = DEFAULT_MMAP_THRESHOLD(~(size_t)0);
3297 mparams.trim_threshold = DEFAULT_TRIM_THRESHOLD((size_t)2U * (size_t)1024U * (size_t)1024U);
3298#if MORECORE_CONTIGUOUS0
3299 mparams.default_mflags = USE_LOCK_BIT(2U)|USE_MMAP_BIT(((size_t)1));
3300#else /* MORECORE_CONTIGUOUS */
3301 mparams.default_mflags = USE_LOCK_BIT(2U)|USE_MMAP_BIT(((size_t)1))|USE_NONCONTIGUOUS_BIT(4U);
3302#endif /* MORECORE_CONTIGUOUS */
3303
3304#if !ONLY_MSPACES0
3305 /* Set up lock for main malloc area */
3306 gm(&_gm_)->mflags = mparams.default_mflags;
3307 (void)INITIAL_LOCK(&gm->mutex)(*&(&_gm_)->mutex = 0);
3308#endif
3309#if LOCK_AT_FORK0
3310 pthread_atfork(&pre_fork, &post_fork_parent, &post_fork_child);
3311#endif
3312
3313 {
3314#if USE_DEV_RANDOM0
3315 int fd;
3316 unsigned char buf[sizeof(size_t)];
3317 /* Try to use /dev/urandom, else fall back on using time */
3318 if ((fd = open("/dev/urandom", O_RDONLY00)) >= 0 &&
3319 read(fd, buf, sizeof(buf)) == sizeof(buf)) {
3320 magic = *((size_t *) buf);
3321 close(fd);
3322 }
3323 else
3324#endif /* USE_DEV_RANDOM */
3325#ifdef WIN32
3326 magic = (size_t)(GetTickCount() ^ (size_t)0x55555555U);
3327#elif defined(LACKS_TIME_H)
3328 magic = (size_t)&magic ^ (size_t)0x55555555U;
3329#else
3330 magic = (size_t)(time(0) ^ (size_t)0x55555555U);
3331#endif
3332 magic |= (size_t)8U; /* ensure nonzero */
3333 magic &= ~(size_t)7U; /* improve chances of fault for bad values */
3334 /* libffi: release-store so any thread that observes magic via the
3335 acquire load in ensure_initialization() sees the writes above (#873). */
3336 ffi_mparams_magic_store(magic)__atomic_store_n(&mparams.magic, (size_t)(magic), 3);
3337 }
3338 }
3339
3340 RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex);;
3341 return 1;
3342}
3343
3344/* support for mallopt */
3345static int change_mparam(int param_number, int value) {
3346 size_t val;
3347 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
3348 val = (value == -1)? MAX_SIZE_T(~(size_t)0) : (size_t)value;
3349 switch(param_number) {
3350 case M_TRIM_THRESHOLD(-1):
3351 mparams.trim_threshold = val;
3352 return 1;
3353 case M_GRANULARITY(-2):
3354 if (val >= mparams.page_size && ((val & (val-1)) == 0)) {
3355 mparams.granularity = val;
3356 return 1;
3357 }
3358 else
3359 return 0;
3360 case M_MMAP_THRESHOLD(-3):
3361 mparams.mmap_threshold = val;
3362 return 1;
3363 default:
3364 return 0;
3365 }
3366}
3367
3368#if DEBUG1
3369/* ------------------------- Debugging Support --------------------------- */
3370
3371/* Check properties of any chunk, whether free, inuse, mmapped etc */
3372static void do_check_any_chunk(mstate m, mchunkptr p) {
3373 assert((is_aligned(chunk2mem(p))) || (p->head == FENCEPOST_HEAD))if(!(((((size_t)((((void*)((char*)(p) + ((sizeof(size_t))<<
1))))) & ((((size_t)(2 * sizeof(void *))) - ((size_t)1)))
) == 0)) || (p->head == (((((size_t)1))|(((size_t)2)))|(sizeof
(size_t)))))) abort();
3374 assert(ok_address(m, p))if(!(((char*)(p) >= (m)->least_addr))) abort();
3375}
3376
3377/* Check properties of top chunk */
3378static void do_check_top_chunk(mstate m, mchunkptr p) {
3379 msegmentptr sp = segment_holding(m, (char*)p);
3380 size_t sz = p->head & ~INUSE_BITS((((size_t)1))|(((size_t)2))); /* third-lowest bit can be set! */
3381 assert(sp != 0)if(!(sp != 0)) abort();
18
←
Assuming 'sp' is not equal to null
→
3382 assert((is_aligned(chunk2mem(p))) || (p->head == FENCEPOST_HEAD))if(!(((((size_t)((((void*)((char*)(p) + ((sizeof(size_t))<<
1))))) & ((((size_t)(2 * sizeof(void *))) - ((size_t)1)))
) == 0)) || (p->head == (((((size_t)1))|(((size_t)2)))|(sizeof
(size_t)))))) abort();
19
←
Taking false branch
→
20
←
Assuming the condition is true
→
21
←
Taking false branch
→
3383 assert(ok_address(m, p))if(!(((char*)(p) >= (m)->least_addr))) abort();
22
←
Assuming 'p' is >= field 'least_addr'
→
23
←
Taking false branch
→
3384 assert(sz == m->topsize)if(!(sz == m->topsize)) abort();
24
←
Assuming 'sz' is equal to field 'topsize'
→
25
←
Taking false branch
→
3385 assert(sz > 0)if(!(sz > 0)) abort();
26
←
Assuming 'sz' is > 0
→
27
←
Taking false branch
→
3386 assert(sz == ((sp->base + sp->size) - (char*)p) - TOP_FOOT_SIZE)if(!(sz == ((sp->base + sp->size) - (char*)p) - (((((size_t
)(((void*)((char*)(0) + ((sizeof(size_t))<<1)))) & (
((size_t)(2 * sizeof(void *))) - ((size_t)1))) == 0)? 0 : (((
(size_t)(2 * sizeof(void *))) - ((size_t)(((void*)((char*)(0)
+ ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof(void *
))) - ((size_t)1))))+(((sizeof(struct malloc_segment)) + ((sizeof
(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+(((sizeof(mchunk
)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~(
((size_t)(2 * sizeof(void *))) - ((size_t)1)))))) abort();
28
←
Addition of a null pointer and a nonzero integer value results in undefined behavior
3387 assert(pinuse(p))if(!(((p)->head & (((size_t)1))))) abort();
3388 assert(!pinuse(chunk_plus_offset(p, sz)))if(!(!((((mchunkptr)(((char*)(p)) + (sz))))->head & ((
(size_t)1))))) abort();
3389}
3390
3391/* Check properties of (inuse) mmapped chunks */
3392static void do_check_mmapped_chunk(mstate m, mchunkptr p) {
3393 size_t sz = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3394 size_t len = (sz + (p->prev_foot) + MMAP_FOOT_PAD(((sizeof(size_t))<<2)));
3395 assert(is_mmapped(p))if(!((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0
))) abort();
3396 assert(use_mmap(m))if(!(((m)->mflags & (((size_t)1))))) abort();
3397 assert((is_aligned(chunk2mem(p))) || (p->head == FENCEPOST_HEAD))if(!(((((size_t)((((void*)((char*)(p) + ((sizeof(size_t))<<
1))))) & ((((size_t)(2 * sizeof(void *))) - ((size_t)1)))
) == 0)) || (p->head == (((((size_t)1))|(((size_t)2)))|(sizeof
(size_t)))))) abort();
3398 assert(ok_address(m, p))if(!(((char*)(p) >= (m)->least_addr))) abort();
3399 assert(!is_small(sz))if(!(!(((sz) >> (3U)) < (32U)))) abort();
3400 assert((len & (mparams.page_size-SIZE_T_ONE)) == 0)if(!((len & (mparams.page_size-((size_t)1))) == 0)) abort
();
3401 assert(chunk_plus_offset(p, sz)->head == FENCEPOST_HEAD)if(!(((mchunkptr)(((char*)(p)) + (sz)))->head == (((((size_t
)1))|(((size_t)2)))|(sizeof(size_t))))) abort();
3402 assert(chunk_plus_offset(p, sz+SIZE_T_SIZE)->head == 0)if(!(((mchunkptr)(((char*)(p)) + (sz+(sizeof(size_t)))))->
head == 0)) abort();
3403}
3404
3405/* Check properties of inuse chunks */
3406static void do_check_inuse_chunk(mstate m, mchunkptr p) {
3407 do_check_any_chunk(m, p);
3408 assert(is_inuse(p))if(!((((p)->head & ((((size_t)1))|(((size_t)2)))) != (
((size_t)1))))) abort();
3409 assert(next_pinuse(p))if(!(((((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((
size_t)1))|(((size_t)2))|(((size_t)4))))))->head) & ((
(size_t)1))))) abort();
3410 /* If not pinuse and not mmapped, previous chunk has OK offset */
3411 assert(is_mmapped(p) || pinuse(p) || next_chunk(prev_chunk(p)) == p)if(!((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0
) || ((p)->head & (((size_t)1))) || ((mchunkptr)( ((char
*)(((mchunkptr)( ((char*)(p)) - ((p)->prev_foot) )))) + ((
((mchunkptr)( ((char*)(p)) - ((p)->prev_foot) )))->head
& ~((((size_t)1))|(((size_t)2))|(((size_t)4)))))) == p))
abort();
3412 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0))
3413 do_check_mmapped_chunk(m, p);
3414}
3415
3416/* Check properties of free chunks */
3417static void do_check_free_chunk(mstate m, mchunkptr p) {
3418 size_t sz = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3419 mchunkptr next = chunk_plus_offset(p, sz)((mchunkptr)(((char*)(p)) + (sz)));
3420 do_check_any_chunk(m, p);
3421 assert(!is_inuse(p))if(!(!(((p)->head & ((((size_t)1))|(((size_t)2)))) != (
((size_t)1))))) abort();
3422 assert(!next_pinuse(p))if(!(!((((mchunkptr)( ((char*)(p)) + ((p)->head & ~(((
(size_t)1))|(((size_t)2))|(((size_t)4))))))->head) & (
((size_t)1))))) abort();
3423 assert (!is_mmapped(p))if(!(!(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0
))) abort();
3424 if (p != m->dv && p != m->top) {
3425 if (sz >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) {
3426 assert((sz & CHUNK_ALIGN_MASK) == 0)if(!((sz & (((size_t)(2 * sizeof(void *))) - ((size_t)1))
) == 0)) abort();
3427 assert(is_aligned(chunk2mem(p)))if(!((((size_t)((((void*)((char*)(p) + ((sizeof(size_t))<<
1))))) & ((((size_t)(2 * sizeof(void *))) - ((size_t)1)))
) == 0))) abort();
3428 assert(next->prev_foot == sz)if(!(next->prev_foot == sz)) abort();
3429 assert(pinuse(p))if(!(((p)->head & (((size_t)1))))) abort();
3430 assert (next == m->top || is_inuse(next))if(!(next == m->top || (((next)->head & ((((size_t)
1))|(((size_t)2)))) != (((size_t)1))))) abort();
3431 assert(p->fd->bk == p)if(!(p->fd->bk == p)) abort();
3432 assert(p->bk->fd == p)if(!(p->bk->fd == p)) abort();
3433 }
3434 else /* markers are always of size SIZE_T_SIZE */
3435 assert(sz == SIZE_T_SIZE)if(!(sz == (sizeof(size_t)))) abort();
3436 }
3437}
3438
3439/* Check properties of malloced chunks at the point they are malloced */
3440static void do_check_malloced_chunk(mstate m, void* mem, size_t s) {
3441 if (mem != 0) {
3442 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
3443 size_t sz = p->head & ~INUSE_BITS((((size_t)1))|(((size_t)2)));
3444 do_check_inuse_chunk(m, p);
3445 assert((sz & CHUNK_ALIGN_MASK) == 0)if(!((sz & (((size_t)(2 * sizeof(void *))) - ((size_t)1))
) == 0)) abort();
3446 assert(sz >= MIN_CHUNK_SIZE)if(!(sz >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))))) abort();
3447 assert(sz >= s)if(!(sz >= s)) abort();
3448 /* unless mmapped, size is less than MIN_CHUNK_SIZE more than request */
3449 assert(is_mmapped(p) || sz < (s + MIN_CHUNK_SIZE))if(!((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0
) || sz < (s + (((sizeof(mchunk)) + (((size_t)(2 * sizeof(
void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1)))))) abort();
3450 }
3451}
3452
3453/* Check a tree and its subtrees. */
3454static void do_check_tree(mstate m, tchunkptr t) {
3455 tchunkptr head = 0;
3456 tchunkptr u = t;
3457 bindex_t tindex = t->index;
3458 size_t tsize = chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3459 bindex_t idx;
3460 compute_tree_index(tsize, idx){ unsigned int X = tsize >> (8U); if (X == 0) idx = 0; else
if (X > 0xFFFF) idx = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); idx = (bindex_t
)((K << 1) + ((tsize >> (K + ((8U)-1)) & 1)))
; }};
3461 assert(tindex == idx)if(!(tindex == idx)) abort();
3462 assert(tsize >= MIN_LARGE_SIZE)if(!(tsize >= (((size_t)1) << (8U)))) abort();
3463 assert(tsize >= minsize_for_tree_index(idx))if(!(tsize >= ((((size_t)1) << (((idx) >> 1) +
(8U))) | (((size_t)((idx) & ((size_t)1))) << (((idx
) >> 1) + (8U) - 1))))) abort();
3464 assert((idx == NTREEBINS-1) || (tsize < minsize_for_tree_index((idx+1))))if(!((idx == (32U)-1) || (tsize < ((((size_t)1) << (
(((idx+1)) >> 1) + (8U))) | (((size_t)(((idx+1)) & (
(size_t)1))) << ((((idx+1)) >> 1) + (8U) - 1)))))
) abort();
3465
3466 do { /* traverse through chain of same-sized nodes */
3467 do_check_any_chunk(m, ((mchunkptr)u));
3468 assert(u->index == tindex)if(!(u->index == tindex)) abort();
3469 assert(chunksize(u) == tsize)if(!(((u)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == tsize)) abort();
3470 assert(!is_inuse(u))if(!(!(((u)->head & ((((size_t)1))|(((size_t)2)))) != (
((size_t)1))))) abort();
3471 assert(!next_pinuse(u))if(!(!((((mchunkptr)( ((char*)(u)) + ((u)->head & ~(((
(size_t)1))|(((size_t)2))|(((size_t)4))))))->head) & (
((size_t)1))))) abort();
3472 assert(u->fd->bk == u)if(!(u->fd->bk == u)) abort();
3473 assert(u->bk->fd == u)if(!(u->bk->fd == u)) abort();
3474 if (u->parent == 0) {
3475 assert(u->child[0] == 0)if(!(u->child[0] == 0)) abort();
3476 assert(u->child[1] == 0)if(!(u->child[1] == 0)) abort();
3477 }
3478 else {
3479 assert(head == 0)if(!(head == 0)) abort(); /* only one node on chain has parent */
3480 head = u;
3481 assert(u->parent != u)if(!(u->parent != u)) abort();
3482 assert (u->parent->child[0] == u ||if(!(u->parent->child[0] == u || u->parent->child
[1] == u || *((tbinptr*)(u->parent)) == u)) abort()
3483 u->parent->child[1] == u ||if(!(u->parent->child[0] == u || u->parent->child
[1] == u || *((tbinptr*)(u->parent)) == u)) abort()
3484 *((tbinptr*)(u->parent)) == u)if(!(u->parent->child[0] == u || u->parent->child
[1] == u || *((tbinptr*)(u->parent)) == u)) abort();
3485 if (u->child[0] != 0) {
3486 assert(u->child[0]->parent == u)if(!(u->child[0]->parent == u)) abort();
3487 assert(u->child[0] != u)if(!(u->child[0] != u)) abort();
3488 do_check_tree(m, u->child[0]);
3489 }
3490 if (u->child[1] != 0) {
3491 assert(u->child[1]->parent == u)if(!(u->child[1]->parent == u)) abort();
3492 assert(u->child[1] != u)if(!(u->child[1] != u)) abort();
3493 do_check_tree(m, u->child[1]);
3494 }
3495 if (u->child[0] != 0 && u->child[1] != 0) {
3496 assert(chunksize(u->child[0]) < chunksize(u->child[1]))if(!(((u->child[0])->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) < ((u->child[1])->head & ~
(((((size_t)1))|(((size_t)2))|(((size_t)4))))))) abort();
3497 }
3498 }
3499 u = u->fd;
3500 } while (u != t);
3501 assert(head != 0)if(!(head != 0)) abort();
3502}
3503
3504/* Check all the chunks in a treebin. */
3505static void do_check_treebin(mstate m, bindex_t i) {
3506 tbinptr* tb = treebin_at(m, i)(&((m)->treebins[i]));
3507 tchunkptr t = *tb;
3508 int empty = (m->treemap & (1U << i)) == 0;
3509 if (t == 0)
3510 assert(empty)if(!(empty)) abort();
3511 if (!empty)
3512 do_check_tree(m, t);
3513}
3514
3515/* Check all the chunks in a smallbin. */
3516static void do_check_smallbin(mstate m, bindex_t i) {
3517 sbinptr b = smallbin_at(m, i)((sbinptr)((char*)&((m)->smallbins[(i)<<1])));
3518 mchunkptr p = b->bk;
3519 unsigned int empty = (m->smallmap & (1U << i)) == 0;
3520 if (p == b)
3521 assert(empty)if(!(empty)) abort();
3522 if (!empty) {
3523 for (; p != b; p = p->bk) {
3524 size_t size = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3525 mchunkptr q;
3526 /* each chunk claims to be free */
3527 do_check_free_chunk(m, p);
3528 /* chunk belongs in bin */
3529 assert(small_index(size) == i)if(!((bindex_t)((size) >> (3U)) == i)) abort();
3530 assert(p->bk == b || chunksize(p->bk) == chunksize(p))if(!(p->bk == b || ((p->bk)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) == ((p)->head & ~(
((((size_t)1))|(((size_t)2))|(((size_t)4))))))) abort();
3531 /* chunk is followed by an inuse chunk */
3532 q = next_chunk(p)((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
3533 if (q->head != FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t))))
3534 do_check_inuse_chunk(m, q);
3535 }
3536 }
3537}
3538
3539/* Find x in a bin. Used in other check functions. */
3540static int bin_find(mstate m, mchunkptr x) {
3541 size_t size = chunksize(x)((x)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3542 if (is_small(size)(((size) >> (3U)) < (32U))) {
3543 bindex_t sidx = small_index(size)(bindex_t)((size) >> (3U));
3544 sbinptr b = smallbin_at(m, sidx)((sbinptr)((char*)&((m)->smallbins[(sidx)<<1])));
3545 if (smallmap_is_marked(m, sidx)((m)->smallmap & ((binmap_t)(1) << (sidx)))) {
3546 mchunkptr p = b;
3547 do {
3548 if (p == x)
3549 return 1;
3550 } while ((p = p->fd) != b);
3551 }
3552 }
3553 else {
3554 bindex_t tidx;
3555 compute_tree_index(size, tidx){ unsigned int X = size >> (8U); if (X == 0) tidx = 0; else
if (X > 0xFFFF) tidx = (32U)-1; else { unsigned int K = (
unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); tidx
= (bindex_t)((K << 1) + ((size >> (K + ((8U)-1))
& 1))); }};
3556 if (treemap_is_marked(m, tidx)((m)->treemap & ((binmap_t)(1) << (tidx)))) {
3557 tchunkptr t = *treebin_at(m, tidx)(&((m)->treebins[tidx]));
3558 size_t sizebits = size << leftshift_for_tree_index(tidx)((tidx == (32U)-1)? 0 : (((sizeof(size_t) << 3)-((size_t
)1)) - (((tidx) >> 1) + (8U) - 2)));
3559 while (t != 0 && chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) != size) {
3560 t = t->child[(sizebits >> (SIZE_T_BITSIZE(sizeof(size_t) << 3)-SIZE_T_ONE((size_t)1))) & 1];
3561 sizebits <<= 1;
3562 }
3563 if (t != 0) {
3564 tchunkptr u = t;
3565 do {
3566 if (u == (tchunkptr)x)
3567 return 1;
3568 } while ((u = u->fd) != t);
3569 }
3570 }
3571 }
3572 return 0;
3573}
3574
3575/* Traverse each chunk and check it; return total */
3576static size_t traverse_and_check(mstate m) {
3577 size_t sum = 0;
3578 if (is_initialized(m)((m)->top != 0)) {
3579 msegmentptr s = &m->seg;
3580 sum += m->topsize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
3581 while (s != 0) {
3582 mchunkptr q = align_as_chunk(s->base)(mchunkptr)((s->base) + ((((size_t)(((void*)((char*)(s->
base) + ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(s->base) + ((sizeof
(size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))));
3583 mchunkptr lastq = 0;
3584 assert(pinuse(q))if(!(((q)->head & (((size_t)1))))) abort();
3585 while (segment_holds(s, q)((char*)(q) >= s->base && (char*)(q) < s->
base + s->size) &&
3586 q != m->top && q->head != FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)))) {
3587 sum += chunksize(q)((q)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3588 if (is_inuse(q)(((q)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1)))) {
3589 assert(!bin_find(m, q))if(!(!bin_find(m, q))) abort();
3590 do_check_inuse_chunk(m, q);
3591 }
3592 else {
3593 assert(q == m->dv || bin_find(m, q))if(!(q == m->dv || bin_find(m, q))) abort();
3594 assert(lastq == 0 || is_inuse(lastq))if(!(lastq == 0 || (((lastq)->head & ((((size_t)1))|((
(size_t)2)))) != (((size_t)1))))) abort(); /* Not 2 consecutive free */
3595 do_check_free_chunk(m, q);
3596 }
3597 lastq = q;
3598 q = next_chunk(q)((mchunkptr)( ((char*)(q)) + ((q)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
3599 }
3600 s = s->next;
3601 }
3602 }
3603 return sum;
3604}
3605
3606
3607/* Check all properties of malloc_state. */
3608static void do_check_malloc_state(mstate m) {
3609 bindex_t i;
3610 size_t total;
3611 /* check bins */
3612 for (i = 0; i < NSMALLBINS(32U); ++i)
3613 do_check_smallbin(m, i);
3614 for (i = 0; i < NTREEBINS(32U); ++i)
3615 do_check_treebin(m, i);
3616
3617 if (m->dvsize != 0) { /* check dv chunk */
3618 do_check_any_chunk(m, m->dv);
3619 assert(m->dvsize == chunksize(m->dv))if(!(m->dvsize == ((m->dv)->head & ~(((((size_t)
1))|(((size_t)2))|(((size_t)4))))))) abort();
3620 assert(m->dvsize >= MIN_CHUNK_SIZE)if(!(m->dvsize >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort();
3621 assert(bin_find(m, m->dv) == 0)if(!(bin_find(m, m->dv) == 0)) abort();
3622 }
3623
3624 if (m->top != 0) { /* check top chunk */
3625 do_check_top_chunk(m, m->top);
3626 /*assert(m->topsize == chunksize(m->top)); redundant */
3627 assert(m->topsize > 0)if(!(m->topsize > 0)) abort();
3628 assert(bin_find(m, m->top) == 0)if(!(bin_find(m, m->top) == 0)) abort();
3629 }
3630
3631 total = traverse_and_check(m);
3632 assert(total <= m->footprint)if(!(total <= m->footprint)) abort();
3633 assert(m->footprint <= m->max_footprint)if(!(m->footprint <= m->max_footprint)) abort();
3634}
3635#endif /* DEBUG */
3636
3637/* ----------------------------- statistics ------------------------------ */
3638
3639#if !NO_MALLINFO1
3640static struct mallinfo internal_mallinfo(mstate m) {
3641 struct mallinfo nm = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
3642 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
3643 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
3644 check_malloc_state(m)do_check_malloc_state(m);
3645 if (is_initialized(m)((m)->top != 0)) {
3646 size_t nfree = SIZE_T_ONE((size_t)1); /* top always free */
3647 size_t mfree = m->topsize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
3648 size_t sum = mfree;
3649 msegmentptr s = &m->seg;
3650 while (s != 0) {
3651 mchunkptr q = align_as_chunk(s->base)(mchunkptr)((s->base) + ((((size_t)(((void*)((char*)(s->
base) + ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(s->base) + ((sizeof
(size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))));
3652 while (segment_holds(s, q)((char*)(q) >= s->base && (char*)(q) < s->
base + s->size) &&
3653 q != m->top && q->head != FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)))) {
3654 size_t sz = chunksize(q)((q)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3655 sum += sz;
3656 if (!is_inuse(q)(((q)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1)))) {
3657 mfree += sz;
3658 ++nfree;
3659 }
3660 q = next_chunk(q)((mchunkptr)( ((char*)(q)) + ((q)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
3661 }
3662 s = s->next;
3663 }
3664
3665 nm.arena = sum;
3666 nm.ordblks = nfree;
3667 nm.hblkhd = m->footprint - sum;
3668 nm.usmblks = m->max_footprint;
3669 nm.uordblks = m->footprint - mfree;
3670 nm.fordblks = mfree;
3671 nm.keepcost = m->topsize;
3672 }
3673
3674 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
3675 }
3676 return nm;
3677}
3678#endif /* !NO_MALLINFO */
3679
3680#if !NO_MALLOC_STATS0
3681static void internal_malloc_stats(mstate m) {
3682 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
3683 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
3684 size_t maxfp = 0;
3685 size_t fp = 0;
3686 size_t used = 0;
3687 check_malloc_state(m)do_check_malloc_state(m);
3688 if (is_initialized(m)((m)->top != 0)) {
3689 msegmentptr s = &m->seg;
3690 maxfp = m->max_footprint;
3691 fp = m->footprint;
3692 used = fp - (m->topsize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
3693
3694 while (s != 0) {
3695 mchunkptr q = align_as_chunk(s->base)(mchunkptr)((s->base) + ((((size_t)(((void*)((char*)(s->
base) + ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(s->base) + ((sizeof
(size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))));
3696 while (segment_holds(s, q)((char*)(q) >= s->base && (char*)(q) < s->
base + s->size) &&
3697 q != m->top && q->head != FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)))) {
3698 if (!is_inuse(q)(((q)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))))
3699 used -= chunksize(q)((q)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
3700 q = next_chunk(q)((mchunkptr)( ((char*)(q)) + ((q)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
3701 }
3702 s = s->next;
3703 }
3704 }
3705 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); }; /* drop lock */
3706 fprintf(stderrstderr, "max system bytes = %10lu\n", (unsigned long)(maxfp));
3707 fprintf(stderrstderr, "system bytes = %10lu\n", (unsigned long)(fp));
3708 fprintf(stderrstderr, "in use bytes = %10lu\n", (unsigned long)(used));
3709 }
3710}
3711#endif /* NO_MALLOC_STATS */
3712
3713/* ----------------------- Operations on smallbins ----------------------- */
3714
3715/*
3716 Various forms of linking and unlinking are defined as macros. Even
3717 the ones for trees, which are very long but have very short typical
3718 paths. This is ugly but reduces reliance on inlining support of
3719 compilers.
3720*/
3721
3722/* Link a free chunk into a smallbin */
3723#define insert_small_chunk(M, P, S){ bindex_t I = (bindex_t)((S) >> (3U)); mchunkptr B = (
(sbinptr)((char*)&((M)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(S >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((M)->smallmap & (
(binmap_t)(1) << (I)))) ((M)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (M)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = P; F->bk = P; P->fd = F; P->bk = B;
} {\
3724 bindex_t I = small_index(S)(bindex_t)((S) >> (3U));\
3725 mchunkptr B = smallbin_at(M, I)((sbinptr)((char*)&((M)->smallbins[(I)<<1])));\
3726 mchunkptr F = B;\
3727 assert(S >= MIN_CHUNK_SIZE)if(!(S >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1))))) abort();\
3728 if (!smallmap_is_marked(M, I)((M)->smallmap & ((binmap_t)(1) << (I))))\
3729 mark_smallmap(M, I)((M)->smallmap |= ((binmap_t)(1) << (I)));\
3730 else if (RTCHECK(ok_address(M, B->fd))__builtin_expect(((char*)(B->fd) >= (M)->least_addr)
, 1))\
3731 F = B->fd;\
3732 else {\
3733 CORRUPTION_ERROR_ACTION(M)abort();\
3734 }\
3735 B->fd = P;\
3736 F->bk = P;\
3737 P->fd = F;\
3738 P->bk = B;\
3739}
3740
3741/* Unlink a chunk from a smallbin */
3742#define unlink_small_chunk(M, P, S){ mchunkptr F = P->fd; mchunkptr B = P->bk; bindex_t I =
(bindex_t)((S) >> (3U)); if(!(P != B)) abort(); if(!(P
!= F)) abort(); if(!(((P)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort()
; if (__builtin_expect(F == ((sbinptr)((char*)&((M)->smallbins
[(I)<<1]))) || (((char*)(F) >= (M)->least_addr) &&
F->bk == P), 1)) { if (B == F) { ((M)->smallmap &=
~((binmap_t)(1) << (I))); } else if (__builtin_expect(
B == ((sbinptr)((char*)&((M)->smallbins[(I)<<1])
)) || (((char*)(B) >= (M)->least_addr) && B->
fd == P), 1)) { F->bk = B; B->fd = F; } else { abort();
} } else { abort(); }} {\
3743 mchunkptr F = P->fd;\
3744 mchunkptr B = P->bk;\
3745 bindex_t I = small_index(S)(bindex_t)((S) >> (3U));\
3746 assert(P != B)if(!(P != B)) abort();\
3747 assert(P != F)if(!(P != F)) abort();\
3748 assert(chunksize(P) == small_index2size(I))if(!(((P)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((I) << (3U)))) abort();\
3749 if (RTCHECK(F == smallbin_at(M,I) || (ok_address(M, F) && F->bk == P))__builtin_expect(F == ((sbinptr)((char*)&((M)->smallbins
[(I)<<1]))) || (((char*)(F) >= (M)->least_addr) &&
F->bk == P), 1)) { \
3750 if (B == F) {\
3751 clear_smallmap(M, I)((M)->smallmap &= ~((binmap_t)(1) << (I)));\
3752 }\
3753 else if (RTCHECK(B == smallbin_at(M,I) ||\__builtin_expect(B == ((sbinptr)((char*)&((M)->smallbins
[(I)<<1]))) || (((char*)(B) >= (M)->least_addr) &&
B->fd == P), 1)
3754 (ok_address(M, B) && B->fd == P))__builtin_expect(B == ((sbinptr)((char*)&((M)->smallbins
[(I)<<1]))) || (((char*)(B) >= (M)->least_addr) &&
B->fd == P), 1)) {\
3755 F->bk = B;\
3756 B->fd = F;\
3757 }\
3758 else {\
3759 CORRUPTION_ERROR_ACTION(M)abort();\
3760 }\
3761 }\
3762 else {\
3763 CORRUPTION_ERROR_ACTION(M)abort();\
3764 }\
3765}
3766
3767/* Unlink the first chunk from a smallbin */
3768#define unlink_first_small_chunk(M, B, P, I){ mchunkptr F = P->fd; if(!(P != B)) abort(); if(!(P != F)
) abort(); if(!(((P)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) == ((I) << (3U)))) abort(); if (B
== F) { ((M)->smallmap &= ~((binmap_t)(1) << (I
))); } else if (__builtin_expect(((char*)(F) >= (M)->least_addr
) && F->bk == P, 1)) { F->bk = B; B->fd = F;
} else { abort(); }} {\
3769 mchunkptr F = P->fd;\
3770 assert(P != B)if(!(P != B)) abort();\
3771 assert(P != F)if(!(P != F)) abort();\
3772 assert(chunksize(P) == small_index2size(I))if(!(((P)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((I) << (3U)))) abort();\
3773 if (B == F) {\
3774 clear_smallmap(M, I)((M)->smallmap &= ~((binmap_t)(1) << (I)));\
3775 }\
3776 else if (RTCHECK(ok_address(M, F) && F->bk == P)__builtin_expect(((char*)(F) >= (M)->least_addr) &&
F->bk == P, 1)) {\
3777 F->bk = B;\
3778 B->fd = F;\
3779 }\
3780 else {\
3781 CORRUPTION_ERROR_ACTION(M)abort();\
3782 }\
3783}
3784
3785/* Replace dv node, binning the old one */
3786/* Used only when dvsize known to be small */
3787#define replace_dv(M, P, S){ size_t DVS = M->dvsize; if(!((((DVS) >> (3U)) <
(32U)))) abort(); if (DVS != 0) { mchunkptr DV = M->dv; {
bindex_t I = (bindex_t)((DVS) >> (3U)); mchunkptr B = (
(sbinptr)((char*)&((M)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(DVS >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((M)->smallmap & (
(binmap_t)(1) << (I)))) ((M)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (M)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = DV; F->bk = DV; DV->fd = F; DV->bk =
B;}; } M->dvsize = S; M->dv = P;} {\
3788 size_t DVS = M->dvsize;\
3789 assert(is_small(DVS))if(!((((DVS) >> (3U)) < (32U)))) abort();\
3790 if (DVS != 0) {\
3791 mchunkptr DV = M->dv;\
3792 insert_small_chunk(M, DV, DVS){ bindex_t I = (bindex_t)((DVS) >> (3U)); mchunkptr B =
((sbinptr)((char*)&((M)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(DVS >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((M)->smallmap & (
(binmap_t)(1) << (I)))) ((M)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (M)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = DV; F->bk = DV; DV->fd = F; DV->bk =
B;};\
3793 }\
3794 M->dvsize = S;\
3795 M->dv = P;\
3796}
3797
3798/* ------------------------- Operations on trees ------------------------- */
3799
3800/* Insert chunk into tree */
3801#define insert_large_chunk(M, X, S){ tbinptr* H; bindex_t I; { unsigned int X = S >> (8U);
if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1; else
{ unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz
(X); I = (bindex_t)((K << 1) + ((S >> (K + ((8U)-
1)) & 1))); }}; H = (&((M)->treebins[I])); X->index
= I; X->child[0] = X->child[1] = 0; if (!((M)->treemap
& ((binmap_t)(1) << (I)))) { ((M)->treemap |= (
(binmap_t)(1) << (I))); *H = X; X->parent = (tchunkptr
)H; X->fd = X->bk = X; } else { tchunkptr T = *H; size_t
K = S << ((I == (32U)-1)? 0 : (((sizeof(size_t) <<
3)-((size_t)1)) - (((I) >> 1) + (8U) - 2))); for (;;) {
if (((T)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) != S) { tchunkptr* C = &(T->child[(K >> (
(sizeof(size_t) << 3)-((size_t)1))) & 1]); K <<=
1; if (*C != 0) T = *C; else if (__builtin_expect(((char*)(C
) >= (M)->least_addr), 1)) { *C = X; X->parent = T; X
->fd = X->bk = X; break; } else { abort(); break; } } else
{ tchunkptr F = T->fd; if (__builtin_expect(((char*)(T) >=
(M)->least_addr) && ((char*)(F) >= (M)->least_addr
), 1)) { T->fd = F->bk = X; X->fd = F; X->bk = T;
X->parent = 0; break; } else { abort(); break; } } } }} {\
3802 tbinptr* H;\
3803 bindex_t I;\
3804 compute_tree_index(S, I){ unsigned int X = S >> (8U); if (X == 0) I = 0; else if
(X > 0xFFFF) I = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); I = (bindex_t
)((K << 1) + ((S >> (K + ((8U)-1)) & 1))); }};\
3805 H = treebin_at(M, I)(&((M)->treebins[I]));\
3806 X->index = I;\
3807 X->child[0] = X->child[1] = 0;\
3808 if (!treemap_is_marked(M, I)((M)->treemap & ((binmap_t)(1) << (I)))) {\
3809 mark_treemap(M, I)((M)->treemap |= ((binmap_t)(1) << (I)));\
3810 *H = X;\
3811 X->parent = (tchunkptr)H;\
3812 X->fd = X->bk = X;\
3813 }\
3814 else {\
3815 tchunkptr T = *H;\
3816 size_t K = S << leftshift_for_tree_index(I)((I == (32U)-1)? 0 : (((sizeof(size_t) << 3)-((size_t)1
)) - (((I) >> 1) + (8U) - 2)));\
3817 for (;;) {\
3818 if (chunksize(T)((T)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) != S) {\
3819 tchunkptr* C = &(T->child[(K >> (SIZE_T_BITSIZE(sizeof(size_t) << 3)-SIZE_T_ONE((size_t)1))) & 1]);\
3820 K <<= 1;\
3821 if (*C != 0)\
3822 T = *C;\
3823 else if (RTCHECK(ok_address(M, C))__builtin_expect(((char*)(C) >= (M)->least_addr), 1)) {\
3824 *C = X;\
3825 X->parent = T;\
3826 X->fd = X->bk = X;\
3827 break;\
3828 }\
3829 else {\
3830 CORRUPTION_ERROR_ACTION(M)abort();\
3831 break;\
3832 }\
3833 }\
3834 else {\
3835 tchunkptr F = T->fd;\
3836 if (RTCHECK(ok_address(M, T) && ok_address(M, F))__builtin_expect(((char*)(T) >= (M)->least_addr) &&
((char*)(F) >= (M)->least_addr), 1)) {\
3837 T->fd = F->bk = X;\
3838 X->fd = F;\
3839 X->bk = T;\
3840 X->parent = 0;\
3841 break;\
3842 }\
3843 else {\
3844 CORRUPTION_ERROR_ACTION(M)abort();\
3845 break;\
3846 }\
3847 }\
3848 }\
3849 }\
3850}
3851
3852/*
3853 Unlink steps:
3854
3855 1. If x is a chained node, unlink it from its same-sized fd/bk links
3856 and choose its bk node as its replacement.
3857 2. If x was the last node of its size, but not a leaf node, it must
3858 be replaced with a leaf node (not merely one with an open left or
3859 right), to make sure that lefts and rights of descendants
3860 correspond properly to bit masks. We use the rightmost descendant
3861 of x. We could use any other leaf, but this is easy to locate and
3862 tends to counteract removal of leftmosts elsewhere, and so keeps
3863 paths shorter than minimally guaranteed. This doesn't loop much
3864 because on average a node in a tree is near the bottom.
3865 3. If x is the base of a chain (i.e., has parent links) relink
3866 x's parent and children to x's replacement (or null if none).
3867*/
3868
3869#define unlink_large_chunk(M, X){ tchunkptr XP = X->parent; tchunkptr R; if (X->bk != X
) { tchunkptr F = X->fd; R = X->bk; if (__builtin_expect
(((char*)(F) >= (M)->least_addr) && F->bk ==
X && R->fd == X, 1)) { F->bk = R; R->fd = F
; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP =
&(X->child[1]))) != 0) || ((R = *(RP = &(X->child
[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->child
[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R = *(
RP = CP); } if (__builtin_expect(((char*)(RP) >= (M)->least_addr
), 1)) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr*
H = (&((M)->treebins[X->index])); if (X == *H) { if
((*H = R) == 0) ((M)->treemap &= ~((binmap_t)(1) <<
(X->index))); } else if (__builtin_expect(((char*)(XP) >=
(M)->least_addr), 1)) { if (XP->child[0] == X) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (M)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = X->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (M)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = X->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (M)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}} {\
3870 tchunkptr XP = X->parent;\
3871 tchunkptr R;\
3872 if (X->bk != X) {\
3873 tchunkptr F = X->fd;\
3874 R = X->bk;\
3875 if (RTCHECK(ok_address(M, F) && F->bk == X && R->fd == X)__builtin_expect(((char*)(F) >= (M)->least_addr) &&
F->bk == X && R->fd == X, 1)) {\
3876 F->bk = R;\
3877 R->fd = F;\
3878 }\
3879 else {\
3880 CORRUPTION_ERROR_ACTION(M)abort();\
3881 }\
3882 }\
3883 else {\
3884 tchunkptr* RP;\
3885 if (((R = *(RP = &(X->child[1]))) != 0) ||\
3886 ((R = *(RP = &(X->child[0]))) != 0)) {\
3887 tchunkptr* CP;\
3888 while ((*(CP = &(R->child[1])) != 0) ||\
3889 (*(CP = &(R->child[0])) != 0)) {\
3890 R = *(RP = CP);\
3891 }\
3892 if (RTCHECK(ok_address(M, RP))__builtin_expect(((char*)(RP) >= (M)->least_addr), 1))\
3893 *RP = 0;\
3894 else {\
3895 CORRUPTION_ERROR_ACTION(M)abort();\
3896 }\
3897 }\
3898 }\
3899 if (XP != 0) {\
3900 tbinptr* H = treebin_at(M, X->index)(&((M)->treebins[X->index]));\
3901 if (X == *H) {\
3902 if ((*H = R) == 0) \
3903 clear_treemap(M, X->index)((M)->treemap &= ~((binmap_t)(1) << (X->index
)));\
3904 }\
3905 else if (RTCHECK(ok_address(M, XP))__builtin_expect(((char*)(XP) >= (M)->least_addr), 1)) {\
3906 if (XP->child[0] == X) \
3907 XP->child[0] = R;\
3908 else \
3909 XP->child[1] = R;\
3910 }\
3911 else\
3912 CORRUPTION_ERROR_ACTION(M)abort();\
3913 if (R != 0) {\
3914 if (RTCHECK(ok_address(M, R))__builtin_expect(((char*)(R) >= (M)->least_addr), 1)) {\
3915 tchunkptr C0, C1;\
3916 R->parent = XP;\
3917 if ((C0 = X->child[0]) != 0) {\
3918 if (RTCHECK(ok_address(M, C0))__builtin_expect(((char*)(C0) >= (M)->least_addr), 1)) {\
3919 R->child[0] = C0;\
3920 C0->parent = R;\
3921 }\
3922 else\
3923 CORRUPTION_ERROR_ACTION(M)abort();\
3924 }\
3925 if ((C1 = X->child[1]) != 0) {\
3926 if (RTCHECK(ok_address(M, C1))__builtin_expect(((char*)(C1) >= (M)->least_addr), 1)) {\
3927 R->child[1] = C1;\
3928 C1->parent = R;\
3929 }\
3930 else\
3931 CORRUPTION_ERROR_ACTION(M)abort();\
3932 }\
3933 }\
3934 else\
3935 CORRUPTION_ERROR_ACTION(M)abort();\
3936 }\
3937 }\
3938}
3939
3940/* Relays to large vs small bin operations */
3941
3942#define insert_chunk(M, P, S)if ((((S) >> (3U)) < (32U))) { bindex_t I = (bindex_t
)((S) >> (3U)); mchunkptr B = ((sbinptr)((char*)&((
M)->smallbins[(I)<<1]))); mchunkptr F = B; if(!(S >=
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
) abort(); if (!((M)->smallmap & ((binmap_t)(1) <<
(I)))) ((M)->smallmap |= ((binmap_t)(1) << (I))); else
if (__builtin_expect(((char*)(B->fd) >= (M)->least_addr
), 1)) F = B->fd; else { abort(); } B->fd = P; F->bk
= P; P->fd = F; P->bk = B;} else { tchunkptr TP = (tchunkptr
)(P); { tbinptr* H; bindex_t I; { unsigned int X = S >>
(8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1
; else { unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned
) __builtin_clz(X); I = (bindex_t)((K << 1) + ((S >>
(K + ((8U)-1)) & 1))); }}; H = (&((M)->treebins[I
])); TP->index = I; TP->child[0] = TP->child[1] = 0;
if (!((M)->treemap & ((binmap_t)(1) << (I)))) {
((M)->treemap |= ((binmap_t)(1) << (I))); *H = TP; TP
->parent = (tchunkptr)H; TP->fd = TP->bk = TP; } else
{ tchunkptr T = *H; size_t K = S << ((I == (32U)-1)? 0
: (((sizeof(size_t) << 3)-((size_t)1)) - (((I) >>
1) + (8U) - 2))); for (;;) { if (((T)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) != S) { tchunkptr* C = &
(T->child[(K >> ((sizeof(size_t) << 3)-((size_t
)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else if (
__builtin_expect(((char*)(C) >= (M)->least_addr), 1)) {
*C = TP; TP->parent = T; TP->fd = TP->bk = TP; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (M)->least_addr) &&
((char*)(F) >= (M)->least_addr), 1)) { T->fd = F->
bk = TP; TP->fd = F; TP->bk = T; TP->parent = 0; break
; } else { abort(); break; } } } }}; }\
3943 if (is_small(S)(((S) >> (3U)) < (32U))) insert_small_chunk(M, P, S){ bindex_t I = (bindex_t)((S) >> (3U)); mchunkptr B = (
(sbinptr)((char*)&((M)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(S >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((M)->smallmap & (
(binmap_t)(1) << (I)))) ((M)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (M)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = P; F->bk = P; P->fd = F; P->bk = B;
}\
3944 else { tchunkptr TP = (tchunkptr)(P); insert_large_chunk(M, TP, S){ tbinptr* H; bindex_t I; { unsigned int X = S >> (8U);
if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1; else
{ unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz
(X); I = (bindex_t)((K << 1) + ((S >> (K + ((8U)-
1)) & 1))); }}; H = (&((M)->treebins[I])); TP->
index = I; TP->child[0] = TP->child[1] = 0; if (!((M)->
treemap & ((binmap_t)(1) << (I)))) { ((M)->treemap
|= ((binmap_t)(1) << (I))); *H = TP; TP->parent = (
tchunkptr)H; TP->fd = TP->bk = TP; } else { tchunkptr T
= *H; size_t K = S << ((I == (32U)-1)? 0 : (((sizeof(size_t
) << 3)-((size_t)1)) - (((I) >> 1) + (8U) - 2)));
for (;;) { if (((T)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) != S) { tchunkptr* C = &(T->child
[(K >> ((sizeof(size_t) << 3)-((size_t)1))) &
1]); K <<= 1; if (*C != 0) T = *C; else if (__builtin_expect
(((char*)(C) >= (M)->least_addr), 1)) { *C = TP; TP->
parent = T; TP->fd = TP->bk = TP; break; } else { abort
(); break; } } else { tchunkptr F = T->fd; if (__builtin_expect
(((char*)(T) >= (M)->least_addr) && ((char*)(F)
>= (M)->least_addr), 1)) { T->fd = F->bk = TP; TP
->fd = F; TP->bk = T; TP->parent = 0; break; } else {
abort(); break; } } } }}; }
3945
3946#define unlink_chunk(M, P, S)if ((((S) >> (3U)) < (32U))) { mchunkptr F = P->fd
; mchunkptr B = P->bk; bindex_t I = (bindex_t)((S) >>
(3U)); if(!(P != B)) abort(); if(!(P != F)) abort(); if(!(((
P)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)4)
)))) == ((I) << (3U)))) abort(); if (__builtin_expect(F
== ((sbinptr)((char*)&((M)->smallbins[(I)<<1]))
) || (((char*)(F) >= (M)->least_addr) && F->
bk == P), 1)) { if (B == F) { ((M)->smallmap &= ~((binmap_t
)(1) << (I))); } else if (__builtin_expect(B == ((sbinptr
)((char*)&((M)->smallbins[(I)<<1]))) || (((char*
)(B) >= (M)->least_addr) && B->fd == P), 1))
{ F->bk = B; B->fd = F; } else { abort(); } } else { abort
(); }} else { tchunkptr TP = (tchunkptr)(P); { tchunkptr XP =
TP->parent; tchunkptr R; if (TP->bk != TP) { tchunkptr
F = TP->fd; R = TP->bk; if (__builtin_expect(((char*)(
F) >= (M)->least_addr) && F->bk == TP &&
R->fd == TP, 1)) { F->bk = R; R->fd = F; } else { abort
(); } } else { tchunkptr* RP; if (((R = *(RP = &(TP->child
[1]))) != 0) || ((R = *(RP = &(TP->child[0]))) != 0)) {
tchunkptr* CP; while ((*(CP = &(R->child[1])) != 0) ||
(*(CP = &(R->child[0])) != 0)) { R = *(RP = CP); } if
(__builtin_expect(((char*)(RP) >= (M)->least_addr), 1)
) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr* H = (
&((M)->treebins[TP->index])); if (TP == *H) { if ((
*H = R) == 0) ((M)->treemap &= ~((binmap_t)(1) <<
(TP->index))); } else if (__builtin_expect(((char*)(XP) >=
(M)->least_addr), 1)) { if (XP->child[0] == TP) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (M)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = TP->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (M)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = TP->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (M)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}}; }\
3947 if (is_small(S)(((S) >> (3U)) < (32U))) unlink_small_chunk(M, P, S){ mchunkptr F = P->fd; mchunkptr B = P->bk; bindex_t I =
(bindex_t)((S) >> (3U)); if(!(P != B)) abort(); if(!(P
!= F)) abort(); if(!(((P)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort()
; if (__builtin_expect(F == ((sbinptr)((char*)&((M)->smallbins
[(I)<<1]))) || (((char*)(F) >= (M)->least_addr) &&
F->bk == P), 1)) { if (B == F) { ((M)->smallmap &=
~((binmap_t)(1) << (I))); } else if (__builtin_expect(
B == ((sbinptr)((char*)&((M)->smallbins[(I)<<1])
)) || (((char*)(B) >= (M)->least_addr) && B->
fd == P), 1)) { F->bk = B; B->fd = F; } else { abort();
} } else { abort(); }}\
3948 else { tchunkptr TP = (tchunkptr)(P); unlink_large_chunk(M, TP){ tchunkptr XP = TP->parent; tchunkptr R; if (TP->bk !=
TP) { tchunkptr F = TP->fd; R = TP->bk; if (__builtin_expect
(((char*)(F) >= (M)->least_addr) && F->bk ==
TP && R->fd == TP, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(TP->child[1]))) != 0) || ((R = *(RP = &(TP->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (M)->
least_addr), 1)) *RP = 0; else { abort(); } } } if (XP != 0) {
tbinptr* H = (&((M)->treebins[TP->index])); if (TP
== *H) { if ((*H = R) == 0) ((M)->treemap &= ~((binmap_t
)(1) << (TP->index))); } else if (__builtin_expect((
(char*)(XP) >= (M)->least_addr), 1)) { if (XP->child
[0] == TP) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(M)->least_addr), 1)) { tchunkptr C0, C1; R->parent = XP
; if ((C0 = TP->child[0]) != 0) { if (__builtin_expect(((char
*)(C0) >= (M)->least_addr), 1)) { R->child[0] = C0; C0
->parent = R; } else abort(); } if ((C1 = TP->child[1])
!= 0) { if (__builtin_expect(((char*)(C1) >= (M)->least_addr
), 1)) { R->child[1] = C1; C1->parent = R; } else abort
(); } } else abort(); } }}; }
3949
3950
3951/* Relays to internal calls to malloc/free from realloc, memalign etc */
3952
3953#if ONLY_MSPACES0
3954#define internal_malloc(m, b)dlmalloc(b) mspace_malloc(m, b)
3955#define internal_free(m, mem)dlfree(mem) mspace_free(m,mem);
3956#else /* ONLY_MSPACES */
3957#if MSPACES0
3958#define internal_malloc(m, b)dlmalloc(b)\
3959 ((m == gm(&_gm_))? dlmalloc(b) : mspace_malloc(m, b))
3960#define internal_free(m, mem)dlfree(mem)\
3961 if (m == gm(&_gm_)) dlfree(mem); else mspace_free(m,mem);
3962#else /* MSPACES */
3963#define internal_malloc(m, b)dlmalloc(b) dlmalloc(b)
3964#define internal_free(m, mem)dlfree(mem) dlfree(mem)
3965#endif /* MSPACES */
3966#endif /* ONLY_MSPACES */
3967
3968/* ----------------------- Direct-mmapping chunks ----------------------- */
3969
3970/*
3971 Directly mmapped chunks are set up with an offset to the start of
3972 the mmapped region stored in the prev_foot field of the chunk. This
3973 allows reconstruction of the required argument to MUNMAP when freed,
3974 and also allows adjustment of the returned chunk to meet alignment
3975 requirements (especially in memalign).
3976*/
3977
3978/* Malloc using mmap */
3979static void* mmap_alloc(mstate m, size_t nb) {
3980 size_t mmsize = mmap_align(nb + SIX_SIZE_T_SIZES + CHUNK_ALIGN_MASK)(((nb + (((sizeof(size_t))<<2)+((sizeof(size_t))<<
1)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) + (mparams
.page_size - ((size_t)1))) & ~(mparams.page_size - ((size_t
)1)));
3981 if (m->footprint_limit != 0) {
3982 size_t fp = m->footprint + mmsize;
3983 if (fp <= m->footprint || fp > m->footprint_limit)
3984 return 0;
3985 }
3986 if (mmsize > nb) { /* Check for wrap around 0 */
3987 char* mm = (char*)(CALL_DIRECT_MMAP(mmsize)mmap(0, (mmsize), (0x1|0x2), (0x02|0x20), -1, 0));
3988 if (mm != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
3989 size_t offset = align_offset(chunk2mem(mm))((((size_t)(((void*)((char*)(mm) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(mm) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))));
3990 size_t psize = mmsize - offset - MMAP_FOOT_PAD(((sizeof(size_t))<<2));
3991 mchunkptr p = (mchunkptr)(mm + offset);
3992 p->prev_foot = offset;
3993 p->head = psize;
3994 mark_inuse_foot(m, p, psize);
3995 chunk_plus_offset(p, psize)((mchunkptr)(((char*)(p)) + (psize)))->head = FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)));
3996 chunk_plus_offset(p, psize+SIZE_T_SIZE)((mchunkptr)(((char*)(p)) + (psize+(sizeof(size_t)))))->head = 0;
3997
3998 if (m->least_addr == 0 || mm < m->least_addr)
3999 m->least_addr = mm;
4000 if ((m->footprint += mmsize) > m->max_footprint)
4001 m->max_footprint = m->footprint;
4002 assert(is_aligned(chunk2mem(p)))if(!((((size_t)((((void*)((char*)(p) + ((sizeof(size_t))<<
1))))) & ((((size_t)(2 * sizeof(void *))) - ((size_t)1)))
) == 0))) abort();
4003 check_mmapped_chunk(m, p)do_check_mmapped_chunk(m,p);
4004 return chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4005 }
4006 }
4007 return 0;
4008}
4009
4010/* Realloc using mmap */
4011static mchunkptr mmap_resize(mstate m, mchunkptr oldp, size_t nb, int flags) {
4012 size_t oldsize = chunksize(oldp)((oldp)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4)))));
4013 (void)flags; /* placate people compiling -Wunused */
4014 if (is_small(nb)(((nb) >> (3U)) < (32U))) /* Can't shrink mmap regions below small size */
4015 return 0;
4016 /* Keep old chunk if big enough but not too big */
4017 if (oldsize >= nb + SIZE_T_SIZE(sizeof(size_t)) &&
4018 (oldsize - nb) <= (mparams.granularity << 1))
4019 return oldp;
4020 else {
4021 size_t offset = oldp->prev_foot;
4022 size_t oldmmsize = oldsize + offset + MMAP_FOOT_PAD(((sizeof(size_t))<<2));
4023 size_t newmmsize = mmap_align(nb + SIX_SIZE_T_SIZES + CHUNK_ALIGN_MASK)(((nb + (((sizeof(size_t))<<2)+((sizeof(size_t))<<
1)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) + (mparams
.page_size - ((size_t)1))) & ~(mparams.page_size - ((size_t
)1)));
4024 char* cp = (char*)CALL_MREMAP((char*)oldp - offset,((void*)((~(size_t)0)))
4025 oldmmsize, newmmsize, flags)((void*)((~(size_t)0)));
4026 if (cp != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
4027 mchunkptr newp = (mchunkptr)(cp + offset);
4028 size_t psize = newmmsize - offset - MMAP_FOOT_PAD(((sizeof(size_t))<<2));
4029 newp->head = psize;
4030 mark_inuse_foot(m, newp, psize);
4031 chunk_plus_offset(newp, psize)((mchunkptr)(((char*)(newp)) + (psize)))->head = FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)));
4032 chunk_plus_offset(newp, psize+SIZE_T_SIZE)((mchunkptr)(((char*)(newp)) + (psize+(sizeof(size_t)))))->head = 0;
4033
4034 if (cp < m->least_addr)
4035 m->least_addr = cp;
4036 if ((m->footprint += newmmsize - oldmmsize) > m->max_footprint)
4037 m->max_footprint = m->footprint;
4038 check_mmapped_chunk(m, newp)do_check_mmapped_chunk(m,newp);
4039 return newp;
4040 }
4041 }
4042 return 0;
4043}
4044
4045
4046/* -------------------------- mspace management -------------------------- */
4047
4048/* Initialize top chunk and its size */
4049static void init_top(mstate m, mchunkptr p, size_t psize) {
4050 /* Ensure alignment */
4051 size_t offset = align_offset(chunk2mem(p))((((size_t)(((void*)((char*)(p) + ((sizeof(size_t))<<1)
))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) == 0
)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*)(
(char*)(p) + ((sizeof(size_t))<<1)))) & (((size_t)(
2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))));
4052 p = (mchunkptr)((char*)p + offset);
4053 psize -= offset;
4054
4055 m->top = p;
4056 m->topsize = psize;
4057 p->head = psize | PINUSE_BIT(((size_t)1));
4058 /* set size of fake trailing chunk holding overhead space only once */
4059 chunk_plus_offset(p, psize)((mchunkptr)(((char*)(p)) + (psize)))->head = TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
4060 m->trim_check = mparams.trim_threshold; /* reset on each update */
4061}
4062
4063/* Initialize bins for a new mstate that is otherwise zeroed out */
4064static void init_bins(mstate m) {
4065 /* Establish circular links for smallbins */
4066 bindex_t i;
4067 for (i = 0; i < NSMALLBINS(32U); ++i) {
4068 sbinptr bin = smallbin_at(m,i)((sbinptr)((char*)&((m)->smallbins[(i)<<1])));
4069 bin->fd = bin->bk = bin;
4070 }
4071}
4072
4073#if PROCEED_ON_ERROR0
4074
4075/* default corruption action */
4076static void reset_on_error(mstate m) {
4077 int i;
4078 ++malloc_corruption_error_count;
4079 /* Reinitialize fields to forget about all memory */
4080 m->smallmap = m->treemap = 0;
4081 m->dvsize = m->topsize = 0;
4082 m->seg.base = 0;
4083 m->seg.size = 0;
4084 m->seg.next = 0;
4085 m->top = m->dv = 0;
4086 for (i = 0; i < NTREEBINS(32U); ++i)
4087 *treebin_at(m, i)(&((m)->treebins[i])) = 0;
4088 init_bins(m);
4089}
4090#endif /* PROCEED_ON_ERROR */
4091
4092/* Allocate chunk and prepend remainder with chunk in successor base. */
4093static void* prepend_alloc(mstate m, char* newbase, char* oldbase,
4094 size_t nb) {
4095 mchunkptr p = align_as_chunk(newbase)(mchunkptr)((newbase) + ((((size_t)(((void*)((char*)(newbase)
+ ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(newbase) + ((sizeof(size_t
))<<1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))))
);
4096 mchunkptr oldfirst = align_as_chunk(oldbase)(mchunkptr)((oldbase) + ((((size_t)(((void*)((char*)(oldbase)
+ ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(oldbase) + ((sizeof(size_t
))<<1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))))
);
4097 size_t psize = (char*)oldfirst - (char*)p;
4098 mchunkptr q = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4099 size_t qsize = psize - nb;
4100 set_size_and_pinuse_of_inuse_chunk(m, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
4101
4102 assert((char*)oldfirst > (char*)q)if(!((char*)oldfirst > (char*)q)) abort();
4103 assert(pinuse(oldfirst))if(!(((oldfirst)->head & (((size_t)1))))) abort();
4104 assert(qsize >= MIN_CHUNK_SIZE)if(!(qsize >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))))) abort();
4105
4106 /* consolidate remainder with first chunk of old base */
4107 if (oldfirst == m->top) {
4108 size_t tsize = m->topsize += qsize;
4109 m->top = q;
4110 q->head = tsize | PINUSE_BIT(((size_t)1));
4111 check_top_chunk(m, q)do_check_top_chunk(m,q);
4112 }
4113 else if (oldfirst == m->dv) {
4114 size_t dsize = m->dvsize += qsize;
4115 m->dv = q;
4116 set_size_and_pinuse_of_free_chunk(q, dsize)((q)->head = (dsize|(((size_t)1))), (((mchunkptr)((char*)(
q) + (dsize)))->prev_foot = (dsize)));
4117 }
4118 else {
4119 if (!is_inuse(oldfirst)(((oldfirst)->head & ((((size_t)1))|(((size_t)2)))) !=
(((size_t)1)))) {
4120 size_t nsize = chunksize(oldfirst)((oldfirst)->head & ~(((((size_t)1))|(((size_t)2))|(((
size_t)4)))));
4121 unlink_chunk(m, oldfirst, nsize)if ((((nsize) >> (3U)) < (32U))) { mchunkptr F = oldfirst
->fd; mchunkptr B = oldfirst->bk; bindex_t I = (bindex_t
)((nsize) >> (3U)); if(!(oldfirst != B)) abort(); if(!(
oldfirst != F)) abort(); if(!(((oldfirst)->head & ~(((
((size_t)1))|(((size_t)2))|(((size_t)4))))) == ((I) << (
3U)))) abort(); if (__builtin_expect(F == ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))) || (((char*)(F) >= (m)
->least_addr) && F->bk == oldfirst), 1)) { if (
B == F) { ((m)->smallmap &= ~((binmap_t)(1) << (
I))); } else if (__builtin_expect(B == ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))) || (((char*)(B) >= (m)
->least_addr) && B->fd == oldfirst), 1)) { F->
bk = B; B->fd = F; } else { abort(); } } else { abort(); }
} else { tchunkptr TP = (tchunkptr)(oldfirst); { tchunkptr XP
= TP->parent; tchunkptr R; if (TP->bk != TP) { tchunkptr
F = TP->fd; R = TP->bk; if (__builtin_expect(((char*)(
F) >= (m)->least_addr) && F->bk == TP &&
R->fd == TP, 1)) { F->bk = R; R->fd = F; } else { abort
(); } } else { tchunkptr* RP; if (((R = *(RP = &(TP->child
[1]))) != 0) || ((R = *(RP = &(TP->child[0]))) != 0)) {
tchunkptr* CP; while ((*(CP = &(R->child[1])) != 0) ||
(*(CP = &(R->child[0])) != 0)) { R = *(RP = CP); } if
(__builtin_expect(((char*)(RP) >= (m)->least_addr), 1)
) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr* H = (
&((m)->treebins[TP->index])); if (TP == *H) { if ((
*H = R) == 0) ((m)->treemap &= ~((binmap_t)(1) <<
(TP->index))); } else if (__builtin_expect(((char*)(XP) >=
(m)->least_addr), 1)) { if (XP->child[0] == TP) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (m)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = TP->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (m)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = TP->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (m)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}}; };
4122 oldfirst = chunk_plus_offset(oldfirst, nsize)((mchunkptr)(((char*)(oldfirst)) + (nsize)));
4123 qsize += nsize;
4124 }
4125 set_free_with_pinuse(q, qsize, oldfirst)(((oldfirst)->head &= ~(((size_t)1))), ((q)->head =
(qsize|(((size_t)1))), (((mchunkptr)((char*)(q) + (qsize)))->
prev_foot = (qsize))));
4126 insert_chunk(m, q, qsize)if ((((qsize) >> (3U)) < (32U))) { bindex_t I = (bindex_t
)((qsize) >> (3U)); mchunkptr B = ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))); mchunkptr F = B; if(!(qsize
>= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) -
((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1))))) abort(); if (!((m)->smallmap & ((binmap_t)(1) <<
(I)))) ((m)->smallmap |= ((binmap_t)(1) << (I))); else
if (__builtin_expect(((char*)(B->fd) >= (m)->least_addr
), 1)) F = B->fd; else { abort(); } B->fd = q; F->bk
= q; q->fd = F; q->bk = B;} else { tchunkptr TP = (tchunkptr
)(q); { tbinptr* H; bindex_t I; { unsigned int X = qsize >>
(8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1
; else { unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned
) __builtin_clz(X); I = (bindex_t)((K << 1) + ((qsize >>
(K + ((8U)-1)) & 1))); }}; H = (&((m)->treebins[I
])); TP->index = I; TP->child[0] = TP->child[1] = 0;
if (!((m)->treemap & ((binmap_t)(1) << (I)))) {
((m)->treemap |= ((binmap_t)(1) << (I))); *H = TP; TP
->parent = (tchunkptr)H; TP->fd = TP->bk = TP; } else
{ tchunkptr T = *H; size_t K = qsize << ((I == (32U)-1
)? 0 : (((sizeof(size_t) << 3)-((size_t)1)) - (((I) >>
1) + (8U) - 2))); for (;;) { if (((T)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) != qsize) { tchunkptr* C =
&(T->child[(K >> ((sizeof(size_t) << 3)-(
(size_t)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else
if (__builtin_expect(((char*)(C) >= (m)->least_addr), 1
)) { *C = TP; TP->parent = T; TP->fd = TP->bk = TP; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (m)->least_addr) &&
((char*)(F) >= (m)->least_addr), 1)) { T->fd = F->
bk = TP; TP->fd = F; TP->bk = T; TP->parent = 0; break
; } else { abort(); break; } } } }}; };
4127 check_free_chunk(m, q)do_check_free_chunk(m,q);
4128 }
4129
4130 check_malloced_chunk(m, chunk2mem(p), nb)do_check_malloced_chunk(m,((void*)((char*)(p) + ((sizeof(size_t
))<<1))),nb);
4131 return chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4132}
4133
4134/* Add a segment to hold a new noncontiguous region */
4135static void add_segment(mstate m, char* tbase, size_t tsize, flag_t mmapped) {
4136 /* Determine locations and sizes of segment, fenceposts, old top */
4137 char* old_top = (char*)m->top;
4138 msegmentptr oldsp = segment_holding(m, old_top);
4139 char* old_end = oldsp->base + oldsp->size;
4140 size_t ssize = pad_request(sizeof(struct malloc_segment))(((sizeof(struct malloc_segment)) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)));
4141 char* rawsp = old_end - (ssize + FOUR_SIZE_T_SIZES((sizeof(size_t))<<2) + CHUNK_ALIGN_MASK(((size_t)(2 * sizeof(void *))) - ((size_t)1)));
4142 size_t offset = align_offset(chunk2mem(rawsp))((((size_t)(((void*)((char*)(rawsp) + ((sizeof(size_t))<<
1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(rawsp) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))));
4143 char* asp = rawsp + offset;
4144 char* csp = (asp < (old_top + MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))))? old_top : asp;
4145 mchunkptr sp = (mchunkptr)csp;
4146 msegmentptr ss = (msegmentptr)(chunk2mem(sp)((void*)((char*)(sp) + ((sizeof(size_t))<<1))));
4147 mchunkptr tnext = chunk_plus_offset(sp, ssize)((mchunkptr)(((char*)(sp)) + (ssize)));
4148 mchunkptr p = tnext;
4149 int nfences = 0;
4150 (void)nfences; /* Suppress unused variable warning */
4151
4152 /* reset top to new space */
4153 init_top(m, (mchunkptr)tbase, tsize - TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
4154
4155 /* Set up segment record */
4156 assert(is_aligned(ss))if(!((((size_t)((ss)) & ((((size_t)(2 * sizeof(void *))) -
((size_t)1)))) == 0))) abort();
4157 set_size_and_pinuse_of_inuse_chunk(m, sp, ssize)((sp)->head = (ssize|(((size_t)1))|(((size_t)2))));
4158 *ss = m->seg; /* Push current record */
4159 m->seg.base = tbase;
4160 m->seg.size = tsize;
4161 (void)set_segment_flags(&m->seg, mmapped)(((mmapped) != (((size_t)1))) ? (abort(), (mmapped)) : (((&
m->seg)->exec_offset = (*(ptrdiff_t*)(((&m->seg)
->base)+((&m->seg)->size)-sizeof(ptrdiff_t)))), (
(*(ptrdiff_t*)(((&m->seg)->base + (&m->seg)->
exec_offset)+((&m->seg)->size)-sizeof(ptrdiff_t))) !=
(&m->seg)->exec_offset) ? (abort(), (mmapped)) : (
(*(ptrdiff_t*)(((&m->seg)->base)+((&m->seg)->
size)-sizeof(ptrdiff_t))) = 0), (mmapped)));
4162 m->seg.next = ss;
4163
4164 /* Insert trailing fenceposts */
4165 for (;;) {
4166 mchunkptr nextp = chunk_plus_offset(p, SIZE_T_SIZE)((mchunkptr)(((char*)(p)) + ((sizeof(size_t)))));
4167 p->head = FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)));
4168 ++nfences;
4169 if ((char*)(&(nextp->head)) < old_end)
4170 p = nextp;
4171 else
4172 break;
4173 }
4174 assert(nfences >= 2)if(!(nfences >= 2)) abort();
4175
4176 /* Insert the rest of old top into a bin as an ordinary free chunk */
4177 if (csp != old_top) {
4178 mchunkptr q = (mchunkptr)old_top;
4179 size_t psize = csp - old_top;
4180 mchunkptr tn = chunk_plus_offset(q, psize)((mchunkptr)(((char*)(q)) + (psize)));
4181 set_free_with_pinuse(q, psize, tn)(((tn)->head &= ~(((size_t)1))), ((q)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(q) + (psize)))->prev_foot
= (psize))));
4182 insert_chunk(m, q, psize)if ((((psize) >> (3U)) < (32U))) { bindex_t I = (bindex_t
)((psize) >> (3U)); mchunkptr B = ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))); mchunkptr F = B; if(!(psize
>= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) -
((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1))))) abort(); if (!((m)->smallmap & ((binmap_t)(1) <<
(I)))) ((m)->smallmap |= ((binmap_t)(1) << (I))); else
if (__builtin_expect(((char*)(B->fd) >= (m)->least_addr
), 1)) F = B->fd; else { abort(); } B->fd = q; F->bk
= q; q->fd = F; q->bk = B;} else { tchunkptr TP = (tchunkptr
)(q); { tbinptr* H; bindex_t I; { unsigned int X = psize >>
(8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1
; else { unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned
) __builtin_clz(X); I = (bindex_t)((K << 1) + ((psize >>
(K + ((8U)-1)) & 1))); }}; H = (&((m)->treebins[I
])); TP->index = I; TP->child[0] = TP->child[1] = 0;
if (!((m)->treemap & ((binmap_t)(1) << (I)))) {
((m)->treemap |= ((binmap_t)(1) << (I))); *H = TP; TP
->parent = (tchunkptr)H; TP->fd = TP->bk = TP; } else
{ tchunkptr T = *H; size_t K = psize << ((I == (32U)-1
)? 0 : (((sizeof(size_t) << 3)-((size_t)1)) - (((I) >>
1) + (8U) - 2))); for (;;) { if (((T)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) != psize) { tchunkptr* C =
&(T->child[(K >> ((sizeof(size_t) << 3)-(
(size_t)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else
if (__builtin_expect(((char*)(C) >= (m)->least_addr), 1
)) { *C = TP; TP->parent = T; TP->fd = TP->bk = TP; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (m)->least_addr) &&
((char*)(F) >= (m)->least_addr), 1)) { T->fd = F->
bk = TP; TP->fd = F; TP->bk = T; TP->parent = 0; break
; } else { abort(); break; } } } }}; };
4183 }
4184
4185 check_top_chunk(m, m->top)do_check_top_chunk(m,m->top);
4186}
4187
4188/* -------------------------- System allocation -------------------------- */
4189
4190/* Get memory from system using MORECORE or MMAP */
4191static void* sys_alloc(mstate m, size_t nb) {
4192 char* tbase = CMFAIL((char*)(((void*)((~(size_t)0)))));
4193 size_t tsize = 0;
4194 flag_t mmap_flag = 0;
4195 size_t asize; /* allocation size */
4196
4197 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
4198
4199 /* Directly map large chunks, but only if already initialized */
4200 if (use_mmap(m)((m)->mflags & (((size_t)1))) && nb >= mparams.mmap_threshold && m->topsize != 0) {
4201 void* mem = mmap_alloc(m, nb);
4202 if (mem != 0)
4203 return mem;
4204 }
4205
4206 asize = granularity_align(nb + SYS_ALLOC_PADDING)(((nb + ((((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))
<<1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)
(((void*)((char*)(0) + ((sizeof(size_t))<<1)))) & (
((size_t)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment
)) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - (
(size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1)))+(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - (
(size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1)))) + ((size_t)(2 * sizeof(void *))))) + (mparams.granularity
- ((size_t)1))) & ~(mparams.granularity - ((size_t)1)));
4207 if (asize <= nb)
4208 return 0; /* wraparound */
4209 if (m->footprint_limit != 0) {
4210 size_t fp = m->footprint + asize;
4211 if (fp <= m->footprint || fp > m->footprint_limit)
4212 return 0;
4213 }
4214
4215 /*
4216 Try getting memory in any of three ways (in most-preferred to
4217 least-preferred order):
4218 1. A call to MORECORE that can normally contiguously extend memory.
4219 (disabled if not MORECORE_CONTIGUOUS or not HAVE_MORECORE or
4220 or main space is mmapped or a previous contiguous call failed)
4221 2. A call to MMAP new space (disabled if not HAVE_MMAP).
4222 Note that under the default settings, if MORECORE is unable to
4223 fulfill a request, and HAVE_MMAP is true, then mmap is
4224 used as a noncontiguous system allocator. This is a useful backup
4225 strategy for systems with holes in address spaces -- in this case
4226 sbrk cannot contiguously expand the heap, but mmap may be able to
4227 find space.
4228 3. A call to MORECORE that cannot usually contiguously extend memory.
4229 (disabled if not HAVE_MORECORE)
4230
4231 In all cases, we need to request enough bytes from system to ensure
4232 we can malloc nb bytes upon success, so pad with enough space for
4233 top_foot, plus alignment-pad to make sure we don't lose bytes if
4234 not on boundary, and round this up to a granularity unit.
4235 */
4236
4237 if (MORECORE_CONTIGUOUS0 && !use_noncontiguous(m)((m)->mflags & (4U))) {
4238 char* br = CMFAIL((char*)(((void*)((~(size_t)0)))));
4239 size_t ssize = asize; /* sbrk call size */
4240 msegmentptr ss = (m->top == 0)? 0 : segment_holding(m, (char*)m->top);
4241 ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);;
4242
4243 if (ss == 0) { /* First time through or recovery */
4244 char* base = (char*)CALL_MORECORE(0)((void*)((~(size_t)0)));
4245 if (base != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
4246 size_t fp;
4247 /* Adjust to end on a page boundary */
4248 if (!is_page_aligned(base)(((size_t)(base) & (mparams.page_size - ((size_t)1))) == 0
))
4249 ssize += (page_align((size_t)base)((((size_t)base) + (mparams.page_size - ((size_t)1))) & ~
(mparams.page_size - ((size_t)1))) - (size_t)base);
4250 fp = m->footprint + ssize; /* recheck limits */
4251 if (ssize > nb && ssize < HALF_MAX_SIZE_T((~(size_t)0) / 2U) &&
4252 (m->footprint_limit == 0 ||
4253 (fp > m->footprint && fp <= m->footprint_limit)) &&
4254 (br = (char*)(CALL_MORECORE(ssize)((void*)((~(size_t)0))))) == base) {
4255 tbase = base;
4256 tsize = ssize;
4257 }
4258 }
4259 }
4260 else {
4261 /* Subtract out existing available top space from MORECORE request. */
4262 ssize = granularity_align(nb - m->topsize + SYS_ALLOC_PADDING)(((nb - m->topsize + ((((((size_t)(((void*)((char*)(0) + (
(sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *
))) - ((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<
1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &
(((size_t)(2 * sizeof(void *))) - ((size_t)1))))+(((sizeof(struct
malloc_segment)) + ((sizeof(size_t))) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1)))+(((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1)))) + ((size_t)(2 * sizeof(void *))))) + (mparams
.granularity - ((size_t)1))) & ~(mparams.granularity - ((
size_t)1)));
4263 /* Use mem here only if it did continuously extend old space */
4264 if (ssize < HALF_MAX_SIZE_T((~(size_t)0) / 2U) &&
4265 (br = (char*)(CALL_MORECORE(ssize)((void*)((~(size_t)0))))) == ss->base+ss->size) {
4266 tbase = br;
4267 tsize = ssize;
4268 }
4269 }
4270
4271 if (tbase == CMFAIL((char*)(((void*)((~(size_t)0)))))) { /* Cope with partial failure */
4272 if (br != CMFAIL((char*)(((void*)((~(size_t)0)))))) { /* Try to use/extend the space we did get */
4273 if (ssize < HALF_MAX_SIZE_T((~(size_t)0) / 2U) &&
4274 ssize < nb + SYS_ALLOC_PADDING((((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<
1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
+ ((size_t)(2 * sizeof(void *))))) {
4275 size_t esize = granularity_align(nb + SYS_ALLOC_PADDING - ssize)(((nb + ((((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))
<<1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)
(((void*)((char*)(0) + ((sizeof(size_t))<<1)))) & (
((size_t)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment
)) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - (
(size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1)))+(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - (
(size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1)))) + ((size_t)(2 * sizeof(void *)))) - ssize) + (mparams.
granularity - ((size_t)1))) & ~(mparams.granularity - ((size_t
)1)));
4276 if (esize < HALF_MAX_SIZE_T((~(size_t)0) / 2U)) {
4277 char* end = (char*)CALL_MORECORE(esize)((void*)((~(size_t)0)));
4278 if (end != CMFAIL((char*)(((void*)((~(size_t)0))))))
4279 ssize += esize;
4280 else { /* Can't use; try to release */
4281 (void) CALL_MORECORE(-ssize)((void*)((~(size_t)0)));
4282 br = CMFAIL((char*)(((void*)((~(size_t)0)))));
4283 }
4284 }
4285 }
4286 }
4287 if (br != CMFAIL((char*)(((void*)((~(size_t)0)))))) { /* Use the space we did get */
4288 tbase = br;
4289 tsize = ssize;
4290 }
4291 else
4292 disable_contiguous(m)((m)->mflags |= (4U)); /* Don't try contiguous path in the future */
4293 }
4294
4295 RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex);;
4296 }
4297
4298 if (HAVE_MMAP1 && tbase == CMFAIL((char*)(((void*)((~(size_t)0)))))) { /* Try MMAP */
4299 char* mp = (char*)(CALL_MMAP(asize)mmap(0, (asize), (0x1|0x2), (0x02|0x20), -1, 0));
4300 if (mp != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
4301 tbase = mp;
4302 tsize = asize;
4303 mmap_flag = USE_MMAP_BIT(((size_t)1));
4304 }
4305 }
4306
4307 if (HAVE_MORECORE0 && tbase == CMFAIL((char*)(((void*)((~(size_t)0)))))) { /* Try noncontiguous MORECORE */
4308 if (asize < HALF_MAX_SIZE_T((~(size_t)0) / 2U)) {
4309 char* br = CMFAIL((char*)(((void*)((~(size_t)0)))));
4310 char* end = CMFAIL((char*)(((void*)((~(size_t)0)))));
4311 ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);;
4312 br = (char*)(CALL_MORECORE(asize)((void*)((~(size_t)0))));
4313 end = (char*)(CALL_MORECORE(0)((void*)((~(size_t)0))));
4314 RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex);;
4315 if (br != CMFAIL((char*)(((void*)((~(size_t)0))))) && end != CMFAIL((char*)(((void*)((~(size_t)0))))) && br < end) {
4316 size_t ssize = end - br;
4317 if (ssize > nb + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))) {
4318 tbase = br;
4319 tsize = ssize;
4320 }
4321 }
4322 }
4323 }
4324
4325 if (tbase != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
4326
4327 if ((m->footprint += tsize) > m->max_footprint)
4328 m->max_footprint = m->footprint;
4329
4330 if (!is_initialized(m)((m)->top != 0)) { /* first-time initialization */
4331 if (m->least_addr == 0 || tbase < m->least_addr)
4332 m->least_addr = tbase;
4333 m->seg.base = tbase;
4334 m->seg.size = tsize;
4335 (void)set_segment_flags(&m->seg, mmap_flag)(((mmap_flag) != (((size_t)1))) ? (abort(), (mmap_flag)) : ((
(&m->seg)->exec_offset = (*(ptrdiff_t*)(((&m->
seg)->base)+((&m->seg)->size)-sizeof(ptrdiff_t))
)), ((*(ptrdiff_t*)(((&m->seg)->base + (&m->
seg)->exec_offset)+((&m->seg)->size)-sizeof(ptrdiff_t
))) != (&m->seg)->exec_offset) ? (abort(), (mmap_flag
)) : ((*(ptrdiff_t*)(((&m->seg)->base)+((&m->
seg)->size)-sizeof(ptrdiff_t))) = 0), (mmap_flag)));
4336 m->magic = mparams.magic;
4337 m->release_checks = MAX_RELEASE_CHECK_RATE4095;
4338 init_bins(m);
4339#if !ONLY_MSPACES0
4340 if (is_global(m)((m) == &_gm_))
4341 init_top(m, (mchunkptr)tbase, tsize - TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
4342 else
4343#endif
4344 {
4345 /* Offset top by embedded malloc_state */
4346 mchunkptr mn = next_chunk(mem2chunk(m))((mchunkptr)( ((char*)(((mchunkptr)((char*)(m) - ((sizeof(size_t
))<<1))))) + ((((mchunkptr)((char*)(m) - ((sizeof(size_t
))<<1))))->head & ~((((size_t)1))|(((size_t)2))|
(((size_t)4))))));
4347 init_top(m, mn, (size_t)((tbase + tsize) - (char*)mn) -TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
4348 }
4349 }
4350
4351 else {
4352 /* Try to merge with an existing segment */
4353 msegmentptr sp = &m->seg;
4354 /* Only consider most recent segment if traversal suppressed */
4355 while (sp != 0 && tbase != sp->base + sp->size)
4356 sp = (NO_SEGMENT_TRAVERSAL0) ? 0 : sp->next;
4357 if (sp != 0 &&
4358 !is_extern_segment(sp)(((((size_t)1))) & (8U)) &&
4359 check_segment_merge(sp, tbase, tsize)((*(ptrdiff_t*)(((tbase))+((tsize))-sizeof(ptrdiff_t))) == (sp
)->exec_offset) &&
4360 (get_segment_flags(sp)((((size_t)1))) & USE_MMAP_BIT(((size_t)1))) == mmap_flag &&
4361 segment_holds(sp, m->top)((char*)(m->top) >= sp->base && (char*)(m->
top) < sp->base + sp->size)) { /* append */
4362 sp->size += tsize;
4363 init_top(m, m->top, m->topsize + tsize);
4364 }
4365 else {
4366 if (tbase < m->least_addr)
4367 m->least_addr = tbase;
4368 sp = &m->seg;
4369 while (sp != 0 && sp->base != tbase + tsize)
4370 sp = (NO_SEGMENT_TRAVERSAL0) ? 0 : sp->next;
4371 if (sp != 0 &&
4372 !is_extern_segment(sp)(((((size_t)1))) & (8U)) &&
4373 check_segment_merge(sp, tbase, tsize)((*(ptrdiff_t*)(((tbase))+((tsize))-sizeof(ptrdiff_t))) == (sp
)->exec_offset) &&
4374 (get_segment_flags(sp)((((size_t)1))) & USE_MMAP_BIT(((size_t)1))) == mmap_flag) {
4375 char* oldbase = sp->base;
4376 sp->base = tbase;
4377 sp->size += tsize;
4378 return prepend_alloc(m, tbase, oldbase, nb);
4379 }
4380 else
4381 add_segment(m, tbase, tsize, mmap_flag);
4382 }
4383 }
4384
4385 if (nb < m->topsize) { /* Allocate from new or extended top space */
4386 size_t rsize = m->topsize -= nb;
4387 mchunkptr p = m->top;
4388 mchunkptr r = m->top = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4389 r->head = rsize | PINUSE_BIT(((size_t)1));
4390 set_size_and_pinuse_of_inuse_chunk(m, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
4391 check_top_chunk(m, m->top)do_check_top_chunk(m,m->top);
4392 check_malloced_chunk(m, chunk2mem(p), nb)do_check_malloced_chunk(m,((void*)((char*)(p) + ((sizeof(size_t
))<<1))),nb);
4393 return chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4394 }
4395 }
4396
4397 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
4398 return 0;
4399}
4400
4401/* ----------------------- system deallocation -------------------------- */
4402
4403/* Unmap and unlink any mmapped segments that don't contain used chunks */
4404static size_t release_unused_segments(mstate m) {
4405 size_t released = 0;
4406 int nsegs = 0;
4407 msegmentptr pred = &m->seg;
4408 msegmentptr sp = pred->next;
4409 while (sp != 0) {
4410 char* base = sp->base;
4411 size_t size = sp->size;
4412 msegmentptr next = sp->next;
4413 ++nsegs;
4414 if (is_mmapped_segment(sp)(((((size_t)1))) & (((size_t)1))) && !is_extern_segment(sp)(((((size_t)1))) & (8U))) {
4415 mchunkptr p = align_as_chunk(base)(mchunkptr)((base) + ((((size_t)(((void*)((char*)(base) + ((sizeof
(size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *))) - (
(size_t)(((void*)((char*)(base) + ((sizeof(size_t))<<1)
))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &
(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
4416 size_t psize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
4417 /* Can unmap if first chunk holds entire segment and not pinned */
4418 if (!is_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) && (char*)p + psize >= base + size - TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))) {
4419 tchunkptr tp = (tchunkptr)p;
4420 assert(segment_holds(sp, (char*)sp))if(!(((char*)((char*)sp) >= sp->base && (char*)
((char*)sp) < sp->base + sp->size))) abort();
4421 if (p == m->dv) {
4422 m->dv = 0;
4423 m->dvsize = 0;
4424 }
4425 else {
4426 unlink_large_chunk(m, tp){ tchunkptr XP = tp->parent; tchunkptr R; if (tp->bk !=
tp) { tchunkptr F = tp->fd; R = tp->bk; if (__builtin_expect
(((char*)(F) >= (m)->least_addr) && F->bk ==
tp && R->fd == tp, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(tp->child[1]))) != 0) || ((R = *(RP = &(tp->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (m)->
least_addr), 1)) *RP = 0; else { abort(); } } } if (XP != 0) {
tbinptr* H = (&((m)->treebins[tp->index])); if (tp
== *H) { if ((*H = R) == 0) ((m)->treemap &= ~((binmap_t
)(1) << (tp->index))); } else if (__builtin_expect((
(char*)(XP) >= (m)->least_addr), 1)) { if (XP->child
[0] == tp) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(m)->least_addr), 1)) { tchunkptr C0, C1; R->parent = XP
; if ((C0 = tp->child[0]) != 0) { if (__builtin_expect(((char
*)(C0) >= (m)->least_addr), 1)) { R->child[0] = C0; C0
->parent = R; } else abort(); } if ((C1 = tp->child[1])
!= 0) { if (__builtin_expect(((char*)(C1) >= (m)->least_addr
), 1)) { R->child[1] = C1; C1->parent = R; } else abort
(); } } else abort(); } }};
4427 }
4428 if (CALL_MUNMAP(base, size)munmap(((base)), ((size))) == 0) {
4429 released += size;
4430 m->footprint -= size;
4431 /* unlink obsoleted record */
4432 sp = pred;
4433 sp->next = next;
4434 }
4435 else { /* back out if cannot unmap */
4436 insert_large_chunk(m, tp, psize){ tbinptr* H; bindex_t I; { unsigned int X = psize >> (
8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1; else
{ unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz
(X); I = (bindex_t)((K << 1) + ((psize >> (K + ((
8U)-1)) & 1))); }}; H = (&((m)->treebins[I])); tp->
index = I; tp->child[0] = tp->child[1] = 0; if (!((m)->
treemap & ((binmap_t)(1) << (I)))) { ((m)->treemap
|= ((binmap_t)(1) << (I))); *H = tp; tp->parent = (
tchunkptr)H; tp->fd = tp->bk = tp; } else { tchunkptr T
= *H; size_t K = psize << ((I == (32U)-1)? 0 : (((sizeof
(size_t) << 3)-((size_t)1)) - (((I) >> 1) + (8U) -
2))); for (;;) { if (((T)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) != psize) { tchunkptr* C = &
(T->child[(K >> ((sizeof(size_t) << 3)-((size_t
)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else if (
__builtin_expect(((char*)(C) >= (m)->least_addr), 1)) {
*C = tp; tp->parent = T; tp->fd = tp->bk = tp; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (m)->least_addr) &&
((char*)(F) >= (m)->least_addr), 1)) { T->fd = F->
bk = tp; tp->fd = F; tp->bk = T; tp->parent = 0; break
; } else { abort(); break; } } } }};
4437 }
4438 }
4439 }
4440 if (NO_SEGMENT_TRAVERSAL0) /* scan only first segment */
4441 break;
4442 pred = sp;
4443 sp = next;
4444 }
4445 /* Reset check counter */
4446 m->release_checks = (((size_t) nsegs > (size_t) MAX_RELEASE_CHECK_RATE4095)?
4447 (size_t) nsegs : (size_t) MAX_RELEASE_CHECK_RATE4095);
4448 return released;
4449}
4450
4451static int sys_trim(mstate m, size_t pad) {
4452 size_t released = 0;
4453 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
4454 if (pad < MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2) && is_initialized(m)((m)->top != 0)) {
4455 pad += TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))); /* ensure enough room for segment overhead */
4456
4457 if (m->topsize > pad) {
4458 /* Shrink top space in granularity-size units, keeping at least one */
4459 size_t unit = mparams.granularity;
4460 size_t extra = ((m->topsize - pad + (unit - SIZE_T_ONE((size_t)1))) / unit -
4461 SIZE_T_ONE((size_t)1)) * unit;
4462 msegmentptr sp = segment_holding(m, (char*)m->top);
4463
4464 if (sp == 0)
4465 CORRUPTION_ERROR_ACTION(m)abort();
4466 if (!is_extern_segment(sp)(((((size_t)1))) & (8U))) {
4467 if (is_mmapped_segment(sp)(((((size_t)1))) & (((size_t)1)))) {
4468 if (HAVE_MMAP1 &&
4469 sp->size >= extra &&
4470 !has_segment_link(m, sp)) { /* can't shrink if pinned */
4471 size_t newsize = sp->size - extra;
4472 (void)newsize; /* placate people compiling -Wunused-variable */
4473 /* Prefer mremap, fall back to munmap */
4474 if ((CALL_MREMAP(sp->base, sp->size, newsize, 0)((void*)((~(size_t)0))) != MFAIL((void*)((~(size_t)0)))) ||
4475 (CALL_MUNMAP(sp->base + newsize, extra)munmap(((sp->base + newsize)), ((extra))) == 0)) {
4476 released = extra;
4477 }
4478 }
4479 }
4480 else if (HAVE_MORECORE0) {
4481 if (extra >= HALF_MAX_SIZE_T((~(size_t)0) / 2U)) /* Avoid wrapping negative */
4482 extra = (HALF_MAX_SIZE_T((~(size_t)0) / 2U)) + SIZE_T_ONE((size_t)1) - unit;
4483 ACQUIRE_MALLOC_GLOBAL_LOCK()(__sync_lock_test_and_set(&malloc_global_mutex, 1)? spin_acquire_lock
(&malloc_global_mutex) : 0);;
4484 {
4485 /* Make sure end of memory is where we last set it. */
4486 char* old_br = (char*)(CALL_MORECORE(0)((void*)((~(size_t)0))));
4487 if (old_br == sp->base + sp->size) {
4488 char* rel_br = (char*)(CALL_MORECORE(-extra)((void*)((~(size_t)0))));
4489 char* new_br = (char*)(CALL_MORECORE(0)((void*)((~(size_t)0))));
4490 if (rel_br != CMFAIL((char*)(((void*)((~(size_t)0))))) && new_br < old_br)
4491 released = old_br - new_br;
4492 }
4493 }
4494 RELEASE_MALLOC_GLOBAL_LOCK()__sync_lock_release(&malloc_global_mutex);;
4495 }
4496 }
4497
4498 if (released != 0) {
4499 sp->size -= released;
4500 m->footprint -= released;
4501 init_top(m, m->top, m->topsize - released);
4502 check_top_chunk(m, m->top)do_check_top_chunk(m,m->top);
4503 }
4504 }
4505
4506 /* Unmap any unused mmapped segments */
4507 if (HAVE_MMAP1)
4508 released += release_unused_segments(m);
4509
4510 /* On failure, disable autotrim to avoid repeated failed future calls */
4511 if (released == 0 && m->topsize > m->trim_check)
4512 m->trim_check = MAX_SIZE_T(~(size_t)0);
4513 }
4514
4515 return (released != 0)? 1 : 0;
4516}
4517
4518/* Consolidate and bin a chunk. Differs from exported versions
4519 of free mainly in that the chunk need not be marked as inuse.
4520*/
4521static void dispose_chunk(mstate m, mchunkptr p, size_t psize) {
4522 mchunkptr next = chunk_plus_offset(p, psize)((mchunkptr)(((char*)(p)) + (psize)));
4523 if (!pinuse(p)((p)->head & (((size_t)1)))) {
4524 mchunkptr prev;
4525 size_t prevsize = p->prev_foot;
4526 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) {
4527 psize += prevsize + MMAP_FOOT_PAD(((sizeof(size_t))<<2));
4528 if (CALL_MUNMAP((char*)p - prevsize, psize)munmap((((char*)p - prevsize)), ((psize))) == 0)
4529 m->footprint -= psize;
4530 return;
4531 }
4532 prev = chunk_minus_offset(p, prevsize)((mchunkptr)(((char*)(p)) - (prevsize)));
4533 psize += prevsize;
4534 p = prev;
4535 if (RTCHECK(ok_address(m, prev))__builtin_expect(((char*)(prev) >= (m)->least_addr), 1)) { /* consolidate backward */
4536 if (p != m->dv) {
4537 unlink_chunk(m, p, prevsize)if ((((prevsize) >> (3U)) < (32U))) { mchunkptr F = p
->fd; mchunkptr B = p->bk; bindex_t I = (bindex_t)((prevsize
) >> (3U)); if(!(p != B)) abort(); if(!(p != F)) abort(
); if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|((
(size_t)4))))) == ((I) << (3U)))) abort(); if (__builtin_expect
(F == ((sbinptr)((char*)&((m)->smallbins[(I)<<1]
))) || (((char*)(F) >= (m)->least_addr) && F->
bk == p), 1)) { if (B == F) { ((m)->smallmap &= ~((binmap_t
)(1) << (I))); } else if (__builtin_expect(B == ((sbinptr
)((char*)&((m)->smallbins[(I)<<1]))) || (((char*
)(B) >= (m)->least_addr) && B->fd == p), 1))
{ F->bk = B; B->fd = F; } else { abort(); } } else { abort
(); }} else { tchunkptr TP = (tchunkptr)(p); { tchunkptr XP =
TP->parent; tchunkptr R; if (TP->bk != TP) { tchunkptr
F = TP->fd; R = TP->bk; if (__builtin_expect(((char*)(
F) >= (m)->least_addr) && F->bk == TP &&
R->fd == TP, 1)) { F->bk = R; R->fd = F; } else { abort
(); } } else { tchunkptr* RP; if (((R = *(RP = &(TP->child
[1]))) != 0) || ((R = *(RP = &(TP->child[0]))) != 0)) {
tchunkptr* CP; while ((*(CP = &(R->child[1])) != 0) ||
(*(CP = &(R->child[0])) != 0)) { R = *(RP = CP); } if
(__builtin_expect(((char*)(RP) >= (m)->least_addr), 1)
) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr* H = (
&((m)->treebins[TP->index])); if (TP == *H) { if ((
*H = R) == 0) ((m)->treemap &= ~((binmap_t)(1) <<
(TP->index))); } else if (__builtin_expect(((char*)(XP) >=
(m)->least_addr), 1)) { if (XP->child[0] == TP) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (m)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = TP->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (m)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = TP->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (m)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}}; };
4538 }
4539 else if ((next->head & INUSE_BITS((((size_t)1))|(((size_t)2)))) == INUSE_BITS((((size_t)1))|(((size_t)2)))) {
4540 m->dvsize = psize;
4541 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
4542 return;
4543 }
4544 }
4545 else {
4546 CORRUPTION_ERROR_ACTION(m)abort();
4547 return;
4548 }
4549 }
4550 if (RTCHECK(ok_address(m, next))__builtin_expect(((char*)(next) >= (m)->least_addr), 1)) {
4551 if (!cinuse(next)((next)->head & (((size_t)2)))) { /* consolidate forward */
4552 if (next == m->top) {
4553 size_t tsize = m->topsize += psize;
4554 m->top = p;
4555 p->head = tsize | PINUSE_BIT(((size_t)1));
4556 if (p == m->dv) {
4557 m->dv = 0;
4558 m->dvsize = 0;
4559 }
4560 return;
4561 }
4562 else if (next == m->dv) {
4563 size_t dsize = m->dvsize += psize;
4564 m->dv = p;
4565 set_size_and_pinuse_of_free_chunk(p, dsize)((p)->head = (dsize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (dsize)))->prev_foot = (dsize)));
4566 return;
4567 }
4568 else {
4569 size_t nsize = chunksize(next)((next)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4)))));
4570 psize += nsize;
4571 unlink_chunk(m, next, nsize)if ((((nsize) >> (3U)) < (32U))) { mchunkptr F = next
->fd; mchunkptr B = next->bk; bindex_t I = (bindex_t)((
nsize) >> (3U)); if(!(next != B)) abort(); if(!(next !=
F)) abort(); if(!(((next)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort()
; if (__builtin_expect(F == ((sbinptr)((char*)&((m)->smallbins
[(I)<<1]))) || (((char*)(F) >= (m)->least_addr) &&
F->bk == next), 1)) { if (B == F) { ((m)->smallmap &=
~((binmap_t)(1) << (I))); } else if (__builtin_expect(
B == ((sbinptr)((char*)&((m)->smallbins[(I)<<1])
)) || (((char*)(B) >= (m)->least_addr) && B->
fd == next), 1)) { F->bk = B; B->fd = F; } else { abort
(); } } else { abort(); }} else { tchunkptr TP = (tchunkptr)(
next); { tchunkptr XP = TP->parent; tchunkptr R; if (TP->
bk != TP) { tchunkptr F = TP->fd; R = TP->bk; if (__builtin_expect
(((char*)(F) >= (m)->least_addr) && F->bk ==
TP && R->fd == TP, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(TP->child[1]))) != 0) || ((R = *(RP = &(TP->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (m)->
least_addr), 1)) *RP = 0; else { abort(); } } } if (XP != 0) {
tbinptr* H = (&((m)->treebins[TP->index])); if (TP
== *H) { if ((*H = R) == 0) ((m)->treemap &= ~((binmap_t
)(1) << (TP->index))); } else if (__builtin_expect((
(char*)(XP) >= (m)->least_addr), 1)) { if (XP->child
[0] == TP) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(m)->least_addr), 1)) { tchunkptr C0, C1; R->parent = XP
; if ((C0 = TP->child[0]) != 0) { if (__builtin_expect(((char
*)(C0) >= (m)->least_addr), 1)) { R->child[0] = C0; C0
->parent = R; } else abort(); } if ((C1 = TP->child[1])
!= 0) { if (__builtin_expect(((char*)(C1) >= (m)->least_addr
), 1)) { R->child[1] = C1; C1->parent = R; } else abort
(); } } else abort(); } }}; };
4572 set_size_and_pinuse_of_free_chunk(p, psize)((p)->head = (psize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (psize)))->prev_foot = (psize)));
4573 if (p == m->dv) {
4574 m->dvsize = psize;
4575 return;
4576 }
4577 }
4578 }
4579 else {
4580 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
4581 }
4582 insert_chunk(m, p, psize)if ((((psize) >> (3U)) < (32U))) { bindex_t I = (bindex_t
)((psize) >> (3U)); mchunkptr B = ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))); mchunkptr F = B; if(!(psize
>= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) -
((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1))))) abort(); if (!((m)->smallmap & ((binmap_t)(1) <<
(I)))) ((m)->smallmap |= ((binmap_t)(1) << (I))); else
if (__builtin_expect(((char*)(B->fd) >= (m)->least_addr
), 1)) F = B->fd; else { abort(); } B->fd = p; F->bk
= p; p->fd = F; p->bk = B;} else { tchunkptr TP = (tchunkptr
)(p); { tbinptr* H; bindex_t I; { unsigned int X = psize >>
(8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1
; else { unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned
) __builtin_clz(X); I = (bindex_t)((K << 1) + ((psize >>
(K + ((8U)-1)) & 1))); }}; H = (&((m)->treebins[I
])); TP->index = I; TP->child[0] = TP->child[1] = 0;
if (!((m)->treemap & ((binmap_t)(1) << (I)))) {
((m)->treemap |= ((binmap_t)(1) << (I))); *H = TP; TP
->parent = (tchunkptr)H; TP->fd = TP->bk = TP; } else
{ tchunkptr T = *H; size_t K = psize << ((I == (32U)-1
)? 0 : (((sizeof(size_t) << 3)-((size_t)1)) - (((I) >>
1) + (8U) - 2))); for (;;) { if (((T)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) != psize) { tchunkptr* C =
&(T->child[(K >> ((sizeof(size_t) << 3)-(
(size_t)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else
if (__builtin_expect(((char*)(C) >= (m)->least_addr), 1
)) { *C = TP; TP->parent = T; TP->fd = TP->bk = TP; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (m)->least_addr) &&
((char*)(F) >= (m)->least_addr), 1)) { T->fd = F->
bk = TP; TP->fd = F; TP->bk = T; TP->parent = 0; break
; } else { abort(); break; } } } }}; };
4583 }
4584 else {
4585 CORRUPTION_ERROR_ACTION(m)abort();
4586 }
4587}
4588
4589/* ---------------------------- malloc --------------------------- */
4590
4591/* allocate a large request from the best fitting chunk in a treebin */
4592static void* tmalloc_large(mstate m, size_t nb) {
4593 tchunkptr v = 0;
4594 size_t rsize = -nb; /* Unsigned negation */
4595 tchunkptr t;
4596 bindex_t idx;
4597 compute_tree_index(nb, idx){ unsigned int X = nb >> (8U); if (X == 0) idx = 0; else
if (X > 0xFFFF) idx = (32U)-1; else { unsigned int K = (unsigned
) sizeof(X)*8 - 1 - (unsigned) __builtin_clz(X); idx = (bindex_t
)((K << 1) + ((nb >> (K + ((8U)-1)) & 1))); }
};
4598 if ((t = *treebin_at(m, idx)(&((m)->treebins[idx]))) != 0) {
4599 /* Traverse tree for this bin looking for node with size == nb */
4600 size_t sizebits = nb << leftshift_for_tree_index(idx)((idx == (32U)-1)? 0 : (((sizeof(size_t) << 3)-((size_t
)1)) - (((idx) >> 1) + (8U) - 2)));
4601 tchunkptr rst = 0; /* The deepest untaken right subtree */
4602 for (;;) {
4603 tchunkptr rt;
4604 size_t trem = chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - nb;
4605 if (trem < rsize) {
4606 v = t;
4607 if ((rsize = trem) == 0)
4608 break;
4609 }
4610 rt = t->child[1];
4611 t = t->child[(sizebits >> (SIZE_T_BITSIZE(sizeof(size_t) << 3)-SIZE_T_ONE((size_t)1))) & 1];
4612 if (rt != 0 && rt != t)
4613 rst = rt;
4614 if (t == 0) {
4615 t = rst; /* set t to least subtree holding sizes > nb */
4616 break;
4617 }
4618 sizebits <<= 1;
4619 }
4620 }
4621 if (t == 0 && v == 0) { /* set t to root of next non-empty treebin */
4622 binmap_t leftbits = left_bits(idx2bit(idx))((((binmap_t)(1) << (idx))<<1) | -(((binmap_t)(1)
<< (idx))<<1)) & m->treemap;
4623 if (leftbits != 0) {
4624 bindex_t i;
4625 binmap_t leastbit = least_bit(leftbits)((leftbits) & -(leftbits));
4626 compute_bit2idx(leastbit, i){ unsigned int J; J = __builtin_ctz(leastbit); i = (bindex_t)
J;};
4627 t = *treebin_at(m, i)(&((m)->treebins[i]));
4628 }
4629 }
4630
4631 while (t != 0) { /* find smallest of tree or subtree */
4632 size_t trem = chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - nb;
4633 if (trem < rsize) {
4634 rsize = trem;
4635 v = t;
4636 }
4637 t = leftmost_child(t)((t)->child[0] != 0? (t)->child[0] : (t)->child[1]);
4638 }
4639
4640 /* If dv is a better fit, return 0 so malloc will use it */
4641 if (v != 0 && rsize < (size_t)(m->dvsize - nb)) {
4642 if (RTCHECK(ok_address(m, v))__builtin_expect(((char*)(v) >= (m)->least_addr), 1)) { /* split */
4643 mchunkptr r = chunk_plus_offset(v, nb)((mchunkptr)(((char*)(v)) + (nb)));
4644 assert(chunksize(v) == rsize + nb)if(!(((v)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == rsize + nb)) abort();
4645 if (RTCHECK(ok_next(v, r))__builtin_expect(((char*)(v) < (char*)(r)), 1)) {
4646 unlink_large_chunk(m, v){ tchunkptr XP = v->parent; tchunkptr R; if (v->bk != v
) { tchunkptr F = v->fd; R = v->bk; if (__builtin_expect
(((char*)(F) >= (m)->least_addr) && F->bk ==
v && R->fd == v, 1)) { F->bk = R; R->fd = F
; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP =
&(v->child[1]))) != 0) || ((R = *(RP = &(v->child
[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->child
[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R = *(
RP = CP); } if (__builtin_expect(((char*)(RP) >= (m)->least_addr
), 1)) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr*
H = (&((m)->treebins[v->index])); if (v == *H) { if
((*H = R) == 0) ((m)->treemap &= ~((binmap_t)(1) <<
(v->index))); } else if (__builtin_expect(((char*)(XP) >=
(m)->least_addr), 1)) { if (XP->child[0] == v) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (m)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = v->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (m)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = v->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (m)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}};
4647 if (rsize < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
4648 set_inuse_and_pinuse(m, v, (rsize + nb))((v)->head = ((rsize + nb)|(((size_t)1))|(((size_t)2))), (
(mchunkptr)(((char*)(v)) + ((rsize + nb))))->head |= (((size_t
)1)));
4649 else {
4650 set_size_and_pinuse_of_inuse_chunk(m, v, nb)((v)->head = (nb|(((size_t)1))|(((size_t)2))));
4651 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
4652 insert_chunk(m, r, rsize)if ((((rsize) >> (3U)) < (32U))) { bindex_t I = (bindex_t
)((rsize) >> (3U)); mchunkptr B = ((sbinptr)((char*)&
((m)->smallbins[(I)<<1]))); mchunkptr F = B; if(!(rsize
>= (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) -
((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1))))) abort(); if (!((m)->smallmap & ((binmap_t)(1) <<
(I)))) ((m)->smallmap |= ((binmap_t)(1) << (I))); else
if (__builtin_expect(((char*)(B->fd) >= (m)->least_addr
), 1)) F = B->fd; else { abort(); } B->fd = r; F->bk
= r; r->fd = F; r->bk = B;} else { tchunkptr TP = (tchunkptr
)(r); { tbinptr* H; bindex_t I; { unsigned int X = rsize >>
(8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1
; else { unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned
) __builtin_clz(X); I = (bindex_t)((K << 1) + ((rsize >>
(K + ((8U)-1)) & 1))); }}; H = (&((m)->treebins[I
])); TP->index = I; TP->child[0] = TP->child[1] = 0;
if (!((m)->treemap & ((binmap_t)(1) << (I)))) {
((m)->treemap |= ((binmap_t)(1) << (I))); *H = TP; TP
->parent = (tchunkptr)H; TP->fd = TP->bk = TP; } else
{ tchunkptr T = *H; size_t K = rsize << ((I == (32U)-1
)? 0 : (((sizeof(size_t) << 3)-((size_t)1)) - (((I) >>
1) + (8U) - 2))); for (;;) { if (((T)->head & ~(((((size_t
)1))|(((size_t)2))|(((size_t)4))))) != rsize) { tchunkptr* C =
&(T->child[(K >> ((sizeof(size_t) << 3)-(
(size_t)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else
if (__builtin_expect(((char*)(C) >= (m)->least_addr), 1
)) { *C = TP; TP->parent = T; TP->fd = TP->bk = TP; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (m)->least_addr) &&
((char*)(F) >= (m)->least_addr), 1)) { T->fd = F->
bk = TP; TP->fd = F; TP->bk = T; TP->parent = 0; break
; } else { abort(); break; } } } }}; };
4653 }
4654 return chunk2mem(v)((void*)((char*)(v) + ((sizeof(size_t))<<1)));
4655 }
4656 }
4657 CORRUPTION_ERROR_ACTION(m)abort();
4658 }
4659 return 0;
4660}
4661
4662/* allocate a small request from the best fitting chunk in a treebin */
4663static void* tmalloc_small(mstate m, size_t nb) {
4664 tchunkptr t, v;
4665 size_t rsize;
4666 bindex_t i;
4667 binmap_t leastbit = least_bit(m->treemap)((m->treemap) & -(m->treemap));
4668 compute_bit2idx(leastbit, i){ unsigned int J; J = __builtin_ctz(leastbit); i = (bindex_t)
J;};
4669 v = t = *treebin_at(m, i)(&((m)->treebins[i]));
4670 rsize = chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - nb;
4671
4672 while ((t = leftmost_child(t)((t)->child[0] != 0? (t)->child[0] : (t)->child[1])) != 0) {
4673 size_t trem = chunksize(t)((t)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - nb;
4674 if (trem < rsize) {
4675 rsize = trem;
4676 v = t;
4677 }
4678 }
4679
4680 if (RTCHECK(ok_address(m, v))__builtin_expect(((char*)(v) >= (m)->least_addr), 1)) {
4681 mchunkptr r = chunk_plus_offset(v, nb)((mchunkptr)(((char*)(v)) + (nb)));
4682 assert(chunksize(v) == rsize + nb)if(!(((v)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == rsize + nb)) abort();
4683 if (RTCHECK(ok_next(v, r))__builtin_expect(((char*)(v) < (char*)(r)), 1)) {
4684 unlink_large_chunk(m, v){ tchunkptr XP = v->parent; tchunkptr R; if (v->bk != v
) { tchunkptr F = v->fd; R = v->bk; if (__builtin_expect
(((char*)(F) >= (m)->least_addr) && F->bk ==
v && R->fd == v, 1)) { F->bk = R; R->fd = F
; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP =
&(v->child[1]))) != 0) || ((R = *(RP = &(v->child
[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->child
[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R = *(
RP = CP); } if (__builtin_expect(((char*)(RP) >= (m)->least_addr
), 1)) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr*
H = (&((m)->treebins[v->index])); if (v == *H) { if
((*H = R) == 0) ((m)->treemap &= ~((binmap_t)(1) <<
(v->index))); } else if (__builtin_expect(((char*)(XP) >=
(m)->least_addr), 1)) { if (XP->child[0] == v) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (m)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = v->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (m)
->least_addr), 1)) { R->child[0] = C0; C0->parent = R
; } else abort(); } if ((C1 = v->child[1]) != 0) { if (__builtin_expect
(((char*)(C1) >= (m)->least_addr), 1)) { R->child[1]
= C1; C1->parent = R; } else abort(); } } else abort(); }
}};
4685 if (rsize < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
4686 set_inuse_and_pinuse(m, v, (rsize + nb))((v)->head = ((rsize + nb)|(((size_t)1))|(((size_t)2))), (
(mchunkptr)(((char*)(v)) + ((rsize + nb))))->head |= (((size_t
)1)));
4687 else {
4688 set_size_and_pinuse_of_inuse_chunk(m, v, nb)((v)->head = (nb|(((size_t)1))|(((size_t)2))));
4689 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
4690 replace_dv(m, r, rsize){ size_t DVS = m->dvsize; if(!((((DVS) >> (3U)) <
(32U)))) abort(); if (DVS != 0) { mchunkptr DV = m->dv; {
bindex_t I = (bindex_t)((DVS) >> (3U)); mchunkptr B = (
(sbinptr)((char*)&((m)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(DVS >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((m)->smallmap & (
(binmap_t)(1) << (I)))) ((m)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (m)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = DV; F->bk = DV; DV->fd = F; DV->bk =
B;}; } m->dvsize = rsize; m->dv = r;};
4691 }
4692 return chunk2mem(v)((void*)((char*)(v) + ((sizeof(size_t))<<1)));
4693 }
4694 }
4695
4696 CORRUPTION_ERROR_ACTION(m)abort();
4697 return 0;
4698}
4699
4700#if !ONLY_MSPACES0
4701
4702void* dlmalloc(size_t bytes) {
4703 /*
4704 Basic algorithm:
4705 If a small request (< 256 bytes minus per-chunk overhead):
4706 1. If one exists, use a remainderless chunk in associated smallbin.
4707 (Remainderless means that there are too few excess bytes to
4708 represent as a chunk.)
4709 2. If it is big enough, use the dv chunk, which is normally the
4710 chunk adjacent to the one used for the most recent small request.
4711 3. If one exists, split the smallest available chunk in a bin,
4712 saving remainder in dv.
4713 4. If it is big enough, use the top chunk.
4714 5. If available, get memory from system and use it
4715 Otherwise, for a large request:
4716 1. Find the smallest available binned chunk that fits, and use it
4717 if it is better fitting than dv chunk, splitting if necessary.
4718 2. If better fitting than any binned chunk, use the dv chunk.
4719 3. If it is big enough, use the top chunk.
4720 4. If request size >= mmap threshold, try to directly mmap this chunk.
4721 5. If available, get memory from system and use it
4722
4723 The ugly goto's here ensure that postaction occurs along all paths.
4724 */
4725
4726#if USE_LOCKS1
4727 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
()); /* initialize in sys_alloc if not using locks */
4
←
Assuming the condition is true
→
4728#endif
4729
4730 if (!PREACTION(gm)(((((&_gm_))->mflags & (2U)))? (__sync_lock_test_and_set
(&((&_gm_))->mutex, 1)? spin_acquire_lock(&((&
_gm_))->mutex) : 0) : 0)) {
5
←
Assuming the condition is false
→
6
←
'?' condition is false
→
7
←
Taking true branch
→
4731 void* mem;
4732 size_t nb;
4733 if (bytes <= MAX_SMALL_REQUEST(((((size_t)1) << (8U)) - ((size_t)1)) - (((size_t)(2 *
sizeof(void *))) - ((size_t)1)) - ((sizeof(size_t))))) {
8
←
Assuming the condition is false
→
9
←
Taking false branch
→
4734 bindex_t idx;
4735 binmap_t smallbits;
4736 nb = (bytes < MIN_REQUEST((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) -
((sizeof(size_t))) - ((size_t)1)))? MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : pad_request(bytes)(((bytes) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)));
4737 idx = small_index(nb)(bindex_t)((nb) >> (3U));
4738 smallbits = gm(&_gm_)->smallmap >> idx;
4739
4740 if ((smallbits & 0x3U) != 0) { /* Remainderless fit to a smallbin. */
4741 mchunkptr b, p;
4742 idx += ~smallbits & 1; /* Uses next bin if idx empty */
4743 b = smallbin_at(gm, idx)((sbinptr)((char*)&(((&_gm_))->smallbins[(idx)<<
1])));
4744 p = b->fd;
4745 assert(chunksize(p) == small_index2size(idx))if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((idx) << (3U)))) abort();
4746 unlink_first_small_chunk(gm, b, p, idx){ mchunkptr F = p->fd; if(!(p != b)) abort(); if(!(p != F)
) abort(); if(!(((p)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) == ((idx) << (3U)))) abort(); if (
b == F) { (((&_gm_))->smallmap &= ~((binmap_t)(1) <<
(idx))); } else if (__builtin_expect(((char*)(F) >= ((&
_gm_))->least_addr) && F->bk == p, 1)) { F->
bk = b; b->fd = F; } else { abort(); }};
4747 set_inuse_and_pinuse(gm, p, small_index2size(idx))((p)->head = (((idx) << (3U))|(((size_t)1))|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (((idx) << (3U)))))->
head |= (((size_t)1)));
4748 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4749 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4750 goto postaction;
4751 }
4752
4753 else if (nb > gm(&_gm_)->dvsize) {
4754 if (smallbits != 0) { /* Use chunk in next nonempty smallbin */
4755 mchunkptr b, p, r;
4756 size_t rsize;
4757 bindex_t i;
4758 binmap_t leftbits = (smallbits << idx) & left_bits(idx2bit(idx))((((binmap_t)(1) << (idx))<<1) | -(((binmap_t)(1)
<< (idx))<<1));
4759 binmap_t leastbit = least_bit(leftbits)((leftbits) & -(leftbits));
4760 compute_bit2idx(leastbit, i){ unsigned int J; J = __builtin_ctz(leastbit); i = (bindex_t)
J;};
4761 b = smallbin_at(gm, i)((sbinptr)((char*)&(((&_gm_))->smallbins[(i)<<
1])));
4762 p = b->fd;
4763 assert(chunksize(p) == small_index2size(i))if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((i) << (3U)))) abort();
4764 unlink_first_small_chunk(gm, b, p, i){ mchunkptr F = p->fd; if(!(p != b)) abort(); if(!(p != F)
) abort(); if(!(((p)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) == ((i) << (3U)))) abort(); if (b
== F) { (((&_gm_))->smallmap &= ~((binmap_t)(1) <<
(i))); } else if (__builtin_expect(((char*)(F) >= ((&
_gm_))->least_addr) && F->bk == p, 1)) { F->
bk = b; b->fd = F; } else { abort(); }};
4765 rsize = small_index2size(i)((i) << (3U)) - nb;
4766 /* Fit here cannot be remainderless if 4byte sizes */
4767 if (SIZE_T_SIZE(sizeof(size_t)) != 4 && rsize < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
4768 set_inuse_and_pinuse(gm, p, small_index2size(i))((p)->head = (((i) << (3U))|(((size_t)1))|(((size_t)
2))), ((mchunkptr)(((char*)(p)) + (((i) << (3U)))))->
head |= (((size_t)1)));
4769 else {
4770 set_size_and_pinuse_of_inuse_chunk(gm, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
4771 r = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4772 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
4773 replace_dv(gm, r, rsize){ size_t DVS = (&_gm_)->dvsize; if(!((((DVS) >> (
3U)) < (32U)))) abort(); if (DVS != 0) { mchunkptr DV = (&
_gm_)->dv; { bindex_t I = (bindex_t)((DVS) >> (3U));
mchunkptr B = ((sbinptr)((char*)&(((&_gm_))->smallbins
[(I)<<1]))); mchunkptr F = B; if(!(DVS >= (((sizeof(
mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))) abort(); if
(!(((&_gm_))->smallmap & ((binmap_t)(1) << (
I)))) (((&_gm_))->smallmap |= ((binmap_t)(1) << (
I))); else if (__builtin_expect(((char*)(B->fd) >= ((&
_gm_))->least_addr), 1)) F = B->fd; else { abort(); } B
->fd = DV; F->bk = DV; DV->fd = F; DV->bk = B;}; }
(&_gm_)->dvsize = rsize; (&_gm_)->dv = r;};
4774 }
4775 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4776 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4777 goto postaction;
4778 }
4779
4780 else if (gm(&_gm_)->treemap != 0 && (mem = tmalloc_small(gm(&_gm_), nb)) != 0) {
4781 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4782 goto postaction;
4783 }
4784 }
4785 }
4786 else if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2))
10
←
Assuming the condition is false
→
11
←
Taking false branch
→
4787 nb = MAX_SIZE_T(~(size_t)0); /* Too big to allocate. Force failure (in sys alloc) */
4788 else {
4789 nb = pad_request(bytes)(((bytes) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)));
4790 if (gm(&_gm_)->treemap != 0 && (mem = tmalloc_large(gm(&_gm_), nb)) != 0) {
12
←
Assuming field 'treemap' is equal to 0
→
4791 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4792 goto postaction;
4793 }
4794 }
4795
4796 if (nb <= gm(&_gm_)->dvsize) {
13
←
Assuming 'nb' is > field 'dvsize'
→
14
←
Taking false branch
→
4797 size_t rsize = gm(&_gm_)->dvsize - nb;
4798 mchunkptr p = gm(&_gm_)->dv;
4799 if (rsize >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) { /* split dv */
4800 mchunkptr r = gm(&_gm_)->dv = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4801 gm(&_gm_)->dvsize = rsize;
4802 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
4803 set_size_and_pinuse_of_inuse_chunk(gm, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
4804 }
4805 else { /* exhaust dv */
4806 size_t dvs = gm(&_gm_)->dvsize;
4807 gm(&_gm_)->dvsize = 0;
4808 gm(&_gm_)->dv = 0;
4809 set_inuse_and_pinuse(gm, p, dvs)((p)->head = (dvs|(((size_t)1))|(((size_t)2))), ((mchunkptr
)(((char*)(p)) + (dvs)))->head |= (((size_t)1)));
4810 }
4811 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4812 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4813 goto postaction;
4814 }
4815
4816 else if (nb < gm(&_gm_)->topsize) { /* Split top */
15
←
Assuming 'nb' is < field 'topsize'
→
16
←
Taking true branch
→
4817 size_t rsize = gm(&_gm_)->topsize -= nb;
4818 mchunkptr p = gm(&_gm_)->top;
4819 mchunkptr r = gm(&_gm_)->top = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4820 r->head = rsize | PINUSE_BIT(((size_t)1));
4821 set_size_and_pinuse_of_inuse_chunk(gm, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
4822 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
4823 check_top_chunk(gm, gm->top)do_check_top_chunk((&_gm_),(&_gm_)->top);
17
←
Calling 'do_check_top_chunk'
→
4824 check_malloced_chunk(gm, mem, nb)do_check_malloced_chunk((&_gm_),mem,nb);
4825 goto postaction;
4826 }
4827
4828 mem = sys_alloc(gm(&_gm_), nb);
4829
4830 postaction:
4831 POSTACTION(gm){ if ((((&_gm_))->mflags & (2U))) __sync_lock_release
(&((&_gm_))->mutex); };
4832 return mem;
4833 }
4834
4835 return 0;
4836}
4837
4838/* ---------------------------- free --------------------------- */
4839
4840void dlfree(void* mem) {
4841 /*
4842 Consolidate freed chunks with preceding or succeeding bordering
4843 free chunks, if they exist, and then place in a bin. Intermixed
4844 with special cases for top, dv, mmapped chunks, and usage errors.
4845 */
4846
4847 if (mem != 0) {
4848 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
4849#if FOOTERS0
4850 mstate fm = get_mstate_for(p);
4851 if (!ok_magic(fm)(1)) {
4852 USAGE_ERROR_ACTION(fm, p)abort();
4853 return;
4854 }
4855#else /* FOOTERS */
4856#define fm gm(&_gm_)
4857#endif /* FOOTERS */
4858 if (!PREACTION(fm)((((fm)->mflags & (2U)))? (__sync_lock_test_and_set(&
(fm)->mutex, 1)? spin_acquire_lock(&(fm)->mutex) : 0
) : 0)) {
4859 check_inuse_chunk(fm, p)do_check_inuse_chunk(fm,p);
4860 if (RTCHECK(ok_address(fm, p) && ok_inuse(p))__builtin_expect(((char*)(p) >= (fm)->least_addr) &&
(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))), 1)) {
4861 size_t psize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
4862 mchunkptr next = chunk_plus_offset(p, psize)((mchunkptr)(((char*)(p)) + (psize)));
4863 if (!pinuse(p)((p)->head & (((size_t)1)))) {
4864 size_t prevsize = p->prev_foot;
4865 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) {
4866 psize += prevsize + MMAP_FOOT_PAD(((sizeof(size_t))<<2));
4867 if (CALL_MUNMAP((char*)p - prevsize, psize)munmap((((char*)p - prevsize)), ((psize))) == 0)
4868 fm->footprint -= psize;
4869 goto postaction;
4870 }
4871 else {
4872 mchunkptr prev = chunk_minus_offset(p, prevsize)((mchunkptr)(((char*)(p)) - (prevsize)));
4873 psize += prevsize;
4874 p = prev;
4875 if (RTCHECK(ok_address(fm, prev))__builtin_expect(((char*)(prev) >= (fm)->least_addr), 1
)) { /* consolidate backward */
4876 if (p != fm->dv) {
4877 unlink_chunk(fm, p, prevsize)if ((((prevsize) >> (3U)) < (32U))) { mchunkptr F = p
->fd; mchunkptr B = p->bk; bindex_t I = (bindex_t)((prevsize
) >> (3U)); if(!(p != B)) abort(); if(!(p != F)) abort(
); if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|((
(size_t)4))))) == ((I) << (3U)))) abort(); if (__builtin_expect
(F == ((sbinptr)((char*)&((fm)->smallbins[(I)<<1
]))) || (((char*)(F) >= (fm)->least_addr) && F->
bk == p), 1)) { if (B == F) { ((fm)->smallmap &= ~((binmap_t
)(1) << (I))); } else if (__builtin_expect(B == ((sbinptr
)((char*)&((fm)->smallbins[(I)<<1]))) || (((char
*)(B) >= (fm)->least_addr) && B->fd == p), 1
)) { F->bk = B; B->fd = F; } else { abort(); } } else {
abort(); }} else { tchunkptr TP = (tchunkptr)(p); { tchunkptr
XP = TP->parent; tchunkptr R; if (TP->bk != TP) { tchunkptr
F = TP->fd; R = TP->bk; if (__builtin_expect(((char*)(
F) >= (fm)->least_addr) && F->bk == TP &&
R->fd == TP, 1)) { F->bk = R; R->fd = F; } else { abort
(); } } else { tchunkptr* RP; if (((R = *(RP = &(TP->child
[1]))) != 0) || ((R = *(RP = &(TP->child[0]))) != 0)) {
tchunkptr* CP; while ((*(CP = &(R->child[1])) != 0) ||
(*(CP = &(R->child[0])) != 0)) { R = *(RP = CP); } if
(__builtin_expect(((char*)(RP) >= (fm)->least_addr), 1
)) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr* H =
(&((fm)->treebins[TP->index])); if (TP == *H) { if
((*H = R) == 0) ((fm)->treemap &= ~((binmap_t)(1) <<
(TP->index))); } else if (__builtin_expect(((char*)(XP) >=
(fm)->least_addr), 1)) { if (XP->child[0] == TP) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (fm)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = TP->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (fm
)->least_addr), 1)) { R->child[0] = C0; C0->parent =
R; } else abort(); } if ((C1 = TP->child[1]) != 0) { if (
__builtin_expect(((char*)(C1) >= (fm)->least_addr), 1))
{ R->child[1] = C1; C1->parent = R; } else abort(); } }
else abort(); } }}; };
4878 }
4879 else if ((next->head & INUSE_BITS((((size_t)1))|(((size_t)2)))) == INUSE_BITS((((size_t)1))|(((size_t)2)))) {
4880 fm->dvsize = psize;
4881 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
4882 goto postaction;
4883 }
4884 }
4885 else
4886 goto erroraction;
4887 }
4888 }
4889
4890 if (RTCHECK(ok_next(p, next) && ok_pinuse(next))__builtin_expect(((char*)(p) < (char*)(next)) && (
(next)->head & (((size_t)1))), 1)) {
4891 if (!cinuse(next)((next)->head & (((size_t)2)))) { /* consolidate forward */
4892 if (next == fm->top) {
4893 size_t tsize = fm->topsize += psize;
4894 fm->top = p;
4895 p->head = tsize | PINUSE_BIT(((size_t)1));
4896 if (p == fm->dv) {
4897 fm->dv = 0;
4898 fm->dvsize = 0;
4899 }
4900 if (should_trim(fm, tsize)((tsize) > (fm)->trim_check))
4901 sys_trim(fm, 0);
4902 goto postaction;
4903 }
4904 else if (next == fm->dv) {
4905 size_t dsize = fm->dvsize += psize;
4906 fm->dv = p;
4907 set_size_and_pinuse_of_free_chunk(p, dsize)((p)->head = (dsize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (dsize)))->prev_foot = (dsize)));
4908 goto postaction;
4909 }
4910 else {
4911 size_t nsize = chunksize(next)((next)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4)))));
4912 psize += nsize;
4913 unlink_chunk(fm, next, nsize)if ((((nsize) >> (3U)) < (32U))) { mchunkptr F = next
->fd; mchunkptr B = next->bk; bindex_t I = (bindex_t)((
nsize) >> (3U)); if(!(next != B)) abort(); if(!(next !=
F)) abort(); if(!(((next)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort()
; if (__builtin_expect(F == ((sbinptr)((char*)&((fm)->
smallbins[(I)<<1]))) || (((char*)(F) >= (fm)->least_addr
) && F->bk == next), 1)) { if (B == F) { ((fm)->
smallmap &= ~((binmap_t)(1) << (I))); } else if (__builtin_expect
(B == ((sbinptr)((char*)&((fm)->smallbins[(I)<<1
]))) || (((char*)(B) >= (fm)->least_addr) && B->
fd == next), 1)) { F->bk = B; B->fd = F; } else { abort
(); } } else { abort(); }} else { tchunkptr TP = (tchunkptr)(
next); { tchunkptr XP = TP->parent; tchunkptr R; if (TP->
bk != TP) { tchunkptr F = TP->fd; R = TP->bk; if (__builtin_expect
(((char*)(F) >= (fm)->least_addr) && F->bk ==
TP && R->fd == TP, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(TP->child[1]))) != 0) || ((R = *(RP = &(TP->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (fm)
->least_addr), 1)) *RP = 0; else { abort(); } } } if (XP !=
0) { tbinptr* H = (&((fm)->treebins[TP->index])); if
(TP == *H) { if ((*H = R) == 0) ((fm)->treemap &= ~((
binmap_t)(1) << (TP->index))); } else if (__builtin_expect
(((char*)(XP) >= (fm)->least_addr), 1)) { if (XP->child
[0] == TP) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(fm)->least_addr), 1)) { tchunkptr C0, C1; R->parent =
XP; if ((C0 = TP->child[0]) != 0) { if (__builtin_expect(
((char*)(C0) >= (fm)->least_addr), 1)) { R->child[0]
= C0; C0->parent = R; } else abort(); } if ((C1 = TP->
child[1]) != 0) { if (__builtin_expect(((char*)(C1) >= (fm
)->least_addr), 1)) { R->child[1] = C1; C1->parent =
R; } else abort(); } } else abort(); } }}; };
4914 set_size_and_pinuse_of_free_chunk(p, psize)((p)->head = (psize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (psize)))->prev_foot = (psize)));
4915 if (p == fm->dv) {
4916 fm->dvsize = psize;
4917 goto postaction;
4918 }
4919 }
4920 }
4921 else
4922 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
4923
4924 if (is_small(psize)(((psize) >> (3U)) < (32U))) {
4925 insert_small_chunk(fm, p, psize){ bindex_t I = (bindex_t)((psize) >> (3U)); mchunkptr B
= ((sbinptr)((char*)&((fm)->smallbins[(I)<<1]))
); mchunkptr F = B; if(!(psize >= (((sizeof(mchunk)) + (((
size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t
)(2 * sizeof(void *))) - ((size_t)1))))) abort(); if (!((fm)->
smallmap & ((binmap_t)(1) << (I)))) ((fm)->smallmap
|= ((binmap_t)(1) << (I))); else if (__builtin_expect(
((char*)(B->fd) >= (fm)->least_addr), 1)) F = B->
fd; else { abort(); } B->fd = p; F->bk = p; p->fd = F
; p->bk = B;};
4926 check_free_chunk(fm, p)do_check_free_chunk(fm,p);
4927 }
4928 else {
4929 tchunkptr tp = (tchunkptr)p;
4930 insert_large_chunk(fm, tp, psize){ tbinptr* H; bindex_t I; { unsigned int X = psize >> (
8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1; else
{ unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz
(X); I = (bindex_t)((K << 1) + ((psize >> (K + ((
8U)-1)) & 1))); }}; H = (&((fm)->treebins[I])); tp
->index = I; tp->child[0] = tp->child[1] = 0; if (!(
(fm)->treemap & ((binmap_t)(1) << (I)))) { ((fm)
->treemap |= ((binmap_t)(1) << (I))); *H = tp; tp->
parent = (tchunkptr)H; tp->fd = tp->bk = tp; } else { tchunkptr
T = *H; size_t K = psize << ((I == (32U)-1)? 0 : (((sizeof
(size_t) << 3)-((size_t)1)) - (((I) >> 1) + (8U) -
2))); for (;;) { if (((T)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) != psize) { tchunkptr* C = &
(T->child[(K >> ((sizeof(size_t) << 3)-((size_t
)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else if (
__builtin_expect(((char*)(C) >= (fm)->least_addr), 1)) {
*C = tp; tp->parent = T; tp->fd = tp->bk = tp; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (fm)->least_addr) &&
((char*)(F) >= (fm)->least_addr), 1)) { T->fd = F->
bk = tp; tp->fd = F; tp->bk = T; tp->parent = 0; break
; } else { abort(); break; } } } }};
4931 check_free_chunk(fm, p)do_check_free_chunk(fm,p);
4932 if (--fm->release_checks == 0)
4933 release_unused_segments(fm);
4934 }
4935 goto postaction;
4936 }
4937 }
4938 erroraction:
4939 USAGE_ERROR_ACTION(fm, p)abort();
4940 postaction:
4941 POSTACTION(fm){ if (((fm)->mflags & (2U))) __sync_lock_release(&
(fm)->mutex); };
4942 }
4943 }
4944#if !FOOTERS0
4945#undef fm
4946#endif /* FOOTERS */
4947}
4948
4949void* dlcalloc(size_t n_elements, size_t elem_size) {
4950 void* mem;
4951 size_t req = 0;
4952 if (n_elements != 0) {
4953 req = n_elements * elem_size;
4954 if (((n_elements | elem_size) & ~(size_t)0xffff) &&
4955 (req / n_elements != elem_size))
4956 req = MAX_SIZE_T(~(size_t)0); /* force downstream failure on overflow */
4957 }
4958 mem = dlmalloc(req);
4959 if (mem != 0 && calloc_must_clear(mem2chunk(mem))(!(((((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1))
))->head & ((((size_t)1))|(((size_t)2)))) == 0)))
4960 memset(mem, 0, req);
4961 return mem;
4962}
4963
4964#endif /* !ONLY_MSPACES */
4965
4966/* ------------ Internal support for realloc, memalign, etc -------------- */
4967
4968/* Try to realloc; only in-place unless can_move true */
4969static mchunkptr try_realloc_chunk(mstate m, mchunkptr p, size_t nb,
4970 int can_move) {
4971 mchunkptr newp = 0;
4972 size_t oldsize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
4973 mchunkptr next = chunk_plus_offset(p, oldsize)((mchunkptr)(((char*)(p)) + (oldsize)));
4974 if (RTCHECK(ok_address(m, p) && ok_inuse(p) &&__builtin_expect(((char*)(p) >= (m)->least_addr) &&
(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) && ((char*)(p) < (char*)(next)) && (
(next)->head & (((size_t)1))), 1)
4975 ok_next(p, next) && ok_pinuse(next))__builtin_expect(((char*)(p) >= (m)->least_addr) &&
(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))) && ((char*)(p) < (char*)(next)) && (
(next)->head & (((size_t)1))), 1)) {
4976 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) {
4977 newp = mmap_resize(m, p, nb, can_move);
4978 }
4979 else if (oldsize >= nb) { /* already big enough */
4980 size_t rsize = oldsize - nb;
4981 if (rsize >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) { /* split off remainder */
4982 mchunkptr r = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4983 set_inuse(m, p, nb)((p)->head = (((p)->head & (((size_t)1)))|nb|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (nb)))->head |= (((size_t
)1)));
4984 set_inuse(m, r, rsize)((r)->head = (((r)->head & (((size_t)1)))|rsize|(((
size_t)2))), ((mchunkptr)(((char*)(r)) + (rsize)))->head |=
(((size_t)1)));
4985 dispose_chunk(m, r, rsize);
4986 }
4987 newp = p;
4988 }
4989 else if (next == m->top) { /* extend into top */
4990 if (oldsize + m->topsize > nb) {
4991 size_t newsize = oldsize + m->topsize;
4992 size_t newtopsize = newsize - nb;
4993 mchunkptr newtop = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
4994 set_inuse(m, p, nb)((p)->head = (((p)->head & (((size_t)1)))|nb|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (nb)))->head |= (((size_t
)1)));
4995 newtop->head = newtopsize |PINUSE_BIT(((size_t)1));
4996 m->top = newtop;
4997 m->topsize = newtopsize;
4998 newp = p;
4999 }
5000 }
5001 else if (next == m->dv) { /* extend into dv */
5002 size_t dvs = m->dvsize;
5003 if (oldsize + dvs >= nb) {
5004 size_t dsize = oldsize + dvs - nb;
5005 if (dsize >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) {
5006 mchunkptr r = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5007 mchunkptr n = chunk_plus_offset(r, dsize)((mchunkptr)(((char*)(r)) + (dsize)));
5008 set_inuse(m, p, nb)((p)->head = (((p)->head & (((size_t)1)))|nb|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (nb)))->head |= (((size_t
)1)));
5009 set_size_and_pinuse_of_free_chunk(r, dsize)((r)->head = (dsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (dsize)))->prev_foot = (dsize)));
5010 clear_pinuse(n)((n)->head &= ~(((size_t)1)));
5011 m->dvsize = dsize;
5012 m->dv = r;
5013 }
5014 else { /* exhaust dv */
5015 size_t newsize = oldsize + dvs;
5016 set_inuse(m, p, newsize)((p)->head = (((p)->head & (((size_t)1)))|newsize|(
((size_t)2))), ((mchunkptr)(((char*)(p)) + (newsize)))->head
|= (((size_t)1)));
5017 m->dvsize = 0;
5018 m->dv = 0;
5019 }
5020 newp = p;
5021 }
5022 }
5023 else if (!cinuse(next)((next)->head & (((size_t)2)))) { /* extend into next free chunk */
5024 size_t nextsize = chunksize(next)((next)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4)))));
5025 if (oldsize + nextsize >= nb) {
5026 size_t rsize = oldsize + nextsize - nb;
5027 unlink_chunk(m, next, nextsize)if ((((nextsize) >> (3U)) < (32U))) { mchunkptr F = next
->fd; mchunkptr B = next->bk; bindex_t I = (bindex_t)((
nextsize) >> (3U)); if(!(next != B)) abort(); if(!(next
!= F)) abort(); if(!(((next)->head & ~(((((size_t)1))
|(((size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort
(); if (__builtin_expect(F == ((sbinptr)((char*)&((m)->
smallbins[(I)<<1]))) || (((char*)(F) >= (m)->least_addr
) && F->bk == next), 1)) { if (B == F) { ((m)->
smallmap &= ~((binmap_t)(1) << (I))); } else if (__builtin_expect
(B == ((sbinptr)((char*)&((m)->smallbins[(I)<<1]
))) || (((char*)(B) >= (m)->least_addr) && B->
fd == next), 1)) { F->bk = B; B->fd = F; } else { abort
(); } } else { abort(); }} else { tchunkptr TP = (tchunkptr)(
next); { tchunkptr XP = TP->parent; tchunkptr R; if (TP->
bk != TP) { tchunkptr F = TP->fd; R = TP->bk; if (__builtin_expect
(((char*)(F) >= (m)->least_addr) && F->bk ==
TP && R->fd == TP, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(TP->child[1]))) != 0) || ((R = *(RP = &(TP->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (m)->
least_addr), 1)) *RP = 0; else { abort(); } } } if (XP != 0) {
tbinptr* H = (&((m)->treebins[TP->index])); if (TP
== *H) { if ((*H = R) == 0) ((m)->treemap &= ~((binmap_t
)(1) << (TP->index))); } else if (__builtin_expect((
(char*)(XP) >= (m)->least_addr), 1)) { if (XP->child
[0] == TP) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(m)->least_addr), 1)) { tchunkptr C0, C1; R->parent = XP
; if ((C0 = TP->child[0]) != 0) { if (__builtin_expect(((char
*)(C0) >= (m)->least_addr), 1)) { R->child[0] = C0; C0
->parent = R; } else abort(); } if ((C1 = TP->child[1])
!= 0) { if (__builtin_expect(((char*)(C1) >= (m)->least_addr
), 1)) { R->child[1] = C1; C1->parent = R; } else abort
(); } } else abort(); } }}; };
5028 if (rsize < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) {
5029 size_t newsize = oldsize + nextsize;
5030 set_inuse(m, p, newsize)((p)->head = (((p)->head & (((size_t)1)))|newsize|(
((size_t)2))), ((mchunkptr)(((char*)(p)) + (newsize)))->head
|= (((size_t)1)));
5031 }
5032 else {
5033 mchunkptr r = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5034 set_inuse(m, p, nb)((p)->head = (((p)->head & (((size_t)1)))|nb|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (nb)))->head |= (((size_t
)1)));
5035 set_inuse(m, r, rsize)((r)->head = (((r)->head & (((size_t)1)))|rsize|(((
size_t)2))), ((mchunkptr)(((char*)(r)) + (rsize)))->head |=
(((size_t)1)));
5036 dispose_chunk(m, r, rsize);
5037 }
5038 newp = p;
5039 }
5040 }
5041 }
5042 else {
5043 USAGE_ERROR_ACTION(m, chunk2mem(p))abort();
5044 }
5045 return newp;
5046}
5047
5048static void* internal_memalign(mstate m, size_t alignment, size_t bytes) {
5049 void* mem = 0;
5050 if (alignment < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) /* must be at least a minimum chunk size */
5051 alignment = MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)));
5052 if ((alignment & (alignment-SIZE_T_ONE((size_t)1))) != 0) {/* Ensure a power of 2 */
5053 size_t a = MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))) << 1;
5054 while (a < alignment) a <<= 1;
5055 alignment = a;
5056 }
5057 if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2) - alignment) {
5058 if (m != 0) { /* Test isn't needed but avoids compiler warning */
5059 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
5060 }
5061 }
5062 else {
5063 size_t nb = request2size(bytes)(((bytes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((bytes)
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5064 size_t req = nb + alignment + MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) - CHUNK_OVERHEAD((sizeof(size_t)));
5065 mem = internal_malloc(m, req)dlmalloc(req);
5066 if (mem != 0) {
5067 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
5068 if (PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0))
5069 return 0;
5070 if ((((size_t)(mem)) & (alignment - 1)) != 0) { /* misaligned */
5071 /*
5072 Find an aligned spot inside chunk. Since we need to give
5073 back leading space in a chunk of at least MIN_CHUNK_SIZE, if
5074 the first calculation places us at a spot with less than
5075 MIN_CHUNK_SIZE leader, we can move to the next aligned spot.
5076 We've allocated enough total room so that this is always
5077 possible.
5078 */
5079 char* br = (char*)mem2chunk((size_t)(((size_t)((char*)mem + alignment -((mchunkptr)((char*)((size_t)(((size_t)((char*)mem + alignment
- ((size_t)1))) & -alignment)) - ((sizeof(size_t))<<
1)))
5080 SIZE_T_ONE)) &((mchunkptr)((char*)((size_t)(((size_t)((char*)mem + alignment
- ((size_t)1))) & -alignment)) - ((sizeof(size_t))<<
1)))
5081 -alignment))((mchunkptr)((char*)((size_t)(((size_t)((char*)mem + alignment
- ((size_t)1))) & -alignment)) - ((sizeof(size_t))<<
1)));
5082 char* pos = ((size_t)(br - (char*)(p)) >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))?
5083 br : br+alignment;
5084 mchunkptr newp = (mchunkptr)pos;
5085 size_t leadsize = pos - (char*)(p);
5086 size_t newsize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - leadsize;
5087
5088 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) { /* For mmapped chunks, just adjust offset */
5089 newp->prev_foot = p->prev_foot + leadsize;
5090 newp->head = newsize;
5091 }
5092 else { /* Otherwise, give back leader, use the rest */
5093 set_inuse(m, newp, newsize)((newp)->head = (((newp)->head & (((size_t)1)))|newsize
|(((size_t)2))), ((mchunkptr)(((char*)(newp)) + (newsize)))->
head |= (((size_t)1)));
5094 set_inuse(m, p, leadsize)((p)->head = (((p)->head & (((size_t)1)))|leadsize|
(((size_t)2))), ((mchunkptr)(((char*)(p)) + (leadsize)))->
head |= (((size_t)1)));
5095 dispose_chunk(m, p, leadsize);
5096 }
5097 p = newp;
5098 }
5099
5100 /* Give back spare room at the end */
5101 if (!is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) {
5102 size_t size = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
5103 if (size > nb + MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) {
5104 size_t remainder_size = size - nb;
5105 mchunkptr remainder = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5106 set_inuse(m, p, nb)((p)->head = (((p)->head & (((size_t)1)))|nb|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (nb)))->head |= (((size_t
)1)));
5107 set_inuse(m, remainder, remainder_size)((remainder)->head = (((remainder)->head & (((size_t
)1)))|remainder_size|(((size_t)2))), ((mchunkptr)(((char*)(remainder
)) + (remainder_size)))->head |= (((size_t)1)));
5108 dispose_chunk(m, remainder, remainder_size);
5109 }
5110 }
5111
5112 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5113 assert (chunksize(p) >= nb)if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) >= nb)) abort();
5114 assert(((size_t)mem & (alignment - 1)) == 0)if(!(((size_t)mem & (alignment - 1)) == 0)) abort();
5115 check_inuse_chunk(m, p)do_check_inuse_chunk(m,p);
5116 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5117 }
5118 }
5119 return mem;
5120}
5121
5122/*
5123 Common support for independent_X routines, handling
5124 all of the combinations that can result.
5125 The opts arg has:
5126 bit 0 set if all elements are same size (using sizes[0])
5127 bit 1 set if elements should be zeroed
5128*/
5129static void** ialloc(mstate m,
5130 size_t n_elements,
5131 size_t* sizes,
5132 int opts,
5133 void* chunks[]) {
5134
5135 size_t element_size; /* chunksize of each element, if all same */
5136 size_t contents_size; /* total size of elements */
5137 size_t array_size; /* request size of pointer array */
5138 void* mem; /* malloced aggregate space */
5139 mchunkptr p; /* corresponding chunk */
5140 size_t remainder_size; /* remaining bytes while splitting */
5141 void** marray; /* either "chunks" or malloced ptr array */
5142 mchunkptr array_chunk; /* chunk for malloced ptr array */
5143 flag_t was_enabled; /* to disable mmap */
5144 size_t size;
5145 size_t i;
5146
5147 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5148 /* compute array length, if needed */
5149 if (chunks != 0) {
5150 if (n_elements == 0)
5151 return chunks; /* nothing to do */
5152 marray = chunks;
5153 array_size = 0;
5154 }
5155 else {
5156 /* if empty req, must still return chunk representing empty array */
5157 if (n_elements == 0)
5158 return (void**)internal_malloc(m, 0)dlmalloc(0);
5159 marray = 0;
5160 array_size = request2size(n_elements * (sizeof(void*)))(((n_elements * (sizeof(void*))) < ((((sizeof(mchunk)) + (
((size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t
)(2 * sizeof(void *))) - ((size_t)1))) - ((sizeof(size_t))) -
((size_t)1)))? (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) : (((n_elements * (sizeof(void*))) + ((sizeof(
size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5161 }
5162
5163 /* compute total element size */
5164 if (opts & 0x1) { /* all-same-size */
5165 element_size = request2size(*sizes)(((*sizes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((*sizes
) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((
size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t
)1))));
5166 contents_size = n_elements * element_size;
5167 }
5168 else { /* add up all the sizes */
5169 element_size = 0;
5170 contents_size = 0;
5171 for (i = 0; i != n_elements; ++i)
5172 contents_size += request2size(sizes[i])(((sizes[i]) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((
sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)
1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) :
(((sizes[i]) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))));
5173 }
5174
5175 size = contents_size + array_size;
5176
5177 /*
5178 Allocate the aggregate chunk. First disable direct-mmapping so
5179 malloc won't use it, since we would not be able to later
5180 free/realloc space internal to a segregated mmap region.
5181 */
5182 was_enabled = use_mmap(m)((m)->mflags & (((size_t)1)));
5183 disable_mmap(m)((m)->mflags &= ~(((size_t)1)));
5184 mem = internal_malloc(m, size - CHUNK_OVERHEAD)dlmalloc(size - ((sizeof(size_t))));
5185 if (was_enabled)
5186 enable_mmap(m)((m)->mflags |= (((size_t)1)));
5187 if (mem == 0)
5188 return 0;
5189
5190 if (PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) return 0;
5191 p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
5192 remainder_size = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
5193
5194 assert(!is_mmapped(p))if(!(!(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0
))) abort();
5195
5196 if (opts & 0x2) { /* optionally clear the elements */
5197 memset((size_t*)mem, 0, remainder_size - SIZE_T_SIZE(sizeof(size_t)) - array_size);
5198 }
5199
5200 /* If not provided, allocate the pointer array as final part of chunk */
5201 if (marray == 0) {
5202 size_t array_chunk_size;
5203 array_chunk = chunk_plus_offset(p, contents_size)((mchunkptr)(((char*)(p)) + (contents_size)));
5204 array_chunk_size = remainder_size - contents_size;
5205 marray = (void**) (chunk2mem(array_chunk)((void*)((char*)(array_chunk) + ((sizeof(size_t))<<1))));
5206 set_size_and_pinuse_of_inuse_chunk(m, array_chunk, array_chunk_size)((array_chunk)->head = (array_chunk_size|(((size_t)1))|(((
size_t)2))));
5207 remainder_size = contents_size;
5208 }
5209
5210 /* split out elements */
5211 for (i = 0; ; ++i) {
5212 marray[i] = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5213 if (i != n_elements-1) {
5214 if (element_size != 0)
5215 size = element_size;
5216 else
5217 size = request2size(sizes[i])(((sizes[i]) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((
sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)
1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) :
(((sizes[i]) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))));
5218 remainder_size -= size;
5219 set_size_and_pinuse_of_inuse_chunk(m, p, size)((p)->head = (size|(((size_t)1))|(((size_t)2))));
5220 p = chunk_plus_offset(p, size)((mchunkptr)(((char*)(p)) + (size)));
5221 }
5222 else { /* the final element absorbs any overallocation slop */
5223 set_size_and_pinuse_of_inuse_chunk(m, p, remainder_size)((p)->head = (remainder_size|(((size_t)1))|(((size_t)2))));
5224 break;
5225 }
5226 }
5227
5228#if DEBUG1
5229 if (marray != chunks) {
5230 /* final element must have exactly exhausted chunk */
5231 if (element_size != 0) {
5232 assert(remainder_size == element_size)if(!(remainder_size == element_size)) abort();
5233 }
5234 else {
5235 assert(remainder_size == request2size(sizes[i]))if(!(remainder_size == (((sizes[i]) < ((((sizeof(mchunk)) +
(((size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t
)(2 * sizeof(void *))) - ((size_t)1))) - ((sizeof(size_t))) -
((size_t)1)))? (((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) : (((sizes[i]) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)))))) abort();
5236 }
5237 check_inuse_chunk(m, mem2chunk(marray))do_check_inuse_chunk(m,((mchunkptr)((char*)(marray) - ((sizeof
(size_t))<<1))));
5238 }
5239 for (i = 0; i != n_elements; ++i)
5240 check_inuse_chunk(m, mem2chunk(marray[i]))do_check_inuse_chunk(m,((mchunkptr)((char*)(marray[i]) - ((sizeof
(size_t))<<1))));
5241
5242#endif /* DEBUG */
5243
5244 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5245 return marray;
5246}
5247
5248/* Try to free all pointers in the given array.
5249 Note: this could be made faster, by delaying consolidation,
5250 at the price of disabling some user integrity checks, We
5251 still optimize some consolidations by combining adjacent
5252 chunks before freeing, which will occur often if allocated
5253 with ialloc or the array is sorted.
5254*/
5255static size_t internal_bulk_free(mstate m, void* array[], size_t nelem) {
5256 size_t unfreed = 0;
5257 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
5258 void** a;
5259 void** fence = &(array[nelem]);
5260 for (a = array; a != fence; ++a) {
5261 void* mem = *a;
5262 if (mem != 0) {
5263 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
5264 size_t psize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
5265#if FOOTERS0
5266 if (get_mstate_for(p) != m) {
5267 ++unfreed;
5268 continue;
5269 }
5270#endif
5271 check_inuse_chunk(m, p)do_check_inuse_chunk(m,p);
5272 *a = 0;
5273 if (RTCHECK(ok_address(m, p) && ok_inuse(p))__builtin_expect(((char*)(p) >= (m)->least_addr) &&
(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))), 1)) {
5274 void ** b = a + 1; /* try to merge with next chunk */
5275 mchunkptr next = next_chunk(p)((mchunkptr)( ((char*)(p)) + ((p)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
5276 if (b != fence && *b == chunk2mem(next)((void*)((char*)(next) + ((sizeof(size_t))<<1)))) {
5277 size_t newsize = chunksize(next)((next)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) + psize;
5278 set_inuse(m, p, newsize)((p)->head = (((p)->head & (((size_t)1)))|newsize|(
((size_t)2))), ((mchunkptr)(((char*)(p)) + (newsize)))->head
|= (((size_t)1)));
5279 *b = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5280 }
5281 else
5282 dispose_chunk(m, p, psize);
5283 }
5284 else {
5285 CORRUPTION_ERROR_ACTION(m)abort();
5286 break;
5287 }
5288 }
5289 }
5290 if (should_trim(m, m->topsize)((m->topsize) > (m)->trim_check))
5291 sys_trim(m, 0);
5292 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5293 }
5294 return unfreed;
5295}
5296
5297/* Traversal */
5298#if MALLOC_INSPECT_ALL0
5299static void internal_inspect_all(mstate m,
5300 void(*handler)(void *start,
5301 void *end,
5302 size_t used_bytes,
5303 void* callback_arg),
5304 void* arg) {
5305 if (is_initialized(m)((m)->top != 0)) {
5306 mchunkptr top = m->top;
5307 msegmentptr s;
5308 for (s = &m->seg; s != 0; s = s->next) {
5309 mchunkptr q = align_as_chunk(s->base)(mchunkptr)((s->base) + ((((size_t)(((void*)((char*)(s->
base) + ((sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(
void *))) - ((size_t)(((void*)((char*)(s->base) + ((sizeof
(size_t))<<1)))) & (((size_t)(2 * sizeof(void *))) -
((size_t)1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t
)1)))));
5310 while (segment_holds(s, q)((char*)(q) >= s->base && (char*)(q) < s->
base + s->size) && q->head != FENCEPOST_HEAD(((((size_t)1))|(((size_t)2)))|(sizeof(size_t)))) {
5311 mchunkptr next = next_chunk(q)((mchunkptr)( ((char*)(q)) + ((q)->head & ~((((size_t)
1))|(((size_t)2))|(((size_t)4))))));
5312 size_t sz = chunksize(q)((q)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
5313 size_t used;
5314 void* start;
5315 if (is_inuse(q)(((q)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1)))) {
5316 used = sz - CHUNK_OVERHEAD((sizeof(size_t))); /* must not be mmapped */
5317 start = chunk2mem(q)((void*)((char*)(q) + ((sizeof(size_t))<<1)));
5318 }
5319 else {
5320 used = 0;
5321 if (is_small(sz)(((sz) >> (3U)) < (32U))) { /* offset by possible bookkeeping */
5322 start = (void*)((char*)q + sizeof(struct malloc_chunk));
5323 }
5324 else {
5325 start = (void*)((char*)q + sizeof(struct malloc_tree_chunk));
5326 }
5327 }
5328 if (start < (void*)next) /* skip if all space is bookkeeping */
5329 handler(start, next, used, arg);
5330 if (q == top)
5331 break;
5332 q = next;
5333 }
5334 }
5335 }
5336}
5337#endif /* MALLOC_INSPECT_ALL */
5338
5339/* ------------------ Exported realloc, memalign, etc -------------------- */
5340
5341#if !ONLY_MSPACES0
5342
5343void* dlrealloc(void* oldmem, size_t bytes) {
5344 void* mem = 0;
5345 if (oldmem == 0) {
5346 mem = dlmalloc(bytes);
5347 }
5348 else if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2)) {
5349 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
5350 }
5351#ifdef REALLOC_ZERO_BYTES_FREES
5352 else if (bytes == 0) {
5353 dlfree(oldmem);
5354 }
5355#endif /* REALLOC_ZERO_BYTES_FREES */
5356 else {
5357 size_t nb = request2size(bytes)(((bytes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((bytes)
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5358 mchunkptr oldp = mem2chunk(oldmem)((mchunkptr)((char*)(oldmem) - ((sizeof(size_t))<<1)));
5359#if ! FOOTERS0
5360 mstate m = gm(&_gm_);
5361#else /* FOOTERS */
5362 mstate m = get_mstate_for(oldp);
5363 if (!ok_magic(m)(1)) {
5364 USAGE_ERROR_ACTION(m, oldmem)abort();
5365 return 0;
5366 }
5367#endif /* FOOTERS */
5368 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
5369 mchunkptr newp = try_realloc_chunk(m, oldp, nb, 1);
5370 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5371 if (newp != 0) {
5372 check_inuse_chunk(m, newp)do_check_inuse_chunk(m,newp);
5373 mem = chunk2mem(newp)((void*)((char*)(newp) + ((sizeof(size_t))<<1)));
5374 }
5375 else {
5376 mem = internal_malloc(m, bytes)dlmalloc(bytes);
5377 if (mem != 0) {
5378 size_t oc = chunksize(oldp)((oldp)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) - overhead_for(oldp)((((oldp)->head & ((((size_t)1))|(((size_t)2)))) == 0)
? (((sizeof(size_t))<<1)) : ((sizeof(size_t))));
5379 memcpy(mem, oldmem, (oc < bytes)? oc : bytes);
5380 internal_free(m, oldmem)dlfree(oldmem);
5381 }
5382 }
5383 }
5384 }
5385 return mem;
5386}
5387
5388void* dlrealloc_in_place(void* oldmem, size_t bytes) {
5389 void* mem = 0;
5390 if (oldmem != 0) {
5391 if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2)) {
5392 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
5393 }
5394 else {
5395 size_t nb = request2size(bytes)(((bytes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((bytes)
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5396 mchunkptr oldp = mem2chunk(oldmem)((mchunkptr)((char*)(oldmem) - ((sizeof(size_t))<<1)));
5397#if ! FOOTERS0
5398 mstate m = gm(&_gm_);
5399#else /* FOOTERS */
5400 mstate m = get_mstate_for(oldp);
5401 if (!ok_magic(m)(1)) {
5402 USAGE_ERROR_ACTION(m, oldmem)abort();
5403 return 0;
5404 }
5405#endif /* FOOTERS */
5406 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
5407 mchunkptr newp = try_realloc_chunk(m, oldp, nb, 0);
5408 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5409 if (newp == oldp) {
5410 check_inuse_chunk(m, newp)do_check_inuse_chunk(m,newp);
5411 mem = oldmem;
5412 }
5413 }
5414 }
5415 }
5416 return mem;
5417}
5418
5419void* dlmemalign(size_t alignment, size_t bytes) {
5420 if (alignment <= MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *)))) {
5421 return dlmalloc(bytes);
5422 }
5423 return internal_memalign(gm(&_gm_), alignment, bytes);
5424}
5425
5426int dlposix_memalign(void** pp, size_t alignment, size_t bytes) {
5427 void* mem = 0;
5428 if (alignment == MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))))
5429 mem = dlmalloc(bytes);
5430 else {
5431 size_t d = alignment / sizeof(void*);
5432 size_t r = alignment % sizeof(void*);
5433 if (r != 0 || d == 0 || (d & (d-SIZE_T_ONE((size_t)1))) != 0)
5434 return EINVAL22;
5435 else if (bytes <= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2) - alignment) {
5436 if (alignment < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
5437 alignment = MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)));
5438 mem = internal_memalign(gm(&_gm_), alignment, bytes);
5439 }
5440 }
5441 if (mem == 0)
5442 return ENOMEM12;
5443 else {
5444 *pp = mem;
5445 return 0;
5446 }
5447}
5448
5449void* dlvalloc(size_t bytes) {
5450 size_t pagesz;
5451 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5452 pagesz = mparams.page_size;
5453 return dlmemalign(pagesz, bytes);
5454}
5455
5456void* dlpvalloc(size_t bytes) {
5457 size_t pagesz;
5458 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5459 pagesz = mparams.page_size;
5460 return dlmemalign(pagesz, (bytes + pagesz - SIZE_T_ONE((size_t)1)) & ~(pagesz - SIZE_T_ONE((size_t)1)));
5461}
5462
5463void** dlindependent_calloc(size_t n_elements, size_t elem_size,
5464 void* chunks[]) {
5465 size_t sz = elem_size; /* serves as 1-element array */
5466 return ialloc(gm(&_gm_), n_elements, &sz, 3, chunks);
5467}
5468
5469void** dlindependent_comalloc(size_t n_elements, size_t sizes[],
5470 void* chunks[]) {
5471 return ialloc(gm(&_gm_), n_elements, sizes, 0, chunks);
5472}
5473
5474size_t dlbulk_free(void* array[], size_t nelem) {
5475 return internal_bulk_free(gm(&_gm_), array, nelem);
5476}
5477
5478#if MALLOC_INSPECT_ALL0
5479void dlmalloc_inspect_all(void(*handler)(void *start,
5480 void *end,
5481 size_t used_bytes,
5482 void* callback_arg),
5483 void* arg) {
5484 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5485 if (!PREACTION(gm)(((((&_gm_))->mflags & (2U)))? (__sync_lock_test_and_set
(&((&_gm_))->mutex, 1)? spin_acquire_lock(&((&
_gm_))->mutex) : 0) : 0)) {
5486 internal_inspect_all(gm(&_gm_), handler, arg);
5487 POSTACTION(gm){ if ((((&_gm_))->mflags & (2U))) __sync_lock_release
(&((&_gm_))->mutex); };
5488 }
5489}
5490#endif /* MALLOC_INSPECT_ALL */
5491
5492int dlmalloc_trim(size_t pad) {
5493 int result = 0;
5494 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5495 if (!PREACTION(gm)(((((&_gm_))->mflags & (2U)))? (__sync_lock_test_and_set
(&((&_gm_))->mutex, 1)? spin_acquire_lock(&((&
_gm_))->mutex) : 0) : 0)) {
5496 result = sys_trim(gm(&_gm_), pad);
5497 POSTACTION(gm){ if ((((&_gm_))->mflags & (2U))) __sync_lock_release
(&((&_gm_))->mutex); };
5498 }
5499 return result;
5500}
5501
5502size_t dlmalloc_footprint(void) {
5503 return gm(&_gm_)->footprint;
5504}
5505
5506size_t dlmalloc_max_footprint(void) {
5507 return gm(&_gm_)->max_footprint;
5508}
5509
5510size_t dlmalloc_footprint_limit(void) {
5511 size_t maf = gm(&_gm_)->footprint_limit;
5512 return maf == 0 ? MAX_SIZE_T(~(size_t)0) : maf;
5513}
5514
5515size_t dlmalloc_set_footprint_limit(size_t bytes) {
5516 size_t result; /* invert sense of 0 */
5517 if (bytes == 0)
5518 result = granularity_align(1)(((1) + (mparams.granularity - ((size_t)1))) & ~(mparams.
granularity - ((size_t)1))); /* Use minimal size */
5519 if (bytes == MAX_SIZE_T(~(size_t)0))
5520 result = 0; /* disable */
5521 else
5522 result = granularity_align(bytes)(((bytes) + (mparams.granularity - ((size_t)1))) & ~(mparams
.granularity - ((size_t)1)));
5523 return gm(&_gm_)->footprint_limit = result;
5524}
5525
5526#if !NO_MALLINFO1
5527struct mallinfo dlmallinfo(void) {
5528 return internal_mallinfo(gm(&_gm_));
5529}
5530#endif /* NO_MALLINFO */
5531
5532#if !NO_MALLOC_STATS0
5533void dlmalloc_stats(void) {
5534 internal_malloc_stats(gm(&_gm_));
5535}
5536#endif /* NO_MALLOC_STATS */
5537
5538int dlmallopt(int param_number, int value) {
5539 return change_mparam(param_number, value);
5540}
5541
5542size_t dlmalloc_usable_size(void* mem) {
5543 if (mem != 0) {
5544 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
5545 if (is_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))))
5546 return chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - overhead_for(p)((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)? (
((sizeof(size_t))<<1)) : ((sizeof(size_t))));
5547 }
5548 return 0;
5549}
5550
5551#endif /* !ONLY_MSPACES */
5552
5553/* ----------------------------- user mspaces ---------------------------- */
5554
5555#if MSPACES0
5556
5557static mstate init_user_mstate(char* tbase, size_t tsize) {
5558 size_t msize = pad_request(sizeof(struct malloc_state))(((sizeof(struct malloc_state)) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)));
5559 mchunkptr mn;
5560 mchunkptr msp = align_as_chunk(tbase)(mchunkptr)((tbase) + ((((size_t)(((void*)((char*)(tbase) + (
(sizeof(size_t))<<1)))) & (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) == 0)? 0 : ((((size_t)(2 * sizeof(void *
))) - ((size_t)(((void*)((char*)(tbase) + ((sizeof(size_t))<<
1)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &
(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
5561 mstate m = (mstate)(chunk2mem(msp)((void*)((char*)(msp) + ((sizeof(size_t))<<1))));
5562 memset(m, 0, msize);
5563 (void)INITIAL_LOCK(&m->mutex)(*&m->mutex = 0);
5564 msp->head = (msize|INUSE_BITS((((size_t)1))|(((size_t)2))));
5565 m->seg.base = m->least_addr = tbase;
5566 m->seg.size = m->footprint = m->max_footprint = tsize;
5567 m->magic = mparams.magic;
5568 m->release_checks = MAX_RELEASE_CHECK_RATE4095;
5569 m->mflags = mparams.default_mflags;
5570 m->extp = 0;
5571 m->exts = 0;
5572 disable_contiguous(m)((m)->mflags |= (4U));
5573 init_bins(m);
5574 mn = next_chunk(mem2chunk(m))((mchunkptr)( ((char*)(((mchunkptr)((char*)(m) - ((sizeof(size_t
))<<1))))) + ((((mchunkptr)((char*)(m) - ((sizeof(size_t
))<<1))))->head & ~((((size_t)1))|(((size_t)2))|
(((size_t)4))))));
5575 init_top(m, mn, (size_t)((tbase + tsize) - (char*)mn) - TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))));
5576 check_top_chunk(m, m->top)do_check_top_chunk(m,m->top);
5577 return m;
5578}
5579
5580mspace create_mspace(size_t capacity, int locked) {
5581 mstate m = 0;
5582 size_t msize;
5583 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5584 msize = pad_request(sizeof(struct malloc_state))(((sizeof(struct malloc_state)) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)));
5585 if (capacity < (size_t) -(msize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) + mparams.page_size)) {
5586 size_t rs = ((capacity == 0)? mparams.granularity :
5587 (capacity + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) + msize));
5588 size_t tsize = granularity_align(rs)(((rs) + (mparams.granularity - ((size_t)1))) & ~(mparams
.granularity - ((size_t)1)));
5589 char* tbase = (char*)(CALL_MMAP(tsize)mmap(0, (tsize), (0x1|0x2), (0x02|0x20), -1, 0));
5590 if (tbase != CMFAIL((char*)(((void*)((~(size_t)0)))))) {
5591 m = init_user_mstate(tbase, tsize);
5592 set_segment_flags(&m->seg, USE_MMAP_BIT)((((((size_t)1))) != (((size_t)1))) ? (abort(), ((((size_t)1)
))) : (((&m->seg)->exec_offset = (*(ptrdiff_t*)(((&
m->seg)->base)+((&m->seg)->size)-sizeof(ptrdiff_t
)))), ((*(ptrdiff_t*)(((&m->seg)->base + (&m->
seg)->exec_offset)+((&m->seg)->size)-sizeof(ptrdiff_t
))) != (&m->seg)->exec_offset) ? (abort(), ((((size_t
)1)))) : ((*(ptrdiff_t*)(((&m->seg)->base)+((&m
->seg)->size)-sizeof(ptrdiff_t))) = 0), ((((size_t)1)))
));
5593 set_lock(m, locked)((m)->mflags = (locked)? ((m)->mflags | (2U)) : ((m)->
mflags & ~(2U)));
5594 }
5595 }
5596 return (mspace)m;
5597}
5598
5599mspace create_mspace_with_base(void* base, size_t capacity, int locked) {
5600 mstate m = 0;
5601 size_t msize;
5602 ensure_initialization()(void)(__atomic_load_n(&mparams.magic, 2) != 0 || init_mparams
());
5603 msize = pad_request(sizeof(struct malloc_state))(((sizeof(struct malloc_state)) + ((sizeof(size_t))) + (((size_t
)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof
(void *))) - ((size_t)1)));
5604 if (capacity > msize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) &&
5605 capacity < (size_t) -(msize + TOP_FOOT_SIZE(((((size_t)(((void*)((char*)(0) + ((sizeof(size_t))<<1
)))) & (((size_t)(2 * sizeof(void *))) - ((size_t)1))) ==
0)? 0 : ((((size_t)(2 * sizeof(void *))) - ((size_t)(((void*
)((char*)(0) + ((sizeof(size_t))<<1)))) & (((size_t
)(2 * sizeof(void *))) - ((size_t)1)))) & (((size_t)(2 * sizeof
(void *))) - ((size_t)1))))+(((sizeof(struct malloc_segment))
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))+
(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) + mparams.page_size)) {
5606 m = init_user_mstate((char*)base, capacity);
5607 set_segment_flags(&m->seg, EXTERN_BIT)((((8U)) != (((size_t)1))) ? (abort(), ((8U))) : (((&m->
seg)->exec_offset = (*(ptrdiff_t*)(((&m->seg)->base
)+((&m->seg)->size)-sizeof(ptrdiff_t)))), ((*(ptrdiff_t
*)(((&m->seg)->base + (&m->seg)->exec_offset
)+((&m->seg)->size)-sizeof(ptrdiff_t))) != (&m->
seg)->exec_offset) ? (abort(), ((8U))) : ((*(ptrdiff_t*)((
(&m->seg)->base)+((&m->seg)->size)-sizeof
(ptrdiff_t))) = 0), ((8U))));
5608 set_lock(m, locked)((m)->mflags = (locked)? ((m)->mflags | (2U)) : ((m)->
mflags & ~(2U)));
5609 }
5610 return (mspace)m;
5611}
5612
5613int mspace_track_large_chunks(mspace msp, int enable) {
5614 int ret = 0;
5615 mstate ms = (mstate)msp;
5616 if (!PREACTION(ms)((((ms)->mflags & (2U)))? (__sync_lock_test_and_set(&
(ms)->mutex, 1)? spin_acquire_lock(&(ms)->mutex) : 0
) : 0)) {
5617 if (!use_mmap(ms)((ms)->mflags & (((size_t)1)))) {
5618 ret = 1;
5619 }
5620 if (!enable) {
5621 enable_mmap(ms)((ms)->mflags |= (((size_t)1)));
5622 } else {
5623 disable_mmap(ms)((ms)->mflags &= ~(((size_t)1)));
5624 }
5625 POSTACTION(ms){ if (((ms)->mflags & (2U))) __sync_lock_release(&
(ms)->mutex); };
5626 }
5627 return ret;
5628}
5629
5630size_t destroy_mspace(mspace msp) {
5631 size_t freed = 0;
5632 mstate ms = (mstate)msp;
5633 if (ok_magic(ms)(1)) {
5634 msegmentptr sp = &ms->seg;
5635 (void)DESTROY_LOCK(&ms->mutex)(0); /* destroy before unmapped */
5636 while (sp != 0) {
5637 char* base = sp->base;
5638 size_t size = sp->size;
5639 flag_t flag = get_segment_flags(sp)((((size_t)1)));
5640 (void)base; /* placate people compiling -Wunused-variable */
5641 sp = sp->next;
5642 if ((flag & USE_MMAP_BIT(((size_t)1))) && !(flag & EXTERN_BIT(8U)) &&
5643 CALL_MUNMAP(base, size)munmap(((base)), ((size))) == 0)
5644 freed += size;
5645 }
5646 }
5647 else {
5648 USAGE_ERROR_ACTION(ms,ms)abort();
5649 }
5650 return freed;
5651}
5652
5653/*
5654 mspace versions of routines are near-clones of the global
5655 versions. This is not so nice but better than the alternatives.
5656*/
5657
5658void* mspace_malloc(mspace msp, size_t bytes) {
5659 mstate ms = (mstate)msp;
5660 if (!ok_magic(ms)(1)) {
5661 USAGE_ERROR_ACTION(ms,ms)abort();
5662 return 0;
5663 }
5664 if (!PREACTION(ms)((((ms)->mflags & (2U)))? (__sync_lock_test_and_set(&
(ms)->mutex, 1)? spin_acquire_lock(&(ms)->mutex) : 0
) : 0)) {
5665 void* mem;
5666 size_t nb;
5667 if (bytes <= MAX_SMALL_REQUEST(((((size_t)1) << (8U)) - ((size_t)1)) - (((size_t)(2 *
sizeof(void *))) - ((size_t)1)) - ((sizeof(size_t))))) {
5668 bindex_t idx;
5669 binmap_t smallbits;
5670 nb = (bytes < MIN_REQUEST((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) -
((sizeof(size_t))) - ((size_t)1)))? MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : pad_request(bytes)(((bytes) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)));
5671 idx = small_index(nb)(bindex_t)((nb) >> (3U));
5672 smallbits = ms->smallmap >> idx;
5673
5674 if ((smallbits & 0x3U) != 0) { /* Remainderless fit to a smallbin. */
5675 mchunkptr b, p;
5676 idx += ~smallbits & 1; /* Uses next bin if idx empty */
5677 b = smallbin_at(ms, idx)((sbinptr)((char*)&((ms)->smallbins[(idx)<<1])));
5678 p = b->fd;
5679 assert(chunksize(p) == small_index2size(idx))if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((idx) << (3U)))) abort();
5680 unlink_first_small_chunk(ms, b, p, idx){ mchunkptr F = p->fd; if(!(p != b)) abort(); if(!(p != F)
) abort(); if(!(((p)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) == ((idx) << (3U)))) abort(); if (
b == F) { ((ms)->smallmap &= ~((binmap_t)(1) << (
idx))); } else if (__builtin_expect(((char*)(F) >= (ms)->
least_addr) && F->bk == p, 1)) { F->bk = b; b->
fd = F; } else { abort(); }};
5681 set_inuse_and_pinuse(ms, p, small_index2size(idx))((p)->head = (((idx) << (3U))|(((size_t)1))|(((size_t
)2))), ((mchunkptr)(((char*)(p)) + (((idx) << (3U)))))->
head |= (((size_t)1)));
5682 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5683 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5684 goto postaction;
5685 }
5686
5687 else if (nb > ms->dvsize) {
5688 if (smallbits != 0) { /* Use chunk in next nonempty smallbin */
5689 mchunkptr b, p, r;
5690 size_t rsize;
5691 bindex_t i;
5692 binmap_t leftbits = (smallbits << idx) & left_bits(idx2bit(idx))((((binmap_t)(1) << (idx))<<1) | -(((binmap_t)(1)
<< (idx))<<1));
5693 binmap_t leastbit = least_bit(leftbits)((leftbits) & -(leftbits));
5694 compute_bit2idx(leastbit, i){ unsigned int J; J = __builtin_ctz(leastbit); i = (bindex_t)
J;};
5695 b = smallbin_at(ms, i)((sbinptr)((char*)&((ms)->smallbins[(i)<<1])));
5696 p = b->fd;
5697 assert(chunksize(p) == small_index2size(i))if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) == ((i) << (3U)))) abort();
5698 unlink_first_small_chunk(ms, b, p, i){ mchunkptr F = p->fd; if(!(p != b)) abort(); if(!(p != F)
) abort(); if(!(((p)->head & ~(((((size_t)1))|(((size_t
)2))|(((size_t)4))))) == ((i) << (3U)))) abort(); if (b
== F) { ((ms)->smallmap &= ~((binmap_t)(1) << (
i))); } else if (__builtin_expect(((char*)(F) >= (ms)->
least_addr) && F->bk == p, 1)) { F->bk = b; b->
fd = F; } else { abort(); }};
5699 rsize = small_index2size(i)((i) << (3U)) - nb;
5700 /* Fit here cannot be remainderless if 4byte sizes */
5701 if (SIZE_T_SIZE(sizeof(size_t)) != 4 && rsize < MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
5702 set_inuse_and_pinuse(ms, p, small_index2size(i))((p)->head = (((i) << (3U))|(((size_t)1))|(((size_t)
2))), ((mchunkptr)(((char*)(p)) + (((i) << (3U)))))->
head |= (((size_t)1)));
5703 else {
5704 set_size_and_pinuse_of_inuse_chunk(ms, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
5705 r = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5706 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
5707 replace_dv(ms, r, rsize){ size_t DVS = ms->dvsize; if(!((((DVS) >> (3U)) <
(32U)))) abort(); if (DVS != 0) { mchunkptr DV = ms->dv; {
bindex_t I = (bindex_t)((DVS) >> (3U)); mchunkptr B = (
(sbinptr)((char*)&((ms)->smallbins[(I)<<1]))); mchunkptr
F = B; if(!(DVS >= (((sizeof(mchunk)) + (((size_t)(2 * sizeof
(void *))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *
))) - ((size_t)1))))) abort(); if (!((ms)->smallmap & (
(binmap_t)(1) << (I)))) ((ms)->smallmap |= ((binmap_t
)(1) << (I))); else if (__builtin_expect(((char*)(B->
fd) >= (ms)->least_addr), 1)) F = B->fd; else { abort
(); } B->fd = DV; F->bk = DV; DV->fd = F; DV->bk =
B;}; } ms->dvsize = rsize; ms->dv = r;};
5708 }
5709 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5710 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5711 goto postaction;
5712 }
5713
5714 else if (ms->treemap != 0 && (mem = tmalloc_small(ms, nb)) != 0) {
5715 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5716 goto postaction;
5717 }
5718 }
5719 }
5720 else if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2))
5721 nb = MAX_SIZE_T(~(size_t)0); /* Too big to allocate. Force failure (in sys alloc) */
5722 else {
5723 nb = pad_request(bytes)(((bytes) + ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *
))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) - (
(size_t)1)));
5724 if (ms->treemap != 0 && (mem = tmalloc_large(ms, nb)) != 0) {
5725 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5726 goto postaction;
5727 }
5728 }
5729
5730 if (nb <= ms->dvsize) {
5731 size_t rsize = ms->dvsize - nb;
5732 mchunkptr p = ms->dv;
5733 if (rsize >= MIN_CHUNK_SIZE(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1)))) { /* split dv */
5734 mchunkptr r = ms->dv = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5735 ms->dvsize = rsize;
5736 set_size_and_pinuse_of_free_chunk(r, rsize)((r)->head = (rsize|(((size_t)1))), (((mchunkptr)((char*)(
r) + (rsize)))->prev_foot = (rsize)));
5737 set_size_and_pinuse_of_inuse_chunk(ms, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
5738 }
5739 else { /* exhaust dv */
5740 size_t dvs = ms->dvsize;
5741 ms->dvsize = 0;
5742 ms->dv = 0;
5743 set_inuse_and_pinuse(ms, p, dvs)((p)->head = (dvs|(((size_t)1))|(((size_t)2))), ((mchunkptr
)(((char*)(p)) + (dvs)))->head |= (((size_t)1)));
5744 }
5745 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5746 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5747 goto postaction;
5748 }
5749
5750 else if (nb < ms->topsize) { /* Split top */
5751 size_t rsize = ms->topsize -= nb;
5752 mchunkptr p = ms->top;
5753 mchunkptr r = ms->top = chunk_plus_offset(p, nb)((mchunkptr)(((char*)(p)) + (nb)));
5754 r->head = rsize | PINUSE_BIT(((size_t)1));
5755 set_size_and_pinuse_of_inuse_chunk(ms, p, nb)((p)->head = (nb|(((size_t)1))|(((size_t)2))));
5756 mem = chunk2mem(p)((void*)((char*)(p) + ((sizeof(size_t))<<1)));
5757 check_top_chunk(ms, ms->top)do_check_top_chunk(ms,ms->top);
5758 check_malloced_chunk(ms, mem, nb)do_check_malloced_chunk(ms,mem,nb);
5759 goto postaction;
5760 }
5761
5762 mem = sys_alloc(ms, nb);
5763
5764 postaction:
5765 POSTACTION(ms){ if (((ms)->mflags & (2U))) __sync_lock_release(&
(ms)->mutex); };
5766 return mem;
5767 }
5768
5769 return 0;
5770}
5771
5772void mspace_free(mspace msp, void* mem) {
5773 if (mem != 0) {
5774 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
5775#if FOOTERS0
5776 mstate fm = get_mstate_for(p);
5777 (void)msp; /* placate people compiling -Wunused */
5778#else /* FOOTERS */
5779 mstate fm = (mstate)msp;
5780#endif /* FOOTERS */
5781 if (!ok_magic(fm)(1)) {
5782 USAGE_ERROR_ACTION(fm, p)abort();
5783 return;
5784 }
5785 if (!PREACTION(fm)((((fm)->mflags & (2U)))? (__sync_lock_test_and_set(&
(fm)->mutex, 1)? spin_acquire_lock(&(fm)->mutex) : 0
) : 0)) {
5786 check_inuse_chunk(fm, p)do_check_inuse_chunk(fm,p);
5787 if (RTCHECK(ok_address(fm, p) && ok_inuse(p))__builtin_expect(((char*)(p) >= (fm)->least_addr) &&
(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))), 1)) {
5788 size_t psize = chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4)))));
5789 mchunkptr next = chunk_plus_offset(p, psize)((mchunkptr)(((char*)(p)) + (psize)));
5790 if (!pinuse(p)((p)->head & (((size_t)1)))) {
5791 size_t prevsize = p->prev_foot;
5792 if (is_mmapped(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)) {
5793 psize += prevsize + MMAP_FOOT_PAD(((sizeof(size_t))<<2));
5794 if (CALL_MUNMAP((char*)p - prevsize, psize)munmap((((char*)p - prevsize)), ((psize))) == 0)
5795 fm->footprint -= psize;
5796 goto postaction;
5797 }
5798 else {
5799 mchunkptr prev = chunk_minus_offset(p, prevsize)((mchunkptr)(((char*)(p)) - (prevsize)));
5800 psize += prevsize;
5801 p = prev;
5802 if (RTCHECK(ok_address(fm, prev))__builtin_expect(((char*)(prev) >= (fm)->least_addr), 1
)) { /* consolidate backward */
5803 if (p != fm->dv) {
5804 unlink_chunk(fm, p, prevsize)if ((((prevsize) >> (3U)) < (32U))) { mchunkptr F = p
->fd; mchunkptr B = p->bk; bindex_t I = (bindex_t)((prevsize
) >> (3U)); if(!(p != B)) abort(); if(!(p != F)) abort(
); if(!(((p)->head & ~(((((size_t)1))|(((size_t)2))|((
(size_t)4))))) == ((I) << (3U)))) abort(); if (__builtin_expect
(F == ((sbinptr)((char*)&((fm)->smallbins[(I)<<1
]))) || (((char*)(F) >= (fm)->least_addr) && F->
bk == p), 1)) { if (B == F) { ((fm)->smallmap &= ~((binmap_t
)(1) << (I))); } else if (__builtin_expect(B == ((sbinptr
)((char*)&((fm)->smallbins[(I)<<1]))) || (((char
*)(B) >= (fm)->least_addr) && B->fd == p), 1
)) { F->bk = B; B->fd = F; } else { abort(); } } else {
abort(); }} else { tchunkptr TP = (tchunkptr)(p); { tchunkptr
XP = TP->parent; tchunkptr R; if (TP->bk != TP) { tchunkptr
F = TP->fd; R = TP->bk; if (__builtin_expect(((char*)(
F) >= (fm)->least_addr) && F->bk == TP &&
R->fd == TP, 1)) { F->bk = R; R->fd = F; } else { abort
(); } } else { tchunkptr* RP; if (((R = *(RP = &(TP->child
[1]))) != 0) || ((R = *(RP = &(TP->child[0]))) != 0)) {
tchunkptr* CP; while ((*(CP = &(R->child[1])) != 0) ||
(*(CP = &(R->child[0])) != 0)) { R = *(RP = CP); } if
(__builtin_expect(((char*)(RP) >= (fm)->least_addr), 1
)) *RP = 0; else { abort(); } } } if (XP != 0) { tbinptr* H =
(&((fm)->treebins[TP->index])); if (TP == *H) { if
((*H = R) == 0) ((fm)->treemap &= ~((binmap_t)(1) <<
(TP->index))); } else if (__builtin_expect(((char*)(XP) >=
(fm)->least_addr), 1)) { if (XP->child[0] == TP) XP->
child[0] = R; else XP->child[1] = R; } else abort(); if (R
!= 0) { if (__builtin_expect(((char*)(R) >= (fm)->least_addr
), 1)) { tchunkptr C0, C1; R->parent = XP; if ((C0 = TP->
child[0]) != 0) { if (__builtin_expect(((char*)(C0) >= (fm
)->least_addr), 1)) { R->child[0] = C0; C0->parent =
R; } else abort(); } if ((C1 = TP->child[1]) != 0) { if (
__builtin_expect(((char*)(C1) >= (fm)->least_addr), 1))
{ R->child[1] = C1; C1->parent = R; } else abort(); } }
else abort(); } }}; };
5805 }
5806 else if ((next->head & INUSE_BITS((((size_t)1))|(((size_t)2)))) == INUSE_BITS((((size_t)1))|(((size_t)2)))) {
5807 fm->dvsize = psize;
5808 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
5809 goto postaction;
5810 }
5811 }
5812 else
5813 goto erroraction;
5814 }
5815 }
5816
5817 if (RTCHECK(ok_next(p, next) && ok_pinuse(next))__builtin_expect(((char*)(p) < (char*)(next)) && (
(next)->head & (((size_t)1))), 1)) {
5818 if (!cinuse(next)((next)->head & (((size_t)2)))) { /* consolidate forward */
5819 if (next == fm->top) {
5820 size_t tsize = fm->topsize += psize;
5821 fm->top = p;
5822 p->head = tsize | PINUSE_BIT(((size_t)1));
5823 if (p == fm->dv) {
5824 fm->dv = 0;
5825 fm->dvsize = 0;
5826 }
5827 if (should_trim(fm, tsize)((tsize) > (fm)->trim_check))
5828 sys_trim(fm, 0);
5829 goto postaction;
5830 }
5831 else if (next == fm->dv) {
5832 size_t dsize = fm->dvsize += psize;
5833 fm->dv = p;
5834 set_size_and_pinuse_of_free_chunk(p, dsize)((p)->head = (dsize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (dsize)))->prev_foot = (dsize)));
5835 goto postaction;
5836 }
5837 else {
5838 size_t nsize = chunksize(next)((next)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4)))));
5839 psize += nsize;
5840 unlink_chunk(fm, next, nsize)if ((((nsize) >> (3U)) < (32U))) { mchunkptr F = next
->fd; mchunkptr B = next->bk; bindex_t I = (bindex_t)((
nsize) >> (3U)); if(!(next != B)) abort(); if(!(next !=
F)) abort(); if(!(((next)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) == ((I) << (3U)))) abort()
; if (__builtin_expect(F == ((sbinptr)((char*)&((fm)->
smallbins[(I)<<1]))) || (((char*)(F) >= (fm)->least_addr
) && F->bk == next), 1)) { if (B == F) { ((fm)->
smallmap &= ~((binmap_t)(1) << (I))); } else if (__builtin_expect
(B == ((sbinptr)((char*)&((fm)->smallbins[(I)<<1
]))) || (((char*)(B) >= (fm)->least_addr) && B->
fd == next), 1)) { F->bk = B; B->fd = F; } else { abort
(); } } else { abort(); }} else { tchunkptr TP = (tchunkptr)(
next); { tchunkptr XP = TP->parent; tchunkptr R; if (TP->
bk != TP) { tchunkptr F = TP->fd; R = TP->bk; if (__builtin_expect
(((char*)(F) >= (fm)->least_addr) && F->bk ==
TP && R->fd == TP, 1)) { F->bk = R; R->fd =
F; } else { abort(); } } else { tchunkptr* RP; if (((R = *(RP
= &(TP->child[1]))) != 0) || ((R = *(RP = &(TP->
child[0]))) != 0)) { tchunkptr* CP; while ((*(CP = &(R->
child[1])) != 0) || (*(CP = &(R->child[0])) != 0)) { R
= *(RP = CP); } if (__builtin_expect(((char*)(RP) >= (fm)
->least_addr), 1)) *RP = 0; else { abort(); } } } if (XP !=
0) { tbinptr* H = (&((fm)->treebins[TP->index])); if
(TP == *H) { if ((*H = R) == 0) ((fm)->treemap &= ~((
binmap_t)(1) << (TP->index))); } else if (__builtin_expect
(((char*)(XP) >= (fm)->least_addr), 1)) { if (XP->child
[0] == TP) XP->child[0] = R; else XP->child[1] = R; } else
abort(); if (R != 0) { if (__builtin_expect(((char*)(R) >=
(fm)->least_addr), 1)) { tchunkptr C0, C1; R->parent =
XP; if ((C0 = TP->child[0]) != 0) { if (__builtin_expect(
((char*)(C0) >= (fm)->least_addr), 1)) { R->child[0]
= C0; C0->parent = R; } else abort(); } if ((C1 = TP->
child[1]) != 0) { if (__builtin_expect(((char*)(C1) >= (fm
)->least_addr), 1)) { R->child[1] = C1; C1->parent =
R; } else abort(); } } else abort(); } }}; };
5841 set_size_and_pinuse_of_free_chunk(p, psize)((p)->head = (psize|(((size_t)1))), (((mchunkptr)((char*)(
p) + (psize)))->prev_foot = (psize)));
5842 if (p == fm->dv) {
5843 fm->dvsize = psize;
5844 goto postaction;
5845 }
5846 }
5847 }
5848 else
5849 set_free_with_pinuse(p, psize, next)(((next)->head &= ~(((size_t)1))), ((p)->head = (psize
|(((size_t)1))), (((mchunkptr)((char*)(p) + (psize)))->prev_foot
= (psize))));
5850
5851 if (is_small(psize)(((psize) >> (3U)) < (32U))) {
5852 insert_small_chunk(fm, p, psize){ bindex_t I = (bindex_t)((psize) >> (3U)); mchunkptr B
= ((sbinptr)((char*)&((fm)->smallbins[(I)<<1]))
); mchunkptr F = B; if(!(psize >= (((sizeof(mchunk)) + (((
size_t)(2 * sizeof(void *))) - ((size_t)1))) & ~(((size_t
)(2 * sizeof(void *))) - ((size_t)1))))) abort(); if (!((fm)->
smallmap & ((binmap_t)(1) << (I)))) ((fm)->smallmap
|= ((binmap_t)(1) << (I))); else if (__builtin_expect(
((char*)(B->fd) >= (fm)->least_addr), 1)) F = B->
fd; else { abort(); } B->fd = p; F->bk = p; p->fd = F
; p->bk = B;};
5853 check_free_chunk(fm, p)do_check_free_chunk(fm,p);
5854 }
5855 else {
5856 tchunkptr tp = (tchunkptr)p;
5857 insert_large_chunk(fm, tp, psize){ tbinptr* H; bindex_t I; { unsigned int X = psize >> (
8U); if (X == 0) I = 0; else if (X > 0xFFFF) I = (32U)-1; else
{ unsigned int K = (unsigned) sizeof(X)*8 - 1 - (unsigned) __builtin_clz
(X); I = (bindex_t)((K << 1) + ((psize >> (K + ((
8U)-1)) & 1))); }}; H = (&((fm)->treebins[I])); tp
->index = I; tp->child[0] = tp->child[1] = 0; if (!(
(fm)->treemap & ((binmap_t)(1) << (I)))) { ((fm)
->treemap |= ((binmap_t)(1) << (I))); *H = tp; tp->
parent = (tchunkptr)H; tp->fd = tp->bk = tp; } else { tchunkptr
T = *H; size_t K = psize << ((I == (32U)-1)? 0 : (((sizeof
(size_t) << 3)-((size_t)1)) - (((I) >> 1) + (8U) -
2))); for (;;) { if (((T)->head & ~(((((size_t)1))|((
(size_t)2))|(((size_t)4))))) != psize) { tchunkptr* C = &
(T->child[(K >> ((sizeof(size_t) << 3)-((size_t
)1))) & 1]); K <<= 1; if (*C != 0) T = *C; else if (
__builtin_expect(((char*)(C) >= (fm)->least_addr), 1)) {
*C = tp; tp->parent = T; tp->fd = tp->bk = tp; break
; } else { abort(); break; } } else { tchunkptr F = T->fd;
if (__builtin_expect(((char*)(T) >= (fm)->least_addr) &&
((char*)(F) >= (fm)->least_addr), 1)) { T->fd = F->
bk = tp; tp->fd = F; tp->bk = T; tp->parent = 0; break
; } else { abort(); break; } } } }};
5858 check_free_chunk(fm, p)do_check_free_chunk(fm,p);
5859 if (--fm->release_checks == 0)
5860 release_unused_segments(fm);
5861 }
5862 goto postaction;
5863 }
5864 }
5865 erroraction:
5866 USAGE_ERROR_ACTION(fm, p)abort();
5867 postaction:
5868 POSTACTION(fm){ if (((fm)->mflags & (2U))) __sync_lock_release(&
(fm)->mutex); };
5869 }
5870 }
5871}
5872
5873void* mspace_calloc(mspace msp, size_t n_elements, size_t elem_size) {
5874 void* mem;
5875 size_t req = 0;
5876 mstate ms = (mstate)msp;
5877 if (!ok_magic(ms)(1)) {
5878 USAGE_ERROR_ACTION(ms,ms)abort();
5879 return 0;
5880 }
5881 if (n_elements != 0) {
5882 req = n_elements * elem_size;
5883 if (((n_elements | elem_size) & ~(size_t)0xffff) &&
5884 (req / n_elements != elem_size))
5885 req = MAX_SIZE_T(~(size_t)0); /* force downstream failure on overflow */
5886 }
5887 mem = internal_malloc(ms, req)dlmalloc(req);
5888 if (mem != 0 && calloc_must_clear(mem2chunk(mem))(!(((((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1))
))->head & ((((size_t)1))|(((size_t)2)))) == 0)))
5889 memset(mem, 0, req);
5890 return mem;
5891}
5892
5893void* mspace_realloc(mspace msp, void* oldmem, size_t bytes) {
5894 void* mem = 0;
5895 if (oldmem == 0) {
5896 mem = mspace_malloc(msp, bytes);
5897 }
5898 else if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2)) {
5899 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
5900 }
5901#ifdef REALLOC_ZERO_BYTES_FREES
5902 else if (bytes == 0) {
5903 mspace_free(msp, oldmem);
5904 }
5905#endif /* REALLOC_ZERO_BYTES_FREES */
5906 else {
5907 size_t nb = request2size(bytes)(((bytes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((bytes)
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5908 mchunkptr oldp = mem2chunk(oldmem)((mchunkptr)((char*)(oldmem) - ((sizeof(size_t))<<1)));
5909#if ! FOOTERS0
5910 mstate m = (mstate)msp;
5911#else /* FOOTERS */
5912 mstate m = get_mstate_for(oldp);
5913 if (!ok_magic(m)(1)) {
5914 USAGE_ERROR_ACTION(m, oldmem)abort();
5915 return 0;
5916 }
5917#endif /* FOOTERS */
5918 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
5919 mchunkptr newp = try_realloc_chunk(m, oldp, nb, 1);
5920 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5921 if (newp != 0) {
5922 check_inuse_chunk(m, newp)do_check_inuse_chunk(m,newp);
5923 mem = chunk2mem(newp)((void*)((char*)(newp) + ((sizeof(size_t))<<1)));
5924 }
5925 else {
5926 mem = mspace_malloc(m, bytes);
5927 if (mem != 0) {
5928 size_t oc = chunksize(oldp)((oldp)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t
)4))))) - overhead_for(oldp)((((oldp)->head & ((((size_t)1))|(((size_t)2)))) == 0)
? (((sizeof(size_t))<<1)) : ((sizeof(size_t))));
5929 memcpy(mem, oldmem, (oc < bytes)? oc : bytes);
5930 mspace_free(m, oldmem);
5931 }
5932 }
5933 }
5934 }
5935 return mem;
5936}
5937
5938void* mspace_realloc_in_place(mspace msp, void* oldmem, size_t bytes) {
5939 void* mem = 0;
5940 if (oldmem != 0) {
5941 if (bytes >= MAX_REQUEST((-(((sizeof(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))))
<< 2)) {
5942 MALLOC_FAILURE_ACTION(*__errno_location ()) = 12;;
5943 }
5944 else {
5945 size_t nb = request2size(bytes)(((bytes) < ((((sizeof(mchunk)) + (((size_t)(2 * sizeof(void
*))) - ((size_t)1))) & ~(((size_t)(2 * sizeof(void *))) -
((size_t)1))) - ((sizeof(size_t))) - ((size_t)1)))? (((sizeof
(mchunk)) + (((size_t)(2 * sizeof(void *))) - ((size_t)1))) &
~(((size_t)(2 * sizeof(void *))) - ((size_t)1))) : (((bytes)
+ ((sizeof(size_t))) + (((size_t)(2 * sizeof(void *))) - ((size_t
)1))) & ~(((size_t)(2 * sizeof(void *))) - ((size_t)1))));
5946 mchunkptr oldp = mem2chunk(oldmem)((mchunkptr)((char*)(oldmem) - ((sizeof(size_t))<<1)));
5947#if ! FOOTERS0
5948 mstate m = (mstate)msp;
5949#else /* FOOTERS */
5950 mstate m = get_mstate_for(oldp);
5951 (void)msp; /* placate people compiling -Wunused */
5952 if (!ok_magic(m)(1)) {
5953 USAGE_ERROR_ACTION(m, oldmem)abort();
5954 return 0;
5955 }
5956#endif /* FOOTERS */
5957 if (!PREACTION(m)((((m)->mflags & (2U)))? (__sync_lock_test_and_set(&
(m)->mutex, 1)? spin_acquire_lock(&(m)->mutex) : 0)
: 0)) {
5958 mchunkptr newp = try_realloc_chunk(m, oldp, nb, 0);
5959 POSTACTION(m){ if (((m)->mflags & (2U))) __sync_lock_release(&(
m)->mutex); };
5960 if (newp == oldp) {
5961 check_inuse_chunk(m, newp)do_check_inuse_chunk(m,newp);
5962 mem = oldmem;
5963 }
5964 }
5965 }
5966 }
5967 return mem;
5968}
5969
5970void* mspace_memalign(mspace msp, size_t alignment, size_t bytes) {
5971 mstate ms = (mstate)msp;
5972 if (!ok_magic(ms)(1)) {
5973 USAGE_ERROR_ACTION(ms,ms)abort();
5974 return 0;
5975 }
5976 if (alignment <= MALLOC_ALIGNMENT((size_t)(2 * sizeof(void *))))
5977 return mspace_malloc(msp, bytes);
5978 return internal_memalign(ms, alignment, bytes);
5979}
5980
5981void** mspace_independent_calloc(mspace msp, size_t n_elements,
5982 size_t elem_size, void* chunks[]) {
5983 size_t sz = elem_size; /* serves as 1-element array */
5984 mstate ms = (mstate)msp;
5985 if (!ok_magic(ms)(1)) {
5986 USAGE_ERROR_ACTION(ms,ms)abort();
5987 return 0;
5988 }
5989 return ialloc(ms, n_elements, &sz, 3, chunks);
5990}
5991
5992void** mspace_independent_comalloc(mspace msp, size_t n_elements,
5993 size_t sizes[], void* chunks[]) {
5994 mstate ms = (mstate)msp;
5995 if (!ok_magic(ms)(1)) {
5996 USAGE_ERROR_ACTION(ms,ms)abort();
5997 return 0;
5998 }
5999 return ialloc(ms, n_elements, sizes, 0, chunks);
6000}
6001
6002size_t mspace_bulk_free(mspace msp, void* array[], size_t nelem) {
6003 return internal_bulk_free((mstate)msp, array, nelem);
6004}
6005
6006#if MALLOC_INSPECT_ALL0
6007void mspace_inspect_all(mspace msp,
6008 void(*handler)(void *start,
6009 void *end,
6010 size_t used_bytes,
6011 void* callback_arg),
6012 void* arg) {
6013 mstate ms = (mstate)msp;
6014 if (ok_magic(ms)(1)) {
6015 if (!PREACTION(ms)((((ms)->mflags & (2U)))? (__sync_lock_test_and_set(&
(ms)->mutex, 1)? spin_acquire_lock(&(ms)->mutex) : 0
) : 0)) {
6016 internal_inspect_all(ms, handler, arg);
6017 POSTACTION(ms){ if (((ms)->mflags & (2U))) __sync_lock_release(&
(ms)->mutex); };
6018 }
6019 }
6020 else {
6021 USAGE_ERROR_ACTION(ms,ms)abort();
6022 }
6023}
6024#endif /* MALLOC_INSPECT_ALL */
6025
6026int mspace_trim(mspace msp, size_t pad) {
6027 int result = 0;
6028 mstate ms = (mstate)msp;
6029 if (ok_magic(ms)(1)) {
6030 if (!PREACTION(ms)((((ms)->mflags & (2U)))? (__sync_lock_test_and_set(&
(ms)->mutex, 1)? spin_acquire_lock(&(ms)->mutex) : 0
) : 0)) {
6031 result = sys_trim(ms, pad);
6032 POSTACTION(ms){ if (((ms)->mflags & (2U))) __sync_lock_release(&
(ms)->mutex); };
6033 }
6034 }
6035 else {
6036 USAGE_ERROR_ACTION(ms,ms)abort();
6037 }
6038 return result;
6039}
6040
6041#if !NO_MALLOC_STATS0
6042void mspace_malloc_stats(mspace msp) {
6043 mstate ms = (mstate)msp;
6044 if (ok_magic(ms)(1)) {
6045 internal_malloc_stats(ms);
6046 }
6047 else {
6048 USAGE_ERROR_ACTION(ms,ms)abort();
6049 }
6050}
6051#endif /* NO_MALLOC_STATS */
6052
6053size_t mspace_footprint(mspace msp) {
6054 size_t result = 0;
6055 mstate ms = (mstate)msp;
6056 if (ok_magic(ms)(1)) {
6057 result = ms->footprint;
6058 }
6059 else {
6060 USAGE_ERROR_ACTION(ms,ms)abort();
6061 }
6062 return result;
6063}
6064
6065size_t mspace_max_footprint(mspace msp) {
6066 size_t result = 0;
6067 mstate ms = (mstate)msp;
6068 if (ok_magic(ms)(1)) {
6069 result = ms->max_footprint;
6070 }
6071 else {
6072 USAGE_ERROR_ACTION(ms,ms)abort();
6073 }
6074 return result;
6075}
6076
6077size_t mspace_footprint_limit(mspace msp) {
6078 size_t result = 0;
6079 mstate ms = (mstate)msp;
6080 if (ok_magic(ms)(1)) {
6081 size_t maf = ms->footprint_limit;
6082 result = (maf == 0) ? MAX_SIZE_T(~(size_t)0) : maf;
6083 }
6084 else {
6085 USAGE_ERROR_ACTION(ms,ms)abort();
6086 }
6087 return result;
6088}
6089
6090size_t mspace_set_footprint_limit(mspace msp, size_t bytes) {
6091 size_t result = 0;
6092 mstate ms = (mstate)msp;
6093 if (ok_magic(ms)(1)) {
6094 if (bytes == 0)
6095 result = granularity_align(1)(((1) + (mparams.granularity - ((size_t)1))) & ~(mparams.
granularity - ((size_t)1))); /* Use minimal size */
6096 if (bytes == MAX_SIZE_T(~(size_t)0))
6097 result = 0; /* disable */
6098 else
6099 result = granularity_align(bytes)(((bytes) + (mparams.granularity - ((size_t)1))) & ~(mparams
.granularity - ((size_t)1)));
6100 ms->footprint_limit = result;
6101 }
6102 else {
6103 USAGE_ERROR_ACTION(ms,ms)abort();
6104 }
6105 return result;
6106}
6107
6108#if !NO_MALLINFO1
6109struct mallinfo mspace_mallinfo(mspace msp) {
6110 mstate ms = (mstate)msp;
6111 if (!ok_magic(ms)(1)) {
6112 USAGE_ERROR_ACTION(ms,ms)abort();
6113 }
6114 return internal_mallinfo(ms);
6115}
6116#endif /* NO_MALLINFO */
6117
6118size_t mspace_usable_size(const void* mem) {
6119 if (mem != 0) {
6120 mchunkptr p = mem2chunk(mem)((mchunkptr)((char*)(mem) - ((sizeof(size_t))<<1)));
6121 if (is_inuse(p)(((p)->head & ((((size_t)1))|(((size_t)2)))) != (((size_t
)1))))
6122 return chunksize(p)((p)->head & ~(((((size_t)1))|(((size_t)2))|(((size_t)
4))))) - overhead_for(p)((((p)->head & ((((size_t)1))|(((size_t)2)))) == 0)? (
((sizeof(size_t))<<1)) : ((sizeof(size_t))));
6123 }
6124 return 0;
6125}
6126
6127int mspace_mallopt(int param_number, int value) {
6128 return change_mparam(param_number, value);
6129}
6130
6131#endif /* MSPACES */
6132
6133
6134/* -------------------- Alternative MORECORE functions ------------------- */
6135
6136/*
6137 Guidelines for creating a custom version of MORECORE:
6138
6139 * For best performance, MORECORE should allocate in multiples of pagesize.
6140 * MORECORE may allocate more memory than requested. (Or even less,
6141 but this will usually result in a malloc failure.)
6142 * MORECORE must not allocate memory when given argument zero, but
6143 instead return one past the end address of memory from previous
6144 nonzero call.
6145 * For best performance, consecutive calls to MORECORE with positive
6146 arguments should return increasing addresses, indicating that
6147 space has been contiguously extended.
6148 * Even though consecutive calls to MORECORE need not return contiguous
6149 addresses, it must be OK for malloc'ed chunks to span multiple
6150 regions in those cases where they do happen to be contiguous.
6151 * MORECORE need not handle negative arguments -- it may instead
6152 just return MFAIL when given negative arguments.
6153 Negative arguments are always multiples of pagesize. MORECORE
6154 must not misinterpret negative args as large positive unsigned
6155 args. You can suppress all such calls from even occurring by defining
6156 MORECORE_CANNOT_TRIM,
6157
6158 As an example alternative MORECORE, here is a custom allocator
6159 kindly contributed for pre-OSX macOS. It uses virtually but not
6160 necessarily physically contiguous non-paged memory (locked in,
6161 present and won't get swapped out). You can use it by uncommenting
6162 this section, adding some #includes, and setting up the appropriate
6163 defines above:
6164
6165 #define MORECORE osMoreCore
6166
6167 There is also a shutdown routine that should somehow be called for
6168 cleanup upon program exit.
6169
6170 #define MAX_POOL_ENTRIES 100
6171 #define MINIMUM_MORECORE_SIZE (64 * 1024U)
6172 static int next_os_pool;
6173 void *our_os_pools[MAX_POOL_ENTRIES];
6174
6175 void *osMoreCore(int size)
6176 {
6177 void *ptr = 0;
6178 static void *sbrk_top = 0;
6179
6180 if (size > 0)
6181 {
6182 if (size < MINIMUM_MORECORE_SIZE)
6183 size = MINIMUM_MORECORE_SIZE;
6184 if (CurrentExecutionLevel() == kTaskLevel)
6185 ptr = PoolAllocateResident(size + RM_PAGE_SIZE, 0);
6186 if (ptr == 0)
6187 {
6188 return (void *) MFAIL;
6189 }
6190 // save ptrs so they can be freed during cleanup
6191 our_os_pools[next_os_pool] = ptr;
6192 next_os_pool++;
6193 ptr = (void *) ((((size_t) ptr) + RM_PAGE_MASK) & ~RM_PAGE_MASK);
6194 sbrk_top = (char *) ptr + size;
6195 return ptr;
6196 }
6197 else if (size < 0)
6198 {
6199 // we don't currently support shrink behavior
6200 return (void *) MFAIL;
6201 }
6202 else
6203 {
6204 return sbrk_top;
6205 }
6206 }
6207
6208 // cleanup any allocated memory pools
6209 // called as last thing before shutting down driver
6210
6211 void osCleanupMem(void)
6212 {
6213 void **ptr;
6214
6215 for (ptr = our_os_pools; ptr < &our_os_pools[MAX_POOL_ENTRIES]; ptr++)
6216 if (*ptr)
6217 {
6218 PoolDeallocate(*ptr);
6219 *ptr = 0;
6220 }
6221 }
6222
6223*/
6224
6225
6226/* -----------------------------------------------------------------------
6227History:
6228 v2.8.6 Wed Aug 29 06:57:58 2012 Doug Lea
6229 * fix bad comparison in dlposix_memalign
6230 * don't reuse adjusted asize in sys_alloc
6231 * add LOCK_AT_FORK -- thanks to Kirill Artamonov for the suggestion
6232 * reduce compiler warnings -- thanks to all who reported/suggested these
6233
6234 v2.8.5 Sun May 22 10:26:02 2011 Doug Lea (dl at gee)
6235 * Always perform unlink checks unless INSECURE
6236 * Add posix_memalign.
6237 * Improve realloc to expand in more cases; expose realloc_in_place.
6238 Thanks to Peter Buhr for the suggestion.
6239 * Add footprint_limit, inspect_all, bulk_free. Thanks
6240 to Barry Hayes and others for the suggestions.
6241 * Internal refactorings to avoid calls while holding locks
6242 * Use non-reentrant locks by default. Thanks to Roland McGrath
6243 for the suggestion.
6244 * Small fixes to mspace_destroy, reset_on_error.
6245 * Various configuration extensions/changes. Thanks
6246 to all who contributed these.
6247
6248 V2.8.4a Thu Apr 28 14:39:43 2011 (dl at gee.cs.oswego.edu)
6249 * Update Creative Commons URL
6250
6251 V2.8.4 Wed May 27 09:56:23 2009 Doug Lea (dl at gee)
6252 * Use zeros instead of prev foot for is_mmapped
6253 * Add mspace_track_large_chunks; thanks to Jean Brouwers
6254 * Fix set_inuse in internal_realloc; thanks to Jean Brouwers
6255 * Fix insufficient sys_alloc padding when using 16byte alignment
6256 * Fix bad error check in mspace_footprint
6257 * Adaptations for ptmalloc; thanks to Wolfram Gloger.
6258 * Reentrant spin locks; thanks to Earl Chew and others
6259 * Win32 improvements; thanks to Niall Douglas and Earl Chew
6260 * Add NO_SEGMENT_TRAVERSAL and MAX_RELEASE_CHECK_RATE options
6261 * Extension hook in malloc_state
6262 * Various small adjustments to reduce warnings on some compilers
6263 * Various configuration extensions/changes for more platforms. Thanks
6264 to all who contributed these.
6265
6266 V2.8.3 Thu Sep 22 11:16:32 2005 Doug Lea (dl at gee)
6267 * Add max_footprint functions
6268 * Ensure all appropriate literals are size_t
6269 * Fix conditional compilation problem for some #define settings
6270 * Avoid concatenating segments with the one provided
6271 in create_mspace_with_base
6272 * Rename some variables to avoid compiler shadowing warnings
6273 * Use explicit lock initialization.
6274 * Better handling of sbrk interference.
6275 * Simplify and fix segment insertion, trimming and mspace_destroy
6276 * Reinstate REALLOC_ZERO_BYTES_FREES option from 2.7.x
6277 * Thanks especially to Dennis Flanagan for help on these.
6278
6279 V2.8.2 Sun Jun 12 16:01:10 2005 Doug Lea (dl at gee)
6280 * Fix memalign brace error.
6281
6282 V2.8.1 Wed Jun 8 16:11:46 2005 Doug Lea (dl at gee)
6283 * Fix improper #endif nesting in C++
6284 * Add explicit casts needed for C++
6285
6286 V2.8.0 Mon May 30 14:09:02 2005 Doug Lea (dl at gee)
6287 * Use trees for large bins
6288 * Support mspaces
6289 * Use segments to unify sbrk-based and mmap-based system allocation,
6290 removing need for emulation on most platforms without sbrk.
6291 * Default safety checks
6292 * Optional footer checks. Thanks to William Robertson for the idea.
6293 * Internal code refactoring
6294 * Incorporate suggestions and platform-specific changes.
6295 Thanks to Dennis Flanagan, Colin Plumb, Niall Douglas,
6296 Aaron Bachmann, Emery Berger, and others.
6297 * Speed up non-fastbin processing enough to remove fastbins.
6298 * Remove useless cfree() to avoid conflicts with other apps.
6299 * Remove internal memcpy, memset. Compilers handle builtins better.
6300 * Remove some options that no one ever used and rename others.
6301
6302 V2.7.2 Sat Aug 17 09:07:30 2002 Doug Lea (dl at gee)
6303 * Fix malloc_state bitmap array misdeclaration
6304
6305 V2.7.1 Thu Jul 25 10:58:03 2002 Doug Lea (dl at gee)
6306 * Allow tuning of FIRST_SORTED_BIN_SIZE
6307 * Use PTR_UINT as type for all ptr->int casts. Thanks to John Belmonte.
6308 * Better detection and support for non-contiguousness of MORECORE.
6309 Thanks to Andreas Mueller, Conal Walsh, and Wolfram Gloger
6310 * Bypass most of malloc if no frees. Thanks To Emery Berger.
6311 * Fix freeing of old top non-contiguous chunk im sysmalloc.
6312 * Raised default trim and map thresholds to 256K.
6313 * Fix mmap-related #defines. Thanks to Lubos Lunak.
6314 * Fix copy macros; added LACKS_FCNTL_H. Thanks to Neal Walfield.
6315 * Branch-free bin calculation
6316 * Default trim and mmap thresholds now 256K.
6317
6318 V2.7.0 Sun Mar 11 14:14:06 2001 Doug Lea (dl at gee)
6319 * Introduce independent_comalloc and independent_calloc.
6320 Thanks to Michael Pachos for motivation and help.
6321 * Make optional .h file available
6322 * Allow > 2GB requests on 32bit systems.
6323 * new WIN32 sbrk, mmap, munmap, lock code from <Walter@GeNeSys-e.de>.
6324 Thanks also to Andreas Mueller <a.mueller at paradatec.de>,
6325 and Anonymous.
6326 * Allow override of MALLOC_ALIGNMENT (Thanks to Ruud Waij for
6327 helping test this.)
6328 * memalign: check alignment arg
6329 * realloc: don't try to shift chunks backwards, since this
6330 leads to more fragmentation in some programs and doesn't
6331 seem to help in any others.
6332 * Collect all cases in malloc requiring system memory into sysmalloc
6333 * Use mmap as backup to sbrk
6334 * Place all internal state in malloc_state
6335 * Introduce fastbins (although similar to 2.5.1)
6336 * Many minor tunings and cosmetic improvements
6337 * Introduce USE_PUBLIC_MALLOC_WRAPPERS, USE_MALLOC_LOCK
6338 * Introduce MALLOC_FAILURE_ACTION, MORECORE_CONTIGUOUS
6339 Thanks to Tony E. Bennett <tbennett@nvidia.com> and others.
6340 * Include errno.h to support default failure action.
6341
6342 V2.6.6 Sun Dec 5 07:42:19 1999 Doug Lea (dl at gee)
6343 * return null for negative arguments
6344 * Added Several WIN32 cleanups from Martin C. Fong <mcfong at yahoo.com>
6345 * Add 'LACKS_SYS_PARAM_H' for those systems without 'sys/param.h'
6346 (e.g. WIN32 platforms)
6347 * Cleanup header file inclusion for WIN32 platforms
6348 * Cleanup code to avoid Microsoft Visual C++ compiler complaints
6349 * Add 'USE_DL_PREFIX' to quickly allow co-existence with existing
6350 memory allocation routines
6351 * Set 'malloc_getpagesize' for WIN32 platforms (needs more work)
6352 * Use 'assert' rather than 'ASSERT' in WIN32 code to conform to
6353 usage of 'assert' in non-WIN32 code
6354 * Improve WIN32 'sbrk()' emulation's 'findRegion()' routine to
6355 avoid infinite loop
6356 * Always call 'fREe()' rather than 'free()'
6357
6358 V2.6.5 Wed Jun 17 15:57:31 1998 Doug Lea (dl at gee)
6359 * Fixed ordering problem with boundary-stamping
6360
6361 V2.6.3 Sun May 19 08:17:58 1996 Doug Lea (dl at gee)
6362 * Added pvalloc, as recommended by H.J. Liu
6363 * Added 64bit pointer support mainly from Wolfram Gloger
6364 * Added anonymously donated WIN32 sbrk emulation
6365 * Malloc, calloc, getpagesize: add optimizations from Raymond Nijssen
6366 * malloc_extend_top: fix mask error that caused wastage after
6367 foreign sbrks
6368 * Add linux mremap support code from HJ Liu
6369
6370 V2.6.2 Tue Dec 5 06:52:55 1995 Doug Lea (dl at gee)
6371 * Integrated most documentation with the code.
6372 * Add support for mmap, with help from
6373 Wolfram Gloger (Gloger@lrz.uni-muenchen.de).
6374 * Use last_remainder in more cases.
6375 * Pack bins using idea from colin@nyx10.cs.du.edu
6376 * Use ordered bins instead of best-fit threshold
6377 * Eliminate block-local decls to simplify tracing and debugging.
6378 * Support another case of realloc via move into top
6379 * Fix error occurring when initial sbrk_base not word-aligned.
6380 * Rely on page size for units instead of SBRK_UNIT to
6381 avoid surprises about sbrk alignment conventions.
6382 * Add mallinfo, mallopt. Thanks to Raymond Nijssen
6383 (raymond@es.ele.tue.nl) for the suggestion.
6384 * Add `pad' argument to malloc_trim and top_pad mallopt parameter.
6385 * More precautions for cases where other routines call sbrk,
6386 courtesy of Wolfram Gloger (Gloger@lrz.uni-muenchen.de).
6387 * Added macros etc., allowing use in linux libc from
6388 H.J. Lu (hjl@gnu.ai.mit.edu)
6389 * Inverted this history list
6390
6391 V2.6.1 Sat Dec 2 14:10:57 1995 Doug Lea (dl at gee)
6392 * Re-tuned and fixed to behave more nicely with V2.6.0 changes.
6393 * Removed all preallocation code since under current scheme
6394 the work required to undo bad preallocations exceeds
6395 the work saved in good cases for most test programs.
6396 * No longer use return list or unconsolidated bins since
6397 no scheme using them consistently outperforms those that don't
6398 given above changes.
6399 * Use best fit for very large chunks to prevent some worst-cases.
6400 * Added some support for debugging
6401
6402 V2.6.0 Sat Nov 4 07:05:23 1995 Doug Lea (dl at gee)
6403 * Removed footers when chunks are in use. Thanks to
6404 Paul Wilson (wilson@cs.texas.edu) for the suggestion.
6405
6406 V2.5.4 Wed Nov 1 07:54:51 1995 Doug Lea (dl at gee)
6407 * Added malloc_trim, with help from Wolfram Gloger
6408 (wmglo@Dent.MED.Uni-Muenchen.DE).
6409
6410 V2.5.3 Tue Apr 26 10:16:01 1994 Doug Lea (dl at g)
6411
6412 V2.5.2 Tue Apr 5 16:20:40 1994 Doug Lea (dl at g)
6413 * realloc: try to expand in both directions
6414 * malloc: swap order of clean-bin strategy;
6415 * realloc: only conditionally expand backwards
6416 * Try not to scavenge used bins
6417 * Use bin counts as a guide to preallocation
6418 * Occasionally bin return list chunks in first scan
6419 * Add a few optimizations from colin@nyx10.cs.du.edu
6420
6421 V2.5.1 Sat Aug 14 15:40:43 1993 Doug Lea (dl at g)
6422 * faster bin computation & slightly different binning
6423 * merged all consolidations to one part of malloc proper
6424 (eliminating old malloc_find_space & malloc_clean_bin)
6425 * Scan 2 returns chunks (not just 1)
6426 * Propagate failure in realloc if malloc returns 0
6427 * Add stuff to allow compilation on non-ANSI compilers
6428 from kpv@research.att.com
6429
6430 V2.5 Sat Aug 7 07:41:59 1993 Doug Lea (dl at g.oswego.edu)
6431 * removed potential for odd address access in prev_chunk
6432 * removed dependency on getpagesize.h
6433 * misc cosmetics and a bit more internal documentation
6434 * anticosmetics: mangled names in macros to evade debugger strangeness
6435 * tested on sparc, hp-700, dec-mips, rs6000
6436 with gcc & native cc (hp, dec only) allowing
6437 Detlefs & Zorn comparison study (in SIGPLAN Notices.)
6438
6439 Trial version Fri Aug 28 13:14:29 1992 Doug Lea (dl at g.oswego.edu)
6440 * Based loosely on libg++-1.2X malloc. (It retains some of the overall
6441 structure of old version, but most details differ.)
6442
6443*/