Fix two prof-related bugs in rallocm().
Properly handle boundary conditions for sampled region promotion in
rallocm(). Prior to this fix, some combinations of 'size' and 'extra'
values could cause erroneous behavior. Additionally, size class
recording for promoted regions was incorrect.
diff --git a/src/arena.c b/src/arena.c
index e00dccc..e749c1d 100644
--- a/src/arena.c
+++ b/src/arena.c
@@ -1657,6 +1657,7 @@
assert(ptr != NULL);
assert(CHUNK_ADDR2BASE(ptr) != ptr);
assert(isalloc(ptr) == PAGE_SIZE);
+ assert(size <= small_maxclass);
chunk = (arena_chunk_t *)CHUNK_ADDR2BASE(ptr);
pageind = ((uintptr_t)ptr - (uintptr_t)chunk) >> PAGE_SHIFT;
diff --git a/src/jemalloc.c b/src/jemalloc.c
index e287516..afba0e1 100644
--- a/src/jemalloc.c
+++ b/src/jemalloc.c
@@ -1670,15 +1670,22 @@
old_ctx = prof_ctx_get(p);
if ((cnt = prof_alloc_prep(max_usize)) == NULL)
goto OOM;
- if (prof_promote && (uintptr_t)cnt != (uintptr_t)1U && max_usize
- <= small_maxclass) {
+ /*
+ * Use minimum usize to determine whether promotion may happen.
+ */
+ if (prof_promote && (uintptr_t)cnt != (uintptr_t)1U
+ && ((alignment == 0) ? s2u(size) : sa2u(size,
+ alignment, NULL)) <= small_maxclass) {
q = iralloc(p, small_maxclass+1, (small_maxclass+1 >=
size+extra) ? 0 : size+extra - (small_maxclass+1),
alignment, zero, no_move);
if (q == NULL)
goto ERR;
usize = isalloc(q);
- arena_prof_promoted(q, usize);
+ if (max_usize < PAGE_SIZE) {
+ usize = max_usize;
+ arena_prof_promoted(q, usize);
+ }
} else {
q = iralloc(p, size, extra, alignment, zero, no_move);
if (q == NULL)