[php-src] PR #24014: zend_alloc: move a small block shrunk to the size of the bin below
| From: | marc-mabe | Date: | Wed, 30 Sep 2026 11:53:43 +0000 |
| Subject: | [php-src] PR #24014: zend_alloc: move a small block shrunk to the size of the bin below | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38979@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24014
Author: marc-mabe
Reallocating a small block to exactly the size of the bin below kept it in place, in its bin.
efree_size() with that size then frees it into the bin below:
heap->size is decreased by too little, and the slot of a run of the larger bin ends
up on the free list of the smaller one. The next zend_mm_gc() counts that slot for the
smaller bin and stores the run in the page map with the number of the smaller bin, so the run's
remaining blocks are then freed and its pages released with the wrong layout.
Truncate when the size fits the bin below, so the block lives in the bin its size maps to. This
costs no instruction; it only turns a realloc to exactly the smaller bin size from in place into a
copy.
The test uses a new zend_test function, zend_test_erealloc_block_size(), to compare the
block size after erealloc() with that of a fresh allocation of the same size.
I couldn't find an actualler caller to hit the case. It needs efree_size() with a
constant size after an in-place erealloc(), and later a zend_mm_gc().