Attachment 314319 Details for Bug 457508 – Testcase that *should* have reproduced this if the alleged failure mode is real

Testcase that *should* have reproduced this if the alleged failure mode is real

testcase.c (text/x-csrc), 1.58 KB, created by Denys Vlasenko on 2008-08-14 14:14:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Denys Vlasenko

Created: 2008-08-14 14:14:48 UTC

Size: 1.58 KB

patch

obsolete

>#include <stdlib.h>
>#include <string.h>
>#include <stdio.h>
>#include <errno.h>
>#include <sys/mman.h>
>
>static void *malloc_fill(int sz)
>{
>	union {
>		char b[sizeof(void*)];
>		void *p;
>	} hack;
>	int i, sum;
>	void *ptr;
>
>	ptr = malloc(sz);
>	if (!ptr)
>		return ptr;
>
>	hack.p = ptr;
>	sum = 0;
>	for (i = 0; i < sizeof(hack.b); i++)
>		sum += hack.b[i];
>	printf("malloc()=%p filled with %02x\n", ptr, (unsigned char)sum);
>	return memset(ptr, sum, sz);
>}
>
>enum {
>	BIGNUM = 99999,
>	ALLOCSZ = 128 - sizeof(size_t),
>};
>
>char *m[BIGNUM];
>
>int main()
>{
>	int i;
>	int diff;
>	void *mmp;
>	char *out_of_arena;
>
>	m[0] = malloc_fill(ALLOCSZ);
>	m[1] = malloc_fill(ALLOCSZ);
>	diff = m[1] - m[0];
>	printf("diff=%d\n", diff);
>
>	errno = 0;
>	mmp = mmap(
>		(void*)((long)(m[0] + 1000*1024) & ~(long)0xffff), // start
>		64*1024, // size
>		PROT_READ | PROT_WRITE,
>		MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED,
>		-1, // fd
>		0 // ofs
>	);
>	printf("mmap()=%p errno:%s\n", mmp, strerror(errno));
>
>	for (i = 2; i < BIGNUM; i++) {
>		m[i] = malloc_fill(ALLOCSZ);
>		if (diff != m[i] - m[i-1]) {
>			printf("jump: %d\n", (int)(m[i] - m[i-1]));
>			break;
>		}
>	}
>	out_of_arena = m[i];
>	malloc_fill(ALLOCSZ); // prevents realloc(out_of_arena) from simply growing up
>	while (i) {
>		i--;
>		free(m[i]);
>	}
>
>	printf("Before realloc: @%p:\n", out_of_arena);
>	for (i = 0; i < ALLOCSZ; i++)
>		printf(" %02x", (unsigned char)out_of_arena[i]);
>	printf("\n");
>
>	out_of_arena = realloc(out_of_arena, ALLOCSZ*2);
>
>	printf("After realloc: @%p:\n", out_of_arena);
>	for (i = 0; i < ALLOCSZ*2; i++)
>		printf(" %02x", (unsigned char)out_of_arena[i]);
>	printf("\n");
>
>	return 0;
>}

Actions: View

Attachments on bug 457508: 314319 | 314330 | 317350 | 360703