One run extending into another in jemalloc-3.5.1 ?

[Chaitanya Patti]

I don't understand how a double-free can cause such a corruption. Can you please explain ?

________________________________________
From: Jason Evans <jasone at canonware.com>
Sent: Tuesday, April 19, 2016 10:01 AM
To: Chaitanya Patti
Cc: jemalloc-discuss at canonware.com
Subject: Re: One run extending into another in jemalloc-3.5.1 ?

On Apr 18, 2016, at 11:12 PM, Chaitanya Patti <cpatti at tintri.com> wrote:
> I am debugging a memory de-allocation issue. We are using jemalloc version 3.5.1. It looks like a run with reg_size 224 and total size of 4 pages has "extended" into an adjacent run, and corrupted the adjacent run. Has such an issue been seen before ?

That usually means that a double free corrupted metadata for the adjacent run.  If you have a repeatable test case, try running with a debug build of jemalloc, and disable tcache, so that assertions immediately detect double frees.

Jason