malloc 소스코드 분석(libc 2.27)

libc 2.23을 기준으로 변경된 부분만 분석하겠다.

https://k0n9.tistory.com/entry/malloc-%EC%86%8C%EC%8A%A4%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9Dlibc-223

 

libc 2.26부터는 tcache의 개념이 도입되었다. 그러니 tcache 위주로 보자.

 

tcache에 관한 함수는 곧 따로 정리하겠다.(tcache_get 등)

__libc_malloc

아래는 malloc함수 호출시 실행되는 코드이다.

//__libc_malloc 2.27
void *
__libc_malloc (size_t bytes)
{
  mstate ar_ptr;
  void *victim;

  void *(*hook) (size_t, const void *)
    = atomic_forced_read (__malloc_hook);
  if (__builtin_expect (hook != NULL, 0))
    return (*hook)(bytes, RETURN_ADDRESS (0));
#if USE_TCACHE
  /* int_free also calls request2size, be careful to not pad twice.  */
  size_t tbytes;
  checked_request2size (bytes, tbytes);
  size_t tc_idx = csize2tidx (tbytes);

  MAYBE_INIT_TCACHE ();

  DIAG_PUSH_NEEDS_COMMENT;
  if (tc_idx < mp_.tcache_bins
      /*&& tc_idx < TCACHE_MAX_BINS*/ /* to appease gcc */
      && tcache
      && tcache->entries[tc_idx] != NULL)
    {
      return tcache_get (tc_idx);
    }
  DIAG_POP_NEEDS_COMMENT;
#endif

  if (SINGLE_THREAD_P)
    {
      victim = _int_malloc (&main_arena, bytes);
      assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
        &main_arena == arena_for_chunk (mem2chunk (victim)));
      return victim;
    }

  arena_get (ar_ptr, bytes);

  victim = _int_malloc (ar_ptr, bytes);
  /* Retry with another arena only if we were able to find a usable arena
     before.  */
  if (!victim && ar_ptr != NULL)
    {
      LIBC_PROBE (memory_malloc_retry, 1, bytes);
      ar_ptr = arena_get_retry (ar_ptr, bytes);
      victim = _int_malloc (ar_ptr, bytes);
    }

  if (ar_ptr != NULL)
    __libc_lock_unlock (ar_ptr->mutex);

  assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
          ar_ptr == arena_for_chunk (mem2chunk (victim)));
  return victim;
}
libc_hidden_def (__libc_malloc)

 

 

살펴보자

 

 

#if USE_TCACHE

  /* int_free also calls request2size, be careful to not pad twice.  */

  size_t tbytes;

  checked_request2size (bytes, tbytes);

  size_t tc_idx = csize2tidx (tbytes);

  MAYBE_INIT_TCACHE ();

  DIAG_PUSH_NEEDS_COMMENT;

  if (tc_idx < mp_.tcache_bins

      /*&& tc_idx < TCACHE_MAX_BINS*/ /* to appease gcc */

      && tcache

      && tcache->entries[tc_idx] != NULL)

    {

      return tcache_get (tc_idx);

    }

  DIAG_POP_NEEDS_COMMENT;

#endif

  if (SINGLE_THREAD_P)

    {

      victim = _int_malloc (&main_arena, bytes);

      assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||

        &main_arena == arena_for_chunk (mem2chunk (victim)));

      return victim;

    }

USE_TCACHE가 참이면 즉, tcache를 사용하면

우선 checked_request2size 로 bytes를 정렬하여 tbytes변수에 저장한다.

csize2tidx로 tbytes에 해당하는 tcache인덱스를 tc_idx에 저장한다.

MAYBE_INIT_TCACHE로 tcache를 초기화한다.

그리고 아래와 같은 검사를 한다.

1. tc_idx < mp_.tcache_bins 는 메모리 블록 크기에 맞는 tcache의 idx가(tc_idx) 지정된 tcache bin의 개수(mp_.tcache_count)보다 작은지 확인한다.

2. tcache로 tcache가 활성화되어있는지 확인한다.

3. 현재 tc_idx에 해당하는 bin에 메모리가 존재하는지 확인한다.

이에 해당하면 tcache_get(tc_idx)를 실행한다.. 이 함수는 tcache에서 메모리 블록을 가져온다.

 

만약 SINGLE_THREAD_P 가 참이면 즉, 단일 스레드이면 2.23 과 큰 차이 없이 실행한다.

멀티 스레드이면 그 이후의 코드를 실행하게 된다.

 

_int_malloc을 보자

 

_int_malloc

//_int_malloc 2.27
static void *
_int_malloc (mstate av, size_t bytes)
{
  INTERNAL_SIZE_T nb;               /* normalized request size */
  unsigned int idx;                 /* associated bin index */
  mbinptr bin;                      /* associated bin */

  mchunkptr victim;                 /* inspected/selected chunk */
  INTERNAL_SIZE_T size;             /* its size */
  int victim_index;                 /* its bin index */

  mchunkptr remainder;              /* remainder from a split */
  unsigned long remainder_size;     /* its size */

  unsigned int block;               /* bit map traverser */
  unsigned int bit;                 /* bit map traverser */
  unsigned int map;                 /* current word of binmap */

  mchunkptr fwd;                    /* misc temp for linking */
  mchunkptr bck;                    /* misc temp for linking */

#if USE_TCACHE
  size_t tcache_unsorted_count;     /* count of unsorted chunks processed */
#endif

  /*
     Convert request size to internal form by adding SIZE_SZ bytes
     overhead plus possibly more to obtain necessary alignment and/or
     to obtain a size of at least MINSIZE, the smallest allocatable
     size. Also, checked_request2size traps (returning 0) request sizes
     that are so large that they wrap around zero when padded and
     aligned.
   */

  checked_request2size (bytes, nb);

  /* There are no usable arenas.  Fall back to sysmalloc to get a chunk from
     mmap.  */
  if (__glibc_unlikely (av == NULL))
    {
      void *p = sysmalloc (nb, av);
      if (p != NULL)
  alloc_perturb (p, bytes);
      return p;
    }

  /*
     If the size qualifies as a fastbin, first check corresponding bin.
     This code is safe to execute even if av is not yet initialized, so we
     can try it without checking, which saves some time on this fast path.
   */

#define REMOVE_FB(fb, victim, pp)     \
  do              \
    {             \
      victim = pp;          \
      if (victim == NULL)       \
  break;            \
    }             \
  while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim)) \
   != victim);          \

  if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
    {
      idx = fastbin_index (nb);
      mfastbinptr *fb = &fastbin (av, idx);
      mchunkptr pp;
      victim = *fb;

      if (victim != NULL)
  {
    if (SINGLE_THREAD_P)
      *fb = victim->fd;
    else
      REMOVE_FB (fb, pp, victim);
    if (__glibc_likely (victim != NULL))
      {
        size_t victim_idx = fastbin_index (chunksize (victim));
        if (__builtin_expect (victim_idx != idx, 0))
    malloc_printerr ("malloc(): memory corruption (fast)");
        check_remalloced_chunk (av, victim, nb);
#if USE_TCACHE
        /* While we're here, if we see other chunks of the same size,
     stash them in the tcache.  */
        size_t tc_idx = csize2tidx (nb);
        if (tcache && tc_idx < mp_.tcache_bins)
    {
      mchunkptr tc_victim;

      /* While bin not empty and tcache not full, copy chunks.  */
      while (tcache->counts[tc_idx] < mp_.tcache_count
       && (tc_victim = *fb) != NULL)
        {
          if (SINGLE_THREAD_P)
      *fb = tc_victim->fd;
          else
      {
        REMOVE_FB (fb, pp, tc_victim);
        if (__glibc_unlikely (tc_victim == NULL))
          break;
      }
          tcache_put (tc_victim, tc_idx);
        }
    }
#endif
        void *p = chunk2mem (victim);
        alloc_perturb (p, bytes);
        return p;
      }
  }
    }

  /*
     If a small request, check regular bin.  Since these "smallbins"
     hold one size each, no searching within bins is necessary.
     (For a large request, we need to wait until unsorted chunks are
     processed to find best fit. But for small ones, fits are exact
     anyway, so we can check now, which is faster.)
   */

  if (in_smallbin_range (nb))
    {
      idx = smallbin_index (nb);
      bin = bin_at (av, idx);

      if ((victim = last (bin)) != bin)
        {
          bck = victim->bk;
    if (__glibc_unlikely (bck->fd != victim))
      malloc_printerr ("malloc(): smallbin double linked list corrupted");
          set_inuse_bit_at_offset (victim, nb);
          bin->bk = bck;
          bck->fd = bin;

          if (av != &main_arena)
      set_non_main_arena (victim);
          check_malloced_chunk (av, victim, nb);
#if USE_TCACHE
    /* While we're here, if we see other chunks of the same size,
       stash them in the tcache.  */
    size_t tc_idx = csize2tidx (nb);
    if (tcache && tc_idx < mp_.tcache_bins)
      {
        mchunkptr tc_victim;

        /* While bin not empty and tcache not full, copy chunks over.  */
        while (tcache->counts[tc_idx] < mp_.tcache_count
         && (tc_victim = last (bin)) != bin)
    {
      if (tc_victim != 0)
        {
          bck = tc_victim->bk;
          set_inuse_bit_at_offset (tc_victim, nb);
          if (av != &main_arena)
      set_non_main_arena (tc_victim);
          bin->bk = bck;
          bck->fd = bin;

          tcache_put (tc_victim, tc_idx);
              }
    }
      }
#endif
          void *p = chunk2mem (victim);
          alloc_perturb (p, bytes);
          return p;
        }
    }

  /*
     If this is a large request, consolidate fastbins before continuing.
     While it might look excessive to kill all fastbins before
     even seeing if there is space available, this avoids
     fragmentation problems normally associated with fastbins.
     Also, in practice, programs tend to have runs of either small or
     large requests, but less often mixtures, so consolidation is not
     invoked all that often in most programs. And the programs that
     it is called frequently in otherwise tend to fragment.
   */

  else
    {
      idx = largebin_index (nb);
      if (atomic_load_relaxed (&av->have_fastchunks))
        malloc_consolidate (av);
    }

  /*
     Process recently freed or remaindered chunks, taking one only if
     it is exact fit, or, if this a small request, the chunk is remainder from
     the most recent non-exact fit.  Place other traversed chunks in
     bins.  Note that this step is the only place in any routine where
     chunks are placed in bins.

     The outer loop here is needed because we might not realize until
     near the end of malloc that we should have consolidated, so must
     do so and retry. This happens at most once, and only when we would
     otherwise need to expand memory to service a "small" request.
   */

#if USE_TCACHE
  INTERNAL_SIZE_T tcache_nb = 0;
  size_t tc_idx = csize2tidx (nb);
  if (tcache && tc_idx < mp_.tcache_bins)
    tcache_nb = nb;
  int return_cached = 0;

  tcache_unsorted_count = 0;
#endif

  for (;; )
    {
      int iters = 0;
      while ((victim = unsorted_chunks (av)->bk) != unsorted_chunks (av))
        {
          bck = victim->bk;
          if (__builtin_expect (chunksize_nomask (victim) <= 2 * SIZE_SZ, 0)
              || __builtin_expect (chunksize_nomask (victim)
           > av->system_mem, 0))
            malloc_printerr ("malloc(): memory corruption");
          size = chunksize (victim);

          /*
             If a small request, try to use last remainder if it is the
             only chunk in unsorted bin.  This helps promote locality for
             runs of consecutive small requests. This is the only
             exception to best-fit, and applies only when there is
             no exact fit for a small chunk.
           */

          if (in_smallbin_range (nb) &&
              bck == unsorted_chunks (av) &&
              victim == av->last_remainder &&
              (unsigned long) (size) > (unsigned long) (nb + MINSIZE))
            {
              /* split and reattach remainder */
              remainder_size = size - nb;
              remainder = chunk_at_offset (victim, nb);
              unsorted_chunks (av)->bk = unsorted_chunks (av)->fd = remainder;
              av->last_remainder = remainder;
              remainder->bk = remainder->fd = unsorted_chunks (av);
              if (!in_smallbin_range (remainder_size))
                {
                  remainder->fd_nextsize = NULL;
                  remainder->bk_nextsize = NULL;
                }

              set_head (victim, nb | PREV_INUSE |
                        (av != &main_arena ? NON_MAIN_ARENA : 0));
              set_head (remainder, remainder_size | PREV_INUSE);
              set_foot (remainder, remainder_size);

              check_malloced_chunk (av, victim, nb);
              void *p = chunk2mem (victim);
              alloc_perturb (p, bytes);
              return p;
            }

          /* remove from unsorted list */
          unsorted_chunks (av)->bk = bck;
          bck->fd = unsorted_chunks (av);

          /* Take now instead of binning if exact fit */

          if (size == nb)
            {
              set_inuse_bit_at_offset (victim, size);
              if (av != &main_arena)
    set_non_main_arena (victim);
#if USE_TCACHE
        /* Fill cache first, return to user only if cache fills.
     We may return one of these chunks later.  */
        if (tcache_nb
      && tcache->counts[tc_idx] < mp_.tcache_count)
    {
      tcache_put (victim, tc_idx);
      return_cached = 1;
      continue;
    }
        else
    {
#endif
              check_malloced_chunk (av, victim, nb);
              void *p = chunk2mem (victim);
              alloc_perturb (p, bytes);
              return p;
#if USE_TCACHE
    }
#endif
            }

          /* place chunk in bin */

          if (in_smallbin_range (size))
            {
              victim_index = smallbin_index (size);
              bck = bin_at (av, victim_index);
              fwd = bck->fd;
            }
          else
            {
              victim_index = largebin_index (size);
              bck = bin_at (av, victim_index);
              fwd = bck->fd;

              /* maintain large bins in sorted order */
              if (fwd != bck)
                {
                  /* Or with inuse bit to speed comparisons */
                  size |= PREV_INUSE;
                  /* if smaller than smallest, bypass loop below */
                  assert (chunk_main_arena (bck->bk));
                  if ((unsigned long) (size)
          < (unsigned long) chunksize_nomask (bck->bk))
                    {
                      fwd = bck;
                      bck = bck->bk;

                      victim->fd_nextsize = fwd->fd;
                      victim->bk_nextsize = fwd->fd->bk_nextsize;
                      fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
                    }
                  else
                    {
                      assert (chunk_main_arena (fwd));
                      while ((unsigned long) size < chunksize_nomask (fwd))
                        {
                          fwd = fwd->fd_nextsize;
        assert (chunk_main_arena (fwd));
                        }

                      if ((unsigned long) size
        == (unsigned long) chunksize_nomask (fwd))
                        /* Always insert in the second position.  */
                        fwd = fwd->fd;
                      else
                        {
                          victim->fd_nextsize = fwd;
                          victim->bk_nextsize = fwd->bk_nextsize;
                          fwd->bk_nextsize = victim;
                          victim->bk_nextsize->fd_nextsize = victim;
                        }
                      bck = fwd->bk;
                    }
                }
              else
                victim->fd_nextsize = victim->bk_nextsize = victim;
            }

          mark_bin (av, victim_index);
          victim->bk = bck;
          victim->fd = fwd;
          fwd->bk = victim;
          bck->fd = victim;

#if USE_TCACHE
      /* If we've processed as many chunks as we're allowed while
   filling the cache, return one of the cached ones.  */
      ++tcache_unsorted_count;
      if (return_cached
    && mp_.tcache_unsorted_limit > 0
    && tcache_unsorted_count > mp_.tcache_unsorted_limit)
  {
    return tcache_get (tc_idx);
  }
#endif

#define MAX_ITERS       10000
          if (++iters >= MAX_ITERS)
            break;
        }

#if USE_TCACHE
      /* If all the small chunks we found ended up cached, return one now.  */
      if (return_cached)
  {
    return tcache_get (tc_idx);
  }
#endif

      /*
         If a large request, scan through the chunks of current bin in
         sorted order to find smallest that fits.  Use the skip list for this.
       */

      if (!in_smallbin_range (nb))
        {
          bin = bin_at (av, idx);

          /* skip scan if empty or largest chunk is too small */
          if ((victim = first (bin)) != bin
        && (unsigned long) chunksize_nomask (victim)
          >= (unsigned long) (nb))
            {
              victim = victim->bk_nextsize;
              while (((unsigned long) (size = chunksize (victim)) <
                      (unsigned long) (nb)))
                victim = victim->bk_nextsize;

              /* Avoid removing the first entry for a size so that the skip
                 list does not have to be rerouted.  */
              if (victim != last (bin)
      && chunksize_nomask (victim)
        == chunksize_nomask (victim->fd))
                victim = victim->fd;

              remainder_size = size - nb;
              unlink (av, victim, bck, fwd);

              /* Exhaust */
              if (remainder_size < MINSIZE)
                {
                  set_inuse_bit_at_offset (victim, size);
                  if (av != &main_arena)
        set_non_main_arena (victim);
                }
              /* Split */
              else
                {
                  remainder = chunk_at_offset (victim, nb);
                  /* We cannot assume the unsorted list is empty and therefore
                     have to perform a complete insert here.  */
                  bck = unsorted_chunks (av);
                  fwd = bck->fd;
      if (__glibc_unlikely (fwd->bk != bck))
        malloc_printerr ("malloc(): corrupted unsorted chunks");
                  remainder->bk = bck;
                  remainder->fd = fwd;
                  bck->fd = remainder;
                  fwd->bk = remainder;
                  if (!in_smallbin_range (remainder_size))
                    {
                      remainder->fd_nextsize = NULL;
                      remainder->bk_nextsize = NULL;
                    }
                  set_head (victim, nb | PREV_INUSE |
                            (av != &main_arena ? NON_MAIN_ARENA : 0));
                  set_head (remainder, remainder_size | PREV_INUSE);
                  set_foot (remainder, remainder_size);
                }
              check_malloced_chunk (av, victim, nb);
              void *p = chunk2mem (victim);
              alloc_perturb (p, bytes);
              return p;
            }
        }

      /*
         Search for a chunk by scanning bins, starting with next largest
         bin. This search is strictly by best-fit; i.e., the smallest
         (with ties going to approximately the least recently used) chunk
         that fits is selected.

         The bitmap avoids needing to check that most blocks are nonempty.
         The particular case of skipping all bins during warm-up phases
         when no chunks have been returned yet is faster than it might look.
       */

      ++idx;
      bin = bin_at (av, idx);
      block = idx2block (idx);
      map = av->binmap[block];
      bit = idx2bit (idx);

      for (;; )
        {
          /* Skip rest of block if there are no more set bits in this block.  */
          if (bit > map || bit == 0)
            {
              do
                {
                  if (++block >= BINMAPSIZE) /* out of bins */
                    goto use_top;
                }
              while ((map = av->binmap[block]) == 0);

              bin = bin_at (av, (block << BINMAPSHIFT));
              bit = 1;
            }

          /* Advance to bin with set bit. There must be one. */
          while ((bit & map) == 0)
            {
              bin = next_bin (bin);
              bit <<= 1;
              assert (bit != 0);
            }

          /* Inspect the bin. It is likely to be non-empty */
          victim = last (bin);

          /*  If a false alarm (empty bin), clear the bit. */
          if (victim == bin)
            {
              av->binmap[block] = map &= ~bit; /* Write through */
              bin = next_bin (bin);
              bit <<= 1;
            }

          else
            {
              size = chunksize (victim);

              /*  We know the first chunk in this bin is big enough to use. */
              assert ((unsigned long) (size) >= (unsigned long) (nb));

              remainder_size = size - nb;

              /* unlink */
              unlink (av, victim, bck, fwd);

              /* Exhaust */
              if (remainder_size < MINSIZE)
                {
                  set_inuse_bit_at_offset (victim, size);
                  if (av != &main_arena)
        set_non_main_arena (victim);
                }

              /* Split */
              else
                {
                  remainder = chunk_at_offset (victim, nb);

                  /* We cannot assume the unsorted list is empty and therefore
                     have to perform a complete insert here.  */
                  bck = unsorted_chunks (av);
                  fwd = bck->fd;
      if (__glibc_unlikely (fwd->bk != bck))
        malloc_printerr ("malloc(): corrupted unsorted chunks 2");
                  remainder->bk = bck;
                  remainder->fd = fwd;
                  bck->fd = remainder;
                  fwd->bk = remainder;

                  /* advertise as last remainder */
                  if (in_smallbin_range (nb))
                    av->last_remainder = remainder;
                  if (!in_smallbin_range (remainder_size))
                    {
                      remainder->fd_nextsize = NULL;
                      remainder->bk_nextsize = NULL;
                    }
                  set_head (victim, nb | PREV_INUSE |
                            (av != &main_arena ? NON_MAIN_ARENA : 0));
                  set_head (remainder, remainder_size | PREV_INUSE);
                  set_foot (remainder, remainder_size);
                }
              check_malloced_chunk (av, victim, nb);
              void *p = chunk2mem (victim);
              alloc_perturb (p, bytes);
              return p;
            }
        }

    use_top:
      /*
         If large enough, split off the chunk bordering the end of memory
         (held in av->top). Note that this is in accord with the best-fit
         search rule.  In effect, av->top is treated as larger (and thus
         less well fitting) than any other available chunk since it can
         be extended to be as large as necessary (up to system
         limitations).

         We require that av->top always exists (i.e., has size >=
         MINSIZE) after initialization, so if it would otherwise be
         exhausted by current request, it is replenished. (The main
         reason for ensuring it exists is that we may need MINSIZE space
         to put in fenceposts in sysmalloc.)
       */

      victim = av->top;
      size = chunksize (victim);

      if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
        {
          remainder_size = size - nb;
          remainder = chunk_at_offset (victim, nb);
          av->top = remainder;
          set_head (victim, nb | PREV_INUSE |
                    (av != &main_arena ? NON_MAIN_ARENA : 0));
          set_head (remainder, remainder_size | PREV_INUSE);

          check_malloced_chunk (av, victim, nb);
          void *p = chunk2mem (victim);
          alloc_perturb (p, bytes);
          return p;
        }

      /* When we are using atomic ops to free fast chunks we can get
         here for all block sizes.  */
      else if (atomic_load_relaxed (&av->have_fastchunks))
        {
          malloc_consolidate (av);
          /* restore original bin index */
          if (in_smallbin_range (nb))
            idx = smallbin_index (nb);
          else
            idx = largebin_index (nb);
        }

      /*
         Otherwise, relay to handle system-dependent cases
       */
      else
        {
          void *p = sysmalloc (nb, av);
          if (p != NULL)
            alloc_perturb (p, bytes);
          return p;
        }
    }
}

 

 

살펴보자

 

 

#if USE_TCACHE

  size_t tcache_unsorted_count;     /* count of unsorted chunks processed */

#endif

우선 USE_TCACHE 즉,  tcache를 사용하면 tcache_unsorted_count 라는 변수를 초기화한다.

 

#define REMOVE_FB(fb, victim, pp)     \

  do              \

    {             \

      victim = pp;          \

      if (victim == NULL)       \

  break;            \

    }             \

  while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim)) \

   != victim);          \

REMOVE_FB에 대한 정의 를 한다. fb는 적절한 크기의 fastbin의 index를 가진다. pp는 마지막 chunk이다. 

우선 victim에 pp를 저장하고 이것이 NULL인지 확인한다. NULL이면 비어있다는 뜻이니 그냥 break한다. 

NULL이 아니면 while 조건문으로 간다.

우선 catomic_compare_and_exchange_val_acq 를 먼저 보면 fb와 victim을 비교한 후 둘이 같으면 fb를 victim->fb로 업데이트하고 이전 fb를 pp에 반환한다. 만약 둘이 같다면 pp는 victim과 같으니 while문을 종료하게 된다. 결과적으로 fastbin의 가장 앞의 chunk가 제거된 것이다.

만약 fb와 victim이 다르다면 pp != victim이 되고 그러면 다시 do ~ while 문을 반복한다. 이는 멀티 스레드로 인해 값이 이상하게 바뀔 수 있기 때문이다.

아무튼 멀티스레드 환경에서 가장 앞의 chunk(victim)를 제거한다고 보면 된다.

 

  if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))

    {

      idx = fastbin_index (nb);

      mfastbinptr *fb = &fastbin (av, idx);

      mchunkptr pp;

      victim = *fb;

      if (victim != NULL)

  {

    if (SINGLE_THREAD_P)

      *fb = victim->fd;

    else

      REMOVE_FB (fb, pp, victim);

    if (__glibc_likely (victim != NULL))

      {

        size_t victim_idx = fastbin_index (chunksize (victim));

        if (__builtin_expect (victim_idx != idx, 0))

    malloc_printerr ("malloc(): memory corruption (fast)");

        check_remalloced_chunk (av, victim, nb);

#if USE_TCACHE

우선 fast bin인지 체크한다. 그리고 bin이 비어있는지 확인을 한다.(victim! = NULL) 만약 비어있지 않다면

싱글 스레드이면 *fb = victim->fd로 첫번째 chunk(가장 최근에 free된 chunk)를 제거하고 멀티 스레드이면 REMOVE_FB를 실행해서 첫번째 chunk를 제거한다. 만약 victim이 NULL이 아니면 idx를 가져와서 올바르지 않다면 오류 출력을 하고 check_remalloced_chunk로 올바른 chunk인지 검사한다.

 

USE_TCAHCE를 검사해서 tcache가 set 되어있는지 검사하고 set되어있으면 이하의 코드를 실행한다.

 

#if USE_TCACHE

        /* While we're here, if we see other chunks of the same size,

     stash them in the tcache.  */

        size_t tc_idx = csize2tidx (nb);

        if (tcache && tc_idx < mp_.tcache_bins)

    {

      mchunkptr tc_victim;

      /* While bin not empty and tcache not full, copy chunks.  */

      while (tcache->counts[tc_idx] < mp_.tcache_count

       && (tc_victim = *fb) != NULL)

        {

          if (SINGLE_THREAD_P)

      *fb = tc_victim->fd;

          else

      {

        REMOVE_FB (fb, pp, tc_victim);

        if (__glibc_unlikely (tc_victim == NULL))

          break;

      }

          tcache_put (tc_victim, tc_idx);

        }

    }

#endif

        void *p = chunk2mem (victim);

        alloc_perturb (p, bytes);

        return p;

      }

  }

    }

만약 tcache가 설정되어있으면

csize2tidx(nb)로 크기에 맞는 tcache의 index를 가져와 tc_idx에 저장한다. 그리고

만약 tcache가 활성화되어있고 tc_idx < mp_.tcache_bins 즉, tc_idx가 최대 idx보다 작으면 즉, 올바른 인덱스이면...(if)

tcache->counts[tc_idx] < mp._tcache_count 이고 tc_victim에 fb 포인터 값을 넣고 이 값이 NULL이 아니면 아래의 코드를 반복한다.

우선 싱글 스레드이면 그냥 fastbin의 처음 chunk를 제거하고 멀티스레드이면 REMOVE_FB로 처음 chunk를 제거한다. 그리고 tcache_put 으로 제거한 chunk들을 크기에 맞게 tcache에 넣는다.

 

즉 nb 크기의 fastbin의 chunk를 모두 tcache에 넣는작업이다.

 

그리고 마지막 victim을 return 한다.

 

#if USE_TCACHE

    /* While we're here, if we see other chunks of the same size,

       stash them in the tcache.  */

    size_t tc_idx = csize2tidx (nb);

    if (tcache && tc_idx < mp_.tcache_bins)

      {

        mchunkptr tc_victim;

        /* While bin not empty and tcache not full, copy chunks over.  */

        while (tcache->counts[tc_idx] < mp_.tcache_count

         && (tc_victim = last (bin)) != bin)

    {

      if (tc_victim != 0)

        {

          bck = tc_victim->bk;

          set_inuse_bit_at_offset (tc_victim, nb);

          if (av != &main_arena)

      set_non_main_arena (tc_victim);

          bin->bk = bck;

          bck->fd = bin;

          tcache_put (tc_victim, tc_idx);

              }

    }

      }

#endif

 

우선 USE_TCACHE로 tcache가 set되어있는지 확인한다.

크기에 맞는 tcache의 index를 tc_idx에 넣는다.

만약 tcache가 set되어있고 tc_idx가 정상적인 크기라면(if)

tc_idx에 해당하는 tcache의 chunk 갯수가 최대 갯수보다 작고 bin의 마지막 chunk가 bin이 아니면 즉, 비어있지 않으면(while)

마지막 chunk가 0이 아니면(if)

bck에는 tc_victim->bk를 넣고 set_inuse_bit_at_offset으로 tc_victim의 inuse_bit를 set해서 사용중임을 표시한다.

만약 main_arena가 아니라면 set_non_main_arena로 non_main_arena를 set하고

bin->bk에 bck 즉 tc_victim->bk를 저장하고

bck->fd 즉 tc_victim->bk->fd에 bin을 저장한다.

그리고 tcache_put으로 tcache에 넣는다.

결과적으로 요청한 크기의 small bin list의 tcache에 들어갈 수 있는 chunk들을 tcache에 넣는 과정이다.

 

#if USE_TCACHE

  INTERNAL_SIZE_T tcache_nb = 0;

  size_t tc_idx = csize2tidx (nb);

  if (tcache && tc_idx < mp_.tcache_bins)

    tcache_nb = nb;

  int return_cached = 0;

  tcache_unsorted_count = 0;

#endif

USE_TCACHE를 체크하고 tc_idx에 적절한 크기의 tcache index를 넣는다.

tcache가 활성화되어있고 tc_idx가 최대인덱스보다 작으면(if)

tcache_nb에 nb(요청한 크기) 를 넣고

return_cached 를 초기화하고(이 변수는 이전에 할당된 chunk가 있는지 표현)

tcache_unsorted_count를 0으로 한다.

 

#if USE_TCACHE

        /* Fill cache first, return to user only if cache fills.

     We may return one of these chunks later.  */

        if (tcache_nb

      && tcache->counts[tc_idx] < mp_.tcache_count)

    {

      tcache_put (victim, tc_idx);

      return_cached = 1;

      continue;

    }

        else

    {

#endif

              check_malloced_chunk (av, victim, nb);

              void *p = chunk2mem (victim);

              alloc_perturb (p, bytes);

              return p;

#if USE_TCACHE

    }

#endif

            }

USE_TCACHE가 set 되어있고

만약 tcache_nb가 0이 아니고 tcache 인덱스가 정상이면(if)

tcache_put으로 victim을 넣고 reuturn_cached를 1로 하고 continue를 한다.

아니라면

그냥 할당할 주소를 리턴한다.

 

#if USE_TCACHE

      /* If we've processed as many chunks as we're allowed while

   filling the cache, return one of the cached ones.  */

      ++tcache_unsorted_count;

      if (return_cached

    && mp_.tcache_unsorted_limit > 0

    && tcache_unsorted_count > mp_.tcache_unsorted_limit)

  {

    return tcache_get (tc_idx);

  }

#endif

USE_TCACHE가 set되어있으면

tcache_unsorted_count를 1 증가한다

만약 return_cached가 참이고 mp_.tcache_unsorted_limit가 0보다 크고 tcache_unsorted_count가

mp_.tcache_unsorted_limit 보다 크면 tcache_get(tc_idx)를 실행한다.

위 코드는 tcache의 chunk가 허용 수를 넘어가면 그냥 tcache_get으로 가져오는것이다.

 

#if USE_TCACHE

      /* If all the small chunks we found ended up cached, return one now.  */

      if (return_cached)

  {

    return tcache_get (tc_idx);

  }

#endif

return_cached 가 1이면 tcache_get을 한다.

 

 

 

 

 

<틀린 부분이 있다면 비난과 욕설을 해주세요>