Re: Heap corruption?

[Gerd Moellmann]

It just crashed again here, and now I realize that alloc.c is using
some new code (ablocks), and there's a bug is lisp_align_malloc: the
thing it is trying to free is actually an interior part of a malloced
ablocks structure.  The check

  /* If the memory just allocated cannot be addressed thru a Lisp
     object's pointer, and it needs to be,
     that's equivalent to running out of memory.  */
  if (val && type != MEM_TYPE_NON_LISP)
    {
      Lisp_Object tem;
      XSETCONS (tem, (char *) val + nbytes - 1);
      if ((char *) XCONS (tem) != (char *) val + nbytes - 1)
        {
          lisp_malloc_loser = val;
          free (val);
          val = 0;
        }
    }

should not be done where is currently is, but in the if above this
code snippet which allocates the ablocks structure.


The question remains though, why this is happening in a lightly loaded
Emacs in the first place.  Can memory be so fragmented by the new
allocation, maybe only in the !HAVE_POSIX_MEMALIGN case?  Is there a
way to check?  Would it possibly help to use the memalign from
gmalloc.c?