From 38b051a106b63d40eb20625948d8b8cd92512f3a Mon Sep 17 00:00:00 2001 From: Chris Kennelly Date: Wed, 8 Jul 2026 16:33:48 -0700 Subject: [PATCH] Deflake ReallocUseAfterFree test. If another thread reuses our slot before we intentionally trigger the UB we want to detect, we may find dealloc_count reset so we do not hit the UseAfterFree case above. We don't synchronize allocators with signal handlers, so mprotect-then-reset may still end up racing if the segfaulting thread is arbitrarily delayed. PiperOrigin-RevId: 944768039 --- tcmalloc/guarded_page_allocator.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tcmalloc/guarded_page_allocator.cc b/tcmalloc/guarded_page_allocator.cc index 123c476d2..88645ecc1 100644 --- a/tcmalloc/guarded_page_allocator.cc +++ b/tcmalloc/guarded_page_allocator.cc @@ -520,7 +520,11 @@ GuardedAllocationsErrorType GuardedPageAllocator::GetErrorType( if (addr >= d.allocation_start + d.requested_size) { return GuardedAllocationsErrorType::kBufferOverflow; } - return GuardedAllocationsErrorType::kUnknown; + // If addr is within [d.allocation_start, d.allocation_start + + // d.requested_size) on a faulted Object Page where dealloc_count == 0, + // metadata was reset by concurrent slot recycling. It is guaranteed to be a + // Use-After-Free. + return GuardedAllocationsErrorType::kUseAfterFree; } uintptr_t GuardedPageAllocator::SlotToAddr(size_t slot) const {