struct malloc_state
{
 /* Serialize access. */
 __libc_lock_define (, mutex);//定義了一个0x4byte的lock

 /* Flags (formerly in max_fast). */
 int flags;//0x4

 /* Set if the fastbin chunks contain recently inserted free blocks. */
 /* Note this is a bool but not all targets support atomics on booleans. */
 int have_fastchunks;//0x4

 /* Fastbins */
 mfastbinptr fastbinsY[NFASTBINS]; //fastbin链的head,總共10个, 每个0x10字节

 /* Base of the topmost chunk -- not otherwise kept in a bin */
 mchunkptr top;//0x4 到此为止总共0x96字节

 /* The remainder from the most recent split of a small request */
 mchunkptr last_remainder;        //切割后剩下的chunk链接到last_remainder

 /* Normal bins packed as described above */
 mchunkptr bins[NBINS * 2 - 2];   // 每个bin头有fd和bk两个指针

 /* Bitmap of bins */
 unsigned int binmap[BINMAPSIZE];   //位图,用32bit来分别表示当前bin哪个链上有chunk，通过按位与的方式

 /* Linked list */
 struct malloc_state *next;

 /* Linked list for free arenas. Access to this field is serialized
    by free_list_lock in arena.c. */
 struct malloc_state *next_free;

 /* Number of threads attached to this arena. 0 if the arena is on
    the free list. Access to this field is serialized by
    free_list_lock in arena.c. */
 INTERNAL_SIZE_T attached_threads;

 /* Memory allocated from the system in this arena. */
 INTERNAL_SIZE_T system_mem;
 INTERNAL_SIZE_T max_system_mem;
}

#define INTERNAL_SIZE_T size_t

struct malloc_chunk
{

INTERNAL_SIZE_T prev_size; /* Size of previous chunk (if free).  */
INTERNAL_SIZE_T size;	   /* Size in bytes, including overhead. */

struct malloc_chunk *fd; /* double links -- used only if free. */
struct malloc_chunk *bk;

/* Only used for large blocks: pointer to next larger size.  */
struct malloc_chunk *fd_nextsize; /* double links -- used only if free. */
struct malloc_chunk *bk_nextsize;
};

#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>

void* thread_func(void* arg) {
    // 分配 0x30 (48 bytes) 大小的記憶體
    void* chunk = malloc(0x30);
    if (chunk == NULL) {
        printf("Memory allocation failed.\n");
        return NULL;
    }
    
    // 顯示記憶體地址
    printf("Memory allocated at: %p\n", chunk);
    
    free(chunk);
    return NULL;
}

int main() {
    pthread_t thread;

    // 創建新線程
    if (pthread_create(&thread, NULL, thread_func, NULL) != 0) {
        printf("Error creating thread.\n");
        return 1;
    }

    // 等待線程完成
    pthread_join(thread, NULL);

    return 0;
}

struct malloc_state
{
  /* Serialize access.  */
  __libc_lock_define (, mutex);

  /* Flags (formerly in max_fast).  */
  int flags;

  /* Set if the fastbin chunks contain recently inserted free blocks.  */
  /* Note this is a bool but not all targets support atomics on booleans.  */
  int have_fastchunks;

  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];

  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;

  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;

  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];

  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];

  /* Linked list */
  struct malloc_state *next;

  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;

  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;

  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

#include <stdio.h>
#include <stdlib.h>

int main() {
    char *ptr1 = malloc(0x420);
    malloc(0x20);
    char *ptr2 = malloc(0x420);
    malloc(0x20);
    char *ptr3 = malloc(0x420);
    malloc(0x20);

    free(ptr1);
    free(ptr2);
    free(ptr3);

    return 0;
}

struct malloc_chunk {

  INTERNAL_SIZE_T      mchunk_prev_size;  /* Size of previous chunk (if free).  */
  INTERNAL_SIZE_T      mchunk_size;       /* Size in bytes, including overhead. */

  struct malloc_chunk* fd;         /* double links -- used only if free. */
  struct malloc_chunk* bk;

  /* Only used for large blocks: pointer to next larger size.  */
  struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  struct malloc_chunk* bk_nextsize;
};

typedef struct tcache_entry
{
  struct tcache_entry *next;
  /* This field exists to detect double frees.  */
  struct tcache_perthread_struct *key;
} tcache_entry; 

typedef struct tcache_perthread_struct
{
  uint16_t counts[TCACHE_MAX_BINS];
  tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;

static struct malloc_par mp_ =
{
  .top_pad = DEFAULT_TOP_PAD,
  .n_mmaps_max = DEFAULT_MMAP_MAX,
  .mmap_threshold = DEFAULT_MMAP_THRESHOLD,
  .trim_threshold = DEFAULT_TRIM_THRESHOLD,
#define NARENAS_FROM_NCORES(n) ((n) * (sizeof (long) == 4 ? 2 : 8))
  .arena_test = NARENAS_FROM_NCORES (1)
#if USE_TCACHE
  ,
  .tcache_count = TCACHE_FILL_COUNT,
  .tcache_bins = TCACHE_MAX_BINS,
  .tcache_max_bytes = tidx2usize (TCACHE_MAX_BINS-1),
  .tcache_unsorted_limit = 0 /* No limit.  */
#endif
};

define TCACHE_MAX_BINS		64

/* Caller must ensure that we know tc_idx is valid and there's
   available chunks to remove.  */
static __always_inline void *
tcache_get (size_t tc_idx)
{
  tcache_entry *e = tcache->entries[tc_idx];  //拿到第一塊tcache
  tcache->entries[tc_idx] = e->next; //tcache entry指next
  --(tcache->counts[tc_idx]); // 計數器減1
  e->key = NULL; // key設為NULL
  return (void *) e; //get chunk
}

void
__libc_free (void *mem)
{
  mstate ar_ptr;
  mchunkptr p;                          /* chunk corresponding to mem */

  // 如果 __free_hook 有定義的話，就會以 __free_hook 為 function pointer 去呼叫
  void (*hook) (void *, const void *)
    = atomic_forced_read (__free_hook);
  if (__builtin_expect (hook != NULL, 0))
    {
      (*hook)(mem, RETURN_ADDRESS (0));
      return;
    }
  // free NULL 會直接回傳
  if (mem == 0)
    return;
  // chunk2mem(): input 為 chunk 的起頭，output 為使用者拿到的 chunk
  // mem2chunk(): input 為使用者拿到的 chunk，output 為 chunk 的起頭
  p = mem2chunk (mem);

  // ! 如果 chunk 是透過 mmap() 產生的，則會使用 unmap 來釋放
  if (chunk_is_mmapped (p))
    {
      ...
      munmap_chunk (p);
      return;
    }
  // 通常在 malloc 時會已經初始化完 tcache
  MAYBE_INIT_TCACHE ();
  // 檢查 chunk 的 NON_MAIN_ARENA bit，如果是 unset，則回傳 main_arena
  // 否則回傳 chunk 所屬的 heap 其對應到的 arena
  ar_ptr = arena_for_chunk (p);
  // ! _int_free 用來處理釋放記憶體的操作
  _int_free (ar_ptr, p, 0);
}

#if USE_TCACHE 
  {
    size_t tc_idx = csize2tidx (size);

    if (tcache
	&& tc_idx < mp_.tcache_bins
	&& tcache->counts[tc_idx] < mp_.tcache_count)
      {
	tcache_put (p, tc_idx);
	return;
      }
  }
#endif

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
  INTERNAL_SIZE_T size;        /* 它的大小 */
  mfastbinptr *fb;             /* 相關的 fastbin */
  mchunkptr nextchunk;         /* 下一個連續的區塊 */
  INTERNAL_SIZE_T nextsize;    /* 下一個區塊的大小 */
  int nextinuse;               /* 下一個區塊是否被使用 */
  INTERNAL_SIZE_T prevsize;    /* 前一個連續區塊的大小 */
  mchunkptr bck;               /* 用於鏈接的臨時變數 */
  mchunkptr fwd;               /* 用於鏈接的臨時變數 */

  size = chunksize (p);

  /* 一個不會影響性能的小安全檢查：分配器永遠不會在地址空間的末尾環繞。
     因此，我們可以排除一些可能會意外出現的大小值，或者是某些入侵者「設計」出來的。 */
  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
      || __builtin_expect (misaligned_chunk (p), 0))
    malloc_printerr ("free(): invalid pointer");
  /* 我們知道每個區塊的大小至少為 MINSIZE 位元組，或是 MALLOC_ALIGNMENT 的倍數。 */
  if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
    malloc_printerr ("free(): invalid size");

  check_inuse_chunk(av, p);

#if USE_TCACHE  // 關注這塊
  {
    size_t tc_idx = csize2tidx (size);
    if (tcache != NULL && tc_idx < mp_.tcache_bins)
      {
	/* 檢查它是否已經在 tcache 中。 */
	tcache_entry *e = (tcache_entry *) chunk2mem (p);

	/* 這個測試在發生 double free 時會成功。然而，我們並不是 100% 
	   信任它（它也有可能以 1/2^<size_t> 的機率匹配隨機的有效載荷數據），
	   所以在中止之前，先驗證這是不是一個不可能的巧合。 */
	if (__glibc_unlikely (e->key == tcache))
	  {
	    tcache_entry *tmp;
	    LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
	    for (tmp = tcache->entries[tc_idx];
		 tmp;
		 tmp = tmp->next)
	      if (tmp == e)
		malloc_printerr ("free(): double free detected in tcache 2");
	    /* 如果我們到了這裡，那麼這就是一個巧合。我們浪費了一些計算週期，
	       但不會中止。 */
	  }

	if (tcache->counts[tc_idx] < mp_.tcache_count)
	  {
	    tcache_put (p, tc_idx);
	    return;
	  }
      }
  }
#endif

static __always_inline void
tcache_put (mchunkptr chunk, size_t tc_idx)
{
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
  assert (tc_idx < TCACHE_MAX_BINS);
  e->next = tcache->entries[tc_idx];
  tcache->entries[tc_idx] = e;
  ++(tcache->counts[tc_idx]);
}

static __always_inline void
tcache_put (mchunkptr chunk, size_t tc_idx)
{
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);

  /* Mark this chunk as "in the tcache" so the test in _int_free will
     detect a double free.  */
  e->key = tcache;

  e->next = tcache->entries[tc_idx];
  tcache->entries[tc_idx] = e;
  ++(tcache->counts[tc_idx]);
}

#include <stdio.h>
#include <stdlib.h>

int main()
{
        char *ptr1=malloc(0x30);
        char *ptr2=malloc(0x30);
        char *ptr3=malloc(0x30);
        
        memset(ptr1,'A',0x20);
    
        free(ptr1);
        free(ptr2);
        free(ptr3);
        
        return 0;
}