From dc19b5ace2414bc45fe23dd3a5c83180fadf4bce Mon Sep 17 00:00:00 2001
From: Matthew Parkinson <mattpark@microsoft.com>
Date: Fri, 18 Jan 2019 21:07:29 +0000
Subject: [PATCH] Test to check external pointer on deallocated objects

This fails an assertion as it reads from a "head" and assumes it is a
sizeclass. This leads to accessing memory out of bounds.
---
 src/test/func/memory/memory.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/test/func/memory/memory.cc b/src/test/func/memory/memory.cc
index 69b8326..5ae4759 100644
--- a/src/test/func/memory/memory.cc
+++ b/src/test/func/memory/memory.cc
@@ -242,6 +242,30 @@ void test_external_pointer_large()
   }
 }
 
+void test_external_pointer_dealloc_bug()
+{
+  auto* alloc = ThreadAlloc::get();
+  constexpr size_t count = (SUPERSLAB_SIZE / SLAB_SIZE) * 2;
+  void* allocs[count];
+
+  for (size_t i = 0; i < count; i++)
+  {
+    allocs[i] = alloc->alloc(SLAB_SIZE / 2);
+  }
+
+  for (size_t i = 1; i < count; i++)
+  {
+    alloc->dealloc(allocs[i]);
+  }
+
+  for (size_t i = 0; i < count; i++)
+  {
+    Alloc::external_pointer(allocs[i]);
+  }
+
+  alloc->dealloc(allocs[0]);
+}
+
 void test_alloc_16M()
 {
   auto* alloc = ThreadAlloc::get();
@@ -264,6 +288,7 @@ int main(int argc, char** argv)
   UNUSED(argv);
 #endif
 
+  test_external_pointer_dealloc_bug();
   test_external_pointer_large();
   test_alloc_dealloc_64k();
   test_random_allocation();