grow_to function assumes final free range is at the end of the overall range

[johnnyrockett]

I ran into crashes when freeing ranges and tracked it down to a bug in the grow_to function.

pub fn grow_to(&mut self, new_end: T) {
    if let Some(last_range) = self.free_ranges.last_mut() {
        last_range.end = new_end;
    } else {
        self.free_ranges.push(self.initial_range.end..new_end);
    }

    self.initial_range.end = new_end;
}

If there is still a free range of memory, this code assumes that it is at the end of the overall range and edits its end to be the new grown end. However, if the last span of freed memory isn't at the very end of the overall range, this will effectively free all the allocated memory in between the last freed span of memory and the end of the overall range.

Something like this change would fix the bug:

pub fn grow_to(&mut self, new_end: T) {
    if let Some(last_range) = self.free_ranges.last_mut() {
        if last_range.end == self.initial_range.end {
            last_range.end = new_end;
        } else {
            self.free_ranges.push(self.initial_range.end..new_end);
        }
    } else {
        self.free_ranges.push(self.initial_range.end..new_end);
    }

    self.initial_range.end = new_end;
}

[cwfitzgerald]

I might actually be hitting this too - would you be willing to submit a PR, possibly with a test to make sure this doesn't come back?

[dbartussek]

I just ran into the exact same issue, could have saved some time by looking here first

I've created a pull request with essentially the fix proposed by @johnnyrockett (just replacing the second if with same body by using Option::filter) and two test cases for a hole at the beginning and a hole in the middle of allocations: #2

[John-Nagle]

Ah. Could this be the cause of

BVE-Reborn/rend3#546

[John-Nagle]

I've built Rend3 and my Sharpview metaverse viewer using this fix. Overrode range-alloc in crates.io with trunk from github. So far, this seems to have fixed BVE-Reborn/rend3#546 I've been running a test for eight hours now without a failure.

[John-Nagle]

This looks good. Please bump version number and push to crates.io. Thanks.