/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "primpl.h"

/*
** We override malloc etc. on any platform which has preemption +
** nspr20 user level threads.  When we're debugging, we can make our
** version of malloc fail occasionally.
*/
#ifdef _PR_OVERRIDE_MALLOC

/*
** Thread safe version of malloc, calloc, realloc, free
*/
#include <stdarg.h>

#ifdef DEBUG
#define SANITY
#define EXTRA_SANITY
#else
#undef SANITY
#undef EXTRA_SANITY
#endif

/* Forward decls */
void *_PR_UnlockedMalloc(size_t size);
void _PR_UnlockedFree(void *ptr);
void *_PR_UnlockedRealloc(void *ptr, size_t size);
void *_PR_UnlockedCalloc(size_t n, size_t elsize);

/************************************************************************/

/*
 * ----------------------------------------------------------------------------
 * "THE BEER-WARE LICENSE" (Revision 42):
 * <phk@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
 * can do whatever you want with this stuff. If we meet some day, and you think
 * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
 * ----------------------------------------------------------------------------
 *
 */

/*
 * Defining SANITY will enable some checks which will tell you if the users
 * program did botch something
 */

/*
 * Defining EXTRA_SANITY will enable some checks which are mostly related
 * to internal conditions in malloc.c
 */

/*
 * Very verbose progress on stdout...
 */
#if 0
#  define TRACE(foo)    printf  foo
static int malloc_event;
#else
#  define TRACE(foo)
#endif

/* XXX Pick a number, any number */
#   define malloc_pagesize      4096UL
#   define malloc_pageshift     12UL

#ifdef XP_UNIX
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/mman.h>
#endif

/*
 * This structure describes a page's worth of chunks.
 */

struct pginfo {
    struct pginfo   *next;  /* next on the free list */
    char        *page;  /* Pointer to the page */
    u_short     size;   /* size of this page's chunks */
    u_short     shift;  /* How far to shift for this size chunks */
    u_short     free;   /* How many free chunks */
    u_short     total;  /* How many chunk */
    u_long      bits[1]; /* Which chunks are free */
};

struct pgfree {
    struct pgfree   *next;  /* next run of free pages */
    struct pgfree   *prev;  /* prev run of free pages */
    char        *page;  /* pointer to free pages */
    char        *end;   /* pointer to end of free pages */
    u_long      size;   /* number of bytes free */
};

/*
 * How many bits per u_long in the bitmap.
 * Change only if not 8 bits/byte
 */
#define MALLOC_BITS (8*sizeof(u_long))

/*
 * Magic values to put in the page_directory
 */
#define MALLOC_NOT_MINE ((struct pginfo*) 0)
#define MALLOC_FREE     ((struct pginfo*) 1)
#define MALLOC_FIRST    ((struct pginfo*) 2)
#define MALLOC_FOLLOW   ((struct pginfo*) 3)
#define MALLOC_MAGIC    ((struct pginfo*) 4)

/*
 * Set to one when malloc_init has been called
 */
static  unsigned    initialized;

/*
 * The size of a page.
 * Must be a integral multiplum of the granularity of mmap(2).
 * Your toes will curl if it isn't a power of two
 */
#define malloc_pagemask ((malloc_pagesize)-1)

/*
 * The size of the largest chunk.
 * Half a page.
 */
#define malloc_maxsize  ((malloc_pagesize)>>1)

/*
 * malloc_pagesize == 1 << malloc_pageshift
 */
#ifndef malloc_pageshift
static  unsigned    malloc_pageshift;
#endif /* malloc_pageshift */

/*
 * The smallest allocation we bother about.
 * Must be power of two
 */
#ifndef malloc_minsize
static  unsigned  malloc_minsize;
#endif /* malloc_minsize */

/*
 * The largest chunk we care about.
 * Must be smaller than pagesize
 * Must be power of two
 */
#ifndef malloc_maxsize
static  unsigned  malloc_maxsize;
#endif /* malloc_maxsize */

#ifndef malloc_cache
static  unsigned  malloc_cache;
#endif /* malloc_cache */

/*
 * The offset from pagenumber to index into the page directory
 */
static  u_long  malloc_origo;

/*
 * The last index in the page directory we care about
 */
static  u_long  last_index;

/*
 * Pointer to page directory.
 * Allocated "as if with" malloc
 */
static  struct  pginfo **page_dir;

/*
 * How many slots in the page directory
 */
static  unsigned    malloc_ninfo;

/*
 * Free pages line up here
 */
static struct pgfree    free_list;

/*
 * Abort() if we fail to get VM ?
 */
static int malloc_abort;

#ifdef SANITY
/*
 * Are we trying to die ?
 */
static int suicide;
#endif

/*
 * dump statistics
 */
static int malloc_stats;

/*
 * always realloc ?
 */
static int malloc_realloc;

/*
 * my last break.
 */
static void *malloc_brk;

/*
 * one location cache for free-list holders
 */
static struct pgfree *px;

static int set_pgdir(void *ptr, struct  pginfo *info);
static int extend_page_directory(u_long index);

#ifdef SANITY
void
malloc_dump(FILE *fd)
{
    struct pginfo **pd;
    struct pgfree *pf;
    int j;

    pd = page_dir;

    /* print out all the pages */
    for(j=0; j<=last_index; j++) {
        fprintf(fd,"%08lx %5d ",(j+malloc_origo) << malloc_pageshift,j);
        if (pd[j] == MALLOC_NOT_MINE) {
            for(j++; j<=last_index && pd[j] == MALLOC_NOT_MINE; j++)
                ;
            j--;
            fprintf(fd,".. %5d not mine\n", j);
        } else if (pd[j] == MALLOC_FREE) {
            for(j++; j<=last_index && pd[j] == MALLOC_FREE; j++)
                ;
            j--;
            fprintf(fd,".. %5d free\n", j);
        } else if (pd[j] == MALLOC_FIRST) {
            for(j++; j<=last_index && pd[j] == MALLOC_FOLLOW; j++)
                ;
            j--;
            fprintf(fd,".. %5d in use\n", j);
        } else if (pd[j] < MALLOC_MAGIC) {
            fprintf(fd,"(%p)\n", pd[j]);
        } else {
            fprintf(fd,"%p %d (of %d) x %d @ %p --> %p\n",
                    pd[j],pd[j]->free, pd[j]->total,
                    pd[j]->size, pd[j]->page, pd[j]->next);
        }
    }

    for(pf=free_list.next; pf; pf=pf->next) {
        fprintf(fd,"Free: @%p [%p...%p[ %ld ->%p <-%p\n",
                pf,pf->page,pf->end,pf->size,pf->prev,pf->next);
        if (pf == pf->next) {
            fprintf(fd,"Free_list loops.\n");
            break;
        }
    }

    /* print out various info */
    fprintf(fd,"Minsize\t%d\n",malloc_minsize);
    fprintf(fd,"Maxsize\t%ld\n",malloc_maxsize);
    fprintf(fd,"Pagesize\t%ld\n",malloc_pagesize);
    fprintf(fd,"Pageshift\t%ld\n",malloc_pageshift);
    fprintf(fd,"FirstPage\t%ld\n",malloc_origo);
    fprintf(fd,"LastPage\t%ld %lx\n",last_index+malloc_pageshift,
            (last_index + malloc_pageshift) << malloc_pageshift);
    fprintf(fd,"Break\t%ld\n",(u_long)sbrk(0) >> malloc_pageshift);
}

static void wrterror(char *fmt, ...)
{
    char *q = "malloc() error: ";
    char buf[100];
    va_list ap;

    suicide = 1;

    va_start(ap, fmt);
    PR_vsnprintf(buf, sizeof(buf), fmt, ap);
    va_end(ap);
    fputs(q, stderr);
    fputs(buf, stderr);

    malloc_dump(stderr);
    PR_Abort();
}

static void wrtwarning(char *fmt, ...)
{
    char *q = "malloc() warning: ";
    char buf[100];
    va_list ap;

    va_start(ap, fmt);
    PR_vsnprintf(buf, sizeof(buf), fmt, ap);
    va_end(ap);
    fputs(q, stderr);
    fputs(buf, stderr);
}
#endif /* SANITY */


/*
 * Allocate a number of pages from the OS
 */
static caddr_t
map_pages(int pages, int update)
{
    caddr_t result,tail;

    result = ((caddr_t)sbrk(0)) + malloc_pagemask - 1;
    result = (caddr_t) ((u_long)result & ~malloc_pagemask);
    tail = result + (pages << malloc_pageshift);
    if (!brk(tail)) {
        last_index = ((u_long)tail >> malloc_pageshift) - malloc_origo -1;
        malloc_brk = tail;
        TRACE(("%6d S %p .. %p\n",malloc_event++, result, tail));
        if (!update || last_index < malloc_ninfo ||
            extend_page_directory(last_index)) {
            return result;
        }
    }
    TRACE(("%6d s %d %p %d\n",malloc_event++,pages,sbrk(0),errno));
#ifdef EXTRA_SANITY
    wrterror("map_pages fails\n");
#endif
    return 0;
}

#define set_bit(_pi,_bit) \
    (_pi)->bits[(_bit)/MALLOC_BITS] |= 1L<<((_bit)%MALLOC_BITS)

#define clr_bit(_pi,_bit) \
    (_pi)->bits[(_bit)/MALLOC_BITS] &= ~(1L<<((_bit)%MALLOC_BITS));

#define tst_bit(_pi,_bit) \
    ((_pi)->bits[(_bit)/MALLOC_BITS] & (1L<<((_bit)%MALLOC_BITS)))

/*
 * Extend page directory
 */
static int
extend_page_directory(u_long index)
{
    struct  pginfo **young, **old;
    int i;

    TRACE(("%6d E %lu\n",malloc_event++,index));

    /* Make it this many pages */
    i = index * sizeof *page_dir;
    i /= malloc_pagesize;
    i += 2;

    /* Get new pages, if you used this much mem you don't care :-) */
    young = (struct pginfo**) map_pages(i,0);
    if (!young) {
        return 0;
    }

    /* Copy the old stuff */
    memset(young, 0, i * malloc_pagesize);
    memcpy(young, page_dir,
           malloc_ninfo * sizeof *page_dir);

    /* register the new size */
    malloc_ninfo = i * malloc_pagesize / sizeof *page_dir;

    /* swap the pointers */
    old = page_dir;
    page_dir = young;

    /* Mark the pages */
    index = ((u_long)young >> malloc_pageshift) - malloc_origo;
    page_dir[index] = MALLOC_FIRST;
    while (--i) {
        page_dir[++index] = MALLOC_FOLLOW;
    }

    /* Now free the old stuff */
    _PR_UnlockedFree(old);
    return 1;
}

/*
 * Set entry in page directory.
 * Extend page directory if need be.
 */
static int
set_pgdir(void *ptr, struct  pginfo *info)
{
    u_long index = ((u_long)ptr >> malloc_pageshift) - malloc_origo;

    if (index >= malloc_ninfo && !extend_page_directory(index)) {
        return 0;
    }
    page_dir[index] = info;
    return 1;
}

/*
 * Initialize the world
 */
static void
malloc_init (void)
{
    int i;
    char *p;

    TRACE(("%6d I\n",malloc_event++));
#ifdef DEBUG
    for (p=getenv("MALLOC_OPTIONS"); p && *p; p++) {
        switch (*p) {
            case 'a': malloc_abort = 0; break;
            case 'A': malloc_abort = 1; break;
            case 'd': malloc_stats = 0; break;
            case 'D': malloc_stats = 1; break;
            case 'r': malloc_realloc = 0; break;
            case 'R': malloc_realloc = 1; break;
            default:
                wrtwarning("Unknown chars in MALLOC_OPTIONS\n");
                break;
        }
    }
#endif

#ifndef malloc_pagesize
    /* determine our pagesize */
    malloc_pagesize = getpagesize();
#endif /* malloc_pagesize */

#ifndef malloc_pageshift
    /* determine how much we shift by to get there */
    for (i = malloc_pagesize; i > 1; i >>= 1) {
        malloc_pageshift++;
    }
#endif /* malloc_pageshift */

#ifndef malloc_cache
    malloc_cache = 50 << malloc_pageshift;
#endif /* malloc_cache */

#ifndef malloc_minsize
    /*
     * find the smallest size allocation we will bother about.
     * this is determined as the smallest allocation that can hold
     * it's own pginfo;
     */
    i = 2;
    for(;;) {
        int j;

        /* Figure out the size of the bits */
        j = malloc_pagesize/i;
        j /= 8;
        if (j < sizeof(u_long)) {
            j = sizeof (u_long);
        }
        if (sizeof(struct pginfo) + j - sizeof (u_long) <= i) {
            break;
        }
        i += i;
    }
    malloc_minsize = i;
#endif /* malloc_minsize */


    /* Allocate one page for the page directory */
    page_dir = (struct pginfo **) map_pages(1,0);
#ifdef SANITY
    if (!page_dir) {
        wrterror("fatal: my first mmap failed.  (check limits ?)\n");
    }
#endif

    /*
     * We need a maximum of malloc_pageshift buckets, steal these from the
     * front of the page_directory;
     */
    malloc_origo = (u_long) page_dir >> malloc_pageshift;
    malloc_origo -= malloc_pageshift;

    /* Clear it */
    memset(page_dir,0,malloc_pagesize);

    /* Find out how much it tells us */
    malloc_ninfo = malloc_pagesize / sizeof *page_dir;

    /* Plug the page directory into itself */
    i = set_pgdir(page_dir,MALLOC_FIRST);
#ifdef SANITY
    if (!i) {
        wrterror("fatal: couldn't set myself in the page directory\n");
    }
#endif

    /* Been here, done that */
    initialized++;
}

/*
 * Allocate a number of complete pages
 */
static void *malloc_pages(size_t size)
{
    void *p,*delay_free = 0;
    int i;
    struct pgfree *pf;
    u_long index;

    /* How many pages ? */
    size += (malloc_pagesize-1);
    size &= ~malloc_pagemask;

    p = 0;
    /* Look for free pages before asking for more */
    for(pf = free_list.next; pf; pf = pf->next) {
#ifdef EXTRA_SANITY
        if (pf->page == pf->end) {
            wrterror("zero entry on free_list\n");
        }
        if (pf->page > pf->end) {
            TRACE(("%6d !s %p %p %p <%d>\n",malloc_event++,
                   pf,pf->page,pf->end,__LINE__));
            wrterror("sick entry on free_list\n");
        }
        if ((void*)pf->page >= (void*)sbrk(0)) {
            wrterror("entry on free_list past brk\n");
        }
        if (page_dir[((u_long)pf->page >> malloc_pageshift) - malloc_origo]
            != MALLOC_FREE) {
            TRACE(("%6d !f %p %p %p <%d>\n",malloc_event++,
                   pf,pf->page,pf->end,__LINE__));
            wrterror("non-free first page on free-list\n");
        }
        if (page_dir[((u_long)pf->end >> malloc_pageshift) - 1 - malloc_origo]
            != MALLOC_FREE) {
            wrterror("non-free last page on free-list\n");
        }
#endif /* EXTRA_SANITY */
        if (pf->size < size) {
            continue;
        }
        else if (pf->size == size) {
            p = pf->page;
            if (pf->next) {
                pf->next->prev = pf->prev;
            }
            pf->prev->next = pf->next;
            delay_free = pf;
            break;
        } else {
            p = pf->page;
            pf->page += size;
            pf->size -= size;
            break;
        }
    }
#ifdef EXTRA_SANITY
    if (p && page_dir[((u_long)p >> malloc_pageshift) - malloc_origo]
        != MALLOC_FREE) {
        wrterror("allocated non-free page on free-list\n");
    }
#endif /* EXTRA_SANITY */

    size >>= malloc_pageshift;

    /* Map new pages */
    if (!p) {
        p = map_pages(size,1);
    }

    if (p) {
        /* Mark the pages in the directory */
        index = ((u_long)p >> malloc_pageshift) - malloc_origo;
        page_dir[index] = MALLOC_FIRST;
        for (i=1; i<size; i++) {
            page_dir[index+i] = MALLOC_FOLLOW;
        }
    }
    if (delay_free) {
        if (!px) {
            px = (struct pgfree*)delay_free;
        }
        else {
            _PR_UnlockedFree(delay_free);
        }
    }
    return p;
}

/*
 * Allocate a page of fragments
 */

static int
malloc_make_chunks(int bits)
{
    struct  pginfo *bp;
    void *pp;
    int i,k,l;

    /* Allocate a new bucket */
    pp = malloc_pages(malloc_pagesize);
    if (!pp) {
        return 0;
    }
    l = sizeof *bp - sizeof(u_long);
    l += sizeof(u_long) *
         (((malloc_pagesize >> bits)+MALLOC_BITS-1) / MALLOC_BITS);
    if ((1<<(bits)) <= l+l) {
        bp = (struct  pginfo *)pp;
    } else {
        bp = (struct  pginfo *)_PR_UnlockedMalloc(l);
    }
    if (!bp) {
        return 0;
    }
    bp->size = (1<<bits);
    bp->shift = bits;
    bp->total = bp->free = malloc_pagesize >> bits;
    bp->next = page_dir[bits];
    bp->page = (char*)pp;
    i = set_pgdir(pp,bp);
    if (!i) {
        return 0;
    }

    /* We can safely assume that there is nobody in this chain */
    page_dir[bits] = bp;

    /* set all valid bits in the bits */
    k = bp->total;
    i = 0;
    /*
        for(;k-i >= MALLOC_BITS; i += MALLOC_BITS)
        bp->bits[i / MALLOC_BITS] = ~0;
    */
    for(; i < k; i++) {
        set_bit(bp,i);
    }

    if (bp != pp) {
        return 1;
    }

    /* We may have used the first ones already */
    for(i=0; l > 0; i++) {
        clr_bit(bp,i);
        bp->free--;
        bp->total--;
        l -= (1 << bits);
    }
    return 1;
}

/*
 * Allocate a fragment
 */
static void *malloc_bytes(size_t size)
{
    size_t s;
    int j;
    struct  pginfo *bp;
    int k;
    u_long *lp, bf;

    /* Don't bother with anything less than this */
    if (size < malloc_minsize) {
        size = malloc_minsize;
    }

    /* Find the right bucket */
    j = 1;
    s = size - 1;
    while (s >>= 1) {
        j++;
    }

    /* If it's empty, make a page more of that size chunks */
    if (!page_dir[j] && !malloc_make_chunks(j)) {
        return 0;
    }

    /* Find first word of bitmap which isn't empty */
    bp = page_dir[j];
    for (lp = bp->bits; !*lp; lp++)
        ;

    /* Find that bit */
    bf = *lp;
    k = 0;
    while ((bf & 1) == 0) {
        bf >>= 1;
        k++;
    }

    *lp ^= 1L<<k;                       /* clear it */
    bp->free--;
    if (!bp->free) {
        page_dir[j] = bp->next;
        bp->next = 0;
    }
    k += (lp - bp->bits)*MALLOC_BITS;
    return bp->page + (k << bp->shift);
}

void *_PR_UnlockedMalloc(size_t size)
{
    void *result;

    /* Round up to a multiple of 8 bytes */
    if (size & 7) {
        size = size + 8 - (size & 7);
    }

    if (!initialized) {
        malloc_init();
    }

#ifdef SANITY
    if (suicide) {
        PR_Abort();
    }
#endif

    if (size <= malloc_maxsize) {
        result =  malloc_bytes(size);
    }
    else {
        result =  malloc_pages(size);
    }
#ifdef SANITY
    if (malloc_abort && !result) {
        wrterror("malloc() returns NULL\n");
    }
#endif
    TRACE(("%6d M %p %d\n",malloc_event++,result,size));

    return result;
}

void *_PR_UnlockedMemalign(size_t alignment, size_t size)
{
    void *result;

    /*
     * alignment has to be a power of 2
     */

    if ((size <= alignment) && (alignment <= malloc_maxsize)) {
        size = alignment;
    }
    else {
        size += alignment - 1;
    }

    /* Round up to a multiple of 8 bytes */
    if (size & 7) {
        size = size + 8 - (size & 7);
    }

    if (!initialized) {
        malloc_init();
    }

#ifdef SANITY
    if (suicide) {
        abort();
    }
#endif

    if (size <= malloc_maxsize) {
        result =  malloc_bytes(size);
    }
    else {
        result =  malloc_pages(size);
    }
#ifdef SANITY
    if (malloc_abort && !result) {
        wrterror("malloc() returns NULL\n");
    }
#endif
    TRACE(("%6d A %p %d\n",malloc_event++,result,size));

    if ((u_long)result & (alignment - 1)) {
        return ((void *)(((u_long)result + alignment)  & ~(alignment - 1)));
    }
    else {
        return result;
    }
}

void *_PR_UnlockedCalloc(size_t n, size_t nelem)
{
    void *p;

    /* Compute total size and then round up to a double word amount */
    n *= nelem;
    if (n & 7) {
        n = n + 8 - (n & 7);
    }

    /* Get the memory */
    p = _PR_UnlockedMalloc(n);
    if (p) {
        /* Zero it */
        memset(p, 0, n);
    }
    return p;
}

/*
 * Change an allocation's size
 */
void *_PR_UnlockedRealloc(void *ptr, size_t size)
{
    void *p;
    u_long osize,page,index,tmp_index;
    struct pginfo **mp;

    if (!initialized) {
        malloc_init();
    }

#ifdef SANITY
    if (suicide) {
        PR_Abort();
    }
#endif

    /* used as free() */
    TRACE(("%6d R %p %d\n",malloc_event++, ptr, size));
    if (ptr && !size) {
        _PR_UnlockedFree(ptr);
        return _PR_UnlockedMalloc (1);
    }

    /* used as malloc() */
    if (!ptr) {
        p = _PR_UnlockedMalloc(size);
        return p;
    }

    /* Find the page directory entry for the page in question */
    page = (u_long)ptr >> malloc_pageshift;
    index = page - malloc_origo;

    /*
     * check if memory was allocated by memalign
     */
    tmp_index = index;
    while (page_dir[tmp_index] == MALLOC_FOLLOW) {
        tmp_index--;
    }
    if (tmp_index != index) {
        /*
         * memalign-allocated memory
         */
        index = tmp_index;
        page = index + malloc_origo;
        ptr = (void *) (page << malloc_pageshift);
    }
    TRACE(("%6d R2 %p %d\n",malloc_event++, ptr, size));

    /* make sure it makes sense in some fashion */
    if (index < malloc_pageshift || index > last_index) {
#ifdef SANITY
        wrtwarning("junk pointer passed to realloc()\n");
#endif
        return 0;
    }

    /* find the size of that allocation, and see if we need to relocate */
    mp = &page_dir[index];
    if (*mp == MALLOC_FIRST) {
        osize = malloc_pagesize;
        while (mp[1] == MALLOC_FOLLOW) {
            osize += malloc_pagesize;
            mp++;
        }
        if (!malloc_realloc &&
            size < osize &&
            size > malloc_maxsize &&
            size > (osize - malloc_pagesize)) {
            return ptr;
        }
    } else if (*mp >= MALLOC_MAGIC) {
        osize = (*mp)->size;
        if (!malloc_realloc &&
            size < osize &&
            (size > (*mp)->size/2 || (*mp)->size == malloc_minsize)) {
            return ptr;
        }
    } else {
#ifdef SANITY
        wrterror("realloc() of wrong page.\n");
#endif
    }

    /* try to reallocate */
    p = _PR_UnlockedMalloc(size);

    if (p) {
        /* copy the lesser of the two sizes */
        if (osize < size) {
            memcpy(p,ptr,osize);
        }
        else {
            memcpy(p,ptr,size);
        }
        _PR_UnlockedFree(ptr);
    }
#ifdef DEBUG
    else if (malloc_abort) {
        wrterror("realloc() returns NULL\n");
    }
#endif

    return p;
}

/*
 * Free a sequence of pages
 */

static void
free_pages(char *ptr, u_long page, int index, struct pginfo *info)
{
    int i;
    struct pgfree *pf,*pt;
    u_long l;
    char *tail;

    TRACE(("%6d FP %p %d\n",malloc_event++, ptr, page));
    /* Is it free already ? */
    if (info == MALLOC_FREE) {
#ifdef SANITY
        wrtwarning("freeing free page at %p.\n", ptr);
#endif
        return;
    }

#ifdef SANITY
    /* Is it not the right place to begin ? */
    if (info != MALLOC_FIRST) {
        wrterror("freeing wrong page.\n");
    }

    /* Is this really a pointer to a page ? */
    if ((u_long)ptr & malloc_pagemask) {
        wrterror("freeing messed up page pointer.\n");
    }
#endif

    /* Count how many pages it is anyway */
    page_dir[index] = MALLOC_FREE;
    for (i = 1; page_dir[index+i] == MALLOC_FOLLOW; i++) {
        page_dir[index + i] = MALLOC_FREE;
    }

    l = i << malloc_pageshift;

    tail = ptr+l;

    /* add to free-list */
    if (!px) {
        px = (struct pgfree*)_PR_UnlockedMalloc(sizeof *pt);
    }
    /* XXX check success */
    px->page = ptr;
    px->end =  tail;
    px->size = l;
    if (!free_list.next) {
        px->next = free_list.next;
        px->prev = &free_list;
        free_list.next = px;
        pf = px;
        px = 0;
    } else {
        tail = ptr+l;
        for(pf = free_list.next; pf->next && pf->end < ptr; pf = pf->next)
            ;
        for(; pf; pf = pf->next) {
            if (pf->end == ptr ) {
                /* append to entry */
                pf->end += l;
                pf->size += l;
                if (pf->next && pf->end == pf->next->page ) {
                    pt = pf->next;
                    pf->end = pt->end;
                    pf->size += pt->size;
                    pf->next = pt->next;
                    if (pf->next) {
                        pf->next->prev = pf;
                    }
                    _PR_UnlockedFree(pt);
                }
            } else if (pf->page == tail) {
                /* prepend to entry */
                pf->size += l;
                pf->page = ptr;
            } else if (pf->page > ptr) {
                px->next = pf;
                px->prev = pf->prev;
                pf->prev = px;
                px->prev->next = px;
                pf = px;
                px = 0;
            } else if (!pf->next) {
                px->next = 0;
                px->prev = pf;
                pf->next = px;
                pf = px;
                px = 0;
            } else {
                continue;
            }
            break;
        }
    }
    if (!pf->next &&
        pf->size > malloc_cache &&
        pf->end == malloc_brk &&
        malloc_brk == (void*)sbrk(0)) {
        pf->end = pf->page + malloc_cache;
        pf->size = malloc_cache;
        TRACE(("%6d U %p %d\n",malloc_event++,pf->end,pf->end - pf->page));
        brk(pf->end);
        malloc_brk = pf->end;
        /* Find the page directory entry for the page in question */
        page = (u_long)pf->end >> malloc_pageshift;
        index = page - malloc_origo;
        /* Now update the directory */
        for(i=index; i <= last_index;) {
            page_dir[i++] = MALLOC_NOT_MINE;
        }
        last_index = index - 1;
    }
}

/*
 * Free a chunk, and possibly the page it's on, if the page becomes empty.
 */

static void
free_bytes(void *ptr, u_long page, int index, struct pginfo *info)
{
    int i;
    struct pginfo **mp;
    void *vp;

    /* Make sure that pointer is multiplum of chunk-size */
#ifdef SANITY
    if ((u_long)ptr & (info->size - 1)) {
        wrterror("freeing messed up chunk pointer\n");
    }
#endif

    /* Find the chunk number on the page */
    i = ((u_long)ptr & malloc_pagemask) >> info->shift;

    /* See if it's free already */
    if (tst_bit(info,i)) {
#ifdef SANITY
        wrtwarning("freeing free chunk at %p\n", ptr);
#endif
        return;
    }

    /* Mark it free */
    set_bit(info,i);
    info->free++;

    /* If the page was full before, we need to put it on the queue now */
    if (info->free == 1) {
        mp = page_dir + info->shift;
        while (*mp && (*mp)->next && (*mp)->next->page < info->page) {
            mp = &(*mp)->next;
        }
        info->next = *mp;
        *mp = info;
        return;
    }

    /* If this page isn't empty, don't do anything. */
    if (info->free != info->total) {
        return;
    }

    /* We may want to keep at least one page of each size chunks around.  */
    mp = page_dir + info->shift;
    if (0 && (*mp == info) && !info->next) {
        return;
    }

    /* Find & remove this page in the queue */
    while (*mp != info) {
        mp = &((*mp)->next);
#ifdef EXTRA_SANITY
        if (!*mp) {
            TRACE(("%6d !q %p\n",malloc_event++,info));
            wrterror("Not on queue\n");
        }
#endif
    }
    *mp = info->next;

    /* Free the page & the info structure if need be */
    set_pgdir(info->page,MALLOC_FIRST);
    if((void*)info->page == (void*)info) {
        _PR_UnlockedFree(info->page);
    } else {
        vp = info->page;
        _PR_UnlockedFree(info);
        _PR_UnlockedFree(vp);
    }
}

void _PR_UnlockedFree(void *ptr)
{
    u_long page;
    struct pginfo *info;
    int index, tmp_index;

    TRACE(("%6d F %p\n",malloc_event++,ptr));
    /* This is legal */
    if (!ptr) {
        return;
    }

#ifdef SANITY
    /* There wouldn't be anything to free */
    if (!initialized) {
        wrtwarning("free() called before malloc() ever got called\n");
        return;
    }
#endif

#ifdef SANITY
    if (suicide) {
        PR_Abort();
    }
#endif

    /* Find the page directory entry for the page in question */
    page = (u_long)ptr >> malloc_pageshift;
    index = page - malloc_origo;

    /*
     * check if memory was allocated by memalign
     */
    tmp_index = index;
    while (page_dir[tmp_index] == MALLOC_FOLLOW) {
        tmp_index--;
    }
    if (tmp_index != index) {
        /*
         * memalign-allocated memory
         */
        index = tmp_index;
        page = index + malloc_origo;
        ptr = (void *) (page << malloc_pageshift);
    }
    /* make sure it makes sense in some fashion */
    if (index < malloc_pageshift) {
#ifdef SANITY
        wrtwarning("junk pointer %p (low) passed to free()\n", ptr);
#endif
        return;
    }
    if (index > last_index) {
#ifdef SANITY
        wrtwarning("junk pointer %p (high) passed to free()\n", ptr);
#endif
        return;
    }

    /* handle as page-allocation or chunk allocation */
    info = page_dir[index];
    if (info < MALLOC_MAGIC) {
        free_pages((char*)ptr, page, index, info);
    }
    else {
        free_bytes(ptr,page,index,info);
    }
    return;
}
#endif /* _PR_OVERRIDE_MALLOC */