Fix page queue mismatch in mi_heap_page_collect

colesbury · colesbury · commit 4d059c9e6b83 · 2026-03-07T16:58:45.000-05:00
diff --git a/Objects/mimalloc/heap.c b/Objects/mimalloc/heap.c
@@ -100,7 +100,10 @@ static bool mi_heap_page_collect(mi_heap_t* heap, mi_page_queue_t* pq, mi_page_t
     // note: this will free retired pages as well.
     bool freed = _PyMem_mi_page_maybe_free(page, pq, collect >= MI_FORCE);
     if (!freed && collect == MI_ABANDON) {
-      _mi_page_abandon(page, pq);
+      // _PyMem_mi_page_maybe_free may have moved the page to a different
+      // page queue, so we need to re-fetch the correct queue.
+      uint8_t bin = (mi_page_is_in_full(page) ? MI_BIN_FULL : _mi_bin(page->xblock_size));
+      _mi_page_abandon(page, &heap->pages[bin]);
     }
   }
   else if (collect == MI_ABANDON) {

Original file line number	Diff line number	Diff line change
`@@ -100,7 +100,10 @@ static bool mi_heap_page_collect(mi_heap_t* heap, mi_page_queue_t* pq, mi_page_t`
`100`	`100`	`// note: this will free retired pages as well.`
`101`	`101`	`bool freed = _PyMem_mi_page_maybe_free(page, pq, collect >= MI_FORCE);`
`102`	`102`	`if (!freed && collect == MI_ABANDON) {`
`103`		`- _mi_page_abandon(page, pq);`
	`103`	`+ // _PyMem_mi_page_maybe_free may have moved the page to a different`
	`104`	`+ // page queue, so we need to re-fetch the correct queue.`
	`105`	`+ uint8_t bin = (mi_page_is_in_full(page) ? MI_BIN_FULL : _mi_bin(page->xblock_size));`
	`106`	`+ _mi_page_abandon(page, &heap->pages[bin]);`
`104`	`107`	`}`
`105`	`108`	`}`
`106`	`109`	`else if (collect == MI_ABANDON) {`