Merge branch 'dev'

Move assert() calls up in arena_run_reg_alloc(), so that a corrupt
pointer will likely be caught by an assertion *before* it is
dereferenced.

jemalloc/src/arena.c

@@ -254,7 +254,6 @@ arena_run_reg_alloc(arena_run_t *run, arena_bin_t *bin)
 	run->nfree--;
 	ret = run->avail;
 	if (ret != NULL) {
-		run->avail = *(void **)ret;
 		/* Double free can cause assertion failure.*/
 		assert(ret != NULL);
 		/* Write-after free can cause assertion failure. */
@@ -264,6 +263,7 @@ arena_run_reg_alloc(arena_run_t *run, arena_bin_t *bin)
 		assert(((uintptr_t)ret - ((uintptr_t)run +
 		    (uintptr_t)bin->reg0_offset)) % (uintptr_t)bin->reg_size ==
 		    0);
+		run->avail = *(void **)ret;
 		return (ret);
 	}
 	ret = run->next;

jemalloc/src/jemalloc.c

@@ -324,6 +324,7 @@ malloc_init_hard(void)
 			CPU_SPINWAIT;
 			malloc_mutex_lock(&init_lock);
 		} while (malloc_initialized == false);
+		malloc_mutex_unlock(&init_lock);
 		return (false);
 	}
 

jemalloc/src/prof.c

@@ -239,17 +239,16 @@ prof_backtrace(prof_bt_t *bt, unsigned nignore, unsigned max)
 	}
 
 	/*
-	 * Iterate over stack frames until there are no more.  Heap-allocate
+	 * Iterate over stack frames until there are no more, or until no space
-	 * and iteratively grow a larger bt if necessary.
+	 * remains in bt.
 	 */
 	for (i = 0; i < max; i++) {
 		unw_get_reg(&cursor, UNW_REG_IP, (unw_word_t *)&bt->vec[i]);
+		bt->len++;
 		err = unw_step(&cursor);
-		if (err <= 0) {
+		if (err <= 0)
-			bt->len = i;
 			break;
 	}
-	}
 }
 #else
 static void