What are tcache chunks?

Recently freed chunks, max 7 per idx by default, are stored in a bin, known as tcache.

In tcache, one chunk directs the next chunk as a linked list.

What does tcache solve?

The tcache allocator is used to accelerate the allocations by the heap manager as a final optimization step.

Each process on a system has one or more threads that operate at the same time.

Every thread in a given process shares the:

• Same address space
• Same code
• Same data in memory
• Global variables
• Heap

However, each thread stores its temporary local variables in individual registers and stacks.

Effect of chunk size on heap manager and heap lock

The chunk size is considered by the heap manager to ensure that it fits in the tcache bin after it is freed. In fast-bin, bin chunks are considered in-use on the tcache and are not merged with neighboring freed chunks.

Heap lock is obtained if the chunk size is larger than the tcache bin or the tcache bin is full. After the heap lock, the chunk is processed as usual.

Request for a chunk

Once a chunk is requested, the heap returns the chunk without the heap lock, if the chunk is available in an appropriate tcache bin.

We continue the same way for the larger chunks. To keep things simple, the chunk is returned.

The allocation procedure is different when the bin is full.

Suppose the heap lock is taken, and the chunks are promoted while the heap lock is still up to the tcache bin limitwhich is seven. Then, the last matching chunk is returned to the user.

How do chunks end up in tcache bins?

There are multiple ways a chunk can end up in a tcache bin.

• On free: If the chunk is a suitable size and the corresponding bin isn’t full, then code it in _int_free: before the fast-bin.

• On malloc: When a small chunk is returned, the appropriate tcache bin is filled by other chunks from the corresponding bin.

Rather than being returned immediately, exact size matches are put in the tcache in the binning code first.

Chunks are taken from the tcache:

• In __libc_malloc, before _int_malloc.

• After the binning code, if at least one exact match is found.

• In a run of the binning code, the number of chunks put in the tcache can be limited. The last one found is returned if that is reached. However, this is unlimited by default.

Things to remember

• The order of chunks will be reversed by the tcache filled code in the fast path of the malloc.

• Cached chunks will be merged even if the neighboring chunk is freed, or with the top when they are freed.