2006-10-11  Jakub Jelinek  <jakub@redhat.com>

	* malloc/malloc.c (_int_malloc): Remove unused any_larger variable.

2006-08-31  Jakub Jelinek  <jakub@redhat.com>

	* malloc/malloc.c (_int_malloc): Use full list insert and not
	shortcut which assumes the list is empty for large requests
	too.

2006-08-26  Ulrich Drepper  <drepper@redhat.com>

	* malloc/malloc.c (_int_malloc): Fix test for large enough buffer
	for early termination.  When no unsorted block matches perfectly
	and an exiting block has to be split, use full list insert and
	not shortcut which assumes the list is empty.

2006-08-19  Ulrich Drepper  <drepper@redhat.com>

	* malloc/malloc.c (_int_malloc): Limit number of unsorted blocks
	to sort in each call.

--- libc/malloc/malloc.c	9 Aug 2006 21:50:30 -0000
+++ libc/malloc/malloc.c	7 Sep 2006 16:06:02 -0000
@@ -4055,6 +4096,7 @@ _int_malloc(mstate av, size_t bytes)
 
   for(;;) {
 
+    int iters = 0;
     while ( (victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) {
       bck = victim->bk;
       if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)
@@ -4150,6 +4193,10 @@ _int_malloc(mstate av, size_t bytes)
       victim->fd = fwd;
       fwd->bk = victim;
       bck->fd = victim;
+
+#define MAX_ITERS	10000
+      if (++iters >= MAX_ITERS)
+	break;
     }
 
     /*
@@ -4182,8 +4231,14 @@ _int_malloc(mstate av, size_t bytes)
         /* Split */
         else {
           remainder = chunk_at_offset(victim, nb);
-          unsorted_chunks(av)->bk = unsorted_chunks(av)->fd = remainder;
-          remainder->bk = remainder->fd = unsorted_chunks(av);
+          /* We cannot assume the unsorted list is empty and therefore
+             have to perform a complete insert here.  */
+	  bck = unsorted_chunks(av);
+	  fwd = bck->fd;
+	  remainder->bk = bck;
+	  remainder->fd = fwd;
+	  bck->fd = remainder;
+	  fwd->bk = remainder;
           set_head(victim, nb | PREV_INUSE |
 		   (av != &main_arena ? NON_MAIN_ARENA : 0));
           set_head(remainder, remainder_size | PREV_INUSE);
@@ -4268,8 +4323,15 @@ _int_malloc(mstate av, size_t bytes)
         else {
           remainder = chunk_at_offset(victim, nb);
 
-          unsorted_chunks(av)->bk = unsorted_chunks(av)->fd = remainder;
-          remainder->bk = remainder->fd = unsorted_chunks(av);
+	  /* We cannot assume the unsorted list is empty and therefore
+	     have to perform a complete insert here.  */
+	  bck = unsorted_chunks(av);
+	  fwd = bck->fd;
+	  remainder->bk = bck;
+	  remainder->fd = fwd;
+	  bck->fd = remainder;
+	  fwd->bk = remainder;
+
           /* advertise as last remainder */
           if (in_smallbin_range(nb))
             av->last_remainder = remainder;