extending list1_ = 0xf15091e0 list1->slab_ = 0xf150e198 str1 = 0xf1509180 str2 = 0xf1509168 .. ints -- before pop(0) ints[0] = 4 ints[1] = 5 ints[2] = 6 -- after mutation ints[0] = 42 ints[1] = 43 ints[2] = 6 list_repeat length = 3 list_repeat length = 3 item 0 1 item 1 1 . forward iteration over list x = 1 x = 2 x = 3 backward iteration over list x = 3 x = 2 x = 1 init.size() = 2 .-- before pop(0) ints[0] = 5 ints[1] = 6 ints[2] = 7 ints[3] = 8 pop() pop(0) .. List ints ....================================================================= ==3803==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xefd02e80 at pc 0xf38cc221 bp 0xffe4ef88 sp 0xffe4eb60 READ of size 60 at 0xefd02e80 thread T0 #0 0xf38cc220 in memmove (/usr/lib32/libasan.so.5+0x2f220) #1 0x5dd09c73 in List::pop(int) (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x1ac73) #2 0x5dd06273 in test_list_pop() (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x17273) #3 0x5dd08852 in main mycpp/gc_list_test.cc:501 #4 0xf346db40 in __libc_start_main (/lib32/libc.so.6+0x1ab40) #5 0x5dcf8870 in _start (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x9870) 0xefd02e80 is located 0 bytes to the right of 128-byte region [0xefd02e00,0xefd02e80) allocated by thread T0 here: #0 0xf39885d4 in __interceptor_malloc (/usr/lib32/libasan.so.5+0xeb5d4) #1 0x5dd6de2a in MarkSweepHeap::Allocate(unsigned int, int*, int*) mycpp/mark_sweep_heap.cc:106 #2 0x5dd0ead8 in Slab* NewSlab(int) (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x1fad8) #3 0x5dd0cce2 in List::reserve(int) (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x1dce2) #4 0x5dd098e9 in List::append(int) (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x1a8e9) #5 0x5dd0625d in test_list_pop() (/home/uke/oil/_bin/cxx-asan32+gcalways/mycpp/gc_list_test+0x1725d) #6 0x5dd08852 in main mycpp/gc_list_test.cc:501 #7 0xf346db40 in __libc_start_main (/lib32/libc.so.6+0x1ab40) SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib32/libasan.so.5+0x2f220) in memmove Shadow bytes around the buggy address: 0x3dfa0580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa0590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa05a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa05b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa05c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x3dfa05d0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa05e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa05f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa0600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa0610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3dfa0620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3803==ABORTING