void *
_PyObject_DebugMallocApi(char id, size_t nbytes)
{
uchar *p; /* base address of malloc'ed block */
uchar *tail; /* p + 2*SST + nbytes == pointer to tail pad bytes */
size_t total; /* nbytes + 4*SST */
bumpserialno();
total = nbytes + 4*SST;
if (total < nbytes)
/* overflow: can't represent total as a size_t */
return NULL;
p = (uchar *)PyObject_Malloc(total);
if (p == NULL)
return NULL;
/* at p, write size (SST bytes), id (1 byte), pad (SST-1 bytes) */
write_size_t(p, nbytes);
p[SST] = (uchar)id;
memset(p + SST + 1 , FORBIDDENBYTE, SST-1);
if (nbytes > 0)
memset(p + 2*SST, CLEANBYTE, nbytes);
/* at tail, write pad (SST bytes) and serialno (SST bytes) */
tail = p + 2*SST + nbytes;
memset(tail, FORBIDDENBYTE, SST);
write_size_t(tail + SST, serialno);
return p + 2*SST;
}
SST是宏定义 4
执行的实际作用是把nbytes的值(360 in this case)写在内存区的前四个字节,然后是一个uchar型的id , 'o' in this case
接着是nbytes个浩浩荡荡的0xcb
然后是4个oxfb, 和hex形式的serialno
(PyFrameObject*)op 0x00b25528
(*((PyFrameObject*)op)).f_localsplus 0x00b25668
我们看到f_localsplus的值正是 op + offset
offset is the f_localsplus offset in PyFrameObject definition