void * _PyObject_DebugMallocApi(char id, size_t nbytes) { uchar *p; /* base address of malloc'ed block */ uchar *tail; /* p + 2*SST + nbytes == pointer to tail pad bytes */ size_t total; /* nbytes + 4*SST */ bumpserialno(); total = nbytes + 4*SST; if (total < nbytes) /* overflow: can't represent total as a size_t */ return NULL; p = (uchar *)PyObject_Malloc(total); if (p == NULL) return NULL; /* at p, write size (SST bytes), id (1 byte), pad (SST-1 bytes) */ write_size_t(p, nbytes); p[SST] = (uchar)id; memset(p + SST + 1 , FORBIDDENBYTE, SST-1); if (nbytes > 0) memset(p + 2*SST, CLEANBYTE, nbytes); /* at tail, write pad (SST bytes) and serialno (SST bytes) */ tail = p + 2*SST + nbytes; memset(tail, FORBIDDENBYTE, SST); write_size_t(tail + SST, serialno); return p + 2*SST; } SST是宏定义 4 执行的实际作用是把nbytes的值(360 in this case)写在内存区的前四个字节,然后是一个uchar型的id , 'o' in this case 接着是nbytes个浩浩荡荡的0xcb 然后是4个oxfb, 和hex形式的serialno
(PyFrameObject*)op0x00b25528
(*((PyFrameObject*)op)).f_localsplus0x00b25668
我们看到f_localsplus的值正是 op + offset
offset is the f_localsplus offset in PyFrameObject definition