.

7 files changed, 126 insertions, 159 deletions

diff --git a/malloc/arena.c b/malloc/arena.c
index 1d9f952112..0dcb7cb9f8 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -1,5 +1,6 @@
 /* Malloc implementation for multiple threads without lock contention.
-   Copyright (C) 2001,2002,2003,2004,2005,2006 Free Software Foundation, Inc.
+   Copyright (C) 2001,2002,2003,2004,2005,2006,2007
+   Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Wolfram Gloger <wg@malloc.de>, 2001.
 
@@ -59,10 +60,12 @@ typedef struct _heap_info {
   mstate ar_ptr; /* Arena for this heap. */
   struct _heap_info *prev; /* Previous heap. */
   size_t size;   /* Current size in bytes. */
+  size_t mprotect_size;	/* Size in bytes that has been mprotected
+			   PROT_READ|PROT_WRITE.  */
   /* Make sure the following data is properly aligned, particularly
      that sizeof (heap_info) + 2 * SIZE_SZ is a multiple of
-     MALLOG_ALIGNMENT. */
-  char pad[-5 * SIZE_SZ & MALLOC_ALIGN_MASK];
+     MALLOC_ALIGNMENT. */
+  char pad[-6 * SIZE_SZ & MALLOC_ALIGN_MASK];
 } heap_info;
 
 /* Get a compile-time error if the heap_info padding is not correct
@@ -149,7 +152,7 @@ int __malloc_initialized = -1;
 
 static __malloc_ptr_t (*save_malloc_hook) (size_t __size,
 					   __const __malloc_ptr_t);
-# if !defined _LIBC || (defined SHARED && !USE___THREAD)
+# if !defined _LIBC || !defined USE_TLS || (defined SHARED && !USE___THREAD)
 static __malloc_ptr_t (*save_memalign_hook) (size_t __align, size_t __size,
 					     __const __malloc_ptr_t);
 # endif
@@ -385,7 +388,7 @@ extern struct dl_open_hook *_dl_open_hook;
 libc_hidden_proto (_dl_open_hook);
 # endif
 
-# if defined SHARED && !USE___THREAD
+# if defined SHARED && defined USE_TLS && !USE___THREAD
 /* This is called by __pthread_initialize_minimal when it needs to use
    malloc to set up the TLS state.  We cannot do the full work of
    ptmalloc_init (below) until __pthread_initialize_minimal has finished,
@@ -428,7 +431,7 @@ ptmalloc_init (void)
   __malloc_initialized = 0;
 
 #ifdef _LIBC
-# if defined SHARED && !USE___THREAD
+# if defined SHARED && defined USE_TLS && !USE___THREAD
   /* ptmalloc_init_minimal may already have been called via
      __libc_malloc_pthread_startup, above.  */
   if (mp_.pagesize == 0)
@@ -437,7 +440,7 @@ ptmalloc_init (void)
     ptmalloc_init_minimal();
 
 #ifndef NO_THREADS
-# if defined _LIBC
+# if defined _LIBC && defined USE_TLS
   /* We know __pthread_initialize_minimal has already been called,
      and that is enough.  */
 #   define NO_STARTER
@@ -692,6 +695,7 @@ new_heap(size, top_pad) size_t size, top_pad;
   }
   h = (heap_info *)p2;
   h->size = size;
+  h->mprotect_size = size;
   THREAD_STAT(stat_n_heaps++);
   return h;
 }
@@ -714,17 +718,34 @@ grow_heap(h, diff) heap_info *h; long diff;
     new_size = (long)h->size + diff;
     if((unsigned long) new_size > (unsigned long) HEAP_MAX_SIZE)
       return -1;
-    if(mprotect((char *)h + h->size, diff, PROT_READ|PROT_WRITE) != 0)
-      return -2;
+    if((unsigned long) new_size > h->mprotect_size) {
+      if (mprotect((char *)h + h->mprotect_size,
+		   (unsigned long) new_size - h->mprotect_size,
+		   PROT_READ|PROT_WRITE) != 0)
+	return -2;
+      h->mprotect_size = new_size;
+    }
   } else {
     new_size = (long)h->size + diff;
     if(new_size < (long)sizeof(*h))
       return -1;
     /* Try to re-map the extra heap space freshly to save memory, and
        make it inaccessible. */
-    if((char *)MMAP((char *)h + new_size, -diff, PROT_NONE,
-                    MAP_PRIVATE|MAP_FIXED) == (char *) MAP_FAILED)
-      return -2;
+#ifdef _LIBC
+    if (__builtin_expect (__libc_enable_secure, 0))
+#else
+    if (1)
+#endif
+      {
+	if((char *)MMAP((char *)h + new_size, -diff, PROT_NONE,
+			MAP_PRIVATE|MAP_FIXED) == (char *) MAP_FAILED)
+	  return -2;
+	h->mprotect_size = new_size;
+      }
+#ifdef _LIBC
+    else
+      madvise ((char *)h + new_size, -diff, MADV_DONTNEED);
+#endif
     /*fprintf(stderr, "shrink %p %08lx\n", h, new_size);*/
   }
   h->size = new_size;
diff --git a/malloc/hooks.c b/malloc/hooks.c
index 8346e73453..708f0faf83 100644
--- a/malloc/hooks.c
+++ b/malloc/hooks.c
@@ -1,5 +1,5 @@
 /* Malloc implementation for multiple threads without lock contention.
-   Copyright (C) 2001,2002,2003,2004,2005,2006 Free Software Foundation, Inc.
+   Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Wolfram Gloger <wg@malloc.de>, 2001.
 
@@ -414,7 +414,7 @@ memalign_check(alignment, bytes, caller)
 #ifndef NO_THREADS
 
 # ifdef _LIBC
-#  if USE___THREAD || !defined SHARED
+#  if USE___THREAD || (defined USE_TLS && !defined SHARED)
     /* These routines are never needed in this configuration.  */
 #   define NO_STARTER
 #  endif
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 6427608a79..a369001520 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -1618,7 +1618,7 @@ static Void_t*   memalign_check(size_t alignment, size_t bytes,
 				const Void_t *caller);
 #ifndef NO_THREADS
 # ifdef _LIBC
-#  if USE___THREAD || !defined SHARED
+#  if USE___THREAD || (defined USE_TLS && !defined SHARED)
     /* These routines are never needed in this configuration.  */
 #   define NO_STARTER
 #  endif
@@ -2741,19 +2741,8 @@ static void do_check_malloc_state(mstate av)
   for (i = 0; i < NFASTBINS; ++i) {
     p = av->fastbins[i];
 
-    /* The following test can only be performed for the main arena.
-       While mallopt calls malloc_consolidate to get rid of all fast
-       bins (especially those larger than the new maximum) this does
-       only happen for the main arena.  Trying to do this for any
-       other arena would mean those arenas have to be locked and
-       malloc_consolidate be called for them.  This is excessive.  And
-       even if this is acceptable to somebody it still cannot solve
-       the problem completely since if the arena is locked a
-       concurrent malloc call might create a new arena which then
-       could use the newly invalid fast bins.  */
-
     /* all bins past max_fast are empty */
-    if (av == &main_arena && i > max_fast_bin)
+    if (i > max_fast_bin)
       assert(p == 0);
 
     while (p != 0) {
@@ -2896,13 +2885,7 @@ static Void_t* sYSMALLOc(nb, av) INTERNAL_SIZE_T nb; mstate av;
       is one SIZE_SZ unit larger than for normal chunks, because there
       is no following chunk whose prev_size field could be used.
     */
-#if 1
-    /* See the front_misalign handling below, for glibc there is no
-       need for further alignments.  */
-    size = (nb + SIZE_SZ + pagemask) & ~pagemask;
-#else
     size = (nb + SIZE_SZ + MALLOC_ALIGN_MASK + pagemask) & ~pagemask;
-#endif
     tried_mmap = true;
 
     /* Don't try if size wraps around 0 */
@@ -2920,12 +2903,6 @@ static Void_t* sYSMALLOc(nb, av) INTERNAL_SIZE_T nb; mstate av;
           address argument for later munmap in free() and realloc().
         */
 
-#if 1
-	/* For glibc, chunk2mem increases the address by 2*SIZE_SZ and
-	   MALLOC_ALIGN_MASK is 2*SIZE_SZ-1.  Each mmap'ed area is page
-	   aligned and therefore definitely MALLOC_ALIGN_MASK-aligned.  */
-        assert (((INTERNAL_SIZE_T)chunk2mem(mm) & MALLOC_ALIGN_MASK) == 0);
-#else
         front_misalign = (INTERNAL_SIZE_T)chunk2mem(mm) & MALLOC_ALIGN_MASK;
         if (front_misalign > 0) {
           correction = MALLOC_ALIGNMENT - front_misalign;
@@ -2933,12 +2910,10 @@ static Void_t* sYSMALLOc(nb, av) INTERNAL_SIZE_T nb; mstate av;
           p->prev_size = correction;
           set_head(p, (size - correction) |IS_MMAPPED);
         }
-        else
-#endif
-	  {
-	    p = (mchunkptr)mm;
-	    set_head(p, size|IS_MMAPPED);
-	  }
+        else {
+          p = (mchunkptr)mm;
+          set_head(p, size|IS_MMAPPED);
+        }
 
         /* update statistics */
 
@@ -4122,6 +4097,7 @@ _int_malloc(mstate av, size_t bytes)
   for(;;) {
 
     int iters = 0;
+    bool any_larger = false;
     while ( (victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) {
       bck = victim->bk;
       if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)
@@ -4218,6 +4194,8 @@ _int_malloc(mstate av, size_t bytes)
       fwd->bk = victim;
       bck->fd = victim;
 
+      if (size >= nb + MINSIZE)
+	any_larger = true;
 #define MAX_ITERS	10000
       if (++iters >= MAX_ITERS)
 	break;
@@ -4706,15 +4684,7 @@ static void malloc_consolidate(av) mstate av;
       reused anyway.
     */
 
-#if 0
-    /* It is wrong to limit the fast bins to search using get_max_fast
-       because, except for the main arena, all the others might have
-       blocks in the high fast bins.  It's not worth it anyway, just
-       search all bins all the time.  */
     maxfb = &(av->fastbins[fastbin_index(get_max_fast ())]);
-#else
-    maxfb = &(av->fastbins[NFASTBINS - 1]);
-#endif
     fb = &(av->fastbins[0]);
     do {
       if ( (p = *fb) != 0) {
diff --git a/malloc/memusage.c b/malloc/memusage.c
index d11e9e6ed5..b5077ffe0b 100644
--- a/malloc/memusage.c
+++ b/malloc/memusage.c
@@ -80,7 +80,6 @@ static memusage_cntr_t large;
 static memusage_cntr_t calls_total;
 static memusage_cntr_t inplace;
 static memusage_cntr_t decreasing;
-static memusage_cntr_t realloc_free;
 static memusage_cntr_t inplace_mremap;
 static memusage_cntr_t decreasing_mremap;
 static memusage_size_t current_heap;
@@ -104,8 +103,8 @@ extern const char *__progname;
 
 struct entry
 {
-  uint64_t heap;
-  uint64_t stack;
+  size_t heap;
+  size_t stack;
   uint32_t time_low;
   uint32_t time_high;
 };
@@ -129,8 +128,8 @@ update_data (struct header *result, size_t len, size_t old_len)
 
   /* Compute current heap usage and compare it with the maximum value.  */
   memusage_size_t heap
-    = catomic_exchange_and_add (&current_heap, len - old_len) + len - old_len;
-  catomic_max (&peak_heap, heap);
+    = atomic_exchange_and_add (&current_heap, len - old_len) + len - old_len;
+  atomic_max (&peak_heap, heap);
 
   /* Compute current stack usage and compare it with the maximum
      value.  The base stack pointer might not be set if this is not
@@ -153,15 +152,15 @@ update_data (struct header *result, size_t len, size_t old_len)
     start_sp = sp;
   size_t current_stack = start_sp - sp;
 #endif
-  catomic_max (&peak_stack, current_stack);
+  atomic_max (&peak_stack, current_stack);
 
   /* Add up heap and stack usage and compare it with the maximum value.  */
-  catomic_max (&peak_total, heap + current_stack);
+  atomic_max (&peak_total, heap + current_stack);
 
   /* Store the value only if we are writing to a file.  */
   if (fd != -1)
     {
-      uatomic32_t idx = catomic_exchange_and_add (&buffer_cnt, 1);
+      uatomic32_t idx = atomic_exchange_and_add (&buffer_cnt, 1);
       if (idx >= 2 * buffer_size)
 	{
 	  /* We try to reset the counter to the correct range.  If
@@ -169,7 +168,7 @@ update_data (struct header *result, size_t len, size_t old_len)
 	     counter it does not matter since that thread will take
 	     care of the correction.  */
 	  unsigned int reset = idx - 2 * buffer_size;
-	  catomic_compare_and_exchange_val_acq (&buffer_size, reset, idx);
+	  atomic_compare_and_exchange_val_acq (&buffer_size, reset, idx);
 	  idx = reset;
 	}
 
@@ -268,7 +267,6 @@ me (void)
 	      GETTIME (first.time_low, first.time_high);
 	      /* Write it two times since we need the starting and end time. */
 	      write (fd, &first, sizeof (first));
-	      write (fd, &first, sizeof (first));
 
 	      /* Determine the buffer size.  We use the default if the
 		 environment variable is not present.  */
@@ -339,24 +337,24 @@ malloc (size_t len)
     return (*mallocp) (len);
 
   /* Keep track of number of calls.  */
-  catomic_increment (&calls[idx_malloc]);
+  atomic_increment (&calls[idx_malloc]);
   /* Keep track of total memory consumption for `malloc'.  */
-  catomic_add (&total[idx_malloc], len);
+  atomic_add (&total[idx_malloc], len);
   /* Keep track of total memory requirement.  */
-  catomic_add (&grand_total, len);
+  atomic_add (&grand_total, len);
   /* Remember the size of the request.  */
   if (len < 65536)
-    catomic_increment (&histogram[len / 16]);
+    atomic_increment (&histogram[len / 16]);
   else
-    catomic_increment (&large);
+    atomic_increment (&large);
   /* Total number of calls of any of the functions.  */
-  catomic_increment (&calls_total);
+  atomic_increment (&calls_total);
 
   /* Do the real work.  */
   result = (struct header *) (*mallocp) (len + sizeof (struct header));
   if (result == NULL)
     {
-      catomic_increment (&failed[idx_malloc]);
+      atomic_increment (&failed[idx_malloc]);
       return NULL;
     }
 
@@ -405,53 +403,36 @@ realloc (void *old, size_t len)
     }
 
   /* Keep track of number of calls.  */
-  catomic_increment (&calls[idx_realloc]);
+  atomic_increment (&calls[idx_realloc]);
   if (len > old_len)
     {
       /* Keep track of total memory consumption for `realloc'.  */
-      catomic_add (&total[idx_realloc], len - old_len);
+      atomic_add (&total[idx_realloc], len - old_len);
       /* Keep track of total memory requirement.  */
-      catomic_add (&grand_total, len - old_len);
+      atomic_add (&grand_total, len - old_len);
     }
-
-  if (len == 0 && old != NULL)
-    {
-      /* Special case.  */
-      catomic_increment (&realloc_free);
-      /* Keep track of total memory freed using `free'.  */
-      catomic_add (&total[idx_free], real->length);
-
-      /* Update the allocation data and write out the records if necessary.  */
-      update_data (NULL, 0, old_len);
-
-      /* Do the real work.  */
-      (*freep) (real);
-
-      return NULL;
-    }
-
   /* Remember the size of the request.  */
   if (len < 65536)
-    catomic_increment (&histogram[len / 16]);
+    atomic_increment (&histogram[len / 16]);
   else
-    catomic_increment (&large);
+    atomic_increment (&large);
   /* Total number of calls of any of the functions.  */
-  catomic_increment (&calls_total);
+  atomic_increment (&calls_total);
 
   /* Do the real work.  */
   result = (struct header *) (*reallocp) (real, len + sizeof (struct header));
   if (result == NULL)
     {
-      catomic_increment (&failed[idx_realloc]);
+      atomic_increment (&failed[idx_realloc]);
       return NULL;
     }
 
   /* Record whether the reduction/increase happened in place.  */
   if (real == result)
-    catomic_increment (&inplace);
+    atomic_increment (&inplace);
   /* Was the buffer increased?  */
   if (old_len > len)
-    catomic_increment (&decreasing);
+    atomic_increment (&decreasing);
 
   /* Update the allocation data and write out the records if necessary.  */
   update_data (result, len, old_len);
@@ -482,16 +463,16 @@ calloc (size_t n, size_t len)
     return (*callocp) (n, len);
 
   /* Keep track of number of calls.  */
-  catomic_increment (&calls[idx_calloc]);
+  atomic_increment (&calls[idx_calloc]);
   /* Keep track of total memory consumption for `calloc'.  */
-  catomic_add (&total[idx_calloc], size);
+  atomic_add (&total[idx_calloc], size);
   /* Keep track of total memory requirement.  */
-  catomic_add (&grand_total, size);
+  atomic_add (&grand_total, size);
   /* Remember the size of the request.  */
   if (size < 65536)
-    catomic_increment (&histogram[size / 16]);
+    atomic_increment (&histogram[size / 16]);
   else
-    catomic_increment (&large);
+    atomic_increment (&large);
   /* Total number of calls of any of the functions.  */
   ++calls_total;
 
@@ -499,7 +480,7 @@ calloc (size_t n, size_t len)
   result = (struct header *) (*mallocp) (size + sizeof (struct header));
   if (result == NULL)
     {
-      catomic_increment (&failed[idx_calloc]);
+      atomic_increment (&failed[idx_calloc]);
       return NULL;
     }
 
@@ -536,7 +517,7 @@ free (void *ptr)
   /* `free (NULL)' has no effect.  */
   if (ptr == NULL)
     {
-      catomic_increment (&calls[idx_free]);
+      atomic_increment (&calls[idx_free]);
       return;
     }
 
@@ -550,9 +531,9 @@ free (void *ptr)
     }
 
   /* Keep track of number of calls.  */
-  catomic_increment (&calls[idx_free]);
+  atomic_increment (&calls[idx_free]);
   /* Keep track of total memory freed using `free'.  */
-  catomic_add (&total[idx_free], real->length);
+  atomic_add (&total[idx_free], real->length);
 
   /* Update the allocation data and write out the records if necessary.  */
   update_data (NULL, 0, real->length);
@@ -586,22 +567,22 @@ mmap (void *start, size_t len, int prot, int flags, int fd, off_t offset)
 		 ? idx_mmap_a : prot & PROT_WRITE ? idx_mmap_w : idx_mmap_r);
 
       /* Keep track of number of calls.  */
-      catomic_increment (&calls[idx]);
+      atomic_increment (&calls[idx]);
       /* Keep track of total memory consumption for `malloc'.  */
-      catomic_add (&total[idx], len);
+      atomic_add (&total[idx], len);
       /* Keep track of total memory requirement.  */
-      catomic_add (&grand_total, len);
+      atomic_add (&grand_total, len);
       /* Remember the size of the request.  */
       if (len < 65536)
-	catomic_increment (&histogram[len / 16]);
+	atomic_increment (&histogram[len / 16]);
       else
-	catomic_increment (&large);
+	atomic_increment (&large);
       /* Total number of calls of any of the functions.  */
-      catomic_increment (&calls_total);
+      atomic_increment (&calls_total);
 
       /* Check for failures.  */
       if (result == NULL)
-	catomic_increment (&failed[idx]);
+	atomic_increment (&failed[idx]);
       else if (idx == idx_mmap_w)
 	/* Update the allocation data and write out the records if
 	   necessary.  Note the first parameter is NULL which means
@@ -638,22 +619,22 @@ mmap64 (void *start, size_t len, int prot, int flags, int fd, off64_t offset)
 		 ? idx_mmap_a : prot & PROT_WRITE ? idx_mmap_w : idx_mmap_r);
 
       /* Keep track of number of calls.  */
-      catomic_increment (&calls[idx]);
+      atomic_increment (&calls[idx]);
       /* Keep track of total memory consumption for `malloc'.  */
-      catomic_add (&total[idx], len);
+      atomic_add (&total[idx], len);
       /* Keep track of total memory requirement.  */
-      catomic_add (&grand_total, len);
+      atomic_add (&grand_total, len);
       /* Remember the size of the request.  */
       if (len < 65536)
-	catomic_increment (&histogram[len / 16]);
+	atomic_increment (&histogram[len / 16]);
       else
-	catomic_increment (&large);
+	atomic_increment (&large);
       /* Total number of calls of any of the functions.  */
-      catomic_increment (&calls_total);
+      atomic_increment (&calls_total);
 
       /* Check for failures.  */
       if (result == NULL)
-	catomic_increment (&failed[idx]);
+	atomic_increment (&failed[idx]);
       else if (idx == idx_mmap_w)
 	/* Update the allocation data and write out the records if
 	   necessary.  Note the first parameter is NULL which means
@@ -692,33 +673,33 @@ mremap (void *start, size_t old_len, size_t len, int flags,  ...)
   if (!not_me && trace_mmap)
     {
       /* Keep track of number of calls.  */
-      catomic_increment (&calls[idx_mremap]);
+      atomic_increment (&calls[idx_mremap]);
       if (len > old_len)
 	{
 	  /* Keep track of total memory consumption for `malloc'.  */
-	  catomic_add (&total[idx_mremap], len - old_len);
+	  atomic_add (&total[idx_mremap], len - old_len);
 	  /* Keep track of total memory requirement.  */
-	  catomic_add (&grand_total, len - old_len);
+	  atomic_add (&grand_total, len - old_len);
 	}
       /* Remember the size of the request.  */
       if (len < 65536)
-	catomic_increment (&histogram[len / 16]);
+	atomic_increment (&histogram[len / 16]);
       else
-	catomic_increment (&large);
+	atomic_increment (&large);
       /* Total number of calls of any of the functions.  */
-      catomic_increment (&calls_total);
+      atomic_increment (&calls_total);
 
       /* Check for failures.  */
       if (result == NULL)
-	catomic_increment (&failed[idx_mremap]);
+	atomic_increment (&failed[idx_mremap]);
       else
 	{
 	  /* Record whether the reduction/increase happened in place.  */
 	  if (start == result)
-	    catomic_increment (&inplace_mremap);
+	    atomic_increment (&inplace_mremap);
 	  /* Was the buffer increased?  */
 	  if (old_len > len)
-	    catomic_increment (&decreasing_mremap);
+	    atomic_increment (&decreasing_mremap);
 
 	  /* Update the allocation data and write out the records if
 	     necessary.  Note the first parameter is NULL which means
@@ -752,19 +733,19 @@ munmap (void *start, size_t len)
   if (!not_me && trace_mmap)
     {
       /* Keep track of number of calls.  */
-      catomic_increment (&calls[idx_munmap]);
+      atomic_increment (&calls[idx_munmap]);
 
       if (__builtin_expect (result == 0, 1))
 	{
 	  /* Keep track of total memory freed using `free'.  */
-	  catomic_add (&total[idx_munmap], len);
+	  atomic_add (&total[idx_munmap], len);
 
 	  /* Update the allocation data and write out the records if
 	     necessary.  */
 	  update_data (NULL, 0, len);
 	}
       else
-	catomic_increment (&failed[idx_munmap]);
+	atomic_increment (&failed[idx_munmap]);
     }
 
   return result;
@@ -789,12 +770,7 @@ dest (void)
   if (fd != -1)
     {
       /* Write the partially filled buffer.  */
-      if (buffer_cnt > buffer_size)
-	write (fd, buffer + buffer_size,
-	       (buffer_cnt - buffer_size) * sizeof (struct entry));
-      else
-	write (fd, buffer, buffer_cnt * sizeof (struct entry));
-
+      write (fd, buffer, buffer_cnt * sizeof (struct entry));
       /* Go back to the beginning of the file.  We allocated two records
 	 here when we opened the file.  */
       lseek (fd, 0, SEEK_SET);
@@ -818,7 +794,7 @@ dest (void)
 \e[01;32mMemory usage summary:\e[0;0m heap total: %llu, heap peak: %lu, stack peak: %lu\n\
 \e[04;34m         total calls   total memory   failed calls\e[0m\n\
 \e[00;34m malloc|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n\
-\e[00;34mrealloc|\e[0m %10lu   %12llu   %s%12lu\e[00;00m  (nomove:%ld, dec:%ld, free:%ld)\n\
+\e[00;34mrealloc|\e[0m %10lu   %12llu   %s%12lu\e[00;00m   (in place: %ld, dec: %ld)\n\
 \e[00;34m calloc|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n\
 \e[00;34m   free|\e[0m %10lu   %12llu\n",
 	   (unsigned long long int) grand_total, (unsigned long int) peak_heap,
@@ -831,9 +807,7 @@ dest (void)
 	   (unsigned long long int) total[idx_realloc],
 	   failed[idx_realloc] ? "\e[01;41m" : "",
 	   (unsigned long int) failed[idx_realloc],
-	   (unsigned long int) inplace,
-	   (unsigned long int) decreasing,
-	   (unsigned long int) realloc_free,
+	   (unsigned long int) inplace, (unsigned long int) decreasing,
 	   (unsigned long int) calls[idx_calloc],
 	   (unsigned long long int) total[idx_calloc],
 	   failed[idx_calloc] ? "\e[01;41m" : "",
@@ -846,7 +820,7 @@ dest (void)
 \e[00;34mmmap(r)|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n\
 \e[00;34mmmap(w)|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n\
 \e[00;34mmmap(a)|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n\
-\e[00;34m mremap|\e[0m %10lu   %12llu   %s%12lu\e[00;00m  (nomove: %ld, dec:%ld)\n\
+\e[00;34m mremap|\e[0m %10lu   %12llu   %s%12lu\e[00;00m   (in place: %ld, dec: %ld)\n\
 \e[00;34m munmap|\e[0m %10lu   %12llu   %s%12lu\e[00;00m\n",
 	     (unsigned long int) calls[idx_mmap_r],
 	     (unsigned long long int) total[idx_mmap_r],
diff --git a/malloc/memusage.sh b/malloc/memusage.sh
index 67af4998ca..47f8cc22ff 100755
--- a/malloc/memusage.sh
+++ b/malloc/memusage.sh
@@ -44,7 +44,7 @@ Profile memory usage of PROGRAM.
    -d,--data=FILE         Generate binary data file and store it in FILE
    -u,--unbuffered        Don't buffer output
    -b,--buffer=SIZE       Collect SIZE entries before writing them out
-      --no-timer          Don't collect additional information through timer
+      --no-timer          Don't collect additional information though timer
    -m,--mmap              Also trace mmap & friends
 
    -?,--help              Print this help and exit
@@ -71,12 +71,21 @@ do_version() {
   printf $"Copyright (C) %s Free Software Foundation, Inc.
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-" "2007"
+" "2006"
   printf $"Written by %s.
 " "Ulrich Drepper"
   exit 0
 }
 
+# These variables are local
+buffer=
+data=
+memusagestat_args=
+notimer=
+png=
+progname=
+tracemmap=
+
 # Process arguments.  But stop as soon as the program name is found.
 while test $# -gt 0; do
   case "$1" in
@@ -213,15 +222,8 @@ datafile=
 if test -n "$data"; then
   datafile="$data"
 elif test -n "$png"; then
-  datafile=$(mktemp ${TMPDIR:-/tmp}/memusage.XXXXXX 2> /dev/null)
-  if test $? -ne 0; then
-    # Lame, but if there is no `mktemp' program the user cannot expect more.
-    if test "$RANDOM" != "$RANDOM"; then
-      datafile=${TMPDIR:-/tmp}/memusage.$RANDOM
-    else
-      datafile=${TMPDIR:-/tmp}/memusage.$$
-    fi
-  fi
+  datafile=$(mktemp -t memusage.XXXXXX) || exit
+  trap 'rm -f "$datafile"; exit 1' HUP INT QUIT TERM PIPE
 fi
 if test -n "$datafile"; then
   add_env="$add_env MEMUSAGE_OUTPUT=$datafile"
diff --git a/malloc/memusagestat.c b/malloc/memusagestat.c
index 93ac2cd744..5d35ee0236 100644
--- a/malloc/memusagestat.c
+++ b/malloc/memusagestat.c
@@ -55,8 +55,8 @@ static const struct argp_option options[] =
   { "time", 't', NULL, 0, N_("Generate output linear to time (default is linear to number of function calls)") },
   { "total", 'T', NULL, 0,
     N_("Also draw graph for total memory consumption") },
-  { "x-size", 'x', "VALUE", 0, N_("Make output graphic VALUE pixels wide") },
-  { "y-size", 'y', "VALUE", 0, N_("Make output graphic VALUE pixels high") },
+  { "x-size", 'x', "VALUE", 0, N_("make output graphic VALUE pixel wide") },
+  { "y-size", 'y', "VALUE", 0, N_("make output graphic VALUE pixel high") },
   { NULL, 0, NULL, 0, NULL }
 };
 
@@ -81,8 +81,8 @@ static struct argp argp =
 
 struct entry
 {
-  uint64_t heap;
-  uint64_t stack;
+  size_t heap;
+  size_t stack;
   uint32_t time_low;
   uint32_t time_high;
 };
diff --git a/malloc/mtrace.pl b/malloc/mtrace.pl
index 280b469d92..8a0fbc7e95 100644
--- a/malloc/mtrace.pl
+++ b/malloc/mtrace.pl
@@ -1,7 +1,7 @@
 #! @PERL@
 eval "exec @PERL@ -S $0 $*"
     if 0;
-# Copyright (C) 1997-2004, 2005, 2006, 2007 Free Software Foundation, Inc.
+# Copyright (C) 1997-2004, 2005, 2006 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 # Contributed by Ulrich Drepper <drepper@gnu.org>, 1997.
 # Based on the mtrace.awk script.
@@ -45,7 +45,7 @@ arglist: while (@ARGV) {
 	$ARGV[0] eq "--vers" || $ARGV[0] eq "--versi" ||
 	$ARGV[0] eq "--versio" || $ARGV[0] eq "--version") {
 	print "mtrace (GNU $PACKAGE) $VERSION\n";
-	print "Copyright (C) 2007 Free Software Foundation, Inc.\n";
+	print "Copyright (C) 2006 Free Software Foundation, Inc.\n";
 	print "This is free software; see the source for copying conditions.  There is NO\n";
 	print "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n";
 	print "Written by Ulrich Drepper <drepper\@gnu.org>\n";