`tiny_malloc_from_free_list` made my pointer `NULL`? : <p>I am working on code that includes <code>bllipparser</code> Python module, among other things. Feeding it the same dataset, it will intermittently crash (maybe once in three to ten runs). Going through <code>lldb</code>, I found that the public field <code>weights</code> of <code>RerankerModel</code> (<a href="https://github.com/BLLIP/bllip-parser/blob/f34db61f5414fe780cc7ff36d6af7a6692a513c6/second-stage/programs/features/simple-api.cc#L60" rel="noreferrer">source</a>), that is apparently only set once (in the constructor), randomly becomes <code>NULL</code> (I only have one <code>RerankerModel</code> for the duration of my run, so there should be exactly one <code>weights</code>, that persists unchanged throughout). So I set up an ambush (I mean, a watchpoint: I stopped the code in the constructor and <code>watchpoint set expression -w write -- &amp;weights</code>), and apparently the culprit that nulls the pointer is <code>tiny_malloc_from_free_list</code> from <code>libsystem_malloc.dylib</code>. Here's the relevant top of the backtrace:</p>

<pre><code>* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 4
  * frame #0: 0x00007fff61caf22a libsystem_malloc.dylib`tiny_malloc_from_free_list + 151
    frame #1: 0x00007fff61cae3bf libsystem_malloc.dylib`szone_malloc_should_clear + 422
    frame #2: 0x00007fff61cae1bd libsystem_malloc.dylib`malloc_zone_malloc + 103
    frame #3: 0x00007fff61cad4c7 libsystem_malloc.dylib`malloc + 24
    frame #4: 0x00007fff5faac628 libc++abi.dylib`operator new(unsigned long) + 40
    frame #5: 0x00000001133c904c _CharniakParser.cpython-36m-darwin.so`std::__1::__split_buffer&lt;short, std::__1::allocator&lt;short&gt;&amp;&gt;::__split_buffer(unsigned long, unsigned long, std::__1::allocator&lt;short&gt;&amp;) [inlined] std::__1::__allocate(__size=4) at new:226
    frame #6: 0x00000001133c9040 _CharniakParser.cpython-36m-darwin.so`std::__1::__split_buffer&lt;short, std::__1::allocator&lt;short&gt;&amp;&gt;::__split_buffer(unsigned long, unsigned long, std::__1::allocator&lt;short&gt;&amp;) [inlined] std::__1::allocator&lt;short&gt;::allocate(this=0x0000000135316448, __n=2, (null)=0x0000000000000000) at memory:1747
    frame #7: 0x00000001133c8f44 _CharniakParser.cpython-36m-darwin.so`std::__1::__split_buffer&lt;short, std::__1::allocator&lt;short&gt;&amp;&gt;::__split_buffer(unsigned long, unsigned long, std::__1::allocator&lt;short&gt;&amp;) [inlined] std::__1::allocator_traits&lt;std::__1::allocator&lt;short&gt; &gt;::allocate(__a=0x0000000135316448, __n=2) at memory:1502
    frame #8: 0x00000001133c8f16 _CharniakParser.cpython-36m-darwin.so`std::__1::__split_buffer&lt;short, std::__1::allocator&lt;short&gt;&amp;&gt;::__split_buffer(this=0x00007ffeefbf3b48, __cap=2, __start=1, __a=0x0000000135316448) at __split_buffer:311
    frame #9: 0x00000001133c878d _CharniakParser.cpython-36m-darwin.so`std::__1::__split_buffer&lt;short, std::__1::allocator&lt;short&gt;&amp;&gt;::__split_buffer(this=0x00007ffeefbf3b48, __cap=2, __start=1, __a=0x0000000135316448) at __split_buffer:310
    frame #10: 0x00000001133c869b _CharniakParser.cpython-36m-darwin.so`void std::__1::vector&lt;short, std::__1::allocator&lt;short&gt; &gt;::__push_back_slow_path&lt;short const&gt;(this=0x0000000135316438 size=1, __x=0x00007ffeefbf3caa) at vector:1567
    frame #11: 0x00000001133c4446 _CharniakParser.cpython-36m-darwin.so`Val::extendTrees(Bst&amp;, int) [inlined] std::__1::vector&lt;short, std::__1::allocator&lt;short&gt; &gt;::push_back(this=0x0000000135316438 size=1, __x=0x00007ffeefbf3caa) at vector:1588
</code></pre>

<p>I am very much not an expert on C++, but... How is the allocator NULLing the pointer? How does the allocator even know where the pointer is? <em>Why</em> is the allocator NULLing the pointer? I mean, I can see how I might run out of memory, what I was doing wasn't exactly memory-light, but I'd much sooner expect allocator to fail to allocate than to randomly deallocate something - and I had no idea it could NULL a pointer. Can anyone explain to me exactly how this works, why it happened, how it happened, why is it always the same pointer in a code that has lots and lots of other juicy pointers, and what I can do to make it not happen?</p>

<p>Addendum if needed: Here's where the actual NULLing takes place, the code of  <code>tiny_malloc_from_free_list</code>, if anyone can make sense of it...</p>

<pre><code>libsystem_malloc.dylib`tiny_malloc_from_free_list:
    0x7fff61caf193 &lt;+0&gt;:    pushq  %rbp
    0x7fff61caf194 &lt;+1&gt;:    movq   %rsp, %rbp
    0x7fff61caf197 &lt;+4&gt;:    pushq  %r15
    0x7fff61caf199 &lt;+6&gt;:    pushq  %r14
    0x7fff61caf19b &lt;+8&gt;:    pushq  %r13
    0x7fff61caf19d &lt;+10&gt;:   pushq  %r12
    0x7fff61caf19f &lt;+12&gt;:   pushq  %rbx
    0x7fff61caf1a0 &lt;+13&gt;:   pushq  %rax
    0x7fff61caf1a1 &lt;+14&gt;:   movl   %edx, %r15d
    0x7fff61caf1a4 &lt;+17&gt;:   movq   %rsi, %r14
    0x7fff61caf1a7 &lt;+20&gt;:   movq   %rdi, %r12
    0x7fff61caf1aa &lt;+23&gt;:   leal   -0x1(%r15), %ecx
    0x7fff61caf1ae &lt;+27&gt;:   movq   0x18(%r14,%rcx,8), %r13
    0x7fff61caf1b3 &lt;+32&gt;:   testq  %r13, %r13
    0x7fff61caf1b6 &lt;+35&gt;:   je     0x7fff61caf22f            ; &lt;+156&gt;
    0x7fff61caf1b8 &lt;+37&gt;:   movq   0x8(%r13), %rdx
    0x7fff61caf1bc &lt;+41&gt;:   movq   %rdx, %rax
    0x7fff61caf1bf &lt;+44&gt;:   shlq   $0x4, %rax
    0x7fff61caf1c3 &lt;+48&gt;:   shrq   $0x3c, %rdx
    0x7fff61caf1c7 &lt;+52&gt;:   movq   0x278(%r12), %rsi
    0x7fff61caf1cf &lt;+60&gt;:   xorq   %rax, %rsi
    0x7fff61caf1d2 &lt;+63&gt;:   movq   %rsi, %rdi
    0x7fff61caf1d5 &lt;+66&gt;:   shrq   $0x8, %rdi
    0x7fff61caf1d9 &lt;+70&gt;:   addl   %esi, %edi
    0x7fff61caf1db &lt;+72&gt;:   movq   %rsi, %rbx
    0x7fff61caf1de &lt;+75&gt;:   shrq   $0x10, %rbx
    0x7fff61caf1e2 &lt;+79&gt;:   addl   %edi, %ebx
    0x7fff61caf1e4 &lt;+81&gt;:   movq   %rsi, %rdi
    0x7fff61caf1e7 &lt;+84&gt;:   shrq   $0x18, %rdi
    0x7fff61caf1eb &lt;+88&gt;:   addl   %ebx, %edi
    0x7fff61caf1ed &lt;+90&gt;:   movq   %rsi, %rbx
    0x7fff61caf1f0 &lt;+93&gt;:   shrq   $0x20, %rbx
    0x7fff61caf1f4 &lt;+97&gt;:   addl   %edi, %ebx
    0x7fff61caf1f6 &lt;+99&gt;:   movq   %rsi, %rdi
    0x7fff61caf1f9 &lt;+102&gt;:  shrq   $0x28, %rdi
    0x7fff61caf1fd &lt;+106&gt;:  addl   %ebx, %edi
    0x7fff61caf1ff &lt;+108&gt;:  movq   %rsi, %rbx
    0x7fff61caf202 &lt;+111&gt;:  shrq   $0x30, %rbx
    0x7fff61caf206 &lt;+115&gt;:  addl   %edi, %ebx
    0x7fff61caf208 &lt;+117&gt;:  shrq   $0x38, %rsi
    0x7fff61caf20c &lt;+121&gt;:  addl   %ebx, %esi
    0x7fff61caf20e &lt;+123&gt;:  andl   $0xf, %esi
    0x7fff61caf211 &lt;+126&gt;:  cmpq   %rsi, %rdx
    0x7fff61caf214 &lt;+129&gt;:  jne    0x7fff61caf602            ; &lt;+1135&gt;
    0x7fff61caf21a &lt;+135&gt;:  testq  %rax, %rax
    0x7fff61caf21d &lt;+138&gt;:  je     0x7fff61caf2de            ; &lt;+331&gt;
    0x7fff61caf223 &lt;+144&gt;:  movq   (%r13), %rdx
    0x7fff61caf227 &lt;+148&gt;:  movq   %rdx, (%rax)
-&gt;  0x7fff61caf22a &lt;+151&gt;:  jmp    0x7fff61caf2f2            ; &lt;+351&gt;
    0x7fff61caf22f &lt;+156&gt;:  movq   $-0x1, %rax
    0x7fff61caf236 &lt;+163&gt;:  shlq   %cl, %rax
    0x7fff61caf239 &lt;+166&gt;:  andq   0x818(%r14), %rax
    0x7fff61caf240 &lt;+173&gt;:  je     0x7fff61caf4f9            ; &lt;+870&gt;
    0x7fff61caf246 &lt;+179&gt;:  bsfq   %rax, %rcx
    0x7fff61caf24a &lt;+183&gt;:  cmpq   $0x3f, %rcx
    0x7fff61caf24e &lt;+187&gt;:  je     0x7fff61caf39d            ; &lt;+522&gt;
    0x7fff61caf254 &lt;+193&gt;:  movq   0x18(%r14,%rcx,8), %r13
    0x7fff61caf259 &lt;+198&gt;:  testq  %r13, %r13
    0x7fff61caf25c &lt;+201&gt;:  je     0x7fff61caf39d            ; &lt;+522&gt;
    0x7fff61caf262 &lt;+207&gt;:  movq   0x8(%r13), %rdx
    0x7fff61caf266 &lt;+211&gt;:  movq   %rdx, %rax
    0x7fff61caf269 &lt;+214&gt;:  shlq   $0x4, %rax
    0x7fff61caf26d &lt;+218&gt;:  shrq   $0x3c, %rdx
    0x7fff61caf271 &lt;+222&gt;:  movq   0x278(%r12), %rsi
    0x7fff61caf279 &lt;+230&gt;:  xorq   %rax, %rsi
    0x7fff61caf27c &lt;+233&gt;:  movq   %rsi, %rdi
    0x7fff61caf27f &lt;+236&gt;:  shrq   $0x8, %rdi
    0x7fff61caf283 &lt;+240&gt;:  addl   %esi, %edi
    0x7fff61caf285 &lt;+242&gt;:  movq   %rsi, %rbx
    0x7fff61caf288 &lt;+245&gt;:  shrq   $0x10, %rbx
    0x7fff61caf28c &lt;+249&gt;:  addl   %edi, %ebx
    0x7fff61caf28e &lt;+251&gt;:  movq   %rsi, %rdi
    0x7fff61caf291 &lt;+254&gt;:  shrq   $0x18, %rdi
    0x7fff61caf295 &lt;+258&gt;:  addl   %ebx, %edi
    0x7fff61caf297 &lt;+260&gt;:  movq   %rsi, %rbx
    0x7fff61caf29a &lt;+263&gt;:  shrq   $0x20, %rbx
    0x7fff61caf29e &lt;+267&gt;:  addl   %edi, %ebx
    0x7fff61caf2a0 &lt;+269&gt;:  movq   %rsi, %rdi
    0x7fff61caf2a3 &lt;+272&gt;:  shrq   $0x28, %rdi
    0x7fff61caf2a7 &lt;+276&gt;:  addl   %ebx, %edi
    0x7fff61caf2a9 &lt;+278&gt;:  movq   %rsi, %rbx
    0x7fff61caf2ac &lt;+281&gt;:  shrq   $0x30, %rbx
    0x7fff61caf2b0 &lt;+285&gt;:  addl   %edi, %ebx
    0x7fff61caf2b2 &lt;+287&gt;:  shrq   $0x38, %rsi
    0x7fff61caf2b6 &lt;+291&gt;:  addl   %ebx, %esi
    0x7fff61caf2b8 &lt;+293&gt;:  andl   $0xf, %esi
    0x7fff61caf2bb &lt;+296&gt;:  cmpq   %rsi, %rdx
    0x7fff61caf2be &lt;+299&gt;:  jne    0x7fff61caf602            ; &lt;+1135&gt;
    0x7fff61caf2c4 &lt;+305&gt;:  movq   %rax, 0x18(%r14,%rcx,8)
    0x7fff61caf2c9 &lt;+310&gt;:  testq  %rax, %rax
    0x7fff61caf2cc &lt;+313&gt;:  je     0x7fff61caf59f            ; &lt;+1036&gt;
    0x7fff61caf2d2 &lt;+319&gt;:  movq   (%r13), %rcx
    0x7fff61caf2d6 &lt;+323&gt;:  movq   %rcx, (%rax)
    0x7fff61caf2d9 &lt;+326&gt;:  jmp    0x7fff61caf5b2            ; &lt;+1055&gt;
    0x7fff61caf2de &lt;+331&gt;:  movl   $0xfffffffe, %edx         ; imm = 0xFFFFFFFE 
    0x7fff61caf2e3 &lt;+336&gt;:  roll   %cl, %edx
    0x7fff61caf2e5 &lt;+338&gt;:  movl   %ecx, %esi
    0x7fff61caf2e7 &lt;+340&gt;:  shrl   $0x5, %esi
    0x7fff61caf2ea &lt;+343&gt;:  andl   %edx, 0x818(%r14,%rsi,4)
    0x7fff61caf2f2 &lt;+351&gt;:  movq   %rax, 0x18(%r14,%rcx,8)
    0x7fff61caf2f7 &lt;+356&gt;:  incl   0x850(%r14)
    0x7fff61caf2fe &lt;+363&gt;:  movzwl %r15w, %esi
    0x7fff61caf302 &lt;+367&gt;:  movl   %esi, %ecx
    0x7fff61caf304 &lt;+369&gt;:  shll   $0x4, %ecx
    0x7fff61caf307 &lt;+372&gt;:  addq   %rcx, 0x858(%r14)
    0x7fff61caf30e &lt;+379&gt;:  movq   %r13, %rax
    0x7fff61caf311 &lt;+382&gt;:  andq   $-0x100000, %rax          ; imm = 0xFFF00000 
    0x7fff61caf317 &lt;+388&gt;:  addl   0xfc098(%rax), %ecx
    0x7fff61caf31d &lt;+394&gt;:  movl   %ecx, 0xfc098(%rax)
    0x7fff61caf323 &lt;+400&gt;:  cmpl   $0xbd060, %ecx            ; imm = 0xBD060 
    0x7fff61caf329 &lt;+406&gt;:  jb     0x7fff61caf335            ; &lt;+418&gt;
    0x7fff61caf32b &lt;+408&gt;:  movl   $0x0, 0xfc090(%rax)
    0x7fff61caf335 &lt;+418&gt;:  cmpl   $0x2, %esi
    0x7fff61caf338 &lt;+421&gt;:  jb     0x7fff61caf344            ; &lt;+433&gt;
    0x7fff61caf33a &lt;+423&gt;:  movq   %r13, %rdi
    0x7fff61caf33d &lt;+426&gt;:  callq  0x7fff61cc5eaa            ; set_tiny_meta_header_in_use
    0x7fff61caf342 &lt;+431&gt;:  jmp    0x7fff61caf38b            ; &lt;+504&gt;
    0x7fff61caf344 &lt;+433&gt;:  movq   %r13, %rcx
    0x7fff61caf347 &lt;+436&gt;:  shrq   $0x4, %rcx
    0x7fff61caf34b &lt;+440&gt;:  movl   %r13d, %edx
    0x7fff61caf34e &lt;+443&gt;:  shrl   $0x8, %edx
    0x7fff61caf351 &lt;+446&gt;:  andl   $0xffe, %edx              ; imm = 0xFFE 
    0x7fff61caf357 &lt;+452&gt;:  movl   $0x1, %esi
    0x7fff61caf35c &lt;+457&gt;:  movl   $0x1, %edi
    0x7fff61caf361 &lt;+462&gt;:  shll   %cl, %edi
    0x7fff61caf363 &lt;+464&gt;:  orl    %edi, 0xfc0a0(%rax,%rdx,4)
    0x7fff61caf36a &lt;+471&gt;:  orl    $0x1, %edx
    0x7fff61caf36d &lt;+474&gt;:  orl    %edi, 0xfc0a0(%rax,%rdx,4)
    0x7fff61caf374 &lt;+481&gt;:  leal   0x1(%rcx), %ecx
    0x7fff61caf377 &lt;+484&gt;:  movl   %ecx, %edx
    0x7fff61caf379 &lt;+486&gt;:  shrl   $0x4, %edx
    0x7fff61caf37c &lt;+489&gt;:  andl   $0xffe, %edx              ; imm = 0xFFE 
    0x7fff61caf382 &lt;+495&gt;:  shll   %cl, %esi
    0x7fff61caf384 &lt;+497&gt;:  orl    %esi, 0xfc0a0(%rax,%rdx,4)
    0x7fff61caf38b &lt;+504&gt;:  movq   %r13, %rax
    0x7fff61caf38e &lt;+507&gt;:  addq   $0x8, %rsp
    0x7fff61caf392 &lt;+511&gt;:  popq   %rbx
    0x7fff61caf393 &lt;+512&gt;:  popq   %r12
    0x7fff61caf395 &lt;+514&gt;:  popq   %r13
    0x7fff61caf397 &lt;+516&gt;:  popq   %r14
    0x7fff61caf399 &lt;+518&gt;:  popq   %r15
    0x7fff61caf39b &lt;+520&gt;:  popq   %rbp
    0x7fff61caf39c &lt;+521&gt;:  retq   
    0x7fff61caf39d &lt;+522&gt;:  movq   0x210(%r14), %r13
    0x7fff61caf3a4 &lt;+529&gt;:  testq  %r13, %r13
    0x7fff61caf3a7 &lt;+532&gt;:  je     0x7fff61caf4f9            ; &lt;+870&gt;
    0x7fff61caf3ad &lt;+538&gt;:  movq   %r13, %rdi
    0x7fff61caf3b0 &lt;+541&gt;:  callq  0x7fff61cb05ab            ; get_tiny_free_size
    0x7fff61caf3b5 &lt;+546&gt;:  movq   0x8(%r13), %rcx
    0x7fff61caf3b9 &lt;+550&gt;:  movq   %rcx, %r8
    0x7fff61caf3bc &lt;+553&gt;:  shlq   $0x4, %r8
    0x7fff61caf3c0 &lt;+557&gt;:  shrq   $0x3c, %rcx
    0x7fff61caf3c4 &lt;+561&gt;:  movq   0x278(%r12), %rsi
    0x7fff61caf3cc &lt;+569&gt;:  movq   %r8, %rdi
    0x7fff61caf3cf &lt;+572&gt;:  xorq   %rsi, %rdi
    0x7fff61caf3d2 &lt;+575&gt;:  movq   %rdi, %rbx
    0x7fff61caf3d5 &lt;+578&gt;:  shrq   $0x8, %rbx
    0x7fff61caf3d9 &lt;+582&gt;:  addl   %edi, %ebx
    0x7fff61caf3db &lt;+584&gt;:  movq   %rdi, %rdx
    0x7fff61caf3de &lt;+587&gt;:  shrq   $0x10, %rdx
    0x7fff61caf3e2 &lt;+591&gt;:  addl   %ebx, %edx
    0x7fff61caf3e4 &lt;+593&gt;:  movq   %rdi, %rbx
    0x7fff61caf3e7 &lt;+596&gt;:  shrq   $0x18, %rbx
    0x7fff61caf3eb &lt;+600&gt;:  addl   %edx, %ebx
    0x7fff61caf3ed &lt;+602&gt;:  movq   %rdi, %rdx
    0x7fff61caf3f0 &lt;+605&gt;:  shrq   $0x20, %rdx
    0x7fff61caf3f4 &lt;+609&gt;:  addl   %ebx, %edx
    0x7fff61caf3f6 &lt;+611&gt;:  movq   %rdi, %rbx
    0x7fff61caf3f9 &lt;+614&gt;:  shrq   $0x28, %rbx
    0x7fff61caf3fd &lt;+618&gt;:  addl   %edx, %ebx
    0x7fff61caf3ff &lt;+620&gt;:  movq   %rdi, %rdx
    0x7fff61caf402 &lt;+623&gt;:  shrq   $0x30, %rdx
    0x7fff61caf406 &lt;+627&gt;:  addl   %ebx, %edx
    0x7fff61caf408 &lt;+629&gt;:  shrq   $0x38, %rdi
    0x7fff61caf40c &lt;+633&gt;:  addl   %edx, %edi
    0x7fff61caf40e &lt;+635&gt;:  andl   $0xf, %edi
    0x7fff61caf411 &lt;+638&gt;:  cmpq   %rdi, %rcx
    0x7fff61caf414 &lt;+641&gt;:  jne    0x7fff61caf602            ; &lt;+1135&gt;
    0x7fff61caf41a &lt;+647&gt;:  movzwl %ax, %edi
    0x7fff61caf41d &lt;+650&gt;:  subl   %r15d, %edi
    0x7fff61caf420 &lt;+653&gt;:  cmpl   $0x40, %edi
    0x7fff61caf423 &lt;+656&gt;:  jl     0x7fff61caf58a            ; &lt;+1015&gt;
    0x7fff61caf429 &lt;+662&gt;:  movl   %r15d, %eax
    0x7fff61caf42c &lt;+665&gt;:  shll   $0x4, %eax
    0x7fff61caf42f &lt;+668&gt;:  addq   %r13, %rax
    0x7fff61caf432 &lt;+671&gt;:  movq   %rax, 0x210(%r14)
    0x7fff61caf439 &lt;+678&gt;:  movq   %rax, %rcx
    0x7fff61caf43c &lt;+681&gt;:  shrq   $0x4, %rcx
    0x7fff61caf440 &lt;+685&gt;:  testq  %r8, %r8
    0x7fff61caf443 &lt;+688&gt;:  je     0x7fff61caf48e            ; &lt;+763&gt;
    0x7fff61caf445 &lt;+690&gt;:  xorq   %rax, %rsi
    0x7fff61caf448 &lt;+693&gt;:  movq   %rsi, %rdx
    0x7fff61caf44b &lt;+696&gt;:  shrq   $0x8, %rdx
    0x7fff61caf44f &lt;+700&gt;:  addl   %esi, %edx
    0x7fff61caf451 &lt;+702&gt;:  movq   %rsi, %rbx
    0x7fff61caf454 &lt;+705&gt;:  shrq   $0x10, %rbx
    0x7fff61caf458 &lt;+709&gt;:  addl   %edx, %ebx
    0x7fff61caf45a &lt;+711&gt;:  movq   %rsi, %rdx
    0x7fff61caf45d &lt;+714&gt;:  shrq   $0x18, %rdx
    0x7fff61caf461 &lt;+718&gt;:  addl   %ebx, %edx
    0x7fff61caf463 &lt;+720&gt;:  movq   %rsi, %rbx
    0x7fff61caf466 &lt;+723&gt;:  shrq   $0x20, %rbx
    0x7fff61caf46a &lt;+727&gt;:  addl   %edx, %ebx
    0x7fff61caf46c &lt;+729&gt;:  movq   %rsi, %rdx
    0x7fff61caf46f &lt;+732&gt;:  shrq   $0x28, %rdx
    0x7fff61caf473 &lt;+736&gt;:  addl   %ebx, %edx
    0x7fff61caf475 &lt;+738&gt;:  movq   %rsi, %rbx
    0x7fff61caf478 &lt;+741&gt;:  shrq   $0x30, %rbx
    0x7fff61caf47c &lt;+745&gt;:  addl   %edx, %ebx
    0x7fff61caf47e &lt;+747&gt;:  shrq   $0x38, %rsi
    0x7fff61caf482 &lt;+751&gt;:  addl   %ebx, %esi
    0x7fff61caf484 &lt;+753&gt;:  shlq   $0x3c, %rsi
    0x7fff61caf488 &lt;+757&gt;:  orq    %rcx, %rsi
    0x7fff61caf48b &lt;+760&gt;:  movq   %rsi, (%r8)
    0x7fff61caf48e &lt;+763&gt;:  movq   (%r13), %rdx
    0x7fff61caf492 &lt;+767&gt;:  movq   %rdx, (%rax)
    0x7fff61caf495 &lt;+770&gt;:  movq   0x8(%r13), %rdx
    0x7fff61caf499 &lt;+774&gt;:  movq   %rdx, 0x8(%rax)
    0x7fff61caf49d &lt;+778&gt;:  movq   %rax, %rdx
    0x7fff61caf4a0 &lt;+781&gt;:  andq   $-0x100000, %rdx          ; imm = 0xFFF00000 
    0x7fff61caf4a7 &lt;+788&gt;:  movl   %eax, %esi
    0x7fff61caf4a9 &lt;+790&gt;:  shrl   $0x8, %esi
    0x7fff61caf4ac &lt;+793&gt;:  andl   $0xffe, %esi              ; imm = 0xFFE 
    0x7fff61caf4b2 &lt;+799&gt;:  andl   $0x1f, %ecx
    0x7fff61caf4b5 &lt;+802&gt;:  movl   $0x1, %ebx
    0x7fff61caf4ba &lt;+807&gt;:  shll   %cl, %ebx
    0x7fff61caf4bc &lt;+809&gt;:  orl    %ebx, 0xfc0a0(%rdx,%rsi,4)
    0x7fff61caf4c3 &lt;+816&gt;:  movl   $0xfffffffe, %ebx         ; imm = 0xFFFFFFFE 
    0x7fff61caf4c8 &lt;+821&gt;:  roll   %cl, %ebx
    0x7fff61caf4ca &lt;+823&gt;:  orl    $0x1, %esi
    0x7fff61caf4cd &lt;+826&gt;:  andl   %ebx, 0xfc0a0(%rdx,%rsi,4)
    0x7fff61caf4d4 &lt;+833&gt;:  movzwl %di, %ecx
    0x7fff61caf4d7 &lt;+836&gt;:  cmpl   $0x2, %ecx
    0x7fff61caf4da &lt;+839&gt;:  jb     0x7fff61caf5ee            ; &lt;+1115&gt;
    0x7fff61caf4e0 &lt;+845&gt;:  movl   %edi, %ecx
    0x7fff61caf4e2 &lt;+847&gt;:  shll   $0x4, %ecx
    0x7fff61caf4e5 &lt;+850&gt;:  andl   $0xffff0, %ecx            ; imm = 0xFFFF0 
    0x7fff61caf4eb &lt;+856&gt;:  movw   %di, -0x2(%rax,%rcx)
    0x7fff61caf4f0 &lt;+861&gt;:  movw   %di, 0x10(%rax)
    0x7fff61caf4f4 &lt;+865&gt;:  jmp    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf4f9 &lt;+870&gt;:  movq   0x838(%r14), %rcx
    0x7fff61caf500 &lt;+877&gt;:  movl   %r15d, %eax
    0x7fff61caf503 &lt;+880&gt;:  shll   $0x4, %eax
    0x7fff61caf506 &lt;+883&gt;:  movq   %rcx, %rdx
    0x7fff61caf509 &lt;+886&gt;:  subq   %rax, %rdx
    0x7fff61caf50c &lt;+889&gt;:  jae    0x7fff61caf516            ; &lt;+899&gt;
    0x7fff61caf50e &lt;+891&gt;:  xorl   %r13d, %r13d
    0x7fff61caf511 &lt;+894&gt;:  jmp    0x7fff61caf38b            ; &lt;+504&gt;
    0x7fff61caf516 &lt;+899&gt;:  movl   $0xfc080, %r13d           ; imm = 0xFC080 
    0x7fff61caf51c &lt;+905&gt;:  subq   %rcx, %r13
    0x7fff61caf51f &lt;+908&gt;:  addq   0x848(%r14), %r13
    0x7fff61caf526 &lt;+915&gt;:  movq   %rdx, 0x838(%r14)
    0x7fff61caf52d &lt;+922&gt;:  testq  %rdx, %rdx
    0x7fff61caf530 &lt;+925&gt;:  je     0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf536 &lt;+931&gt;:  addq   %r13, %rax
    0x7fff61caf539 &lt;+934&gt;:  movq   %rax, %rdx
    0x7fff61caf53c &lt;+937&gt;:  andq   $-0x100000, %rdx          ; imm = 0xFFF00000 
    0x7fff61caf543 &lt;+944&gt;:  movq   %rax, %rcx
    0x7fff61caf546 &lt;+947&gt;:  shrq   $0x4, %rcx
    0x7fff61caf54a &lt;+951&gt;:  shrl   $0x8, %eax
    0x7fff61caf54d &lt;+954&gt;:  andl   $0xffe, %eax              ; imm = 0xFFE 
    0x7fff61caf552 &lt;+959&gt;:  movl   $0x1, %esi
    0x7fff61caf557 &lt;+964&gt;:  movl   $0x1, %edi
    0x7fff61caf55c &lt;+969&gt;:  shll   %cl, %edi
    0x7fff61caf55e &lt;+971&gt;:  orl    %edi, 0xfc0a0(%rdx,%rax,4)
    0x7fff61caf565 &lt;+978&gt;:  orl    $0x1, %eax
    0x7fff61caf568 &lt;+981&gt;:  orl    %edi, 0xfc0a0(%rdx,%rax,4)
    0x7fff61caf56f &lt;+988&gt;:  leal   0x1(%rcx), %ecx
    0x7fff61caf572 &lt;+991&gt;:  movl   %ecx, %eax
    0x7fff61caf574 &lt;+993&gt;:  shrl   $0x4, %eax
    0x7fff61caf577 &lt;+996&gt;:  andl   $0xffe, %eax              ; imm = 0xFFE 
    0x7fff61caf57c &lt;+1001&gt;: shll   %cl, %esi
    0x7fff61caf57e &lt;+1003&gt;: orl    %esi, 0xfc0a0(%rdx,%rax,4)
    0x7fff61caf585 &lt;+1010&gt;: jmp    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf58a &lt;+1015&gt;: testq  %r8, %r8
    0x7fff61caf58d &lt;+1018&gt;: je     0x7fff61caf596            ; &lt;+1027&gt;
    0x7fff61caf58f &lt;+1020&gt;: movq   (%r13), %rcx
    0x7fff61caf593 &lt;+1024&gt;: movq   %rcx, (%r8)
    0x7fff61caf596 &lt;+1027&gt;: movq   %r8, 0x210(%r14)
    0x7fff61caf59d &lt;+1034&gt;: jmp    0x7fff61caf5ba            ; &lt;+1063&gt;
    0x7fff61caf59f &lt;+1036&gt;: movl   $0xfffffffe, %eax         ; imm = 0xFFFFFFFE 
    0x7fff61caf5a4 &lt;+1041&gt;: roll   %cl, %eax
    0x7fff61caf5a6 &lt;+1043&gt;: shrq   $0x5, %rcx
    0x7fff61caf5aa &lt;+1047&gt;: andl   %eax, 0x818(%r14,%rcx,4)
    0x7fff61caf5b2 &lt;+1055&gt;: movq   %r13, %rdi
    0x7fff61caf5b5 &lt;+1058&gt;: callq  0x7fff61cb05ab            ; get_tiny_free_size
    0x7fff61caf5ba &lt;+1063&gt;: leal   -0x1(%rax), %ecx
    0x7fff61caf5bd &lt;+1066&gt;: cmpw   %r15w, %cx
    0x7fff61caf5c1 &lt;+1070&gt;: jae    0x7fff61caf5cc            ; &lt;+1081&gt;
    0x7fff61caf5c3 &lt;+1072&gt;: movw   %ax, %r15w
    0x7fff61caf5c7 &lt;+1076&gt;: jmp    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf5cc &lt;+1081&gt;: subl   %r15d, %eax
    0x7fff61caf5cf &lt;+1084&gt;: movl   %r15d, %ecx
    0x7fff61caf5d2 &lt;+1087&gt;: shll   $0x4, %ecx
    0x7fff61caf5d5 &lt;+1090&gt;: movq   %r13, %rdx
    0x7fff61caf5d8 &lt;+1093&gt;: addq   %rcx, %rdx
    0x7fff61caf5db &lt;+1096&gt;: movzwl %ax, %ecx
    0x7fff61caf5de &lt;+1099&gt;: movq   %r12, %rdi
    0x7fff61caf5e1 &lt;+1102&gt;: movq   %r14, %rsi
    0x7fff61caf5e4 &lt;+1105&gt;: callq  0x7fff61cafe1b            ; tiny_free_list_add_ptr
    0x7fff61caf5e9 &lt;+1110&gt;: jmp    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf5ee &lt;+1115&gt;: testw  %di, %di
    0x7fff61caf5f1 &lt;+1118&gt;: jne    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf5f7 &lt;+1124&gt;: movw   $0x0, 0x10(%rax)
    0x7fff61caf5fd &lt;+1130&gt;: jmp    0x7fff61caf2f7            ; &lt;+356&gt;
    0x7fff61caf602 &lt;+1135&gt;: addq   $0x8, %r13
    0x7fff61caf606 &lt;+1139&gt;: movl   0x26c(%r12), %edi
    0x7fff61caf60e &lt;+1147&gt;: movq   %r13, %rsi
    0x7fff61caf611 &lt;+1150&gt;: callq  0x7fff61cc5505            ; free_list_checksum_botch.352
    0x7fff61caf616 &lt;+1155&gt;: ud2    
    0x7fff61caf618 &lt;+1157&gt;: nop    
</code></pre>

<p>The offender is <code>0x7fff61caf227 &lt;+148&gt;:  movq   %rdx, (%rax)</code>, where <code>rax</code> is the address of my <code>weights</code> pointer that gets nulled, and <code>rdx</code> is 0.</p>
