How does SGI STL's memory pool reclaim chunk memory?

SGI STL, unused memory is mounted as a linked list in free_list . If there is enough memory in free_list , it is returned directly. However, memory recycling is not necessarily in the order in which memory is requested, which leads to the fact that the first memory in the linked list is not necessarily the header memory of chunk

and if you want to reclaim the memory of the chunk part, you must know the header address of its malloc () postback, and then pass it to free () . Although this address must exist in free_list , how do you know? At present, the only way you can think of is to have a dynamic void * [] array that records the header address

because in chunk_alloc () , if start_free = = end_free occurs, if there is enough memory, that is, malloc () succeeds, start_free and end_free will be overwritten. There is no action in the chunk_alloc () function to record the

of the original address.

therefore, I looked at the source code of allocators.cpp in STLport 5.2.1. About the recycling of chunk memory, I found these codes:

-sharpinclude <iostream>

using namespace std;
union x {
    x *next;
    char client_data[0];
};
int main(int argc, char *argv[]) {
    auto p {malloc(sizeof(x) * 2)};
    auto x_ptr1 {static_cast<x *>(p)};
    auto x_ptr2 {static_cast<x *>(p) + 1};
    free(x_ptr2);
    free(x_ptr1);
}

the final result is pointer being freed was not allocated
* set a breakpoint in malloc_error_break to debug
Terminated due to signal: ABORT TRAP (6)

so this is not feasible

how does, SGI STL finally reclaim chunk memory?