The instance allocator progresses along the pool linearly, returning the first free block it finds. Inevitably, it reaches the end of the pool, at which point it returns to the beginning. It seems though that when this happens, the allocator will sometimes return a block near the beginning of the pool that's already in use, which in some cases leads to memory corruption as whoever invoked the allocator may attempt to overwrite this object.
sakura57
commented
4 years ago
The instance allocator progresses along the pool linearly, returning the first free block it finds. Inevitably, it reaches the end of the pool, at which point it returns to the beginning. It seems though that when this happens, the allocator will sometimes return a block near the beginning of the pool that's already in use, which in some cases leads to memory corruption as whoever invoked the allocator may attempt to overwrite this object.
This often, but not always, results in a crash.