cumo 0.5.5 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96a38fa0ad4be223020cef21720e30e9a32fcd2901798279293924df8bfd0f92
-  data.tar.gz: c826e49bea46001d6764c7d0f8ad124e5b6072543eb97a07990a26453dd71bf7
+  metadata.gz: 324cdfec0cf163d40b3b3b635fa69ecf516aa12e15a0bf614cbc34d3fe61a4c7
+  data.tar.gz: 3d0f6c8b66a9b51eca9fe6912c1a4e7c3534a028ed4c8d740467ae8d6e215824
 SHA512:
-  metadata.gz: 1dba1ea3cb5a9c93044d222a9d03c975809c5b03d7925702aa3357a0244752d532cb9421b0632e71808944685c3ca44e7a0fc6032ca8c39d8083c279596dce61
-  data.tar.gz: 81c933a8f07f862b22a0c6be5e397000d4ea9476139203353907ba7de21a7aae418264fa8425b197d6302861a2788d262af2d2ecd2e34100900d2293706439f4
+  metadata.gz: 9c82a985c471260943c4716630d6db803706ac50cccd5e1fc8a0a2bb02d80172ec38743f5c5f286467e97814843b8fbe1d6ec1f98e75081364fd9a5c0a4da832
+  data.tar.gz: d3ed8c3e8844d51676c4011139faa509de8cdb39ef325d84b4b8b41f6725fb63b9893fae8dbced5e546810ff4eb570f60a347ef248323f805bffa9fde60faab1

data/CHANGELOG.md

@@ -1,3 +1,30 @@
+# 0.5.6 (2026/08/09)
+
+Fixes:
+
+* Fix out-of-tree build failing to create the narray/types object directory
+* Fix segfaults from unchecked String arguments in Driver (#179)
+* Fix out-of-bounds read of include_names in nvrtcCreateProgram (#178)
+* Fix store into a strided view reading a released staging buffer (#177)
+* Fix pinned host memory leak when indexing by an array (#176)
+* Fix segfault in Module#get_global_var reading device memory as a host pointer (#174)
+* Fix freeing pooled memory with cudaFree after disabling the pool (#173)
+* Fix run-ctest failing to start the test binary (#172)
+* Fix process abort when freeing device memory fails (#171)
+* Fix memory pool handing out a tiny chunk for a huge allocation (#170)
+* Fix out-of-bounds read of a shorter sub-narray in store (#169)
+* Fix out-of-bounds device write in store when a sub-narray is too long (#168)
+* Backport: fix na_flatten_dim for multi-dimensional empty arrays (#167)
+* Backport: make qsort loop condition explicit to prevent incorrect optimization (#166)
+* Backport: free previously allocated shape in cumo_na_alloc_shape (#165)
+* Backport: free shape on deallocation regardless of size (#164)
+* Backport: convert max to double in rand method of Cumo::RObject (#163)
+* Backport: use an inline function to prevent double use of macro argument (#162)
+* Fix out-of-bounds stridx access in at() when :new is given (#161)
+* Backport: prevent out-of-bounds access to stridx when orig_dim exceeds ndim (#160)
+* Backport: prevent negative array index in na_get_strides_nadata when ndim is zero (#159)
+* Backport: use correct array index for mod result in divmod macro for Cumo::RObject (#158)
+
 # 0.5.5 (2026/07/11)
 
 Fixes:

data/ext/cumo/cuda/driver.c

@@ -102,15 +102,19 @@ rb_cuLinkAddData(VALUE self, VALUE state, VALUE type, VALUE data, VALUE name)
 {
     CUlinkState _state = (CUlinkState)NUM2SIZET(state);
     CUjitInputType _type = (CUjitInputType)NUM2INT(type);
-    void* _data = (void *)RSTRING_PTR(data);
+    // The image may be a cubin, so it is taken by length and allowed to hold
+    // NUL bytes; the name is a plain C string cuLinkAddData reports errors with.
+    void* _data = (void *)StringValuePtr(data);
     size_t _size = RSTRING_LEN(data);
-    const char* _name = RSTRING_PTR(data);
+    const char* _name = StringValueCStr(name);
     CUresult status;
 
     struct cuLinkAddDataParam param = {_state, _type, _data, _size, _name, 0, (CUjit_option*)0, (void**)0};
     status = (CUresult)rb_thread_call_without_gvl(cuLinkAddData_without_gvl_cb, &param, NULL, NULL);
     //status = cuLinkAddData(_state, _type, _data, _size, _name, 0, (CUjit_option*)0, (void**)0);
 
+    RB_GC_GUARD(data);
+    RB_GC_GUARD(name);
     check_status(status);
     return Qnil;
 }
@@ -139,13 +143,14 @@ rb_cuLinkAddFile(VALUE self, VALUE state, VALUE type, VALUE path)
 {
     CUlinkState _state = (CUlinkState)NUM2SIZET(state);
     CUjitInputType _type = (CUjitInputType)NUM2INT(type);
-    const char* _path = RSTRING_PTR(path);
+    const char* _path = StringValueCStr(path);
     CUresult status;
 
     struct cuLinkAddFileParam param = {_state, _type, _path, 0, (CUjit_option*)0, (void **)0};
     status = (CUresult)rb_thread_call_without_gvl(cuLinkAddFile_without_gvl_cb, &param, NULL, NULL);
     //status = cuLinkAddFile(_state, _type, _path, 0, (CUjit_option*)0, (void **)0);
 
+    RB_GC_GUARD(path);
     check_status(status);
     return Qnil;
 }
@@ -259,13 +264,14 @@ rb_cuModuleGetFunction(VALUE self, VALUE hmod, VALUE name)
 {
     CUfunction _hfunc;
     CUmodule _hmod = (CUmodule)NUM2SIZET(hmod);
-    const char* _name = RSTRING_PTR(name);
+    const char* _name = StringValueCStr(name);
     CUresult status;
 
     struct cuModuleGetFunctionParam param = {&_hfunc, _hmod, _name};
     status = (CUresult)rb_thread_call_without_gvl(cuModuleGetFunction_without_gvl_cb, &param, NULL, NULL);
     //status = cuModuleGetFunction(&_hfunc, _hmod, _name);
 
+    RB_GC_GUARD(name);
     check_status(status);
     return SIZET2NUM((size_t)_hfunc);
 }
@@ -292,15 +298,21 @@ rb_cuModuleGetGlobal(VALUE self, VALUE hmod, VALUE name)
     CUdeviceptr _dptr;
     size_t _bytes;
     CUmodule _hmod = (CUmodule)NUM2SIZET(hmod);
-    const char* _name = RSTRING_PTR(name);
+    const char* _name = StringValueCStr(name);
     CUresult status;
+    VALUE ret;
 
     struct cuModuleGetGlobalParam param = {&_dptr, &_bytes, _hmod, _name};
     status = (CUresult)rb_thread_call_without_gvl(cuModuleGetGlobal_without_gvl_cb, &param, NULL, NULL);
     //status = cuModuleGetGlobal(&_dptr, &_bytes, _hmod, _name);
 
+    RB_GC_GUARD(name);
     check_status(status);
-    return rb_str_new((char *)_dptr, _bytes);
+
+    // _dptr addresses device memory, which the host cannot read directly.
+    ret = rb_str_new(NULL, (long)_bytes);
+    check_status(cuMemcpyDtoH(RSTRING_PTR(ret), _dptr, _bytes));
+    return ret;
 }
 
 struct cuModuleLoadParam {
@@ -321,13 +333,14 @@ static VALUE
 rb_cuModuleLoad(VALUE self, VALUE fname)
 {
     CUmodule _module;
-    const char* _fname = RSTRING_PTR(fname);
+    const char* _fname = StringValueCStr(fname);
     CUresult status;
 
     struct cuModuleLoadParam param = {&_module, _fname};
     status = (CUresult)rb_thread_call_without_gvl(cuModuleLoad_without_gvl_cb, &param, NULL, NULL);
     //status = cuModuleLoad(&_module, _fname);
 
+    RB_GC_GUARD(fname);
     check_status(status);
     return SIZET2NUM((size_t)_module);
 }
@@ -350,13 +363,15 @@ static VALUE
 rb_cuModuleLoadData(VALUE self, VALUE image)
 {
     CUmodule _module;
-    const void* _image = (void*)RSTRING_PTR(image);
+    // A cubin is binary, so the image is not required to be NUL-free.
+    const void* _image = (void*)StringValuePtr(image);
     CUresult status;
 
     struct cuModuleLoadDataParam param = {&_module, _image};
     status = (CUresult)rb_thread_call_without_gvl(cuModuleLoadData_without_gvl_cb, &param, NULL, NULL);
     //status = cuModuleLoadData(&_module, _image);
 
+    RB_GC_GUARD(image);
     check_status(status);
     return SIZET2NUM((size_t)_module);
 }

data/ext/cumo/cuda/memory_pool.cpp

@@ -50,16 +50,22 @@ cumo_cuda_runtime_malloc(size_t size)
 void
 cumo_cuda_runtime_free(char *ptr)
 {
-    if (memory_pool_enabled) {
-        try {
-            // TODO(sonots): Get current CUDA stream and pass it
-            pool.Free(reinterpret_cast<intptr_t>(ptr));
-        } catch (const cumo::internal::CUDARuntimeError& e) {
-            cumo_cuda_runtime_check_status(e.status());
+    // Always offer the pointer to the pool first, whatever memory_pool_enabled
+    // says now: MemoryPool.enable/disable is public, so the state can differ
+    // from what it was at allocation time. Handing a pooled chunk to cudaFree
+    // releases memory the pool still hands out, and fails outright for a chunk
+    // which is not at the head of its buffer.
+    try {
+        // TODO(sonots): Get current CUDA stream and pass it
+        if (pool.Free(reinterpret_cast<intptr_t>(ptr))) {
+            return;
         }
-    } else {
-        cumo_cuda_runtime_check_status(cudaFree((void*)ptr));
+    } catch (const cumo::internal::CUDARuntimeError& e) {
+        cumo_cuda_runtime_check_status(e.status());
+        return;
     }
+    // No pool owns it, so it came straight from cudaMallocManaged.
+    cumo_cuda_runtime_check_status(cudaFree((void*)ptr));
 }
 
 /*

data/ext/cumo/cuda/memory_pool_impl.cpp

@@ -1,5 +1,7 @@
 #include "memory_pool_impl.hpp"
 
+#include <cstdio>
+
 #include <ruby.h>
 
 namespace cumo {
@@ -25,9 +27,15 @@ Memory::~Memory() {
         cudaError_t status = cudaFree(ptr_);
         // CUDA driver may shut down before freeing memory inside memory pool.
         // It is okay to simply ignore because CUDA driver automatically frees memory.
-        if (status != cudaErrorCudartUnloading) {
-            CheckStatus(status);
+        if (status == cudaSuccess || status == cudaErrorCudartUnloading) {
+            return;
         }
+        // A destructor is implicitly noexcept, so throwing here would call
+        // std::terminate and abort the process. Report the failure instead:
+        // cudaFree only fails once the context is already unusable, and the
+        // next runtime call reports the same status to the caller anyway.
+        std::fprintf(stderr, "cumo: failed to free %zu bytes of device memory: %s\n",
+                     size_, cudaGetErrorString(status));
     }
 }
 
@@ -63,14 +71,14 @@ void Merge(std::shared_ptr<Chunk>& self, std::shared_ptr<Chunk> remaining) {
 
 void SingleDeviceMemoryPool::AppendToFreeList(size_t size, std::shared_ptr<Chunk>& chunk, cudaStream_t stream_ptr) {
     assert(chunk != nullptr && !chunk->in_use());
-    int bin_index = GetBinIndex(size);
+    size_t bin_index = GetBinIndex(size);
 
     std::lock_guard<std::recursive_mutex> lock{mutex_};
 
     Arena& arena = GetArena(stream_ptr);
     ArenaIndexMap& arena_index_map = GetArenaIndexMap(stream_ptr);
-    int arena_index = std::lower_bound(arena_index_map.begin(), arena_index_map.end(), bin_index) - arena_index_map.begin();
-    int length = static_cast<int>(arena_index_map.size());
+    size_t arena_index = std::lower_bound(arena_index_map.begin(), arena_index_map.end(), bin_index) - arena_index_map.begin();
+    size_t length = arena_index_map.size();
     if (arena_index >= length || arena_index_map.at(arena_index) != bin_index) {
         arena_index_map.insert(arena_index_map.begin() + arena_index, bin_index);
         arena.insert(arena.begin() + arena_index, FreeList{});
@@ -81,7 +89,7 @@ void SingleDeviceMemoryPool::AppendToFreeList(size_t size, std::shared_ptr<Chunk
 
 bool SingleDeviceMemoryPool::RemoveFromFreeList(size_t size, std::shared_ptr<Chunk>& chunk, cudaStream_t stream_ptr) {
     assert(chunk != nullptr && !chunk->in_use());
-    int bin_index = GetBinIndex(size);
+    size_t bin_index = GetBinIndex(size);
 
     std::lock_guard<std::recursive_mutex> lock{mutex_};
 
@@ -90,20 +98,32 @@ bool SingleDeviceMemoryPool::RemoveFromFreeList(size_t size, std::shared_ptr<Chu
     if (arena_index_map.size() == 0) {
         return false;
     }
-    int arena_index = std::lower_bound(arena_index_map.begin(), arena_index_map.end(), bin_index) - arena_index_map.begin();
-    if (static_cast<size_t>(arena_index) == arena_index_map.size()) {
+    size_t arena_index = std::lower_bound(arena_index_map.begin(), arena_index_map.end(), bin_index) - arena_index_map.begin();
+    if (arena_index == arena_index_map.size()) {
         // Bin does not exist for the given chunk size.
         return false;
     }
     if (arena_index_map.at(arena_index) != bin_index) {
         return false;
     }
-    assert(arena.size() > static_cast<size_t>(arena_index));
+    assert(arena.size() > arena_index);
     FreeList& free_list = arena[arena_index];
     return EraseFromFreeList(free_list, chunk);
 }
 
 intptr_t SingleDeviceMemoryPool::Malloc(size_t size, cudaStream_t stream_ptr) {
+    if (size == 0) {
+        // A zero-sized chunk would share its address with the chunk it was
+        // split from, and aliased addresses break the `in_use_` bookkeeping.
+        // cudaMalloc returns a null pointer for a zero-sized request as well.
+        return 0;
+    }
+    if (size > kMaxAllocationSize) {
+        // Rounding up would wrap around in size_t and the pool would then hand
+        // out a chunk far smaller than requested. Such a request can never be
+        // satisfied, so report it as out of memory instead.
+        throw OutOfMemoryError(size, GetTotalBytes());
+    }
     size = GetRoundedSize(size);
     std::shared_ptr<Chunk> chunk = nullptr;
 
@@ -112,9 +132,9 @@ intptr_t SingleDeviceMemoryPool::Malloc(size_t size, cudaStream_t stream_ptr) {
 
         // find best-fit, or a smallest larger allocation
         Arena& arena = GetArena(stream_ptr);
-        int arena_index = GetArenaIndex(size);
-        int arena_length = static_cast<int>(arena.size());
-        for (int i = arena_index; i < arena_length; ++i) {
+        size_t arena_index = GetArenaIndex(size);
+        size_t arena_length = arena.size();
+        for (size_t i = arena_index; i < arena_length; ++i) {
             FreeList& free_list = arena[i];
             if (free_list.empty()) {
                 continue;
@@ -166,17 +186,24 @@ intptr_t SingleDeviceMemoryPool::Malloc(size_t size, cudaStream_t stream_ptr) {
     return chunk->ptr();
 }
 
-void SingleDeviceMemoryPool::Free(intptr_t ptr, cudaStream_t stream_ptr) {
+bool SingleDeviceMemoryPool::Free(intptr_t ptr, cudaStream_t stream_ptr) {
     std::shared_ptr<Chunk> chunk = nullptr;
 
     {
         std::lock_guard<std::recursive_mutex> lock{mutex_};
 
-        chunk = in_use_[ptr];
-        // assert(chunk != nullptr);
-        if (!chunk) return;
+        // find rather than operator[], which would insert an empty entry for
+        // every pointer this pool does not own.
+        auto it = in_use_.find(ptr);
+        if (it == in_use_.end()) {
+            return false;
+        }
+        chunk = it->second;
+        in_use_.erase(it);
+        if (!chunk) {
+            return false;
+        }
         chunk->set_in_use(false);
-        in_use_.erase(ptr);
     }
 
     if (chunk->next() != nullptr && !chunk->next()->in_use()) {
@@ -191,6 +218,7 @@ void SingleDeviceMemoryPool::Free(intptr_t ptr, cudaStream_t stream_ptr) {
         }
     }
     AppendToFreeList(chunk->size(), chunk, stream_ptr);
+    return true;
 }
 
 void SingleDeviceMemoryPool::CompactIndex(cudaStream_t stream_ptr, bool free) {

data/ext/cumo/cuda/memory_pool_impl.hpp

@@ -3,6 +3,7 @@
 
 #include <algorithm>
 #include <cassert>
+#include <limits>
 #include <memory>
 #include <mutex>
 #include <stdexcept>
@@ -21,6 +22,10 @@ namespace internal {
 // cf. https://gist.github.com/sonots/41daaa6432b1c8b27ef782cd14064269
 constexpr int kRoundSize = 512; // bytes
 
+// The largest size which can be rounded up to a multiple of kRoundSize without
+// wrapping around in size_t. Larger requests can never be satisfied anyway.
+constexpr size_t kMaxAllocationSize = std::numeric_limits<size_t>::max() - (kRoundSize - 1);
+
 class CUDARuntimeError : public std::runtime_error {
 private:
     cudaError_t status_;
@@ -143,7 +148,7 @@ public:
 
 using FreeList = std::vector<std::shared_ptr<Chunk>>;  // list of free chunk
 using Arena = std::vector<FreeList>;  // free_list w.r.t arena index
-using ArenaIndexMap = std::vector<int>;  // arena index <=> bin size index
+using ArenaIndexMap = std::vector<size_t>;  // arena index <=> bin size index
 
 // Memory pool implementation for single device.
 // - The allocator attempts to find the smallest cached block that will fit
@@ -167,7 +172,9 @@ public:
 
     intptr_t Malloc(size_t size, cudaStream_t stream_ptr = 0);
 
-    void Free(intptr_t ptr, cudaStream_t stream_ptr = 0);
+    // Returns false if this pool did not allocate the pointer, in which case
+    // nothing was freed.
+    bool Free(intptr_t ptr, cudaStream_t stream_ptr = 0);
 
     // Free all **non-split** chunks in all arenas
     void FreeAllBlocks();
@@ -188,17 +195,29 @@ public:
 // private:
 
     // Rounds up the memory size to fit memory alignment of cudaMalloc.
+    //
+    // `size` must not exceed kMaxAllocationSize. Otherwise the addition below
+    // wraps around in size_t, and the largest sizes would round down to 0.
     size_t GetRoundedSize(size_t size) {
+        assert(size <= kMaxAllocationSize);
         return ((size + kRoundSize - 1) / kRoundSize) * kRoundSize;
     }
 
     // Get bin index regarding the memory size
-    int GetBinIndex(size_t size) {
+    //
+    // The index is a size_t rather than an int because the bin index of a huge
+    // size does not fit in an int. A truncated (possibly negative) index makes
+    // the free list search below start at the wrong bin and hand out a chunk
+    // smaller than requested.
+    //
+    // `size` must be positive; a zero-sized allocation has no bin.
+    size_t GetBinIndex(size_t size) {
+        assert(size > 0);
         return (size - 1) / kRoundSize;
     }
 
-    int GetArenaIndex(size_t size, cudaStream_t stream_ptr = 0) {
-        int bin_index = GetBinIndex(size);
+    size_t GetArenaIndex(size_t size, cudaStream_t stream_ptr = 0) {
+        size_t bin_index = GetBinIndex(size);
         ArenaIndexMap& arena_index_map = GetArenaIndexMap(stream_ptr);
         return std::lower_bound(arena_index_map.begin(), arena_index_map.end(), bin_index) - arena_index_map.begin();
     }
@@ -308,9 +327,30 @@ public:
     // Args:
     //     ptr (intptr_t): Pointer of the memory buffer
     //     stream_ptr (cudaStream_t): Return the memory to the arena of given stream
-    void Free(intptr_t ptr, cudaStream_t stream_ptr = 0) {
-        auto& mp = pools_[device_id()];
-        mp.Free(ptr, stream_ptr);
+    // Returns:
+    //     bool: false if no pool allocated the pointer, in which case nothing
+    //           was freed and the caller has to free it by its own means.
+    bool Free(intptr_t ptr, cudaStream_t stream_ptr = 0) {
+        if (pools_.empty()) {  // nothing has ever been allocated from a pool
+            return false;
+        }
+        int current_device_id = device_id();
+        auto it = pools_.find(current_device_id);
+        if (it != pools_.end() && it->second.Free(ptr, stream_ptr)) {
+            return true;
+        }
+        // The current device may have been switched since the allocation.
+        // cudaMallocManaged hands out addresses which are unique across the
+        // host and every device, so the pointer identifies its pool on its own.
+        for (auto& entry : pools_) {
+            if (entry.first == current_device_id) {
+                continue;
+            }
+            if (entry.second.Free(ptr, stream_ptr)) {
+                return true;
+            }
+        }
+        return false;
     }
 
     // Free all **non-split** chunks in all arenas

data/ext/cumo/cuda/memory_pool_impl_test.cpp

@@ -134,12 +134,15 @@ public:
     void Run() {
         TearDown(); SetUp(); TestGetRoundedSize();
         TearDown(); SetUp(); TestGetBinIndex();
+        TearDown(); SetUp(); TestGetArenaIndexWithHugeSize();
         TearDown(); SetUp(); TestAppendToFreeList();
         TearDown(); SetUp(); TestRemoveFromFreeList();
         TearDown(); SetUp(); TestMalloc();
         TearDown(); SetUp(); TestMallocWithZero();
+        TearDown(); SetUp(); TestMallocWithHugeSize();
         TearDown(); SetUp(); TestFree();
         TearDown(); SetUp(); TestFreeDoubly();
+        TearDown(); SetUp(); TestFreeReportsOwnership();
         TearDown(); SetUp(); TestMallocSplit();
         TearDown(); SetUp(); TestFreeMerge();
         TearDown(); SetUp(); TestFreeDifferentSize();
@@ -156,12 +159,28 @@ public:
         assert(pool_->GetRoundedSize(kRoundSize - 1) == kRoundSize);
         assert(pool_->GetRoundedSize(kRoundSize) == kRoundSize);
         assert(pool_->GetRoundedSize(kRoundSize + 1) == kRoundSize * 2);
+        // the largest roundable size must not wrap around to 0
+        assert(pool_->GetRoundedSize(kMaxAllocationSize) == kMaxAllocationSize);
     }
 
     void TestGetBinIndex() {
         assert(pool_->GetBinIndex(kRoundSize - 1) == 0);
         assert(pool_->GetBinIndex(kRoundSize) == 0);
         assert(pool_->GetBinIndex(kRoundSize + 1) == 1);
+        // the bin index of a huge size does not fit in an int
+        assert(pool_->GetBinIndex(kMaxAllocationSize) == (kMaxAllocationSize - 1) / kRoundSize);
+    }
+
+    void TestGetArenaIndexWithHugeSize() {
+        auto mem = std::make_shared<Memory>(kRoundSize * 4);
+        auto chunk = std::make_shared<Chunk>(mem, 0, mem->size(), stream_ptr_);
+        pool_->AppendToFreeList(chunk->size(), chunk, stream_ptr_);
+
+        assert(pool_->GetArenaIndex(kRoundSize * 4, stream_ptr_) == 0);
+        // A bin index which does not fit in an int must not fold back to a
+        // smaller arena index, or the free list search would pick this chunk.
+        assert(pool_->GetArenaIndex(size_t(1) << 41, stream_ptr_) == 1);
+        assert(pool_->GetArenaIndex(kMaxAllocationSize, stream_ptr_) == 1);
     }
 
     void TestAppendToFreeList() {
@@ -292,7 +311,38 @@ public:
     }
 
     void TestMallocWithZero() {
-        pool_->Malloc(0); // actually, cuda returns 0
+        intptr_t p1 = pool_->Malloc(kRoundSize * 4);
+        pool_->Free(p1);
+
+        assert(pool_->Malloc(0) == 0); // actually, cuda returns 0
+        // A zero-sized request must not take a cached chunk, or two live
+        // allocations would share one address.
+        assert(pool_->GetUsedBytes() == 0);
+        assert(pool_->GetFreeBytes() == kRoundSize * 4);
+        assert(pool_->Malloc(kRoundSize * 4) == p1);
+    }
+
+    void TestMallocWithHugeSize() {
+        intptr_t p1 = pool_->Malloc(kRoundSize * 4);
+        pool_->Free(p1);
+
+        // Sizes which cannot be rounded up without wrapping around in size_t
+        // must be rejected instead of being rounded down to 0.
+        assert(RaisesOutOfMemory(kMaxAllocationSize + 1));
+        assert(RaisesOutOfMemory(std::numeric_limits<size_t>::max()));
+
+        assert(pool_->GetUsedBytes() == 0);
+        assert(pool_->GetFreeBytes() == kRoundSize * 4);
+        assert(pool_->Malloc(kRoundSize * 4) == p1);
+    }
+
+    bool RaisesOutOfMemory(size_t size) {
+        try {
+            pool_->Malloc(size);
+        } catch (const OutOfMemoryError&) {
+            return true;
+        }
+        return false;
     }
 
     void TestFree() {
@@ -308,6 +358,33 @@ public:
         // pool_->Free(p1); // will abort
     }
 
+    // Free reports whether the pool owns the pointer, so that a caller which
+    // allocated outside the pool can fall back to cudaFree without releasing
+    // memory the pool still hands out.
+    void TestFreeReportsOwnership() {
+        intptr_t p = pool_->Malloc(kRoundSize * 4);
+        assert(pool_->Free(p));
+        assert(!pool_->Free(p));  // already returned to the free list
+
+        assert(!pool_->Free(0));
+        assert(!pool_->Free(p + 1));
+
+        // a buffer allocated outside the pool, as happens while the pool is
+        // disabled, stays the caller's to free
+        void* raw = nullptr;
+        CheckStatus(cudaMallocManaged(&raw, kRoundSize, cudaMemAttachGlobal));
+        assert(!pool_->Free(reinterpret_cast<intptr_t>(raw)));
+        CheckStatus(cudaFree(raw));
+
+        // a chunk which is not at the head of its buffer is owned just as much,
+        // and is exactly the one cudaFree cannot free
+        intptr_t head = pool_->Malloc(kRoundSize * 2);
+        intptr_t tail = pool_->Malloc(kRoundSize * 2);
+        assert(head != tail);
+        assert(pool_->Free(tail));
+        assert(pool_->Free(head));
+    }
+
     void TestMallocSplit() {
         intptr_t p = pool_->Malloc(kRoundSize * 4);
         pool_->Free(p);
@@ -543,6 +620,29 @@ public:
     }
 };
 
+// Resets the CUDA device, so it has to run after every other test.
+class TestMemoryDestructor {
+public:
+    void Run() {
+        TestFailingFreeDoesNotAbort();
+    }
+
+    // A destructor is implicitly noexcept, so a throwing CheckStatus here used
+    // to call std::terminate and abort the whole process.
+    void TestFailingFreeDoesNotAbort() {
+        auto mem = std::make_shared<Memory>(kRoundSize);
+        // Destroying the primary context invalidates the pointer, so the
+        // cudaFree in ~Memory fails with cudaErrorInvalidValue.
+        CheckStatus(cudaDeviceReset());
+
+        std::cerr << "(the cumo warning below is expected)" << std::endl;
+        mem.reset();
+        // Reaching this line is the assertion: the destructor reported the
+        // failure instead of terminating the process.
+        cudaGetLastError();  // clear the error left by the failed cudaFree
+    }
+};
+
 }  // namespace internal
 }  // namespace cumo
 
@@ -550,5 +650,6 @@ int main() {
     cumo::internal::TestChunk{}.Run();
     cumo::internal::TestSingleDeviceMemoryPool{}.Run();
     cumo::internal::TestMemoryPool{}.Run();
+    cumo::internal::TestMemoryDestructor{}.Run();
     return 0;
 }