> Slotmap keeps track of the "identity" of the stored object

(I am not sure if slotmap uses this strategy)

To give more details some of these data structures use generational indexes, a pair (generation, index) where index is a plain index of the underlying vector and generation is a bookkeeping counter of how many times you have allocated a value to that index. These two values can be combined in a single 32bit-64bit value but additional memory would be required to keep track of the counter.

E.g. with a vector of length 2

{meta: [0,0], data:[...]}

malloc -> (1,0)

{meta: [1,0], data:[...]}

malloc -> (1,1)

{meta: [1,1], data:[...]}

free(0)

{meta: [2,1], data:[...]}

malloc -> (3,0)

{meta: [3,1], data:[...]}

free(0)

{meta: [4,1], data:[...]}

malloc -> (5,0)

{meta: [5,1], data:[...]}

free(0)

free(1)

{meta: [6,2], data:[...]}

malloc -> (7,0)

malloc -> (3,1)

{meta: [7,3], data:[...]}

This way if you tried to access the pointer (5,0) the library can check that at index zero of the meta array the generation is 7 and conclude that you are doing a use after free (in this example even generations denote unallocated memory).

This is a description of a very simplified algorithm.