s

1 2	delete(2) # delete idx 1 delete(1) # delete idx 0, idx 0 point to idx 1 #在fastbin中后释放的1的bk会指向先释放的2的地址，从而泄露堆地址。