[scudo] Fix insufficient blocks when pushing BatchClass blocks

[Chia-hungDuan]

Summary

populateFreeListAndPopBatch may return batch with single block. Merge
it with the reported free blocks and enqueue them together.

[Chia-hungDuan]

Add more context for @cferris, this logic is only needed temporarily. We don't rely on this precondition after we land D153492

[Chia-hungDuan]

slightly repharse the problem

[cferris]

LGTM

compiler-rt/lib/scudo/standalone/primary64.h

if (ClassId == SizeClassMap::BatchClassId) {
         ScopedLock L(Region->MMLock);
         {
           ScopedLock L(Region->FLLock);
           const bool NeedToRefill = Size == 1U &&
                                     Region->FreeListInfo.BlockList.empty() &&
                                     B == nullptr;
           if (UNLIKELY(!NeedToRefill)) {
             if (UNLIKELY(B)) {
+              // Even though we always populate the blocks with the number which
+              // is multiple of TransferBatch::getMaxCached() , the top
+              // `TransferBatch` from the freelist may still have fewer elements
+              // than the size of TransferBatch::getMaxCached() because we
+              // always fill up the top `TransferBatch` first when it's not
+              // full.
+              // When this happens, simply push the block in `TransferBatch` and
+              // `Array` together.
+              if (UNLIKELY(B->getCount() == 1)) {
+                DCHECK_EQ(Size, 1U);
+                B->appendFromArray(Array, 1U);
+                Size = 0;
+              }
               pushBlocksImpl(C, SizeClassMap::BatchClassId, Region,
                              B->getRawArray(), B->getCount());
               CHECK(!Region->FreeListInfo.BlockList.empty());
+              if (Size == 0)
+                return;
             }
             pushBlocksImpl(C, SizeClassMap::BatchClassId, Region, Array, Size);
             return;
           }
         }
 
         // Note that this batch will be pushed again and it's only used to
         // ensure we have enough blocks to construct batch group.