Maybe it depends upon the architecture? With a 64 bit address space, there should be plenty of room to allow for a contiguous sbrk-allocated chunk of memory and separate mmap regions that are far away from any possible overlap. 32 bit processes might have to take more precautions to prevent premature address space collisions.

Wouldn't sbrk kind of get in the way of ASLR?

malloc still uses sbrk() it seems; and only uses mmap() when requesting blocks larger than MMAP_THRESHOLD. I'll have to verify this I guess.

http://man7.org/linux/man-pages/man3/malloc.3.html

Yup that's true on my machine atleast. Ran this:

  #include <stdio.h>
  #include <stdlib.h>

  int main(void)
  {
  	int i = 0;
	for(i=0; i<200000; i+= 1000)
	{
		printf("%d",i);
		fflush(stdout);
		malloc(i);
	}

  return 0;
  }

strace output where it switches from sbrk to mmap:

  write(1, "125000", 6125000)                   = 6
  write(1, "126000", 6126000)                   = 6
  brk(0x1a65000)                          = 0x1a65000
  write(1, "127000", 6127000)                   = 6
  write(1, "128000", 6128000)                   = 6
  brk(0x1aa3000)                          = 0x1aa3000
  write(1, "129000", 6129000)                   = 6
  write(1, "130000", 6130000)                   = 6
  brk(0x1ae2000)                          = 0x1ae2000
  write(1, "131000", 6131000)                   = 6
  write(1, "132000", 6132000)                   = 6
  mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3aa9b04000
  write(1, "133000", 6133000)                   = 6
  mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3aa9ae3000
  write(1, "134000", 6134000)                   = 6
  mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3aa9ac2000

Only in Linux's case.