Assertion malloc.c: sYSMALLOc and malloc(): memory corruption

[attekett]

Tested on:

OS: Ubuntu 12.04
Node: v0.10.4

Minimized test case:

while(true){
    var test=new Buffer(10000)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test=remove(test)
    test.writeDoubleBE(0xFFFFFFFFFFFFFFFF,test.length,true)

    function remove(input){
        return Buffer.concat([input.slice(0,100),input.slice((101),input.length)])
    }

}

~$ node ./crash-test-node.js 
*** glibc detected *** node: malloc(): memory corruption: 0x0000000001371dd0 ***

If you change the amount of 'test=remove(test)' lines the crash changes.

8 lines:
~$ node ./crash-test-node.js 
node: malloc.c:2451: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.

[bnoordhuis]

Well, you're passing noAssert=true to Buffer#writeDoubleBE(). noAssert means 'take off the safety wheels, I know what I'm doing'. Closing, works as expected.