Program: 186547
Project: 186547
Buggy source:
static int newArray(int size,int type){
  if (size < 0) {
    throw new NegativeArraySizeException();
  }
  int arrayLength=size;
  if ((type == 11) || (type == 7))   size<<=1;
  if (Config.USE_SCOPES) {
    int ptr=allocationPointer;
    if (RtThreadImpl.initArea == null) {
      allocationPointer+=size + HEADER_SIZE;
    }
 else {
      Memory sc=null;
      if (RtThreadImpl.mission) {
        Scheduler s=Scheduler.sched[RtThreadImpl.sys.cpuId];
        sc=s.ref[s.active].currentArea;
      }
 else {
        sc=RtThreadImpl.initArea;
      }
      if (sc.allocPtr + size + HEADER_SIZE > sc.endLocalPtr) {
        throw OOMError;
      }
      ptr=sc.allocPtr;
      sc.allocPtr+=size + HEADER_SIZE;
      if (Config.ADD_REF_INFO) {
        ptr=ptr | (sc.level << 25);
      }
      Native.wrMem(sc.level,ptr + OFF_SPACE);
    }
    Native.wrMem(ptr + HEADER_SIZE,ptr + OFF_PTR);
    Native.wrMem(arrayLength,ptr + OFF_MTAB_ALEN);
    Native.wrMem(type,ptr + OFF_TYPE);
    return ptr;
  }
synchronized (mutex) {
    if (copyPtr + size >= allocPtr) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        gc_alloc();
      }
      if (copyPtr + size >= allocPtr) {
        throw OOMError;
      }
    }
  }
synchronized (mutex) {
    if (freeList == 0) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        log("String_Node_Str");
        gc_alloc();
        if (freeList == 0) {
          throw OOMError;
        }
      }
    }
  }
  int ref;
synchronized (mutex) {
    allocPtr-=size;
    ref=freeList;
    freeList=Native.rdMem(ref + OFF_NEXT);
    Native.wrMem(useList,ref + OFF_NEXT);
    useList=ref;
    Native.wrMem(allocPtr,ref);
    Native.wrMem(toSpace,ref + OFF_SPACE);
    Native.wrMem(0,ref + OFF_GREY);
    Native.wrMem(type,ref + OFF_TYPE);
    Native.wrMem(arrayLength,ref + OFF_MTAB_ALEN);
  }
  return ref;
}

Fixed version (ground truth):
static int newArray(int size,int type){
  if (size < 0) {
    throw new NegativeArraySizeException();
  }
  int arrayLength=size;
  if ((type == 11) || (type == 7))   size<<=1;
  if (Config.USE_SCOPES) {
    int ptr=allocationPointer;
    if (RtThreadImpl.initArea == null) {
      allocationPointer+=size + HEADER_SIZE;
    }
 else {
      Memory sc=null;
      if (RtThreadImpl.mission) {
        Scheduler s=Scheduler.sched[RtThreadImpl.sys.cpuId];
        sc=s.ref[s.active].currentArea;
      }
 else {
        sc=RtThreadImpl.initArea;
      }
      if (sc.allocPtr + size + HEADER_SIZE > sc.endLocalPtr) {
        throw OOMError;
      }
      ptr=sc.allocPtr;
      sc.allocPtr+=size + HEADER_SIZE;
      if (Config.ADD_REF_INFO) {
        ptr=ptr | (sc.level << 25);
      }
      Native.wrMem(sc.level,ptr + OFF_SCOPE_LEVEL);
    }
    Native.wrMem(ptr + HEADER_SIZE,ptr + OFF_PTR);
    Native.wrMem(arrayLength,ptr + OFF_MTAB_ALEN);
    Native.wrMem(type,ptr + OFF_TYPE);
    return ptr;
  }
synchronized (mutex) {
    if (copyPtr + size >= allocPtr) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        gc_alloc();
      }
      if (copyPtr + size >= allocPtr) {
        throw OOMError;
      }
    }
  }
synchronized (mutex) {
    if (freeList == 0) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        log("String_Node_Str");
        gc_alloc();
        if (freeList == 0) {
          throw OOMError;
        }
      }
    }
  }
  int ref;
synchronized (mutex) {
    allocPtr-=size;
    ref=freeList;
    freeList=Native.rdMem(ref + OFF_NEXT);
    Native.wrMem(useList,ref + OFF_NEXT);
    useList=ref;
    Native.wrMem(allocPtr,ref);
    Native.wrMem(toSpace,ref + OFF_SPACE);
    Native.wrMem(0,ref + OFF_GREY);
    Native.wrMem(type,ref + OFF_TYPE);
    Native.wrMem(arrayLength,ref + OFF_MTAB_ALEN);
  }
  return ref;
}