Program: 186548
Project: 186548
Buggy source:
/** 
 * Allocate a new Object. Invoked from JVM.f_new(cons);
 * @param cons pointer to class struct
 * @return address of the handle
 */
static int newObject(int cons){
  int size=Native.rdMem(cons);
  if (Config.USE_SCOPES) {
    int ptr=allocationPointer;
    if (RtThreadImpl.initArea == null) {
      allocationPointer+=size + HEADER_SIZE;
    }
 else {
      Memory sc=null;
      if (RtThreadImpl.mission) {
        Scheduler s=Scheduler.sched[RtThreadImpl.sys.cpuId];
        sc=s.ref[s.active].currentArea;
      }
 else {
        sc=RtThreadImpl.initArea;
      }
      if (sc.allocPtr + size + HEADER_SIZE > sc.endLocalPtr) {
        throw OOMError;
      }
      ptr=sc.allocPtr;
      sc.allocPtr+=size + HEADER_SIZE;
      if (Config.ADD_REF_INFO) {
        ptr=ptr | (sc.level << 25);
      }
      Native.wrMem(sc.level,ptr + OFF_SPACE);
    }
    Native.wrMem(ptr + HEADER_SIZE,ptr + OFF_PTR);
    Native.wrMem(cons + Const.CLASS_HEADR,ptr + OFF_MTAB_ALEN);
    Native.wrMem(0,ptr + OFF_TYPE);
    return ptr;
  }
synchronized (mutex) {
    if (copyPtr + size >= allocPtr) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        gc_alloc();
        if (copyPtr + size >= allocPtr) {
          throw OOMError;
        }
      }
    }
  }
synchronized (mutex) {
    if (freeList == 0) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        log("String_Node_Str");
        gc_alloc();
        if (freeList == 0) {
          throw OOMError;
        }
      }
    }
  }
  int ref;
synchronized (mutex) {
    allocPtr-=size;
    ref=freeList;
    freeList=Native.rdMem(ref + OFF_NEXT);
    Native.wrMem(useList,ref + OFF_NEXT);
    useList=ref;
    Native.wrMem(allocPtr,ref);
    Native.wrMem(toSpace,ref + OFF_SPACE);
    Native.wrMem(0,ref + OFF_GREY);
    Native.wrMem(IS_OBJ,ref + OFF_TYPE);
    Native.wrMem(cons + Const.CLASS_HEADR,ref + OFF_MTAB_ALEN);
  }
  return ref;
}

Fixed version (ground truth):
/** 
 * Allocate a new Object. Invoked from JVM.f_new(cons);
 * @param cons pointer to class struct
 * @return address of the handle
 */
static int newObject(int cons){
  int size=Native.rdMem(cons);
  if (Config.USE_SCOPES) {
    int ptr=allocationPointer;
    if (RtThreadImpl.initArea == null) {
      allocationPointer+=size + HEADER_SIZE;
    }
 else {
      Memory sc=null;
      if (RtThreadImpl.mission) {
        Scheduler s=Scheduler.sched[RtThreadImpl.sys.cpuId];
        sc=s.ref[s.active].currentArea;
      }
 else {
        sc=RtThreadImpl.initArea;
      }
      if (sc.allocPtr + size + HEADER_SIZE > sc.endLocalPtr) {
        throw OOMError;
      }
      ptr=sc.allocPtr;
      sc.allocPtr+=size + HEADER_SIZE;
      if (Config.ADD_REF_INFO) {
        ptr=ptr | (sc.level << 25);
      }
      Native.wrMem(sc.level,ptr + OFF_SCOPE_LEVEL);
    }
    Native.wrMem(ptr + HEADER_SIZE,ptr + OFF_PTR);
    Native.wrMem(cons + Const.CLASS_HEADR,ptr + OFF_MTAB_ALEN);
    Native.wrMem(0,ptr + OFF_TYPE);
    return ptr;
  }
synchronized (mutex) {
    if (copyPtr + size >= allocPtr) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        gc_alloc();
        if (copyPtr + size >= allocPtr) {
          throw OOMError;
        }
      }
    }
  }
synchronized (mutex) {
    if (freeList == 0) {
      if (Config.USE_SCOPES) {
        throw OOMError;
      }
 else {
        log("String_Node_Str");
        gc_alloc();
        if (freeList == 0) {
          throw OOMError;
        }
      }
    }
  }
  int ref;
synchronized (mutex) {
    allocPtr-=size;
    ref=freeList;
    freeList=Native.rdMem(ref + OFF_NEXT);
    Native.wrMem(useList,ref + OFF_NEXT);
    useList=ref;
    Native.wrMem(allocPtr,ref);
    Native.wrMem(toSpace,ref + OFF_SPACE);
    Native.wrMem(0,ref + OFF_GREY);
    Native.wrMem(IS_OBJ,ref + OFF_TYPE);
    Native.wrMem(cons + Const.CLASS_HEADR,ref + OFF_MTAB_ALEN);
  }
  return ref;
}