Two late-stage error branches in createPackageArtifact (the
result_package_name and result_signature dupe failures) manually freed
archive_hash even though an errdefer registered earlier for archive_hash
was still armed, causing a double-free when OOM struck at either of
those two allocation sites.
Add a regression test that runs createPackageArtifact once to learn its
real allocation count, then re-runs it with a FailingAllocator targeting
the last allocation on the happy path (result_signature's dupe) to
deterministically reproduce the double-free. Verified the test fails
against the unfixed code (GeneralPurposeAllocator reports the double
free at the exact two call sites) and passes with the fix.
Two late-stage error branches in createPackageArtifact (the
result_package_name and result_signature dupe failures) manually freed
archive_hash even though an errdefer registered earlier for archive_hash
was still armed, causing a double-free when OOM struck at either of
those two allocation sites.
Add a regression test that runs createPackageArtifact once to learn its
real allocation count, then re-runs it with a FailingAllocator targeting
the last allocation on the happy path (result_signature's dupe) to
deterministically reproduce the double-free. Verified the test fails
against the unfixed code (GeneralPurposeAllocator reports the double
free at the exact two call sites) and passes with the fix.