Daniel Gröber (dxld) authored Feb 07, 2020 and Marge Bot committed Feb 08, 2020

When requesting more than BLOCKS_PER_MBLOCK blocks allocGroup can return a
different number of blocks than requested. Here we use the number of
requested blocks, however arenaFree will subtract the actual number of
blocks we got from arena_blocks (possibly) resulting in a negative value
and triggering ASSERT(arena_blocks >= 0).