Fuzzer failure: segfault in yaml_fuzz_to_json, seed 1597729744

This came up in an unrelated CI run.

From cursory investigation, the segfault happens deep inside snmalloc, while doing the seemingly harmless action of allocating a synthetic SourceDef, as of commit 917938ee73880db75efe738d39d5667566abd8f8.

I don't know what it means, and it will require either someone with more knowledge of snmalloc, or just a deeper investigation.

For convenience, here is my VSCode debug definition (your exact folder structure/args may vary, but know at least that this reproduces the problem on my machine):

{
  "type": "lldb",
  "request": "launch",
  "name": "yaml_fuzzer to_json",
  "program": "${workspaceFolder}/out/build/debug-clang/parsers/test/yaml_fuzzer",
  "args": ["to_json", "-s", "1597729744", "-f"],
  "cwd": "${workspaceFolder}"
}

Reproduce the failure with out/build/debug-clang/parsers/test/yaml_fuzzer using args to_json -s 1597729744 -f. Start by tracing yaml_fuzz_to_json and the synthetic SourceDef allocation, then investigate the snmalloc crash around commit 917938ee73880db75efe738d39d5667566abd8f. Done means identifying and fixing the segfault and validating the same seed without a crash.