test: Add a regression test for Apple platforms aborting on free

Add a regression test for RUST-150898 to make users aware that if this
test failures, they may encounter unusual behavior elsewhere.

Author: tgross35

tests/ui/allocator/regression-abort-on-free-issue-150898.rs

@@ -0,0 +1,91 @@
+// Regression test for https://github.com/rust-lang/rust/issues/150898
+//
+// This test fails on Apple platforms with versions containing an allocator
+// bug. If this fails with SIGABRT, you may need to upgrade your system to
+// avoid other unexpected behavior.
+//
+// The bug was resolved by MacOS 26.4.
+
+//@ run-pass
+//@ only-apple
+//@ compile-flags: -C opt-level=1 -C lto=off -C codegen-units=1
+
+use std::ffi::c_void;
+use std::hint::black_box;
+use std::mem::transmute;
+use std::ptr;
+
+#[link(name = "System")]
+unsafe extern "C" {
+    unsafe fn malloc(size: usize) -> *mut c_void;
+    unsafe fn free(p: *mut c_void);
+}
+
+// Probably needed to prevent the compiler from optimizing based on it being `malloc`.
+#[inline(never)]
+#[unsafe(no_mangle)]
+fn allocate(capacity: usize) -> *mut c_void {
+    let size = capacity * size_of::<Reproducer>();
+    let ptr = unsafe { malloc(size) };
+    if ptr.is_null() {
+        panic!("allocation failure")
+    }
+    ptr
+}
+
+#[repr(u32)]
+#[derive(Clone)]
+pub enum ABC {
+    A,
+    B,
+    C,
+}
+
+type Reproducer = Option<(ABC, i64, u64)>;
+
+#[inline(never)]
+#[unsafe(no_mangle)]
+fn extend_with(ptr: *mut c_void, len: *mut usize, n: usize, value: Reproducer) {
+    let mut ptr = unsafe { ptr.cast::<Reproducer>().add(*len) };
+
+    for _ in 1..n {
+        // Curiously must be `value.clone()`, doing a copy doesn't trigger the bug
+        unsafe { ptr::write(ptr, value.clone()) };
+        ptr = unsafe { ptr.add(1) };
+    }
+
+    if n > 0 {
+        unsafe { ptr::write(ptr, value) };
+    }
+}
+
+#[inline(never)]
+#[unsafe(no_mangle)]
+fn retv() -> Reproducer {
+    // let x = [48, 0, 3, 1, 48, 0];
+    let x = [0, 0, 3, 0, 0, 0];
+    unsafe { transmute(x) }
+}
+
+#[inline(never)]
+#[unsafe(no_mangle)]
+fn foo(size: usize) {
+    let v0 = allocate(size);
+    extend_with(v0, &mut 0, size, retv());
+    unsafe { free(v0) };
+}
+
+fn main() {
+    for i in 0..50 {
+        println!("step {i}");
+
+        let s = 128;
+        // A few more allocations seem to be necessary, probably to prime
+        // the allocator find the bug.
+        let v1 = allocate(black_box(s));
+        foo(black_box(s));
+        unsafe { free(v1) };
+    }
+
+    println!("finished");
+}