RHEL 6 alpha3 valloc() aborted with an assertion message.

Issue

This is a regression issue.
As far as we tested, this problem did not occur on RHEL5.4.
When I ran a test program, which just calls valloc() and free(), on RHEL6alpha3,
the program aborted with the following message.

valloc: malloc.c:3951: __libc_valloc: Assertion `!p || ((((mchunkptr)((char*)
(p) - 2*(sizeof(size_t)))))->size & 0x2) || ar_ptr == (((((mchunkptr)((char*)
(p) - 2*(sizeof(size_t)))))->size & 0x4) ? ((heap_info *)((unsigned long)(((
mchunkptr)((char*)(p) - 2*(sizeof(size_t))))) & ~((2 * (4 * 1024 * 1024 * size
of(long)))-1)))->ar_ptr : &main_arena)' failed.

The massage was generated in malloc.c as shown below.

  3911  Void_t*
  3912  public_vALLOc(size_t bytes)
  3913  {
        ...
  3950    assert(!p || chunk_is_mmapped(mem2chunk(p)) ||
  3951           ar_ptr == arena_for_chunk(mem2chunk(p)));