When allocating the slab, the code accidentally computed the array
size from s->slab (an elemtype**). The slab is an array of elemtype*,
however, so we should take the size of *s->slab.
Noticed-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Thomas Rast <tr@thomasrast.ch> Reviewed-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>