Can overallocate

[alecmocatta]

There's a race where one thread tries to overallocate: self.remaining.fetch_sub(size, Ordering::Acquire) >= size and correctly fails, but self.remaining has now wrapped, so another thread's attempt to overallocate (before the first thread has restored self.remaining) incorrectly succeeds.

I fixed this by switching self.remaining to isize and bounding allocations to isize::max_value() but had a brain blip and undid this.

Another possible solution is CAS to avoid decrementing self.remaining if it would wrap, or do a saturating decrement.