bin/54069: mandoc(1) appears to have a use-after-free bug

[thorpej%me.com@localhost]

>Number:         54069
>Category:       bin
>Synopsis:       mandoc(1) appears to have a use-after-free bug
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 23 16:40:00 +0000 2019
>Originator:     Jason Thorpe
>Release:        NetBSD-current sources from 20190319
>Organization:
NetBSD
>Environment:
macOS 10.13.6 host, cross building -current sources noted above.
>Description:
#    format  man/groff_ms.html7
if test "" != "yes"; then  /nbsd/tools/bin/nbmandoc -Thtml -Oman=../html%S/%N.html,style=../style.css  groff_ms.7 > groff_ms.html7.tmp &&  mv -f groff_ms.html7.tmp groff_ms.html7;  else  GROFF_ENCODING=  GROFF_BIN_PATH=/nbsd/tools/lib/groff  GROFF_FONT_PATH=/nbsd/tools/share/groff/site-font:/nbsd/tools/share/groff/font  GROFF_TMAC_PATH=/nbsd/tools/share/groff/site-tmac:/nbsd/tools/share/groff/tmac /nbsd/tools/bin/nbgroff  -Tlatin1 -mdoc2html groff_ms.7   > groff_ms.html7.tmp && mv -f groff_ms.html7.tmp groff_ms.html7;  fi
nbmandoc(66926,0x7fff8ce6f380) malloc: *** error for object 0x7fc980c4aa50: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
/bin/sh: line 1: 66926 Abort trap: 6           /nbsd/tools/bin/nbmandoc -Thtml -Oman=../html%S/%N.html,style=../style.css groff_ms.7 > groff_ms.html7.tmp

*** Failed target:  groff_ms.html7

>How-To-Repeat:
Best way I know how is to cross-build a release from a macOS 10.13.6 host; the macOS malloc() on my system detects the error.
>Fix: