Node::operator new looks like:

inline void* operator new(size_t x) throw() {
   Compile* C = Compile::current();
   Node* n = (Node*)C->node_arena()->Amalloc_D(x);
#ifdef ASSERT
   n->_in = (Node**)n; // magic cookie for assertion check
#endif
   return (void*)n;
 }

That assignment of n->_in is, in this context, undefined behavior. Applying member access (either data or function) to storage before the constructor has been applied to it (or after the destructor) is undefined behavior.