Hotspot code contains a usage of an array placement new in ConcurrentHashTable: "new (memory) Bucket[_size]" where "memory" is allocated by malloc with size "_size * sizeof(Bucket)".

This seems to be fine with nicely behaving compilers (hopefully all we use?).
However, the C++ standard (Section 5.3.4/12) allows the array placement new to use more space than "_size * sizeof(Bucket)". In this case, we may write beyond the allocated memory.