I've found that we crash if we try to use ArrayAllocatorMallocLimit. The cause is that the CHeapBitMap destructor passes down the size to CHeapBitMap::free in "bits" but that function expects the size to be in "words".

This is a benign in normal runs, because the CHeapBitMap then uses os::free and it ignores the size. However, if you use the experimental ArrayAllocatorMallocLimit flag, then you can force CHeapBitMap to use mmap/munmap instead of malloc/free, and then the JVM will crash.