Well, it looks like jemalloc "simply" hooks into the stdlib functions, so the free() call goes through jemalloc. I have no idea how the default operator new is wired internally to do the actual allocation.
I've had a better look at this, because the jemalloc build that comes with LWJGL is built with `--disable-zone-allocator`, which means it does not replace the default macOS allocator.
Turns out it does override C++ new/delete with
jemalloc_cpp.cpp. So with the way jemalloc is built, YGNodeNew goes to je_malloc via the overridden new, but YGNodeFree goes to the default zone allocator's free. Which tries to free a pointer it doesn't know about and crashes.
I couldn't believe you can override new/delete by loading a shared library without something like LD_PRELOAD, but apparently it's
actually possible on macOS.
Build 12 will include both the Yoga fix and a jemalloc built with `--disable-cxx --disable-zone-allocator` (i.e. neither the default zone allocator, nor new/delete will be overridden).