Webkit has a custom allocator. See http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., and, via, http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., which seems to use mmap and a SYSCALL macro. That doesn't seem to build on the system's alloc.

According to https://www.webkit.org/quality/leakhunting.html, it may even have multiple ones: "Get a fresh WebKit build, ideally a Debug build as this turns off the various custom allocators in WebKit."

It wouldn't surprise me to find custom allocations in many other large projects that may be memory constrained (postgres, open office, gcc, clang, you name it) at some size, the extra burden of a custom allocator isn't that large relative to the size of a project.