After many crashes and much pain, I determined that having CellStatistics enabled causes a busy relay to consume at least two or three _gigabytes_ of additional memory. Relay operators with less than 16GB per instance are advised to disable it.
By default CellStatistics is disabled unless explicitly set in torrc.
CellStatistics can be turned off without restarting, via the control-channel command
setconf CellStatistics=0