From the stack trace for this escalation, the crash happens around the following line in chaitin.cpp
(pointed by the arrow):
        if( !after_aggressive &&
          _cfg._bbs[n->in(k)->_idx]->_freq > 1000*b->_freq ) {
          // Since we are BEFORE aggressive coalesce, leave the register
          // mask untrimmed by the call. This encourages more coalescing.
          // Later, AFTER aggressive, this live range will have to spill
          // but the spiller handles slow-path calls very nicely.
        } else {
===> lrg.AND( rm );
        }

Stacktrack from same testcase:

 > > [10] PhaseChaitin::gather_lrg_masks(0xfee213d8, 0xfee6cd90, 0x50,
 > 0xfeeb1ebc, 0x1, 0x15), at 0xfec99958
 > > [11] PhaseChaitin::Register_Allocate(0xfee6c9bc, 0x0, 0xfeec9ff0,
 > 0xfee5480c, 0x0, 0x793ff128), at 0xfec98134
 > > [12] Compile::Code_Gen(0xfee6ccf0, 0x0, 0xfee5480c, 0x793ff970,
 > 0x0, 0x793ff560), at 0xfecaca74
 > > [13] Compile::Compile(0xfee6ce5c, 0xfeedde24, 0xc52488,
 > 0x793ffab0, 0x793ffac4, 0x793ffa24), at 0xfecaa73c
 > > [14] C2Compiler::compile_method(0x27ba8, 0x793ffd54, 0xc52488,
 > 0xc52398, 0xffffffff, 0x1),
 > > at 0xfec8ecb0
 > > [15] CompileBroker::invoke_compiler_on_method(0xc52398, 0xc52488,
 > 0xfee88e78, 0x0, 0xfee6cc78, 0x5f7), at 0xfebe8d80
 > > [16] CompileBroker::compiler_thread_loop(0xfee68614, 0xfee5480c,
 > 0xfee88fb4, 0xfee85378, 0xffffffff, 0xf765b768), at 0xfebe86bc
 > > [17] JavaThread::run(0x79200000, 0xfedf4838, 0xfee6d04c,
 > 0xfee5480c, 0x1da960, 0x200000), at 0xfeba674c
 > > [18] _start(0xfee5480c, 0xff050e00, 0x0, 0x0, 0x0, 0x0), at
 > > 0xfeb32930