I have seen this crash in several ways and all involved a GuardWithCatch, suggesting a problem with exception dispatch. It appears that the last sp value is being replaced with an oop sometimes which moves the stack into the Java heap and various kinds of crashes result.
From Christian:

I have bad news: I found a C1 crasher today and I don't know yet what causes it. It happens with both the promoted b146 drop and self-built Hotspot with John's latest patch applied. I can reproduce it with product and fastdebug but no luck with debug yet.

Here is the output of a debugging session:

ct232829@intelsdv07:~/mlvm/jruby$ bin/jruby.sh -J-XX:+ShowMessageBoxOnError -J-showversion --client test/test_respond_to.rb
VM option '+ShowMessageBoxOnError'
java version "1.7.0-fastdebug"
Java(TM) SE Runtime Environment (build 1.7.0-fastdebug-b146)
Java HotSpot(TM) Client VM (build 21.0-b14-internal-fastdebug, mixed mode)

Loaded suite test/test_respond_to
Started
.==============================================================================
Unexpected Error
------------------------------------------------------------------------------
SIGSEGV (0xb) at pc=0xf8d2c0c4, pid=19220, tid=15

Do you want to debug the problem?

To debug, run 'dbx - 19220'; then switch to thread 15
Enter 'yes' to launch dbx automatically (PATH must include dbx)
Otherwise, press RETURN to abort...
==============================================================================