G1 always crashes when run with -UseTLAB and heap verification -XX:+VerifyBeforeGC is enabled in dacapo-bach (www.dacapobench.org) eclipse.

Command line

-XX:+UseG1GC -XX:-UseTLAB -XX:+UnlockDiagnosticVMOptions -XX:+VerifyBeforeGC -jar dacapo.jar eclipse -n 1

Crash (with product vm):
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f78cabf52df, pid=27087, tid=140156792600320
#
# JRE version: (8.0) (build )
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.0-b23-internal mixed mode linux-amd64 compressed oops)
# Problematic frame:
# V [libjvm.so+0x8c32df] Threads::possibly_parallel_oops_do(OopClosure*, CLDToOopClosure*, CodeBlobClosure*)+0x7f
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# .../hs_err_pid27087.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

Crash (run with debug vm):
# after -XX: or in .hotspotrc: SuppressErrorAt=/g1CollectedHeap.cpp:3278
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (.../hs8005857/src-8005857/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp:3278), pid=22290, tid=139667374491392
# assert(Thread::current()->is_VM_thread()) failed: Expected to be executed serially by the VM thread at this point
#
# JRE version: (8.0) (build )
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.0-b23-internal-jvmg mixed mode linux-amd64 compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# [...]/hs_err_pid22290.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

hs_err logs attached

(Originally reported by C. Kotselidis)

Expected behavior:

The VM does not crash when running with the given options.