Here are the error logs. The crash appears quite reliably. In 50 runs of the entire V8 suite, there is a high probability that the crash appears.

Here is the run script:

#!/bin/bash
JAVA_HOME=/java/re/jdk/8/promoted/latest/binaries/linux-amd64/fastdebug
NASHORN=${JAVA_HOME}/jre/lib/ext/nashorn.jar
CC=-XX:ReservedCodeCacheSize=24m
for i in {1..50}
do
  echo $i: $JAVA_HOME $CC >&2
  $JAVA_HOME/bin/java $CC -XX:+TieredCompilation -Dengine=nashorn -XX:+TieredCompilation -jar $NASHORN run.js
done