CMS: small OldPLABSize and -XX:-ResizePLAB cause assert(ResizePLAB || n_blks == OldPLABSize) failed: Error

CMS crashes with assertion failure during GC when ResizePLAB is disabled and OldPLABSize is pretty small:

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/HUDSON/workspace/8-2-build-linux-amd64/jdk8u40/1614/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp:2644), pid=14574, tid=139647074510592
# assert(ResizePLAB || n_blks == OldPLABSize) failed: Error
#
# JRE version: Java(TM) SE Runtime Environment (8.0_40-b08) (build 1.8.0_40-ea-fastdebug-b08)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.40-b12-fastdebug mixed mode linux-amd64 compressed oops)
# Core dump written. Default location: /tmp/sa/core or core.14574
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x00007f0218026800): GCTaskThread [stack: 0x00007f021e352000,0x00007f021e453000] [id=14579]

Stack: [0x00007f021e352000,0x00007f021e453000], sp=0x00007f021e450c40, free space=1019k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xfddbd2] VMError::report_and_die()+0x2d2
V [libjvm.so+0x7211d4] report_vm_error(char const*, int, char const*, char const*)+0x84
V [libjvm.so+0x6775af] CFLS_LAB::get_from_global_pool(unsigned long, AdaptiveFreeList<FreeChunk>*)+0x1af
V [libjvm.so+0x6778d0] CFLS_LAB::alloc(unsigned long)+0x310
V [libjvm.so+0x6e9640] ConcurrentMarkSweepGeneration::par_promote(int, oop, markOopDesc*, unsigned long)+0x140
V [libjvm.so+0xd97287] ParNewGeneration::copy_to_survivor_space_avoiding_promotion_undo(ParScanThreadState*, oop, unsigned long, markOopDesc*)+0x1267
V [libjvm.so+0x92a416] ParNewGeneration::copy_to_survivor_space(ParScanThreadState*, oop, unsigned long, markOopDesc*)+0xd6
V [libjvm.so+0x92bc8d] void ParScanClosure::do_oop_work<oop>(oop*, bool, bool)+0x1ad
V [libjvm.so+0x72fe2f] KlassScanClosure::do_klass(Klass*)+0xaf
V [libjvm.so+0x6361bd] ClassLoaderData::oops_do(OopClosure*, KlassClosure*, bool)+0x7d
V [libjvm.so+0x632869] ClassLoaderDataGraph::roots_cld_do(CLDClosure*, CLDClosure*)+0x39
V [libjvm.so+0xe707d4] SharedHeap::process_roots(bool, SharedHeap::ScanningOption, OopClosure*, OopClosure*, CLDClosure*, CLDClosure*, CodeBlobClosure*)+0x434
V [libjvm.so+0x885309] GenCollectedHeap::gen_process_roots(int, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, OopsInGenClosure*, OopsInGenClosure*, CLDClosure*, CLDClosure*, CodeBlobClosure*)+0x49
V [libjvm.so+0x88553d] GenCollectedHeap::gen_process_roots(int, bool, bool, SharedHeap::ScanningOption, bool, OopsInGenClosure*, OopsInGenClosure*, CLDClosure*)+0x8d
V [libjvm.so+0xd91bc5] ParNewGenTask::work(unsigned int)+0x255
V [libjvm.so+0x102a166] GangWorker::loop()+0x2b6
V [libjvm.so+0xd6a798] java_start(Thread*)+0x108