JVM crashes during GC on various asserts which checks that HeapWord ptr is an oop

JVM crashes during GC on various asserts which checks that HeapWord ptr is an oop.
Issues could be intermittently reproduced with G1 & CMS.
I was able to reproduce only on linux-sparc hosts and only w/ 7u80, but there is an JI bug (JI-9011043) which was filed against very similar crash happened on solaris-sparc w/ 7u51.

Here are example of failed asserts:

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/HUDSON/workspace/7u-2-build-linux-sparcv9/jdk7u-dev/1740/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp:1012), pid=19426, tid=18446735281952250128
# assert(k->is_oop(true )) failed: Should be klass oop
#
# JRE version: Java(TM) SE Runtime Environment (7.0_80-b03) (build 1.7.0_80-ea-fastdebug-langtools-nightly-h1740-20141030-b03-b03)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (24.80-b07-fastdebug mixed mode linux-sparc compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0xfffff80104024000): GCTaskThread [stack: 0xfffff801025de000,0xfffff801026de000] [id=19437]

Stack: [0xfffff801025de000,0xfffff801026de000], sp=0xfffff801026da360, free space=1008k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xe34fa0] VMError::report_and_die()+0x24c
V [libjvm.so+0x6daa28] report_vm_error(char const*, int, char const*, char const*)+0x6c
V [libjvm.so+0x631894] CompactibleFreeListSpace::block_size(HeapWord const*) const+0x27c
V [libjvm.so+0x44fdf4] BlockOffsetArrayNonContigSpace::block_start_unsafe(void const*) const+0x474
V [libjvm.so+0x6287ac] CompactibleFreeListSpace::block_start_const(void const*) const+0xe0
V [libjvm.so+0x633ec0] Space::block_start(void const*)+0x18
V [libjvm.so+0xc1ea54] CardTableModRefBS::process_chunk_boundaries(Space*, DirtyCardToOopClosure*, MemRegion, MemRegion, signed char**, unsigned long, unsigned long)+0xc8
V [libjvm.so+0xc1fdc0] CardTableModRefBS::process_stride(Space*, MemRegion, int, int, OopsInGenClosure*, CardTableRS*, signed char**, unsigned long, unsigned long)+0x458
V [libjvm.so+0xc20188] CardTableModRefBS::non_clean_card_iterate_parallel_work(Space*, MemRegion, OopsInGenClosure*, CardTableRS*, int)+0x15c
V [libjvm.so+0x557028] CardTableModRefBS::non_clean_card_iterate_possibly_parallel(Space*, MemRegion, OopsInGenClosure*, CardTableRS*)+0xb8
V [libjvm.so+0x55a84c] CardTableRS::younger_refs_in_space_iterate(Space*, OopsInGenClosure*)+0x8c
V [libjvm.so+0x8077c8] Generation::younger_refs_in_space_iterate(Space*, OopsInGenClosure*)+0x3c
V [libjvm.so+0x68cfbc] ConcurrentMarkSweepGeneration::younger_refs_iterate(OopsInGenClosure*)+0x34
V [libjvm.so+0x55a074] CardTableRS::younger_refs_iterate(Generation*, OopsInGenClosure*)+0x2c
V [libjvm.so+0x7f17dc] GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0xe8
V [libjvm.so+0xc29314] ParNewGenTask::work(unsigned int)+0x1cc
V [libjvm.so+0xe759a8] GangWorker::loop()+0x358
V [libjvm.so+0xe743f4] GangWorker::run()+0x24
V [libjvm.so+0xc01914] java_start(Thread*)+0x164
C [libpthread.so.0+0x8a08] start_thread+0xc8

or

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/HUDSON/workspace/7u-2-build-linux-sparcv9/jdk7u-dev/1725/hotspot/src/share/vm/memory/space.cpp:822), pid=43076, tid=8796149045520
# assert(p == current_top || oop(p)->is_oop()) failed: p (0x0000000147b36c00) is not a block start - current_top: 0x0000000147c00000, is_oop: false
#
# JRE version: Java(TM) SE Runtime Environment (7.0_80-b03) (build 1.7.0_80-ea-fastdebug-langtools-nightly-h1725-20141027-b03-b03)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (24.80-b07-fastdebug mixed mode linux-sparc compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x0000080004046800): GCTaskThread [stack: 0x000008000346e000,0x000008000356e000] [id=43101]

Stack: [0x000008000346e000,0x000008000356e000], sp=0x0000080003565a40, free space=990k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xe34fa0] VMError::report_and_die()+0x24c
V [libjvm.so+0x6daa28] report_vm_error(char const*, int, char const*, char const*)+0x6c
V [libjvm.so+0xd2e040] ContiguousSpace::block_size(HeapWord const*) const+0x2e4
V [libjvm.so+0x78dc74] G1BlockOffsetArrayContigSpace::block_start_unsafe(void const*)+0x26c
V [libjvm.so+0x83fb90] G1OffsetTableContigSpace::block_start(void const*)+0x38
V [libjvm.so+0xd2aaa0] DirtyCardToOopClosure::do_MemRegion(MemRegion)+0xc0
V [libjvm.so+0x7d17a8] ScanRSClosure::doHeapRegion(HeapRegion*)+0x448
V [libjvm.so+0x799118] G1CollectedHeap::collection_set_iterate_from(HeapRegion*, HeapRegionClosure*)+0x204
V [libjvm.so+0x7cf5e8] G1RemSet::scanRS(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, int)+0xbc
V [libjvm.so+0x7cf9c0] G1RemSet::oops_into_collection_set_do(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, int)+0xfc
V [libjvm.so+0x7a0710] _ZN15G1CollectedHeap23g1_process_strong_rootsEbN10SharedHeap14ScanningOptionEP10OopClosureP23OopsInHeapRegionClosureP16OopsInGenClosureib.clone.11+0x4ac
V [libjvm.so+0x7b8a20] G1ParTask::work(unsigned int)+0x6a4
V [libjvm.so+0xe759a8] GangWorker::loop()+0x358
V [libjvm.so+0xe743f4] GangWorker::run()+0x24
V [libjvm.so+0xc01914] java_start(Thread*)+0x164
C [libpthread.so.0+0x8a08] start_thread+0xc8


Note that in case of crash in CompactibleFreeListSpace::block_size, p point to:
(gdb) p *p
$1 = {i = 0xbaadbabebaadbabe <Address 0xbaadbabebaadbabe out of bounds>}

And in case of crash in ContiguousSpace::block_size, p point to:
(gdb) p *p
$1 = {i = 0xdeafbabedeafbabe <Address 0xdeafbabedeafbabe out of bounds>}