Assertion fails on reference in free region in SATB buffer

Failed on Windows in GC nightlies.

# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (\hotspot\src\share\vm\gc_implementation\g1\concurrentMark.cpp:3811), pid=4308, tid=11288
# assert(!_g1h->is_on_master_free_list( _g1h->heap_region_containing((HeapWord*) obj))) failed: invariant
#
# JRE version: Java(TM) SE Runtime Environment (9.0) (build 1.9.0-internal-fastdebug-20150407085837.tschatzl.8058354-b00)
# Java VM: Java HotSpot(TM) Client VM (1.9.0-internal-20150407085837.tschatzl.8058354-b00 mixed mode, sharing windows-x86 )


Stack: [0x044d0000,0x04520000], sp=0x0451efb0, free space=315k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [jvm.dll+0x2b4535] VMError::report_and_die+0x3d5;; ?report_and_die@VMError@@QAEXXZ+0x3d5
V [jvm.dll+0x2a7ed5] report_vm_error+0x45;; ?report_vm_error@@YAXPBDH00@Z+0x45
V [jvm.dll+0x3d93ef] CMTask::drain_local_queue+0x19f;; ?drain_local_queue@CMTask@@QAEX_N@Z+0x19f
V [jvm.dll+0x3dc8a3] CMTask::do_marking_step+0x763;; ?do_marking_step@CMTask@@QAEXN_N0@Z+0x763
V [jvm.dll+0x3dcf93] CMConcurrentMarkingTask::work+0x153;; ?work@CMConcurrentMarkingTask@@UAEXI@Z+0x153
V [jvm.dll+0x2b51dc] GangWorker::loop+0x2cc;; ?loop@GangWorker@@MAEXXZ+0x2cc
V [jvm.dll+0x2d9e7c] java_start+0xcc;; ?java_start@@YGIPAVThread@@@Z+0xcc
C [msvcr100.dll+0x5c556]
C [msvcr100.dll+0x5c600]
C [kernel32.dll+0x4d3c9]
C [ntdll.dll+0x41603]
C [ntdll.dll+0x415d6]