Seen only once, macos.

# Internal Error (/opt/jprt/T/P1/044756.amurillo/s/hotspot/src/share/vm/gc/g1/g1OopClosures.inline.hpp:186), pid=18325, tid=14339
# assert(_from->is_in_reserved(p)) failed: p is not in from
#
# JRE version: Java(TM) SE Runtime Environment (9.0) (fastdebug build 9-internal+0-2016-03-06-044756.amurillo.jdk9-hs-2016-03-05-snapshot)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 9-internal+0-2016-03-06-044756.amurillo.jdk9-hs-2016-03-05-snapshot, mixed mode, tiered, compressed oops, g1 gc, bsd-amd64)
# Core dump will be written. Default location: /cores/core.18325
--------------- S U M M A R Y ------------

Command Line: -Xmixed -Xmixed -XX:+UnlockDiagnosticVMOptions -XX:+VerifyBeforeExit -XX:+EnableContended -XX:-RestrictContended -XX:ContendedPaddingWidth=5880 vm.runtime.contended.share.tests.GeneratedClassTest

Host: vmsqe-mac-02.ru.oracle.com, Macmini4,1 x86_64 2400 MHz, 2 cores, 8G, Darwin 12.5.0
Time: Sun Mar 6 15:23:28 2016 MSK elapsed time: 18 seconds (0d 0h 0m 18s)

--------------- T H R E A D ---------------

Current thread (0x00007ff64082e000): ConcurrentGCThread [stack: 0x000000021afcd000,0x000000021b0cd000] [id=14339]

Stack: [0x000000021afcd000,0x000000021b0cd000], sp=0x000000021b0cc7a0, free space=1021k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.dylib+0xad48bb] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x425
V [libjvm.dylib+0xad5024] VMError::report_and_die(Thread*, char const*, int, char const*, char const*, __va_list_tag*)+0x4a
V [libjvm.dylib+0x40bd23] report_vm_error(char const*, int, char const*, char const*, ...)+0xcd
V [libjvm.dylib+0x50a5d9] void G1UpdateRSOrPushRefOopClosure::do_oop_work<unsigned int>(unsigned int*)+0x1eb
V [libjvm.dylib+0x4fcf08] void FilterOutOfRegionClosure::do_oop_nv<unsigned int>(unsigned int*)+0x10e
V [libjvm.dylib+0x4fe6ca] void InstanceKlass::oop_oop_iterate_oop_maps<true, FilterOutOfRegionClosure>(oop, FilterOutOfRegionClosure*)+0xbe
V [libjvm.dylib+0x4f1831] InstanceKlass::oop_oop_iterate_nv(oop, FilterOutOfRegionClosure*)+0x89
V [libjvm.dylib+0x57e505] HeapRegion::oops_on_card_seq_iterate_careful(MemRegion, FilterOutOfRegionClosure*, bool, signed char*)+0x71d
V [libjvm.dylib+0x509d53] G1RemSet::refine_card(signed char*, unsigned int, bool)+0x3c5
V [libjvm.dylib+0x4ced13] RefineCardTableEntryClosure::do_card_ptr(signed char*, unsigned int)+0x2d
V [libjvm.dylib+0x481a0b] DirtyCardQueue::apply_closure_to_buffer(CardTableEntryClosure*, void**, unsigned long, unsigned long, bool, unsigned int)+0x69
V [libjvm.dylib+0x481dcc] DirtyCardQueueSet::apply_closure_to_completed_buffer(CardTableEntryClosure*, unsigned int, unsigned long, bool)+0x84
V [libjvm.dylib+0x3d5f8c] ConcurrentG1RefineThread::run_service()+0x10c
V [libjvm.dylib+0x3d5e72] ConcurrentG1RefineThread::run()+0x1e
V [libjvm.dylib+0x8fc48c] java_start(Thread*)+0x134
C [libsystem_c.dylib+0x14772] _pthread_start+0x147
C [libsystem_c.dylib+0x11a1] thread_start+0xd