This crash occurred in fastdebug JVM which was built by GCC 6.
Address of pointer was expected (0x0), however is_oop_or_null() did not work.

I do not understand why current code did not work, however it works fine as below:

-------------------------
--- old/src/share/vm/oops/oop.inline.hpp 2016-06-27 12:31:51.062240003 +0900
+++ new/src/share/vm/oops/oop.inline.hpp 2016-06-27 12:31:50.922240253 +0900
@@ -539,7 +539,7 @@

 // used only for asserts
 bool oopDesc::is_oop_or_null(bool ignore_mark_word) const {
- return this == NULL ? true : is_oop(ignore_mark_word);
+ return (this == NULL) || is_oop(ignore_mark_word);
 }

 #ifndef PRODUCT
-------------------------