One Lucene test crashes C1 compiler in patching path.

Steps to reproduce:
1. Download Lucene: https://lucene.apache.org/core/downloads.html (tested with 8.4.1)
2. Unpack and setup Ant build according to instructions
3. Run test:
export JAVA_HOME=/path/to/jdk-under-test
ant beast -Dbeast.iters=2000 -Dtestcase=TestBagOfPostings -Dargs="-XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -Xcomp"

ant beast runs the test 2000 times. It always failed for me before completing 2000 runs.

See also:
http://cr.openjdk.java.net/~rkennke/hs_err_pid129211.log

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (src/hotspot/share/gc/shenandoah/shenandoahNMethod.cpp:240), pid=129211, tid=129238
# assert(oops->length() == oop_count()) failed: Must match
#
# JRE version: OpenJDK Runtime Environment (15.0) (fastdebug build 15-internal+0-adhoc.rkennke.jdk-jdk)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 15-internal+0-adhoc.rkennke.jdk-jdk, compiled mode, sharing, tiered, compressed oops, shenandoah gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x14ca8bf] ShenandoahNMethod::assert_same_oops(bool)+0x17f
#
# Core dump will be written. Default location: /home/rkennke/src/lucene-8.4.1/build/core/test/J0/core.129211
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

--------------- S U M M A R Y ------------

Command Line: -XX:+UnlockExperimentalVMOptions -XX:+UnlockDiagnosticVMOptions -XX:+UseShenandoahGC -XX:TieredStopAtLevel=1 -Xcomp -ea -esa --illegal-access=deny -Dtests.prefix=tests -Dtests.seed=A02243E5B86A266 -Xmx512M -Dtests.iters= -Dtests.verbose=false -Dtests.infostream=false -Dtests.codec=random -Dtests.postingsformat=random -Dtests.docvaluesformat=random -Dtests.locale=random -Dtests.timezone=random -Dtests.directory=random -Dtests.linedocsfile=europarl.lines.txt.gz -Dtests.luceneMatchVersion=8.4.1 -Dtests.cleanthreads=perMethod -Djava.util.logging.config.file=/home/rkennke/src/lucene-8.4.1/tools/junit4/logging.properties -Dtests.nightly=false -Dtests.weekly=false -Dtests.monster=false -Dtests.slow=true -Dtests.asserts=true -Dtests.multiplier=1 -DtempDir=./temp -Djava.io.tmpdir=./temp -Dcommon.dir=/home/rkennke/src/lucene-8.4.1 -Dant.library.dir=/usr/share/ant/lib -Dclover.db.dir=/home/rkennke/src/lucene-8.4.1/build/clover/db -Djava.security.policy=/home/rkennke/src/lucene-8.4.1/tools/junit4/tests.policy -Dtests.LUCENE_VERSION=8.4.1 -Djetty.testMode=1 -Djetty.insecurerandom=1 -Dsolr.directoryFactory=org.apache.solr.core.MockDirectoryFactory -Djava.awt.headless=true -Djdk.map.althashing.threshold=0 -Dtests.src.home=/home/rkennke/src/lucene-8.4.1/core -Djava.security.egd=file:/dev/./urandom -Djunit4.childvm.cwd=/home/rkennke/src/lucene-8.4.1/build/core/test/J0 -Djunit4.tempDir=/home/rkennke/src/lucene-8.4.1/build/core/test/temp -Djunit4.childvm.id=0 -Djunit4.childvm.count=1 -Dtests.timeoutSuite=900000 -Djava.security.manager=org.apache.lucene.util.TestSecurityManager -Dtests.filterstacks=true -Dtests.leaveTemporary=false com.carrotsearch.ant.tasks.junit4.slave.SlaveMainSafe -flush -eventsfile /home/rkennke/src/lucene-8.4.1/build/core/test/temp/junit4-J0-20200123_151925_7207630521666166729161.events @/home/rkennke/src/lucene-8.4.1/build/core/test/temp/junit4-J0-20200123_151925_72010202514177565122205.suites -stdin

Host: venus.localdomain, AMD Ryzen Threadripper 1950X 16-Core Processor, 32 cores, 62G, Red Hat Enterprise Linux release 8.1 (Ootpa)
Time: Thu Jan 23 15:19:40 2020 CET elapsed time: 14 seconds (0d 0h 0m 14s)

--------------- T H R E A D ---------------

Current thread (0x00007ff15c1ab000): JavaThread "Thread-2" [_thread_in_vm, id=129238, stack(0x00007ff1a0af1000,0x00007ff1a0bf2000)]

Stack: [0x00007ff1a0af1000,0x00007ff1a0bf2000], sp=0x00007ff1a0bed4c0, free space=1009k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x14ca8bf] ShenandoahNMethod::assert_same_oops(bool)+0x17f
V [libjvm.so+0x14cdd57] ShenandoahNMethod::update()+0x167
V [libjvm.so+0x14ce565] ShenandoahNMethodTable::register_nmethod(nmethod*)+0xd5
V [libjvm.so+0x701511] Runtime1::patch_code(JavaThread*, Runtime1::StubID)+0x481
V [libjvm.so+0x703d55] Runtime1::move_mirror_patching(JavaThread*)+0x35
v ~RuntimeStub::load_mirror_patching Runtime1 stub
J 6052 c1 jdk.internal.math.FloatingDecimal$BinaryToASCIIBuffer.dtoa(IJIZ)V java.base@15-internal (1509 bytes) @ 0x00007ff1b29118eb [0x00007ff1b290f960+0x0000000000001f8b]
J 6047 c1 jdk.internal.math.FloatingDecimal.getBinaryToASCIIConverter(DZ)Ljdk/internal/math/FloatingDecimal$BinaryToASCIIConverter; java.base@15-internal (183 bytes) @ 0x00007ff1b290d55c [0x00007ff1b290d320+0x000000000000023c]
J 6077 c1 org.apache.lucene.index.LogMergePolicy.toString()Ljava/lang/String; (197 bytes) @ 0x00007ff1b2924274 [0x00007ff1b2923c00+0x0000000000000674]
J 6033 c1 org.apache.lucene.index.LiveIndexWriterConfig.toString()Ljava/lang/String; (459 bytes) @ 0x00007ff1b2903fcc [0x00007ff1b29036e0+0x00000000000008ec]
j org.apache.lucene.index.IndexWriterConfig.toString()Ljava/lang/String;+5
j org.apache.lucene.util.LuceneTestCase.maybeChangeLiveIndexWriterConfig(Ljava/util/Random;Lorg/apache/lucene/index/LiveIndexWriterConfig;)V+3
j org.apache.lucene.index.RandomIndexWriter.addDocument(Ljava/lang/Iterable;)J+11
j org.apache.lucene.index.TestBagOfPostings$1.run()V+158
v ~StubRoutines::call_stub
V [libjvm.so+0xc5522c] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, Thread*)+0x6ac
V [libjvm.so+0xc557de] JavaCalls::call_virtual(JavaValue*, Klass*, Symbol*, Symbol*, JavaCallArguments*, Thread*)+0x33e
V [libjvm.so+0xc559fa] JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, Thread*)+0xca
V [libjvm.so+0xdb77a3] thread_entry(JavaThread*, Thread*)+0xa3
V [libjvm.so+0x1677d46] JavaThread::thread_main_inner()+0x226
V [libjvm.so+0x167cdd6] Thread::call_run()+0xf6
V [libjvm.so+0x128ceae] thread_native_entry(Thread*)+0x10e