There is a race in remembered set memory management that can lead to crashes:

- Thread A executes G1SegmentedArray::create_new_segment and tries to pop an element from the _free_segment_list. For that, thread A executes LockFreeStack::pop()
- Thread A reads LockFreeStack::top()
- Thread B executes LockFreeStack::pop(), also reads LockFreeStack::top() and pops that element from the stack
- Thread B executes Atomic::cmpxchg(&_first, prev, next); in G1SegmentedArray::create_new_segment but it fails because another thread already registered a different segment
- Thread B calls G1SegmentedArraySegment::delete_segment and frees the value
- Thread A tries to access top()->next in LockFreeStack::pop(), which causes a segfault because top() was freed by thread B

(Reported by [~chaeubl])