Allocating card table before heap causes underflow asserts in CardTable::addr_for()

While trying to reproduce JDK-8288970 with rr's chaos mode, I hit the following assert:

# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/opt/mach5/mesos/work_dir/slaves/0c72054a-24ab-4dbb-944f-97f9341a1b96-S8390/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/797c2d6c-cad2-4366-a6f2-60684f87e042/runs/2190c5db-12ca-4203-9eb8-a16739c5beae/workspace/open/src/hotspot/share/utilities/globalDefinitions.hpp:453), pid=2484426, tid=2484446
# assert(left >= right) failed: avoid underflow - left: 0x000000006ffed800 right: 0xffffffc388dc3000
#
# JRE version: Java(TM) SE Runtime Environment (20.0+7) (fastdebug build 20-ea+7-335)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 20-ea+7-335, mixed mode, tiered, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x950acf] CardTable::addr_for(unsigned char const*) const+0xef
#

Stack: [0x0000549120646000,0x0000549120747000], sp=0x0000549120744920, free space=1018k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x950acf] CardTable::addr_for(unsigned char const*) const+0xef
V [libjvm.so+0xd88c64] G1CardCounts::clear_range(MemRegion)+0x54
V [libjvm.so+0xf58304] HeapRegionManager::expand_exact(unsigned int, unsigned int, WorkerThreads*)+0x154
V [libjvm.so+0xf58a6d] HeapRegionManager::expand_and_allocate_humongous(unsigned int)+0x5d
V [libjvm.so+0xda625b] G1CollectedHeap::humongous_obj_allocate(unsigned long)+0x1ab
V [libjvm.so+0xda7bcd] G1CollectedHeap::attempt_allocation_humongous(unsigned long)+0x17d
V [libjvm.so+0x15ed18e] MemAllocator::allocate() const+0x17e
V [libjvm.so+0x1aca087] TypeArrayKlass::allocate_common(int, bool, JavaThread*)+0x307
V [libjvm.so+0x1727905] oopFactory::new_typeArray(BasicType, int, JavaThread*)+0xb5
V [libjvm.so+0x1016026] InterpreterRuntime::newarray(JavaThread*, BasicType, int)+0xb6
j DefinedAsHiddenKlass+0x0000388665c83800.<clinit>()V+2
v ~StubRoutines::call_stub 0x000058810ea51d76
V [libjvm.so+0x10364e4] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*)+0x514
V [libjvm.so+0xfe1890] InstanceKlass::call_class_initializer(JavaThread*)+0x270
V [libjvm.so+0xfe5401] InstanceKlass::initialize_impl(JavaThread*)+0x6f1
V [libjvm.so+0x1adfd4b] Unsafe_EnsureClassInitialized0+0x13b
j jdk.internal.misc.Unsafe.ensureClassInitialized0(Ljava/lang/Class;)V+0 java.base@20-ea
j jdk.internal.misc.Unsafe.ensureClassInitialized(Ljava/lang/Class;)V+14 java.base@20-ea
j jdk.internal.reflect.MethodHandleAccessorFactory.ensureClassInitialized(Ljava/lang/Class;)V+14 java.base@20-ea
j jdk.internal.reflect.MethodHandleAccessorFactory.newConstructorAccessor(Ljava/lang/reflect/Constructor;)Ljdk/internal/reflect/ConstructorAccessorImpl;+16 java.base@20-ea
j jdk.internal.reflect.ReflectionFactory.newConstructorAccessor(Ljava/lang/reflect/Constructor;)Ljdk/internal/reflect/ConstructorAccessor;+67 java.base@20-ea
j java.lang.reflect.Constructor.acquireConstructorAccessor()Ljdk/internal/reflect/ConstructorAccessor;+58 java.base@20-ea
j java.lang.reflect.Constructor.newInstanceWithCaller([Ljava/lang/Object;ZLjava/lang/Class;)Ljava/lang/Object;+33 java.base@20-ea
j java.lang.reflect.ReflectAccess.newInstance(Ljava/lang/reflect/Constructor;[Ljava/lang/Object;Ljava/lang/Class;)Ljava/lang/Object;+4 java.base@20-ea
j jdk.internal.reflect.ReflectionFactory.newInstance(Ljava/lang/reflect/Constructor;[Ljava/lang/Object;Ljava/lang/Class;)Ljava/lang/Object;+7 java.base@20-ea
j java.lang.Class.newInstance()Ljava/lang/Object;+117 java.base@20-ea
j LotsUnloadApp.run()V+27
j java.lang.Thread.run()V+13 java.base@20-ea
v ~StubRoutines::call_stub 0x000058810ea51d76
V [libjvm.so+0x10364e4] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*)+0x514
V [libjvm.so+0x1036d84] JavaCalls::call_virtual(JavaValue*, Klass*, Symbol*, Symbol*, JavaCallArguments*, JavaThread*)+0x4b4
V [libjvm.so+0x10371f7] JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, JavaThread*)+0x77
V [libjvm.so+0x11c76eb] thread_entry(JavaThread*, JavaThread*)+0x12b
V [libjvm.so+0x106d7e8] JavaThread::thread_main_inner()+0x238
V [libjvm.so+0x1a8c5e0] Thread::call_run()+0x100
V [libjvm.so+0x174f474] thread_native_entry(Thread*)+0x104