Lilliput's C2 code for generating LoadNKlass currently assumes that the disp of the incoming address is klass_offset_in_bytes. It then extracts the base register and loads from the mark_offset_in_bytes instead.
Sometimes (apparently very rarely) it happens that C2 emits code that pre-adds obj+klass_offset into a register, and uses that as base, but with offset 0. In this case we would trip the assert or crash in release builds.