G1 crashes at startup with -XX:+UseDynamicNumberOfThreads

Running dacapo eclipse with g1 always crashes the VM at startup at the very first young GC, e.g.:

java -XX:+UseG1GC -XX:+UnlockExperimentalVMOptions -XX:InitiatingHeapOccupancyPercent=20 -Xmx128M -XX:+UseDynamicNumberOfGCThreads -XX:+PrintGCDetails -jar ../x/dacapo.jar eclipse

In product mode the following guarantee fails:

[GC pause (G1 Evacuation Pause) (young)#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (numberSeq.cpp:166), pid=7651, tid=140689441662720
# guarantee(variance() > -1.0) failed: variance should be >= 0
#
# JRE version: Java(TM) SE Runtime Environment (8.0-b125) (build 1.8.0-ea-b125)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.0-b66 mixed mode linux-amd64 compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/thomas/Downloads/vmshare/jdk7u/x-jdk8/hs_err_pid7651.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#
Aborted

In debug mode we get:

[GC pause (G1 Evacuation Pause) (young), 0.0234396 secs]
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/g1GCPhaseTimes.cpp:150
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (...hotspot/src/share/vm/gc_implementation/g1/g1GCPhaseTimes.cpp:150), pid=7685, tid=140278269638400
# assert(_data[i] != _uninitialized) failed: Invalid data for worker 2, data: -1.000000, uninitialized: -1.000000
#
# JRE version: Java(TM) SE Runtime Environment (9.0-b01) (build 1.9.0-ea-fastdebug-b01)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.0-b62-fastdebug mixed mode linux-amd64 compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/thomas/Downloads/vmshare/jdk7u/x-jdk9/hs_err_pid7685.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#
Current thread is 140278269638400

Seems to affect all recent java/hotspot versions: tested 7u60b08, 8b125, 9b01

ILW:
Impact: high, crash
Likelihood: high, always
Workaround: low, do not use uncommon flag UseDynamicNumberOfGCThreads