Race in G1 card scanning could allow scanning of memory covered by PLABs

G1 GC crash:

# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007fd519bc2f65, pid=10969, tid=140552886540032
#
# JRE version: Java(TM) SE Runtime Environment (8.0_40-b03) (build 1.8.0_40-ea-b03)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.40-b06 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# V [libjvm.so+0x605f65] HeapRegionDCTOC::walk_mem_region(MemRegion, HeapWord*, HeapWord*)+0x135


Stack: [0x00007fd504cfd000,0x00007fd504dfe000], sp=0x00007fd504df7d90, free space=1003k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x605f65] HeapRegionDCTOC::walk_mem_region(MemRegion, HeapWord*, HeapWord*)+0x135
V [libjvm.so+0x9addc3] DirtyCardToOopClosure::do_MemRegion(MemRegion)+0x113
V [libjvm.so+0x5aaec0] ScanRSClosure::doHeapRegion(HeapRegion*)+0x330
V [libjvm.so+0x57ea10] G1CollectedHeap::collection_set_iterate_from(HeapRegion*, HeapRegionClosure*)+0x60
V [libjvm.so+0x5a9dbb] G1RemSet::scanRS(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, unsigned int)+0xcb
V [libjvm.so+0x5aa1fd] G1RemSet::oops_into_collection_set_do(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, unsigned int)+0x13d
V [libjvm.so+0x587fb7] G1CollectedHeap::g1_process_roots(OopClosure*, OopClosure*, OopsInHeapRegionClosure*, CLDClosure*, CLDClosure*, CodeBlobClosure*, unsigned int)+0x3b7
V [libjvm.so+0x593149] G1ParTask::work(unsigned int)+0x429
V [libjvm.so+0xaa393f] GangWorker::loop()+0xcf
V [libjvm.so+0x8f3638] java_start(Thread*)+0x108