Reference pending list root might not get marked

We've seen the following crash in the JDK 9 nightly testing:
assert(Universe::heap()->is_in_or_null(r)) failed: bad receiver: 0xbaadbabe (-1163019586)

Java VM: Java HotSpot(TM) Server VM (fastdebug 9-internal+0-2017-07-10-212747.vkozlov.8184036, mixed mode, emulated-client, g1 gc, windows-x86)

Stack trace:
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [jvm.dll+0x8d0169] VMError::report_and_die+0x409;; ?report_and_die@VMError@@SAXHPBD0PADPAVThread@@PAEPAX40HI@Z+0x409
V [jvm.dll+0x8d0667] VMError::report_and_die+0x27;; ?report_and_die@VMError@@SAXPAVThread@@PBDH11PAD@Z+0x27
V [jvm.dll+0x3bb518] report_vm_error+0x48;; ?report_vm_error@@YAXPBDH00ZZ+0x48
V [jvm.dll+0x455d7f] frame::retrieve_receiver+0xaf;; ?retrieve_receiver@frame@@QAEPAVoopDesc@@PAVRegisterMap@@@Z+0xaf
V [jvm.dll+0x8002a2] SharedRuntime::find_callee_info_helper+0x352;; ?find_callee_info_helper@SharedRuntime@@CA?AVHandle@@PAVJavaThread@@AAVvframeStream@@AAW4Code@Bytecodes@@AAVCallInfo@@PAVThread@@@Z+0x352
V [jvm.dll+0x805453] SharedRuntime::resolve_sub_helper+0x133;; ?resolve_sub_helper@SharedRuntime@@CA?AVmethodHandle@@PAVJavaThread@@_N1PAVThread@@@Z+0x133
V [jvm.dll+0x804e15] SharedRuntime::resolve_helper+0x35;; ?resolve_helper@SharedRuntime@@SA?AVmethodHandle@@PAVJavaThread@@_N1PAVThread@@@Z+0x35
V [jvm.dll+0x805c3e] SharedRuntime::resolve_virtual_call_C+0xae;; ?resolve_virtual_call_C@SharedRuntime@@SAPAEPAVJavaThread@@@Z+0xae
v ~RuntimeStub::resolve_virtual_call
J 206 c1 java.lang.ref.Reference.processPendingReferences()V java.base@9-internal (132 bytes) @ 0x02cf2958 [0x02cf2780+0x000001d8]
j java.lang.ref.Reference.access$000()V+0 java.base@9-internal
j java.lang.ref.Reference$ReferenceHandler.run()V+0 java.base@9-internal