VM crashes during marking in a number of nsk.stress tests. Such a behavior has been also observed with specjbb2005. 

To quote a fragment of the hs_err file:

Instructions: (pc=0x00002b8a7715759f)
0x00002b8a7715758f:   e8 4c 89 75 f0 48 89 5d d8 4c 89 7d f8 49 89 f4
0x00002b8a7715759f:   8b 5e 08 49 89 fe 41 89 dd 41 c1 fd 03 85 db 7e 
;; 00002b8a7715758f e8 4c 89 75 f0          callq  0x00002b8a678afee0
;; 00002b8a77157594 48 89 5d d8             mov    %rbx,0xffffffffffffffd8(%rbp)
;; 00002b8a77157598 4c 89 7d f8             mov    %r15,0xfffffffffffffff8(%rbp)
;; 00002b8a7715759c 49 89 f4                mov    %rsi,%r12
;; ---------------
;; 00002b8a7715759f 8b 5e 08                mov    0x8(%rsi),%ebx
;; 00002b8a771575a2 49 89 fe                mov    %rdi,%r14
;; 00002b8a771575a5 41 89 dd                mov    %ebx,%r13d
;; 00002b8a771575a8 41 c1 fd 03             sar    $0x3,%r13d
;; 00002b8a771575ac 85 db                   test   %ebx,%ebx
;; 00002b8a771575ae 7e ff                   jle    0x00002b8a771575af
;; 
Stack: 
[error occurred during error reporting (printing stack bounds), id 0xe0000000]

Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x28059f];;  oopDesc::size_given_klass(Klass*)+0x1f
V  [libjvm.so+0x4040c8];;  CMBitMapClosure::do_bit(unsigned long)+0x1d8
V  [libjvm.so+0x2e4f0b];;  BitMap::iterate(BitMapClosure*, unsigned long, unsigned long)+0xcb
V  [libjvm.so+0x3f8a9f];;  CMBitMapRO::iterate(BitMapClosure*, MemRegion)+0x7f
V  [libjvm.so+0x400e26];;  CMTask::do_marking_step(double)+0x386
V  [libjvm.so+0x402624];;  CMConcurrentMarkingTask::work(int)+0x1b4
V  [libjvm.so+0xb492bc];;  GangWorker::loop()+0x1fc
V  [libjvm.so+0xb48fb4];;  GangWorker::run()+0x24
V  [libjvm.so+0x9085b6];;  java_start(Thread*)+0x166


Registers:
RAX=0x00002aaabbbae078, RBX=0x0000000000e803fe, RCX=0x0000000000e8033e, RDX=0xdeafbabedeafbabe
RSP=0x0000000040625ea0, RBP=0x0000000040625ed0, RSI=0xdeafbabedeafbace, RDI=0x00002aaab5801ff0
R8 =0x0000000000000000, R9 =0x00002aaabb600000, R10=0x0000000001a40000, R11=0x4000000000000000
R12=0xdeafbabedeafbace, R13=0x00002aaab5801ff0, R14=0x0000000040120ec8, R15=0x0000000040626000
RIP=0x00002b8a7715759f, EFL=0x0000000000010206, CSGSFS=0x0000000000000033, ERR=0x0000000000000000


Basically we try to scan an object, which is in fact an internal space of the filler object (notice the deafbabe pattern that is used to mangle the filler object space)