JVM crashes during GC on various asserts which checks that HeapWord ptr is an oop.
Issues could be intermittently reproduced with G1 & CMS.
I was able to reproduce only on linux-sparc hosts and only w/ 7u80, but there is an JI bug (JI-9011043) which was filed against very similar crash happened on solaris-sparc w/ 7u51.

Here are example of failed asserts:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/HUDSON/workspace/7u-2-build-linux-sparcv9/jdk7u-dev/1740/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp:1012), pid=19426, tid=18446735281952250128
#  assert(k->is_oop(true )) failed: Should be klass oop
#
# JRE version: Java(TM) SE Runtime Environment (7.0_80-b03) (build 1.7.0_80-ea-fastdebug-langtools-nightly-h1740-20141030-b03-b03)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (24.80-b07-fastdebug mixed mode linux-sparc compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0xfffff80104024000):  GCTaskThread [stack: 0xfffff801025de000,0xfffff801026de000] [id=19437]

Stack: [0xfffff801025de000,0xfffff801026de000],  sp=0xfffff801026da360,  free space=1008k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0xe34fa0]  VMError::report_and_die()+0x24c
V  [libjvm.so+0x6daa28]  report_vm_error(char const*, int, char const*, char const*)+0x6c
V  [libjvm.so+0x631894]  CompactibleFreeListSpace::block_size(HeapWord const*) const+0x27c
V  [libjvm.so+0x44fdf4]  BlockOffsetArrayNonContigSpace::block_start_unsafe(void const*) const+0x474
V  [libjvm.so+0x6287ac]  CompactibleFreeListSpace::block_start_const(void const*) const+0xe0
V  [libjvm.so+0x633ec0]  Space::block_start(void const*)+0x18
V  [libjvm.so+0xc1ea54]  CardTableModRefBS::process_chunk_boundaries(Space*, DirtyCardToOopClosure*, MemRegion, MemRegion, signed char**, unsigned long, unsigned long)+0xc8
V  [libjvm.so+0xc1fdc0]  CardTableModRefBS::process_stride(Space*, MemRegion, int, int, OopsInGenClosure*, CardTableRS*, signed char**, unsigned long, unsigned long)+0x458
V  [libjvm.so+0xc20188]  CardTableModRefBS::non_clean_card_iterate_parallel_work(Space*, MemRegion, OopsInGenClosure*, CardTableRS*, int)+0x15c
V  [libjvm.so+0x557028]  CardTableModRefBS::non_clean_card_iterate_possibly_parallel(Space*, MemRegion, OopsInGenClosure*, CardTableRS*)+0xb8
V  [libjvm.so+0x55a84c]  CardTableRS::younger_refs_in_space_iterate(Space*, OopsInGenClosure*)+0x8c
V  [libjvm.so+0x8077c8]  Generation::younger_refs_in_space_iterate(Space*, OopsInGenClosure*)+0x3c
V  [libjvm.so+0x68cfbc]  ConcurrentMarkSweepGeneration::younger_refs_iterate(OopsInGenClosure*)+0x34
V  [libjvm.so+0x55a074]  CardTableRS::younger_refs_iterate(Generation*, OopsInGenClosure*)+0x2c
V  [libjvm.so+0x7f17dc]  GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0xe8
V  [libjvm.so+0xc29314]  ParNewGenTask::work(unsigned int)+0x1cc
V  [libjvm.so+0xe759a8]  GangWorker::loop()+0x358
V  [libjvm.so+0xe743f4]  GangWorker::run()+0x24
V  [libjvm.so+0xc01914]  java_start(Thread*)+0x164
C  [libpthread.so.0+0x8a08]  start_thread+0xc8

or 

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/HUDSON/workspace/7u-2-build-linux-sparcv9/jdk7u-dev/1725/hotspot/src/share/vm/memory/space.cpp:822), pid=43076, tid=8796149045520
#  assert(p == current_top || oop(p)->is_oop()) failed: p (0x0000000147b36c00) is not a block start - current_top: 0x0000000147c00000, is_oop: false
#
# JRE version: Java(TM) SE Runtime Environment (7.0_80-b03) (build 1.7.0_80-ea-fastdebug-langtools-nightly-h1725-20141027-b03-b03)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (24.80-b07-fastdebug mixed mode linux-sparc compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x0000080004046800):  GCTaskThread [stack: 0x000008000346e000,0x000008000356e000] [id=43101]

Stack: [0x000008000346e000,0x000008000356e000],  sp=0x0000080003565a40,  free space=990k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0xe34fa0]  VMError::report_and_die()+0x24c
V  [libjvm.so+0x6daa28]  report_vm_error(char const*, int, char const*, char const*)+0x6c
V  [libjvm.so+0xd2e040]  ContiguousSpace::block_size(HeapWord const*) const+0x2e4
V  [libjvm.so+0x78dc74]  G1BlockOffsetArrayContigSpace::block_start_unsafe(void const*)+0x26c
V  [libjvm.so+0x83fb90]  G1OffsetTableContigSpace::block_start(void const*)+0x38
V  [libjvm.so+0xd2aaa0]  DirtyCardToOopClosure::do_MemRegion(MemRegion)+0xc0
V  [libjvm.so+0x7d17a8]  ScanRSClosure::doHeapRegion(HeapRegion*)+0x448
V  [libjvm.so+0x799118]  G1CollectedHeap::collection_set_iterate_from(HeapRegion*, HeapRegionClosure*)+0x204
V  [libjvm.so+0x7cf5e8]  G1RemSet::scanRS(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, int)+0xbc
V  [libjvm.so+0x7cf9c0]  G1RemSet::oops_into_collection_set_do(OopsInHeapRegionClosure*, CodeBlobToOopClosure*, int)+0xfc
V  [libjvm.so+0x7a0710]  _ZN15G1CollectedHeap23g1_process_strong_rootsEbN10SharedHeap14ScanningOptionEP10OopClosureP23OopsInHeapRegionClosureP16OopsInGenClosureib.clone.11+0x4ac
V  [libjvm.so+0x7b8a20]  G1ParTask::work(unsigned int)+0x6a4
V  [libjvm.so+0xe759a8]  GangWorker::loop()+0x358
V  [libjvm.so+0xe743f4]  GangWorker::run()+0x24
V  [libjvm.so+0xc01914]  java_start(Thread*)+0x164
C  [libpthread.so.0+0x8a08]  start_thread+0xc8


Note that in case of crash in CompactibleFreeListSpace::block_size, p point to:
(gdb) p *p
$1 = {i = 0xbaadbabebaadbabe <Address 0xbaadbabebaadbabe out of bounds>}

And in case of crash in ContiguousSpace::block_size, p point to:
(gdb) p *p
$1 = {i = 0xdeafbabedeafbabe <Address 0xdeafbabedeafbabe out of bounds>}