When iterating over a Howl "Full" card set to mark these cards, the current code iterates over too many cards, the number of cards in a (card) region, not the number of cards the bucket of the Howl card set the partition actually covers.

I.e.

    case G1CardSet::CardSetHowl: { // actually FullCardSet
      if (found.start_iterate(G1GCPhaseTimes::MergeRSHowlFull)) {
        assert(card_set == G1CardSet::FullCardSet, "Must be");
        uint offset = index << config->log2_num_cards_in_howl_bitmap();
        for (uint i = 0; i < config->max_cards_in_region(); i++) {
          found((offset | (uint)i));
        }
      }
      return;
    }


The config->max_cards_in_region() should be config->num_cards_in_howl_bitmap(). Also we should probably call the found() method with the range parameters.

This problem can cause crashes/memory overwrites.