JVM crash when using CMS collector with large heap

Issue

One of our JBoss instances crashed. The hs_err file contains

C  [libc.so.6+0x82e50]  __tls_get_addr@@GLIBC_2.3+0x82e50
V  [libjvm.so+0x27d25b]  BlockOffsetArray::set_remainder_to_point_to_start(HeapWord*, HeapWord*, bool)+0x2b
V  [libjvm.so+0x27d632]  BlockOffsetArray::do_block_internal(HeapWord*, HeapWord*, BlockOffsetArray::Action, bool)+0xc2
V  [libjvm.so+0x27d65e]  BlockOffsetArray::single_block(HeapWord*, HeapWord*)+0xe
V  [libjvm.so+0x391c47]  CompactibleFreeListSpace::reset(MemRegion)+0xd7
V  [libjvm.so+0x391d23]  CompactibleFreeListSpace::reset_after_compaction()+0x43
V  [libjvm.so+0x3971a0]  CompactibleFreeListSpace::compact()+0xf0
V  [libjvm.so+0x47dadc]  Generation::compact()+0x2c
V  [libjvm.so+0x472360]  GenCompactClosure::do_generation(Generation*)+0x10
V  [libjvm.so+0x470695]  GenCollectedHeap::generation_iterate(GenCollectedHeap::GenClosure*, bool)+0x35
V  [libjvm.so+0x4717ea]  GenMarkSweep::invoke_at_safepoint(int, ReferenceProcessor*, bool)+0x3ca
V  [libjvm.so+0x3c1dd9]  CMSCollector::do_compaction_work(bool)+0x1f9
V  [libjvm.so+0x3c17f0]  CMSCollector::acquire_control_and_collect(bool, bool)+0x160
V  [libjvm.so+0x3c14f8]  ConcurrentMarkSweepGeneration::collect(bool, bool, unsigned long, bool)+0xf8
V  [libjvm.so+0x46e84a]  GenCollectedHeap::do_collection(bool, bool, unsigned long, bool, int)+0x51a
V  [libjvm.so+0x38ca65]  GenCollectorPolicy::satisfy_failed_allocation(unsigned long, bool)+0xc5
V  [libjvm.so+0x46eebd]  GenCollectedHeap::satisfy_failed_allocation(unsigned long, bool)+0x2d
V  [libjvm.so+0x862ded]  VM_GenCollectForAllocation::doit()+0x5d
V  [libjvm.so+0x870a2a]  VM_Operation::evaluate()+0x4a
V  [libjvm.so+0x86fff2]  VMThread::evaluate_operation(VM_Operation*)+0x82
V  [libjvm.so+0x870268]  VMThread::loop()+0x198
V  [libjvm.so+0x86fd6e]  VMThread::run()+0x6e
V  [libjvm.so+0x712eef]  java_start(Thread*)+0x13f