The reason for the failure is that the outgoing region map for each region's RSet is not maintained correctly.
The outgoing region map is a bitmap that determines which other regions a region A, say, has references to. There's a bit in the bitmap per region in the heap. If that bit is set to 1 then A has, or has had in the past, a reference to the region that corresponds to that bit.
The issue is that the bits are only cleared during cleanup. So, if the heap is retracted (by, say, a Full GC) after a bit has been set and before a cleanup, then it's possible that said bit would correspond to a region that might not be in the committed space any more.
We could try to prune such entries more carefully (at the end of, say, Full GCs). However, the outgoing region map is not actually used currently (we populate it but never read it). So I'm going to take the liberty to remove it from the codebase. If we need it in the future, we can re-introduce it.