When there's a conflict between two threads evacuating the same TSO,
in some cases we would update the incall->tso pointer to point to the
wrong copy of the TSO.  This would get fixed during the next GC, but
if the thread completed in the meantime, it would likely crash.  We're
seeing this about once per day on a heavily loaded machine (it varies
a lot though).