Managed to reproduce a few more crashes:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffecfa0700 (LWP 13305)]
0x00000000007b3b2f in rec_get_offsets_func (rec=0x7ffff4564470 "\200", index=0x15983e8, offsets=0x7fffecf9e770, n_fields=2, heap=0x7fffecf9edc0, file=0x9f3c6c "page/page0cur.c", line=378) at rem/rem0rec.c:546
546             if (dict_table_is_comp(index->table)) {



#0  0x00000000007b3b2f in rec_get_offsets_func (rec=0x7ffff4564470 "\200", 
    index=0x15983e8, offsets=0x7fffecf9e770, n_fields=2, heap=0x7fffecf9edc0, 
    file=0x9f3c6c "page/page0cur.c", line=378) at rem/rem0rec.c:546
#1  0x00000000007a08bf in page_cur_search_with_match (block=0x7ffff2690078, 
    index=0x15983e8, tuple=0x13f1e18, mode=4, 
    iup_matched_fields=0x7fffecf9f218, iup_matched_bytes=0x7fffecf9f220, 
    ilow_matched_fields=0x7fffecf9f228, ilow_matched_bytes=0x7fffecf9f230, 
    cursor=0x7fffecf9f2d8) at page/page0cur.c:376
#2  0x0000000000804597 in btr_cur_search_to_nth_level (index=0x15983e8, 
    level=0, tuple=0x13f1e18, mode=4, latch_mode=2, cursor=0x7fffecf9f2d0, 
    has_search_latch=0, file=0x9f9abe "row/row0row.c", line=771, 
    mtr=0x7fffecf9f3c0) at btr/btr0cur.c:665
#3  0x00000000007c7e10 in btr_pcur_open_func (mtr=<optimized out>, line=771, 
    file=0x9f9abe "row/row0row.c", cursor=0x7fffecf9f2d0, 
    latch_mode=<optimized out>, mode=4, tuple=0x13f1e18, index=<optimized out>)
    at ./include/btr0pcur.ic:498
#4  row_search_index_entry (index=<optimized out>, entry=0x13f1e18, 
    mode=<optimized out>, pcur=<optimized out>, mtr=<optimized out>)
    at row/row0row.c:771
#5  0x00000000007c5b24 in row_purge_remove_sec_if_poss_low (node=0x138fb88, 
    index=0x15983e8, entry=0x13f1e18, mode=2) at row/row0purge.c:253
#6  0x00000000007c690b in row_purge_remove_sec_if_poss (entry=0x13f1e18, 
    index=0x15983e8, node=0x138fb88) at row/row0purge.c:328

#7  row_purge_del_mark (node=0x138fb88) at row/row0purge.c:375
#8  row_purge (thr=0x138fa00, node=0x138fb88) at row/row0purge.c:648
#9  row_purge_step (thr=0x138fa00) at row/row0purge.c:688
#10 0x00000000007b167d in que_thr_step (thr=0x138fa00) at que/que0que.c:1260
#11 que_run_threads_low (thr=0x138fa00) at que/que0que.c:1320
#12 que_run_threads (thr=0x138fa00) at que/que0que.c:1357
#13 0x00000000007e2ffc in trx_purge () at trx/trx0purge.c:1201
#14 0x00000000007da109 in srv_purge_thread (arg=<optimized out>)
    at srv/srv0srv.c:3513
#15 0x00007ffff7bc6efc in start_thread (arg=0x7fffecfa0700)
    at pthread_create.c:304
#16 0x00007ffff6b1989d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#17 0x0000000000000000 in ?? ()



and...


#0  0x00007ffff6a6e3a5 in __GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff6a71b0b in __GI_abort () at abort.c:92
#2  0x00000000007dd68f in rw_lock_free (lock=0x1433100) at sync/sync0rw.c:307
#3  0x000000000082e4d4 in dict_index_remove_from_cache (table=0x142c048, 
    index=0x1433078) at dict/dict0dict.c:1825
#4  0x000000000082e5e0 in dict_table_remove_from_cache (table=0x142c048)
    at dict/dict0dict.c:1227
#5  0x000000000082e935 in dict_table_LRU_trim (self=0x7fffe8049478)
    at dict/dict0dict.c:1291
#6  0x0000000000832e20 in dict_table_get (table_name=<optimized out>, 
    inc_mysql_count=1) at dict/dict0dict.c:734
#7  0x000000000077656f in ha_innobase::open(char const*, int, unsigned int) ()
#8  0x00000000006bc03d in handler::ha_open(st_table*, char const*, int, int) ()
#9  0x0000000000624537 in open_table_from_share(THD*, st_table_share*, char const*, unsigned int, unsigned int, unsigned int, st_table*, bool) ()
#10 0x000000000061e081 in open_unireg_entry(THD*, st_table*, TABLE_LIST*, char const*, char*, unsigned int, st_mem_root*, unsigned int) ()
#11 0x0000000000620027 in open_table(THD*, TABLE_LIST*, st_mem_root*, bool*, unsigned int) ()
#12 0x00000000006205e8 in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int) ()



with that branch I think i've also managed to spot some situations that end in deadlock (but haven't done the backtrace all threads yet)