MethodHandles::remove_dependent_nmethod is not MT safe, but called from parallel GC worker threads.

See:
void MethodHandles::remove_dependent_nmethod(oop call_site, nmethod* nm) {
  assert_locked_or_safepoint(CodeCache_lock);

  oop context = java_lang_invoke_CallSite::context(call_site);
  nmethodBucket* deps = java_lang_invoke_MethodHandleNatives_CallSiteContext::vmdependencies(context);

  if (nmethodBucket::remove_dependent_nmethod(deps, nm)) {
    nmethodBucket* new_deps = nmethodBucket::clean_dependent_nmethods(deps);
    if (deps != new_deps) {
      java_lang_invoke_MethodHandleNatives_CallSiteContext::set_vmdependencies(context, new_deps);
    }
  }
}

The code in nmethodBucket::clean_dependent_nmethods deletes entries and cuts the list. This works for most callers but not when GC does Klass cleaning in parallel.

This is most likely the reason for multiple crashes seen when JSR292 intensive tests are run with G1.