This was discovered while auditing the diffs in the native WebKit code between FX 9-dev and 8u-dev. Except for JDK-9-specific build changes there should be no differences, but there are.

This difference is:

diff -u -r 9-dev/rt/modules/javafx.web/src/main/native/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp 8u-dev/rt/modules/web/src/main/native/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
--- 9-dev/rt/modules/javafx.web/src/main/native/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp 2016-08-22 07:59:20.751842615 -0700
+++ 8u-dev/rt/modules/web/src/main/native/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp 2016-08-30 11:18:58.751621961 -0700
@@ -84,8 +84,8 @@
 Class* JavaInstance::getClass() const
 {
     if (!m_class) {
- jobject acc = accessControlContext();
- m_class = new JavaClass(m_instance->instance(), rootObject(), acc);
+ jobject acc = accessControlContext();
+ m_class = new JavaClass (m_instance->instance(), rootObject(), acc);
     }
     return m_class;
 }
@@ -168,6 +168,10 @@
     }
 
     JavaClass* aClass = static_cast<JavaClass*>(getClass());
+
+ if (!aClass)
+ return jsUndefined();
+
     if (aClass->isCharacterClass())
         return numberValueForCharacter(obj);
     if (aClass->isBooleanClass())
@@ -232,6 +236,10 @@
 JSValue JavaInstance::getMethod(ExecState* exec, PropertyName propertyName)
 {
     JavaClass* aClass = static_cast<JavaClass*>(getClass());
+
+ if (!aClass)
+ return jsUndefined();
+
     Method *method = aClass->methodNamed(propertyName, this);
     return JavaRuntimeMethod::create(exec, exec->lexicalGlobalObject(), propertyName.publicName(), method);
 }
@@ -274,7 +282,7 @@
     // to handle valueOf method call.
     jobject obj = m_instance->instance();
     JavaClass* aClass = static_cast<JavaClass*>(getClass());
- if (aClass->isCharacterClass() && jMethod->name() == "valueOf")
+ if (aClass && aClass->isCharacterClass() && jMethod->name() == "valueOf")
         return numberValueForCharacter(obj);
 
     // Since m_instance->instance() is WeakGlobalRef, creating a localref to safeguard instance() from GC
@@ -423,6 +431,9 @@
         return numberValue(exec);
 
     JavaClass* aClass = static_cast<JavaClass*>(getClass());
+ if (!aClass)
+ return jsUndefined();
+
     if (aClass->isStringClass())
         return stringValue(exec);