JDK b139 fastdebug hit assertion with certain SharedMiscCodeSize, SharedMiscDataSize, SharedReadOnlySize, SharedReadWriteSize values(e.g. (MIN+MAX)/2 value, SharedMiscCodeSize=1066924031). Linux-x64 system:
java -XX:+UnlockDiagnosticVMOptions -XX:SharedArchiveFile=Test.jsa -Xshare:dump -XX:SharedMiscCodeSize=1066924031
Allocated shared space: 2163212288 bytes at 0x21e00000
Loading classes to share ...
Loading classes to share: done.
Rewriting and linking classes ...
Rewriting and linking classes: done
Number of classes 1206
    instance classes = 1192
    obj array classes = 6
    type array classes = 8
Updating ConstMethods ... done.
Removing unshareable information ... done.
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/compactHashtable.cpp:175
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/scratch/workspace/9-2-build-linux-i586-phase2/jdk9/5571/hotspot/src/share/vm/classfile/compactHashtable.cpp:175), pid=26633, tid=26646
# assert(max_delta <= (0x7FFFFFFF)) failed: range check
#
# JRE version: (9.0+139) (fastdebug build )
# Java VM: Java HotSpot(TM) Server VM (fastdebug 9-ea+139, interpreted mode, tiered, g1 gc, linux-x86)
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %P" (or dumping to /home/ddmitriev/bundles/jdk-9/b139/jdk-9/fastdebug/bin/core.26633)
#
# An error report file with more information is saved as:
# /home/ddmitriev/bundles/jdk-9/b139/jdk-9/fastdebug/bin/hs_err_pid26633.log
.................................................

JDK b139 contains fix for JDK-8078644. This fix changes FileMapInfo::shared_spaces_size() method:
hotspot/src/share/vm/memory/filemap.hpp module
class FileMapInfo : public CHeapObj<mtInternal> {
…
  static size_t shared_spaces_size() { return core_spaces_size() + optional_space_size(); }
...

Previously(prior to JDK b139) shared_spaces_size() method returns value equals to core_spaces_size(), but now it returns sum of core_spaces_size() and optional_space_size(). Actually optional_space_size() is equals to the core_spaces_size() and thus starting with b139 FileMapInfo::shared_spaces_size() returns 2 x core_spaces_size() value. CDS total value(cds_total) is initialized with FileMapInfo::shared_spaces_size() return value in Metaspace::global_initialize() method. Also, MetaspaceShared::shared_rs is initialized in Metaspace::global_initialize() to cds_total value(via new VirtualSpaceList() -> create_new_virtual_space() -> new VirtualSpaceNode() -> MetaspaceShared::initialize_shared_rs()):
hotspot/src/share/vm/memory/metaspace.cpp module
void Metaspace::global_initialize() {
…
 if (DumpSharedSpaces) {
...
    // Initialize with the sum of the shared space sizes. The read-only
    // and read write metaspace chunks will be allocated out of this and the
    // remainder is the misc code and data chunks.
    cds_total = FileMapInfo::shared_spaces_size();
    cds_total = align_size_up(cds_total, _reserve_alignment);
    _space_list = new VirtualSpaceList(cds_total/wordSize);
...

Assert fired in CompactSymbolTableWriter::add() method: hotspot/src/share/vm/classfile/compactHashtable.cpp module
void CompactSymbolTableWriter::add(unsigned int hash, Symbol *symbol) {
  address base_address = address(MetaspaceShared::shared_rs()->base());
  uintx max_delta = uintx(MetaspaceShared::shared_rs()->size());
  assert(max_delta <= MAX_SHARED_DELTA, "range check");
  uintx deltax = address(symbol) - base_address;
  assert(deltax < max_delta, "range check");
...

MAX_SHARED_DELTA is equal to 0x7FFFFFFF (2147483647). shared_rs()->size() is FileMapInfo::shared_spaces_size(). FileMapInfo::shared_spaces_size() is roughly 2x(SharedReadOnlySize + SharedReadWriteSize + SharedMiscDataSize + SharedMiscCodeSize). sharedConstraintFunc() method(hotspot/src/share/vm/runtime/commandLineFlagConstraintsRuntime.cpp) ensures that sum of (SharedReadOnlySize + SharedReadWriteSize + SharedMiscDataSize + SharedMiscCodeSize) not exceed MAX_SHARED_DELTA. The assert is fired because in b139 shared_rs()->size() is two times bigger and that constraint doesn't help with big Shared* values.