A thread stopping for a handshake must make sure it the operation is still 'alive'. It seem like with two close handshakes, a thread going from a safe (native) thread state can end up in the second handshake but with a pointer to the first handshake operation.

Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x18635ef] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x25f
V [libjvm.so+0x186440f] VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x2f
V [libjvm.so+0xae49d0] report_vm_error(char const*, int, char const*, char const*, ...)+0x100
V [libjvm.so+0x164fbd8] PosixSemaphore::signal(unsigned int)+0xa8
V [libjvm.so+0xdddb83] HandshakeThreadsOperation::do_handshake(JavaThread*)+0x143
V [libjvm.so+0xdde591] HandshakeState::process_self_inner(JavaThread*)+0x131
V [libjvm.so+0x163d002] ThreadSafepointState::handle_polling_page_exception()+0xa02
v ~SafepointBlob
J 363% c1 AVTest.run()V (164 bytes) @ 0x00007f90f127136c [0x00007f90f126e0c0+0x00000000000032ac]
v ~StubRoutines::call_stub
V [libjvm.so+0xeb4a3a] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, Thread*)+0x85a
V [libjvm.so+0xeb09ef] JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, Thread*)+0x3df
V [libjvm.so+0x10129b1] thread_entry(JavaThread*, Thread*)+0x91
V [libjvm.so+0x17a71c7] JavaThread::thread_main_inner()+0x2c7
V [libjvm.so+0x17a7548] JavaThread::run()+0x278
V [libjvm.so+0x14aa030] thread_native_entry(Thread*)+0x100