It seems Shenandoah can trash the collection set region even if it is pinned:

# Internal Error (/home/jenkins/workspace/nightly/shenandoah-jdk11/src/hotspot/share/gc/shenandoah/shenandoahHeapRegion.cpp:86), pid=116828, tid=116836
# fatal error: Illegal region state transition from "Collection Set, Pinned", at trashing
  | 2038|CSP|BTE ffb00000, ffb80000, ffb80000|TAMS ffb80000|U 512K|T 0B|G 0B|S 512K|L 8336B|CP 1|SN b7d, b7d, 0, 0

Stack: [0x00007f825a3e5000,0x00007f825a4e5000], sp=0x00007f825a4e31c0, free space=1016k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x19c4f47] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x187
V [libjvm.so+0x19c5fd7] VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x47
V [libjvm.so+0xb5f38d] report_fatal(char const*, int, char const*, ...)+0x10d
V [libjvm.so+0x174bcdb] ShenandoahHeapRegion::report_illegal_transition(char const*)+0x14b
V [libjvm.so+0x172a4f8] ShenandoahHeap::trash_cset_regions()+0x38
V [libjvm.so+0x172e738] ShenandoahHeap::op_final_updaterefs()+0xd8
V [libjvm.so+0x1733ccb] ShenandoahHeap::op_degenerated(ShenandoahHeap::ShenandoahDegenPoint)+0x11b
V [libjvm.so+0x173416c] ShenandoahHeap::entry_degenerated(int)+0x10c
V [libjvm.so+0x17c3237] VM_ShenandoahDegeneratedGC::doit()+0x37
V [libjvm.so+0x1a0869d] VM_Operation::evaluate()+0x13d
V [libjvm.so+0x1a0405a] VMThread::evaluate_operation(VM_Operation*)+0x15a
V [libjvm.so+0x1a048e8] VMThread::loop()+0x2d8
V [libjvm.so+0x1a04f95] VMThread::run()+0xc5
V [libjvm.so+0x19035b2] Thread::call_run()+0x72
V [libjvm.so+0x15021c0] thread_native_entry(Thread*)+0x110

The failure is extremely rare, because we need to switch to Degenerated GC during evacuation. If we did Full GC, this would have been handled correctly.