rootResolver.cpp:

void RootResolver::resolve(RootCallback& callback) {

  // Need to clear cld claim bit before starting
  ClassLoaderDataGraph::clear_claimed_marks(); <<-- !
  RootResolverMarkScope mark_scope;

  // thread local roots
  ReferenceToThreadRootClosure rtrc(callback);
  if (rtrc.complete()) {
    return;
  }
  // system global roots
  ReferenceToRootClosure rrc(callback);
}

The code above is correct under the premise that the saveRestore construct for restoring CLD claims is on the stack. And I think it was originally. I can't remember how but it was moved to RootSetClosure::process_roots(). This means the above code in RootResolver is invalid.

  // Iteration over CLDs involves setting a claim bit.
  // Save the currently claimed CLDs and restore their claimed state upon completion (function exit).
  SaveRestoreCLDClaimBits save_restore_cld_claim_bits;

We need to move SaveRestoreCLDClaimBits, from inside RootSetClosure::process_roots() back up to EmitEventOperation::doit() for the proper scope.

The problematic path triggers only if the option "path-to-gc-roots=true" is set via the command-line or via jcmd AND an existing leak candidate is found.