(synopsis is provisional, change after root cause is identified)

Easiest way to reproduce:

$ CONF=linux-x86_64-server-fastdebug make images run-test TEST=vmTestbase/nsk/jvmti/scenarios/allocation/AP01/ap01t001/ TEST_VM_OPTS="-XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -XX:ShenandoahGCMode=traversal"

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/shade/trunks/jdk-jdk/src/hotspot/share/gc/shenandoah/shenandoahHeap.inline.hpp:246), pid=16491, tid=16520
# assert(ShenandoahThreadLocalData::is_evac_allowed(thread)) failed: must be enclosed in oom-evac scope
#
# JRE version: OpenJDK Runtime Environment (14.0) (fastdebug build 14-internal+0-adhoc.shade.jdk-jdk)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 14-internal+0-adhoc.shade.jdk-jdk, mixed mode, sharing, tiered, compressed oops, shenandoah gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x37dba4] ShenandoahHeap::evacuate_object(oop, Thread*)+0x804
#

--------------- T H R E A D ---------------

Current thread (0x00007fdcac01f800): GCTaskThread "Shenandoah GC Threads#7" [stack: 0x00007fdcb8b1f000,0x00007fdcb8c1f000] [id=16520]

Stack: [0x00007fdcb8b1f000,0x00007fdcb8c1f000], sp=0x00007fdcb8c1d890, free space=1018k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x37dba4] ShenandoahHeap::evacuate_object(oop, Thread*)+0x804
V [libjvm.so+0x1441eea] ShenandoahBarrierSet::load_reference_barrier_impl(oop)+0x17a
V [libjvm.so+0x144223b] ShenandoahBarrierSet::load_reference_barrier_not_null(oop)+0x7b
V [libjvm.so+0x14428f2] ShenandoahBarrierSet::oop_load_from_native_barrier(oop)+0x72
V [libjvm.so+0x8ec808] AccessInternal::PostRuntimeDispatch<ShenandoahBarrierSet::AccessBarrier<1187956ul, ShenandoahBarrierSet>, (AccessInternal::BarrierType)2, 1187956ul>::oop_access_barrier(void*)+0x88
V [libjvm.so+0x1037a0f] JvmtiTagMap::do_weak_oops(BoolObjectClosure*, OopClosure*)+0x24f
V [libjvm.so+0x1037dbe] JvmtiTagMap::weak_oops_do(BoolObjectClosure*, OopClosure*)+0xae
V [libjvm.so+0x14df897] ShenandoahSerialWeakRoots::weak_oops_do(BoolObjectClosure*, OopClosure*, unsigned int)+0xf7
V [libjvm.so+0x150f59a] void ShenandoahRootUpdater::roots_do<ShenandoahForwardedIsAliveClosure, ShenandoahTraversalFixRootsClosure>(unsigned int, ShenandoahForwardedIsAliveClosure*, ShenandoahTraversalFixRootsClosure*)+0x13a
V [libjvm.so+0x150f6c8] ShenandoahTraversalFixRootsTask::work(unsigned int)+0xa8
V [libjvm.so+0x1764720] GangWorker::loop()+0xe0
V [libjvm.so+0x165b226] Thread::call_run()+0xf6
V [libjvm.so+0x12b838e] thread_native_entry(Thread*)+0x10e