Observed a very rare crash found in CI, and caught by verification. It looks like we've got a lone reference from global-list in ObjectSynchronizer. This list is only used when threads are dying. ObjectMonitors on this list may be the only remaining reference to an oop. When running with I-U mode, we don't enqueue the new-value when creating such ObjectMonitor objects, and thus such objects end up not being marked.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/jenkins/workspace/nightly/jdk-jdk/src/hotspot/share/gc/shenandoah/shenandoahClosures.inline.hpp:100), pid=82970, tid=83515
# Error: Shenandoah assert_marked failed; Object should be marked
 
Referenced from:
  interior location: 0x00007f470c043dc8
  outside of Java heap
  0x00007f470c043dc8 points into unknown readable memory: 0x00000000fe24e7f8 | f8 e7 24 fe 00 00 00 00
 
Object:
  0x00000000fe24e7f8 - klass 0x0000000100000c70 [I
    not allocated after mark start
    not after update watermark
    not marked
        in collection set
  mark: monitor(0x00007f470c043dc2)={contentions=0x00000000,waiters=0x00000000,recursions=0,owner=0x0000000000000000}
  region: | 1929|CS |BTE fe240000, fe280000, fe280000|TAMS fe280000|UWM fe280000|U 256K|T 0B|G 256K|S 0B|L 5656B|CP 0
 
Forwardee:
  (the object itself)
 
Stack: [0x00007f4779fd0000,0x00007f477a0d0000], sp=0x00007f477a0cc670, free space=1009k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x173f9fe] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x37e
V [libjvm.so+0x174070f] VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x2f
V [libjvm.so+0x8bbff1] report_vm_error(char const*, int, char const*, char const*, ...)+0x111
V [libjvm.so+0x1439108] ShenandoahAsserts::print_failure(ShenandoahAsserts::SafeLevel, oop, void*, oop, char const*, char const*, char const*, int)+0x3f8
V [libjvm.so+0x143b855] ShenandoahAsserts::assert_marked(void*, oop, char const*, int)+0x1d5
V [libjvm.so+0x1467ec7] ShenandoahEvacuateUpdateRootsClosure<64ul>::do_oop(oop*)+0x447
V [libjvm.so+0x1603ed9] ObjectSynchronizer::oops_do(OopClosure*)+0xe9
V [libjvm.so+0x150192e] ShenandoahRootEvacuator::roots_do(unsigned int, OopClosure*)+0x2ae
V [libjvm.so+0x14bc1d4] ShenandoahEvacuateUpdateRootsTask::work(unsigned int)+0x174
V [libjvm.so+0x17b13a0] GangWorker::loop()+0xe0
V [libjvm.so+0x1680616] Thread::call_run()+0xf6
V [libjvm.so+0x12a5f66] thread_native_entry(Thread*)+0x116