JDK-8254314 introduced the following code:

    if (in1->bottom_type() == TypePtr::NULL_PTR &&
        (in1->Opcode() != Op_ShenandoahLoadReferenceBarrier || !((ShenandoahLoadReferenceBarrierNode*)in1)->is_native())) {
      in2 = step_over_gc_barrier(in2);
    }

However, the check for LRB and !native are the wrong way around: they should check if *in2* are not native LRB.

The bug is currently only observed in the conc-weakrefs branch, but may manifest (rarely) in mainline too.