Code in HotSpot can hold onto pointers into the stack (e.g. embedded in a RegisterMap) over a safepoint. This implicitly assumes that the structure of the stack — i.e. the number, location, and size of frames — cannot be changed by other threads in a safepoint/handshakes. A simple assertion can at least verify that the thread's last-frame anchor is not changed by safepoints/handshakes.