Similar to JDK-8286830, JavaThread touches oop after GC barrier is detached. This time in SharedRuntime::get_java_tid() call, where it tries to resolve JavaThread::_threadObj.

#21 OopHandle::resolve (this=0x7f2828ee4ee0) at /home/zhengyu/ws/jdk/src/hotspot/share/oops/oopHandle.inline.hpp:34
#22 JavaThread::threadObj (this=this@entry=0x7f27bcc75240) at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.cpp:796
#23 0x00007f2850b38e3c in SharedRuntime::get_java_tid (thread=0x7f27bcc75240)
    at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.hpp:1582
#24 0x00007f2850e207c5 in ThreadsSMRSupport::remove_thread (thread=thread@entry=0x7f27bcc75240)
    at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/threadSMR.cpp:1005
#25 0x00007f2850e0ac1c in Threads::remove (p=p@entry=0x7f27bcc75240, is_daemon=is_daemon@entry=false)
    at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.cpp:3605
#26 0x00007f2850e13937 in JavaThread::exit (this=this@entry=0x7f27bcc75240, destroy_vm=destroy_vm@entry=false,
    exit_type=exit_type@entry=JavaThread::normal_exit) at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.cpp:1540
#27 0x00007f2850e13f9b in JavaThread::post_run (this=0x7f27bcc75240) at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.cpp:1336
#28 0x00007f2850e132a1 in Thread::call_run (this=this@entry=0x7f27bcc75240)
    at /home/zhengyu/ws/jdk/src/hotspot/share/runtime/thread.cpp:370
#29 0x00007f28509baf3c in thread_native_entry (thread=0x7f27bcc75240) at /home/zhengyu/ws/jdk/src/hotspot/os/linux/os_linux.cpp:706
#30 0x00007f2851690609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#31 0x00007f28517ec133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95