To reproduce:

$ __jtreg_home=[path to jtreg home]
$ __test_jdk=[path to test jdk home]
$ __test=test/jdk/java/awt/Graphics2D/DrawString/DrawRotatedStringUsingRotatedFont.java
$ while true; do $__jtreg_home/bin/jtreg -v -a -testjdk:$__test_jdk $__test || break; done

It could take anywhere between 10 seconds and 20 minutes to crash on MacOS.

With additional logging and malloc debugging on (export MallocDebugReport=crash), the error appears to come from a "bad" free():

java(75464,0x700010d80000) malloc: *** error for object 0x7ff636c574a0: pointer being freed was not allocated
java(75464,0x700010d80000) malloc: *** set a breakpoint in malloc_error_break to debug

allocated from here
0x0000000107afc4e0(0x00007ff636c574a0)
java.lang.Exception
at java.desktop/sun.java2d.DefaultDisposerRecord.<init>(DefaultDisposerRecord.java:55)
at java.desktop/sun.java2d.Disposer.addRecord(Disposer.java:107)
at java.desktop/sun.awt.image.BufImgSurfaceData.initRaster(Native Method)
at java.desktop/sun.awt.image.BufImgSurfaceData.createDataIC(BufImgSurfaceData.java:274)
at java.desktop/sun.awt.image.BufImgSurfaceData.createData(BufImgSurfaceData.java:92)
at java.desktop/sun.awt.image.BufImgSurfaceData.createData(BufImgSurfaceData.java:74)
at java.desktop/sun.awt.image.BufImgSurfaceManager.<init>(BufImgSurfaceManager.java:55)
at java.desktop/sun.awt.image.SurfaceManager.getManager(SurfaceManager.java:79)
at java.desktop/sun.java2d.SurfaceData.getPrimarySurfaceData(SurfaceData.java:275)
at java.desktop/sun.java2d.SunGraphicsEnvironment.createGraphics(SunGraphicsEnvironment.java:170)
at java.desktop/java.awt.image.BufferedImage.createGraphics(BufferedImage.java:1183)
at DrawRotatedStringUsingRotatedFont.createImage(DrawRotatedStringUsingRotatedFont.java:130)
at DrawRotatedStringUsingRotatedFont.main(DrawRotatedStringUsingRotatedFont.java:74)


Also getting errors like this (with additional stacktrace added) that are probably related:
Exception while disposing deferred rec: java.lang.NullPointerException: Cannot invoke "sun.java2d.DisposerRecord.dispose()" because "rec" is null
java.lang.NullPointerException: Cannot invoke "sun.java2d.DisposerRecord.dispose()" because "rec" is null
at java.desktop/sun.java2d.Disposer.clearDeferredRecords(Disposer.java:176)
at java.desktop/sun.java2d.Disposer.run(Disposer.java:151)
at java.base/java.lang.Thread.run(Thread.java:833)

With SIGABRT caught by HotSpot (again, additional code not present in OpenJDK), this is the usual crash log excerpt:

Current thread (0x00007fa048172c00): JavaThread "Java2D Disposer" daemon [_thread_in_native, id=60939, stack(0x0000700002c44000,0x0000700002d44000)]

Stack: [0x0000700002c44000,0x0000700002d44000], sp=0x0000700002d43778, free space=1021k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libsystem_kernel.dylib+0x732a] __pthread_kill+0xa
C [libsystem_c.dylib+0x7f808] abort+0x78
C [libsystem_malloc.dylib+0xf50b] has_default_zone0+0x0
C [libsystem_malloc.dylib+0x1240f] malloc_report+0x97
j sun.java2d.DefaultDisposerRecord.invokeNativeDispose(JJ)V+0 java.desktop@17.0.3-internal
j sun.java2d.DefaultDisposerRecord.dispose()V+8 java.desktop@17.0.3-internal
j sun.java2d.Disposer.clearDeferredRecords()V+40 java.desktop@17.0.3-internal
j sun.java2d.Disposer.run()V+35 java.desktop@17.0.3-internal
j java.lang.Thread.run()V+11 java.base@17.0.3-internal
v ~StubRoutines::call_stub
V [libjvm.dylib+0x5199f1] _ZN9JavaCalls11call_helperEP9JavaValueRK12methodHandleP17JavaCallArgumentsP10JavaThread+0x2a1
V [libjvm.dylib+0x518a67] _ZN9JavaCalls12call_virtualEP9JavaValueP5KlassP6SymbolS5_P17JavaCallArgumentsP10JavaThread+0x147
V [libjvm.dylib+0x518b33] _ZN9JavaCalls12call_virtualEP9JavaValue6HandleP5KlassP6SymbolS6_P10JavaThread+0x63
V [libjvm.dylib+0x5c4c94] _ZL12thread_entryP10JavaThreadS0_+0xb4
V [libjvm.dylib+0xa9d2f7] _ZN10JavaThread17thread_main_innerEv+0x147
V [libjvm.dylib+0xa9b70a] _ZN6Thread8call_runEv+0x11a
V [libjvm.dylib+0x8aa978] _ZL19thread_native_entryP6Thread+0x148
C [libsystem_pthread.dylib+0x6109] _pthread_start+0x94
C [libsystem_pthread.dylib+0x1b8b] thread_start+0xf

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.java2d.DefaultDisposerRecord.invokeNativeDispose(JJ)V+0 java.desktop@17.0.3-internal
j sun.java2d.DefaultDisposerRecord.dispose()V+8 java.desktop@17.0.3-internal
j sun.java2d.Disposer.clearDeferredRecords()V+40 java.desktop@17.0.3-internal
j sun.java2d.Disposer.run()V+35 java.desktop@17.0.3-internal
j java.lang.Thread.run()V+11 java.base@17.0.3-internal
v ~StubRoutines::call_stub