The following test failed in the JDK20 CI:

jdk/internal/vm/Continuation/Fuzz.java#default

Here's a snippet from the log file:

5: COMPILE_LEVEL: 4 COMPILE_RUN: true
CALL_C_DBL, CALL_C_INT, LOOP, CALL_C_INT, CALL_C_CTCH, LOOP, CALL_C_CTCH, YIELD, CALL_C_DBL, LOOP, CALL_C_MANY, CALL_C_CTCH, CALL_C_INT, YIELD, CALL_C_MANY, YIELD, CALL_C_DBL, CALL_C_DBL, CALL_C_INT, CALL_C_MANY, CALL_C_INT, CALL_C_INT, CALL_C_DBL, YIELD, CALL_C_CTCH, CALL_C_MANY, CALL_C_CTCH, CALL_C_INT, CALL_C_CTCH, YIELD, CALL_C_MANY, CALL_C_INT, LOOP, CALL_C_DBL, LOOP, YIELD, YIELD, YIELD, CALL_C_DBL, CALL_C_INT, YIELD, LOOP, CALL_C_MANY, CALL_C_DBL, CALL_C_CTCH, YIELD, LOOP, CALL_C_DBL, CALL_C_MANY, CALL_C_INT, CALL_C_DBL, YIELD, YIELD, YIELD, CALL_C_MANY
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/stackValue.cpp:114
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/System/Volumes/Data/mesos/work_dir/slaves/91e16c40-06d4-468a-9fc3-7198a5bb7d5a-S10627/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/4a5be6b3-c063-4178-9aba-1efb5c1d9fe4/runs/b87402b2-df1c-41e2-9f08-018c2b1ed26c/workspace/open/src/hotspot/share/runtime/stackValue.cpp:114), pid=37120, tid=26887
# assert(oopDesc::is_oop_or_null(val)) failed: bad oop found at 0x000070000d92cc78 in_cont: 0 compressed: 0
#
# JRE version: Java(TM) SE Runtime Environment (20.0+27) (fastdebug build 20-ea+27-2055)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 20-ea+27-2055, mixed mode, tiered, compressed class ptrs, z gc, bsd-amd64)
# Core dump will be written. Default location: core.37120
#
Unsupported internal testing APIs have been used.

# An error report file with more information is saved as:
# /System/Volumes/Data/mesos/work_dir/slaves/91e16c40-06d4-468a-9fc3-7198a5bb7d5a-S8631/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/09d18ded-bbe7-4197-b60e-25f222da0a9e/runs/4fb529ac-ceb0-4eaa-a68c-1cbd574921e0/testoutput/test-support/jtreg_open_test_jdk_jdk_lang/scratch/0/hs_err_pid37120.log
[73.084s][warning][os] Loading hsdis library failed
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
----------System.err:(0/0)----------
----------rerun:(47/8078)*----------


Here's the crashing thread's stack:

--------------- T H R E A D ---------------

Current thread (0x00007faa8508cc10): JavaThread "MainThread" [_thread_in_vm, id=26887, stack(0x000070000d82e000,0x000070000d92e000)]

Stack: [0x000070000d82e000,0x000070000d92e000], sp=0x000070000d92abe0, free space=1010k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.dylib+0x12c0cd9] VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x6d9 (stackValue.cpp:114)
V [libjvm.dylib+0x12c134b] VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x3b
V [libjvm.dylib+0x6ccc6d] report_vm_error(char const*, int, char const*, char const*, ...)+0xdd
V [libjvm.dylib+0x10c8ea3] StackValue::create_stack_value_from_oop_location(stackChunkOop, void*)+0x363
V [libjvm.dylib+0x10c9c80] StackValue* StackValue::create_stack_value<RegisterMap>(ScopeValue*, unsigned char*, RegisterMap const*)+0x560
V [libjvm.dylib+0x12ad1ac] compiledVFrame::create_stack_value(ScopeValue*) const+0x13c
V [libjvm.dylib+0x12ae3c3] compiledVFrame::expressions() const+0x1e3
V [libjvm.dylib+0x10cedf7] LiveFrameStream::fill_live_stackframe(Handle, methodHandle const&, JavaThread*)+0xc7
V [libjvm.dylib+0x10ced0a] LiveFrameStream::fill_frame(int, objArrayHandle, methodHandle const&, JavaThread*)+0x19a
V [libjvm.dylib+0x10ce5f7] StackWalk::fill_in_frames(long, BaseFrameStream&, int, int, objArrayHandle, int&, JavaThread*)+0x6e7
V [libjvm.dylib+0x10d0b1d] StackWalk::fetchFirstBatch(BaseFrameStream&, Handle, long, int, int, int, objArrayHandle, JavaThread*)+0x52d
V [libjvm.dylib+0x10d04eb] StackWalk::walk(Handle, long, int, Handle, Handle, int, int, objArrayHandle, JavaThread*)+0x59b
V [libjvm.dylib+0xb286e8] JVM_CallStackWalk+0x6d8
J 813 java.lang.StackStreamFactory$AbstractStackWalker.callStackWalk(JILjdk/internal/vm/ContinuationScope;Ljdk/internal/vm/Continuation;II[Ljava/lang/Object;)Ljava/lang/Object; java.base@20-ea (0 bytes) @ 0x0000000119891aec [0x00000001198919c0+0x000000000000012c]
J 1002 c2 java.lang.StackStreamFactory$AbstractStackWalker.walk()Ljava/lang/Object; java.base@20-ea (39 bytes) @ 0x0000000119863998 [0x0000000119862860+0x0000000000001138]
J 1104 c1 Fuzz.captureStack()V (31 bytes) @ 0x0000000111e64394 [0x0000000111e639c0+0x00000000000009d4]
J 512 c2 Fuzz.com_dbl(ID)D (1032 bytes) @ 0x0000000119842de4 [0x000000011983fe00+0x0000000000002fe4]
J 572 jdk.internal.vm.Continuation.enterSpecial(Ljdk/internal/vm/Continuation;ZZ)V java.base@20-ea (0 bytes) @ 0x0000000119874f33 [0x0000000119874dc0+0x0000000000000173]
J 938 c1 jdk.internal.vm.Continuation.run()V java.base@20-ea (586 bytes) @ 0x0000000111ee369c [0x0000000111ee2c40+0x0000000000000a5c]
j Fuzz.test()I+25
j Fuzz.testTrace([LFuzz$Op;)V+81
j Fuzz$$Lambda$58+0x00000003510c33f0.accept(Ljava/lang/Object;)V+4
j java.util.stream.ForEachOps$ForEachOp$OfRef.accept(Ljava/lang/Object;)V+5 java.base@20-ea
j java.util.stream.SliceOps$1$1.accept(Ljava/lang/Object;)V+33 java.base@20-ea
J 685 c1 java.util.stream.ReferencePipeline$3$1.accept(Ljava/lang/Object;)V java.base@20-ea (23 bytes) @ 0x0000000111e62364 [0x0000000111e62180+0x00000000000001e4]
j java.util.stream.Stream$1.tryAdvance(Ljava/util/function/Consumer;)Z+46 java.base@20-ea
j java.util.stream.ReferencePipeline.forEachWithCancel(Ljava/util/Spliterator;Ljava/util/stream/Sink;)Z+13 java.base@20-ea
j java.util.stream.AbstractPipeline.copyIntoWithCancel(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Z+32 java.base@20-ea
j java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V+49 java.base@20-ea
j java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink;+13 java.base@20-ea
j java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Ljava/util/stream/PipelineHelper;Ljava/util/Spliterator;)Ljava/lang/Void;+3 java.base@20-ea
j java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Ljava/util/stream/PipelineHelper;Ljava/util/Spliterator;)Ljava/lang/Object;+3 java.base@20-ea
j java.util.stream.AbstractPipeline.evaluate(Ljava/util/stream/TerminalOp;)Ljava/lang/Object;+88 java.base@20-ea
j java.util.stream.ReferencePipeline.forEach(Ljava/util/function/Consumer;)V+6 java.base@20-ea
j Fuzz.testStream(Ljava/util/stream/Stream;)V+10
j Fuzz.testRandom(JI)V+30
j Fuzz.runTests()V+10
j Fuzz.main([Ljava/lang/String;)V+70
j java.lang.invoke.LambdaForm$DMH+0x00000003510c0000.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;)V+10 java.base@20-ea
j java.lang.invoke.LambdaForm$MH+0x00000003510c6000.invoke(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+33 java.base@20-ea
j java.lang.invoke.Invokers$Holder.invokeExact_MT(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+20 java.base@20-ea
j jdk.internal.reflect.DirectMethodHandleAccessor.invokeImpl(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+55 java.base@20-ea
j jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+23 java.base@20-ea
j java.lang.reflect.Method.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+102 java.base@20-ea
j com.sun.javatest.regtest.agent.MainWrapper$MainThread.run()V+134
j java.lang.Thread.run()V+13 java.base@20-ea
v ~StubRoutines::call_stub 0x000000011926fd1a
V [libjvm.dylib+0x9f2dbd] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*)+0x4ed
V [libjvm.dylib+0x9f1d0a] JavaCalls::call_virtual(JavaValue*, Klass*, Symbol*, Symbol*, JavaCallArguments*, JavaThread*)+0x24a
V [libjvm.dylib+0x9f1e93] JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, JavaThread*)+0x63
V [libjvm.dylib+0xb46459] thread_entry(JavaThread*, JavaThread*)+0x179
V [libjvm.dylib+0xa1de18] JavaThread::thread_main_inner()+0x288
V [libjvm.dylib+0x120f537] Thread::call_run()+0x177
V [libjvm.dylib+0xf6849f] thread_native_entry(Thread*)+0x14f
C [libsystem_pthread.dylib+0x64e1] _pthread_start+0x7d
C [libsystem_pthread.dylib+0x1f6b] thread_start+0xf

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
J 813 java.lang.StackStreamFactory$AbstractStackWalker.callStackWalk(JILjdk/internal/vm/ContinuationScope;Ljdk/internal/vm/Continuation;II[Ljava/lang/Object;)Ljava/lang/Object; java.base@20-ea (0 bytes) @ 0x0000000119891a71 [0x00000001198919c0+0x00000000000000b1]
J 1002 c2 java.lang.StackStreamFactory$AbstractStackWalker.walk()Ljava/lang/Object; java.base@20-ea (39 bytes) @ 0x0000000119863998 [0x0000000119862860+0x0000000000001138]
J 1104 c1 Fuzz.captureStack()V (31 bytes) @ 0x0000000111e64394 [0x0000000111e639c0+0x00000000000009d4]
J 512 c2 Fuzz.com_dbl(ID)D (1032 bytes) @ 0x0000000119842de4 [0x000000011983fe00+0x0000000000002fe4]
J 572 jdk.internal.vm.Continuation.enterSpecial(Ljdk/internal/vm/Continuation;ZZ)V java.base@20-ea (0 bytes) @ 0x0000000119874f33 [0x0000000119874dc0+0x0000000000000173]
J 938 c1 jdk.internal.vm.Continuation.run()V java.base@20-ea (586 bytes) @ 0x0000000111ee369c [0x0000000111ee2c40+0x0000000000000a5c]
j Fuzz.test()I+25
j Fuzz.testTrace([LFuzz$Op;)V+81
j Fuzz$$Lambda$58+0x00000003510c33f0.accept(Ljava/lang/Object;)V+4
j java.util.stream.ForEachOps$ForEachOp$OfRef.accept(Ljava/lang/Object;)V+5 java.base@20-ea
j java.util.stream.SliceOps$1$1.accept(Ljava/lang/Object;)V+33 java.base@20-ea
J 685 c1 java.util.stream.ReferencePipeline$3$1.accept(Ljava/lang/Object;)V java.base@20-ea (23 bytes) @ 0x0000000111e62364 [0x0000000111e62180+0x00000000000001e4]
j java.util.stream.Stream$1.tryAdvance(Ljava/util/function/Consumer;)Z+46 java.base@20-ea
j java.util.stream.ReferencePipeline.forEachWithCancel(Ljava/util/Spliterator;Ljava/util/stream/Sink;)Z+13 java.base@20-ea
j java.util.stream.AbstractPipeline.copyIntoWithCancel(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Z+32 java.base@20-ea
j java.util.stream.AbstractPipeline.copyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)V+49 java.base@20-ea
j java.util.stream.AbstractPipeline.wrapAndCopyInto(Ljava/util/stream/Sink;Ljava/util/Spliterator;)Ljava/util/stream/Sink;+13 java.base@20-ea
j java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Ljava/util/stream/PipelineHelper;Ljava/util/Spliterator;)Ljava/lang/Void;+3 java.base@20-ea
j java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Ljava/util/stream/PipelineHelper;Ljava/util/Spliterator;)Ljava/lang/Object;+3 java.base@20-ea
j java.util.stream.AbstractPipeline.evaluate(Ljava/util/stream/TerminalOp;)Ljava/lang/Object;+88 java.base@20-ea
j java.util.stream.ReferencePipeline.forEach(Ljava/util/function/Consumer;)V+6 java.base@20-ea
j Fuzz.testStream(Ljava/util/stream/Stream;)V+10
j Fuzz.testRandom(JI)V+30
j Fuzz.runTests()V+10
j Fuzz.main([Ljava/lang/String;)V+70
j java.lang.invoke.LambdaForm$DMH+0x00000003510c0000.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;)V+10 java.base@20-ea
j java.lang.invoke.LambdaForm$MH+0x00000003510c6000.invoke(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+33 java.base@20-ea
j java.lang.invoke.Invokers$Holder.invokeExact_MT(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+20 java.base@20-ea
j jdk.internal.reflect.DirectMethodHandleAccessor.invokeImpl(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+55 java.base@20-ea
j jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+23 java.base@20-ea
j java.lang.reflect.Method.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+102 java.base@20-ea
j com.sun.javatest.regtest.agent.MainWrapper$MainThread.run()V+134
j java.lang.Thread.run()V+13 java.base@20-ea
v ~StubRoutines::call_stub 0x000000011926fd1a

We hit the assert while trying to walk the stack of a vthread
so I'm starting this bug off in hotspot/runtime for initial triage.
This test run is also using ZGC.