Check out: https://github.com/openjdk/lilliput-jdk17u
Build JDK and run:
make run-test TEST=compiler/arraycopy/TestArrayCopyIntrinsicWithUCT.java TEST_VM_OPTS="-XX:+UseShenandoahGC -XX:+UnlockExperimentalVMOptions -XX:+UseCompactObjectHeaders"

It yields the following assert here:
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/shenandoahSupport.cpp:1988
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/rkennke/src/openjdk/lilliput-jdk17u/src/hotspot/share/gc/shenandoah/c2/shenandoahSupport.cpp:1988), pid=36444, tid=36466
# Error: assert(found_phi || all_in) failed
#
# JRE version: OpenJDK Runtime Environment (17.0.8) (fastdebug build 17.0.8-internal+0-adhoc.rkennke.lilliput-jdk17u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 17.0.8-internal+0-adhoc.rkennke.lilliput-jdk17u, compiled mode, compressed oops, compressed class ptrs, shenandoah gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x161344c] ShenandoahBarrierC2Support::verify_raw_mem(RootNode*)+0xe0c
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /local/home/rkennke/src/openjdk/lilliput-jdk17u/build/linux-x86_64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_compiler_arraycopy_TestArrayCopyIntrinsicWithUCT_java/scratch/0/hs_err_pid36444.log
#
# Compiler replay data is saved as:
# /local/home/rkennke/src/openjdk/lilliput-jdk17u/build/linux-x86_64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_compiler_arraycopy_TestArrayCopyIntrinsicWithUCT_java/scratch/0/replay_pid36444.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

Find hs_err and replay attached.