assert(m->is_entered(current)) failed: invariant

ADDITIONAL SYSTEM INFORMATION :
# JRE version: OpenJDK Runtime Environment (11.0.22) (fastdebug build 11.0.22-internal+0-adhoc.xiezifan.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.22-internal+0-adhoc.xiezifan.jdk11u, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)

A DESCRIPTION OF THE PROBLEM :
I ran a modified regression test case on jdk 11.0.22(mainline) and found that the JVM crashed without any options.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/data/xiezifan/jdk11u/src/hotspot/share/runtime/synchronizer.cpp:311), pid=2907562, tid=2907563
# assert(m->is_entered(__the_thread__)) failed: invariant
#
# JRE version: OpenJDK Runtime Environment (11.0.22) (fastdebug build 11.0.22-internal+0-adhoc.xiezifan.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.22-internal+0-adhoc.xiezifan.jdk11u, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /data/xiezifan/JVM-Tesing-by-Anti-Optimization/toreport/AppPLABEvacuationFailure_01_08_06_10_10/core.2907562)
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
java -cp gc.g1.plab.lib.AppPLABEvacuationFailure

ACTUAL -
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/synchronizer.cpp:311
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/data/xiezifan/jdk11u/src/hotspot/share/runtime/synchronizer.cpp:311), pid=2907562, tid=2907563
# assert(m->is_entered(__the_thread__)) failed: invariant
#
# JRE version: OpenJDK Runtime Environment (11.0.22) (fastdebug build 11.0.22-internal+0-adhoc.xiezifan.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.22-internal+0-adhoc.xiezifan.jdk11u, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /data/xiezifan/JVM-Tesing-by-Anti-Optimization/toreport/AppPLABEvacuationFailure_01_08_06_10_10/core.2907562)
#
# An error report file with more information is saved as:
# /data/xiezifan/JVM-Tesing-by-Anti-Optimization/toreport/AppPLABEvacuationFailure_01_08_06_10_10/hs_err_pid2907562.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 2907563
Dumping core ...
./replay.sh: line 5: 2907562 Aborted (core dumped) /data/xiezifan/jdk11u/build/linux-x86_64-normal-server-fastdebug/jdk/bin/java -cp "50/:0/" gc.g1.plab.lib.AppPLABEvacuationFailure

---------- BEGIN SOURCE ----------
The reduced tesetcase file and hs_err file are available at the URL:
<link>
---------- END SOURCE ----------

FREQUENCY : always