When building with ubsan enabled, and running the java/net jtreg tests, in the following tests

java/net/httpclient/AuthFilterCacheTest.java: AuthenticationFilter.Cache::remove may throw ConcurrentModificationException
java/net/httpclient/HttpClientLocalAddrTest.java: Tests HttpClient usage when configured with a local address to bind to, when sending requests
java/net/httpclient/ManyRequests.java: Send a large number of requests asynchronously
java/net/httpclient/ManyRequests2.java: Send a large number of requests asynchronously.
java/net/vthread/BlockingSocketOps.java#poller-modes:

This error can be seen :

TestServer(2): connection accepted
jdk/src/hotspot/share/oops/stackChunkOop.inline.hpp:205:3: runtime error: member call on null pointer of type 'const struct SmallRegisterMap'
    #0 0x7f670e982d04 in void stackChunkOopDesc::iterate_stack<(ChunkFrames)1, TransformStackChunkClosure>(TransformStackChunkClosure*) jdk/src/hotspot/share/oops/stackChunkOop.inline.hpp:205
    #1 0x7f670e95936a in void stackChunkOopDesc::iterate_stack<TransformStackChunkClosure>(TransformStackChunkClosure*) jdk/src/hotspot/share/oops/stackChunkOop.inline.hpp:198
    #2 0x7f670e95936a in stackChunkOopDesc::transform() jdk/src/hotspot/share/oops/stackChunkOop.cpp:334
    #3 0x7f670c75d7b6 in ContinuationGCSupport::transform_stack_chunk(oop) jdk/src/hotspot/share/gc/shared/continuationGCSupport.inline.hpp:52
    #4 0x7f670cd8627b in G1ParScanThreadState::do_copy_to_survivor_space(G1HeapRegionAttr, oop, markWord) jdk/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp:542
    #5 0x7f670cd96c7b in void G1ParScanThreadState::do_oop_evac<narrowOop>(narrowOop*) jdk/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp:218
    #6 0x7f670cd8793d in G1ParScanThreadState::dispatch_task(ScannerTask) jdk/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp:296
    #7 0x7f670cd8838b in G1ParScanThreadState::trim_queue_to_threshold(unsigned int) jdk/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp:317
    #8 0x7f670cdcce6e in G1ParScanThreadState::trim_queue_partially() jdk/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp:53
    #9 0x7f670ce09532 in G1ParCopyHelper::trim_queue_partially() jdk/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp:210
    #10 0x7f670ce09532 in void G1ParCopyClosure<(G1Barrier)0, false>::do_oop_work<oop>(oop*) jdk/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp:255
    #11 0x7f670ce10d4c in bool OopStorage::OopFn<OopClosure>::operator()<oop*>(oop*) const jdk/src/hotspot/share/gc/shared/oopStorage.inline.hpp:240
    #12 0x7f670ce10d4c in bool OopStorage::BasicParState::AlwaysTrueFn<OopStorage::OopFn<OopClosure> >::operator()<oop*>(oop*) const jdk/src/hotspot/share/gc/shared/oopStorageParState.inline.hpp:43
    #13 0x7f670ce10d4c in bool OopStorage::Block::iterate_impl<OopStorage::BasicParState::AlwaysTrueFn<OopStorage::OopFn<OopClosure> >, OopStorage::Block*>(OopStorage::BasicParState::AlwaysTrueFn<OopStorage::OopFn<OopClosure> >, OopStorage::Block*) jdk/src/hotspot/share/gc/shared/oopStorage.inline.hpp:337
    #14 0x7f670ce10d4c in bool OopStorage::Block::iterate<OopStorage::BasicParState::AlwaysTrueFn<OopStorage::OopFn<OopClosure> > >(OopStorage::BasicParState::AlwaysTrueFn<OopStorage::OopFn<OopClosure> >) jdk/src/hotspot/share/gc/shared/oopStorage.inline.hpp:346
    #15 0x7f670ce10d4c in void OopStorage::BasicParState::iterate<false, OopStorage::OopFn<OopClosure> >(OopStorage::OopFn<OopClosure>) jdk/src/hotspot/share/gc/shared/oopStorageParState.inline.hpp:64
    #16 0x7f670ce0f218 in void OopStorage::ParState<false, false>::iterate<OopStorage::OopFn<OopClosure> >(OopStorage::OopFn<OopClosure>) jdk/src/hotspot/share/gc/shared/oopStorageParState.inline.hpp:83
    #17 0x7f670ce0f218 in void OopStorage::ParState<false, false>::oops_do<OopClosure>(OopClosure*) jdk/src/hotspot/share/gc/shared/oopStorageParState.inline.hpp:88
    #18 0x7f670ce0f218 in G1RootProcessor::process_vm_roots(G1RootClosures*, G1GCPhaseTimes*, unsigned int) jdk/src/hotspot/share/gc/g1/g1RootProcessor.cpp:199
    #19 0x7f670ce1054c in G1RootProcessor::evacuate_roots(G1ParScanThreadState*, unsigned int) jdk/src/hotspot/share/gc/g1/g1RootProcessor.cpp:63
    #20 0x7f670ce37f82 in G1EvacuateRegionsTask::scan_roots(G1ParScanThreadState*, unsigned int) jdk/src/hotspot/share/gc/g1/g1YoungCollector.cpp:664
    #21 0x7f670ce387e0 in G1EvacuateRegionsBaseTask::work(unsigned int) jdk/src/hotspot/share/gc/g1/g1YoungCollector.cpp:651
    #22 0x7f670f028212 in WorkerTaskDispatcher::worker_run_task() jdk/src/hotspot/share/gc/shared/workerThread.cpp:70
    #23 0x7f670f028212 in WorkerThread::run() jdk/src/hotspot/share/gc/shared/workerThread.cpp:201
    #24 0x7f670ece8b0f in Thread::call_run() jdk/src/hotspot/share/runtime/thread.cpp:225
    #25 0x7f670e1dae75 in thread_native_entry jdk/src/hotspot/os/linux/os_linux.cpp:846
    #26 0x7f67146df6e9 in start_thread (/lib64/libpthread.so.0+0xa6e9) (BuildId: 2f8d3c2d0f4d7888c2598d2ff6356537f5708a73)
    #27 0x7f6713d1550e in clone (/lib64/libc.so.6+0x11850e) (BuildId: f732026552f6adff988b338e92d466bc81a01c37)

So we are calling into a nullptr under some special circumstances.
Same can be seen with a guarantee added (and not using ubsan) .