A crash happens here because key.member_method() == nullptr.

https://github.com/openjdk/jdk/blob/50c099d69e9cef5c38a2624d7c798360eb6c1fba/src/hotspot/share/cds/lambdaProxyClassDictionary.hpp#L146

  static RunTimeLambdaProxyClassKey init_for_dumptime(LambdaProxyClassKey& key) {
    assert(ArchiveBuilder::is_active(), "sanity");
    ArchiveBuilder* b = ArchiveBuilder::current();

    u4 caller_ik = b->any_to_offset_u4(key.caller_ik());
    u4 invoked_name = b->any_to_offset_u4(key.invoked_name());
    u4 invoked_type = b->any_to_offset_u4(key.invoked_type());
    u4 method_type = b->any_to_offset_u4(key.method_type());
>>>u4 member_method = b->any_to_offset_u4(key.member_method());
    u4 instantiated_method_type = b->any_to_offset_u4(key.instantiated_method_type());

V [libjvm.so+0x420dcf] ArchiveBuilder::any_to_offset(unsigned char*) const+0x7f
V [libjvm.so+0xefc72e] SystemDictionaryShared::write_lambda_proxy_class_dictionary(LambdaProxyClassDictionary*)+0x18e
V [libjvm.so+0xcbd72a] VM_PopulateDumpSharedSpace::dump_read_only_tables()+0x2a
V [libjvm.so+0xcbdd37] VM_PopulateDumpSharedSpace::doit()+0x237
V [libjvm.so+0xfcb999] VM_Operation::evaluate()+0x109
V [libjvm.so+0xfcec5c] VMThread::evaluate_operation(VM_Operation*)+0xcc
V [libjvm.so+0xfcf7cb] VMThread::inner_execute(VM_Operation*)+0x35b
V [libjvm.so+0xfcfac7] VMThread::run()+0xb7
V [libjvm.so+0xf35f0f] Thread::call_run()+0x9f
V [libjvm.so+0xd46136] thread_native_entry(Thread*)+0xd6

The crash can be reproduced by a program that looks like this:

interface MyFunctionalInterface {
    Object invokeMethodReference(String s, char c1, char c2) throws Throwable;
}

class LambdaInvokeVirtualApp {
    private static MethodHandle createMethodHandle() throws NoSuchMethodException, IllegalAccessException {
        MethodHandles.Lookup lookup = MethodHandles.lookup();
        MethodType mt = MethodType.methodType(String.class, char.class, char.class);
        return lookup.findVirtual(String.class, "replace", mt);
    }

    public static void main(String argv[]) throws Throwable {
        MethodHandle ms = createMethodHandle();
        MyFunctionalInterface instance = ms::invoke; <<<<< HERE
        Object result = instance.invokeMethodReference("some string to search", 's', 'o');
        String expected = "oome otring to oearch";
        if (!result.equals(expected)) {
            throw new RuntimeException("Expected \"" + expected + "\" but got \"" +
                                       result + "\"");
        }
    }
}