The code in PhaseMacroExpand::create_scalarized_object_description iterates over the flat representation of fields and therefore misses to add null markers for flat, nullable fields like we do in InlineTypeNode::add_fields_to_safepoint for value class holders. I added a bailout (see "// TODO 8353432") that should be reverted once this is properly fixed:
https://github.com/fparain/valhalla/commit/1dd907dbf167969ba7754dcc1855f979537b3838

java --enable-preview -XX:CompileCommand=quiet -cp . -XX:CompileCommand=compileonly,Test::test -XX:-TieredCompilation -Xbatch -XX:CompileCommand=print,Test::test -XX:+UseNullableValueFlattening Test.java

# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (.... src/hotspot/share/utilities/growableArray.hpp:150), pid=2701054, tid=2701055
# assert(0 <= i && i < _len) failed: illegal index 1 for length 1
#
# JRE version: Java(TM) SE Runtime Environment (25.0) (fastdebug build 25-lworld5ea-LTS-2025-03-24-0820489.tobias...)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 25-lworld5ea-LTS-2025-03-24-0820489.tobias..., mixed mode, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xbb8504] GrowableArrayView<ScopeValue*>::at(int) const [clone .part.0]+0x24
#

Stack: [0x000075c554a17000,0x000075c554b17000], sp=0x000075c554b12520, free space=1005k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xbb8504] GrowableArrayView<ScopeValue*>::at(int) const [clone .part.0]+0x24 (growableArray.hpp:150)
V [libjvm.so+0xbc41db] reassign_fields_by_klass(InstanceKlass*, frame*, RegisterMap*, ObjectValue*, int, oop, bool, int, GrowableArray<int>*, JavaThread*)+0x242b (debugInfo.hpp:162)
V [libjvm.so+0xbc4ec2] Deoptimization::reassign_fields(frame*, RegisterMap*, GrowableArray<ScopeValue*>*, bool, bool, JavaThread*)+0x222 (deoptimization.cpp:1710)
V [libjvm.so+0xbcad60] rematerialize_objects(JavaThread*, int, nmethod*, frame&, RegisterMap&, GrowableArray<compiledVFrame*>*, bool&)+0x700 (deoptimization.cpp:404)
V [libjvm.so+0xbcc782] Deoptimization::fetch_unroll_info_helper(JavaThread*, int)+0x452 (deoptimization.cpp:560)
V [libjvm.so+0xbcdee4] Deoptimization::uncommon_trap(JavaThread*, int, int)+0x54 (deoptimization.cpp:2728)
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v ~UncommonTrapBlob 0x000075c54d031801
J 100 c2 Test.test(Z)Ljava/lang/Object; (30 bytes) @ 0x000075c54d23ccfc [0x000075c54d23ccc0+0x000000000000003c]
j Test.main([Ljava/lang/String;)V+20
j java.lang.invoke.LambdaForm$DMH+0x0000000021081c00.invokeStatic(Ljava/lang/Object;Ljava/lang/Object;)V+10 java.base
j java.lang.invoke.LambdaForm$MH+0x0000000021209400.invoke(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+33 java.base
j java.lang.invoke.LambdaForm$MH+0x0000000021209800.invokeExact_MT(Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;+20 java.base
j jdk.internal.reflect.DirectMethodHandleAccessor.invokeImpl(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+55 java.base
j jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+23 java.base
j java.lang.reflect.Method.invoke(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;+102 java.base
j com.sun.tools.javac.launcher.SourceLauncher.execute(Lcom/sun/tools/javac/launcher/MemoryContext;[Ljava/lang/String;)Ljava/lang/Class;+455 jdk.compiler
j com.sun.tools.javac.launcher.SourceLauncher.run([Ljava/lang/String;[Ljava/lang/String;)Lcom/sun/tools/javac/launcher/Result;+62 jdk.compiler
j com.sun.tools.javac.launcher.SourceLauncher.main([Ljava/lang/String;)V+14 jdk.compiler