I'm filing this as a separate issue from JDK-8345147, because to me it looks like a different crash, in different code, though the type is the same.

From David's report:

Test: vmTestbase/gc/gctests/StringInternSync2/TestDescription.java

    frame #12: 0x0000000115f5d3b8
* thread #39, stop reason = ESR_EC_DABORT_EL0 (fault address: 0x1294f1bd8)
  * frame #0: 0x0000000104853f58 libjvm.dylib`assert_is_oop_or_null(zaddress) + 88
    frame #1: 0x000000010454343c libjvm.dylib`AccessInternal::PostRuntimeDispatch<ZBarrierSet::AccessBarrier<593988ull, ZBarrierSet>, (AccessInternal::BarrierType)2, 593988ull>::oop_access_barrier(void*) + 92
    frame #2: 0x0000000105299f64 libjvm.dylib`StringTableLookupOop::equals(WeakHandle*) + 92
    frame #3: 0x0000000105299e34 libjvm.dylib`ConcurrentHashTable<StringTableConfig, (MemTag)11>::Node* ConcurrentHashTable<StringTableConfig, (MemTag)11>::get_node<StringTableLookupOop>(ConcurrentHashTable<StringTableConfig, (MemTag)11>::Bucket const*, StringTableLookupOop&, bool*, unsigned long*) const + 128
    frame #4: 0x000000010529ab28 libjvm.dylib`bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::internal_insert_get<StringTableLookupOop, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP>(Thread*, StringTableLookupOop&, WeakHandle const&, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP&, bool*, bool*) + 368
    frame #5: 0x0000000105296034 libjvm.dylib`StringTable::do_intern(StringWrapperInternal const&, unsigned long, JavaThread*) + 580
    frame #6: 0x00000001052959d4 libjvm.dylib`StringTable::intern(StringWrapperInternal const&, JavaThread*) + 488
    frame #7: 0x0000000105295c44 libjvm.dylib`StringTable::intern(oop, JavaThread*) + 444
    frame #8: 0x0000000104ce6320 libjvm.dylib`JVM_InternString + 344
    frame #9: 0x0000000115f5d3b8

    frame #12: 0x0000000115f5d3b8
  thread #41, stop reason = ESR_EC_DABORT_EL0 (fault address: 0x600026f40000)
    frame #0: 0x00000001afb59470 libsystem_malloc.dylib`nanov2_allocate + 348
    frame #1: 0x00000001afb592b0 libsystem_malloc.dylib`nanov2_malloc + 64
    frame #2: 0x00000001afb76770 libsystem_malloc.dylib`_malloc_zone_malloc + 156
    frame #3: 0x0000000105109c48 libjvm.dylib`os::malloc(unsigned long, MemTag, NativeCallStack const&) + 184
    frame #4: 0x00000001044e8ff8 libjvm.dylib`AllocateHeap(unsigned long, MemTag, AllocFailStrategy::AllocFailEnum) + 124
    frame #5: 0x000000010529aa1c libjvm.dylib`bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::internal_insert_get<StringTableLookupOop, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP>(Thread*, StringTableLookupOop&, WeakHandle const&, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP&, bool*, bool*) + 100
    frame #6: 0x0000000105296034 libjvm.dylib`StringTable::do_intern(StringWrapperInternal const&, unsigned long, JavaThread*) + 580
    frame #7: 0x00000001052959d4 libjvm.dylib`StringTable::intern(StringWrapperInternal const&, JavaThread*) + 488
    frame #8: 0x0000000105295c44 libjvm.dylib`StringTable::intern(oop, JavaThread*) + 444
    frame #9: 0x0000000104ce6320 libjvm.dylib`JVM_InternString + 344
    frame #10: 0x0000000115f5d3b8

  thread #44, stop reason = ESR_EC_DABORT_EL0 (fault address: 0x600022f50000)
    frame #0: 0x00000001afb59470 libsystem_malloc.dylib`nanov2_allocate + 348
    frame #1: 0x00000001afb592b0 libsystem_malloc.dylib`nanov2_malloc + 64
    frame #2: 0x00000001afb76770 libsystem_malloc.dylib`_malloc_zone_malloc + 156
    frame #3: 0x0000000105109c48 libjvm.dylib`os::malloc(unsigned long, MemTag, NativeCallStack const&) + 184
    frame #4: 0x00000001044e8ff8 libjvm.dylib`AllocateHeap(unsigned long, MemTag, AllocFailStrategy::AllocFailEnum) + 124
    frame #5: 0x000000010529aa1c libjvm.dylib`bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::internal_insert_get<StringTableLookupOop, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP>(Thread*, StringTableLookupOop&, WeakHandle const&, bool ConcurrentHashTable<StringTableConfig, (MemTag)11>::insert<StringTableLookupOop>(Thread*, StringTableLookupOop&, WeakHandle const&, bool*, bool*)::NOP&, bool*, bool*) + 100
    frame #6: 0x0000000105296034 libjvm.dylib`StringTable::do_intern(StringWrapperInternal const&, unsigned long, JavaThread*) + 580
    frame #7: 0x00000001052959d4 libjvm.dylib`StringTable::intern(StringWrapperInternal const&, JavaThread*) + 488
    frame #8: 0x0000000105295c44 libjvm.dylib`StringTable::intern(oop, JavaThread*) + 444
    frame #9: 0x0000000104ce6320 libjvm.dylib`JVM_InternString + 344
    frame #10: 0x0000000115f5d3b8