There is an issue in Compile::flatten_alias_type, if the base is a constant, it returns the body of the array even when the address is actually in the array header.

This does not cause any further issue, because the array length and the klass word are constants, so loads from them are always from the shared immutable memory. On the other hand, while the lock mechanism looks at the markword, symbolically, LockNode consumes all memory while UnlockNode consumes raw memory, symbolic loads from markword are only for hashcode calculation, but it is idempotent so loading from the wrong state does not result in a wrong hashcode.