redefining method used by multiple MethodHandles crashes VM

This is a bug found by [~dnsimon]. The attached test case creates two MethodHandles for the same method, redefines the method and then calls the first created MethodHandle:

        // fooMH2 displaces fooMH1 from the MemberNamesTable
        MethodHandle fooMH1 = lookup.unreflect(fooMethod);
        MethodHandle fooMH2 = lookup.unreflect(fooMethod);

        // Redefining Foo.getName() causes vmtarget to be updated
        // in fooMH2 but not fooMH1
        redefineFoo();

        // Full GC causes fooMH1.vmtarget to be deallocated
        System.gc();

        // Calling fooMH1.vmtarget crashes the VM
        System.out.println("fooMH1.invoke = " + fooMH1.invokeExact());

The problem is that MemberNameTable only stores the last created MemberName for a given method.

$ java RedefineMethodUsedByMultipleMethodHandles
fooMH1.invoke = foo
fooMH2.invoke = foo
objc[11873]: Class JavaLaunchHelper is implemented in both /Users/cthaling/build/jdk9/hs-comp/hotspot/jdk-universal/bin/java and /Users/cthaling/build/jdk9/hs-comp/hotspot/jdk-universal/jre/lib/libinstrument.dylib. One of the two will be used. Which one is undefined.
redefining class RedefineMethodUsedByMultipleMethodHandles$Foo
replacing "foo" with "bar"
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x0000000000000000, pid=11873, tid=6147
#
# JRE version: Java(TM) SE Runtime Environment (9.0-b04) (build 1.9.0-ea-b04)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.0-b62-internal-debug mixed mode bsd-amd64 compressed oops)
# Problematic frame:
#
[error occurred during error reporting (printing problematic frame), id 0xe0000000]

# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /Users/cthaling/Downloads/hs_err_pid11873.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#
Current thread is 6147
Dumping core ...
Abort trap: 6