In virtual calls the Method pointer in the interpreter stack frame is not kept alive by anything other than the "this" pointers to that method. If bytecodes overwrite the "this" pointer, then call a full GC, the class loader containing the Method* can be unloaded and the Method* deallocated.
This is also a problem with JSR292 MethodHandle static code because the MethodHandle containing the mirror for the interpreted method Method* is not on the stack if a GC occurs.
After much discussion (and arm twisting) we think we should add the special oop closure. Reassigning to Stefan.