SymbolPropertyEntry* new_entry(unsigned int hash, Symbol* symbol, intptr_t symbol_mode) {
    SymbolPropertyEntry* entry = (SymbolPropertyEntry*) Hashtable<Symbol*, mtSymbol>::new_entry(hash, symbol);
    // Hashtable with Symbol* literal must increment and decrement refcount.
    symbol->increment_refcount();
    entry->set_symbol_mode(symbol_mode);
    entry->set_method(NULL);
    entry->set_method_type(NULL);
    return entry;
  }

Since the SymbolPropertyEntry constructor isn't called, the fields need to be explicitly zeroed.

void SymbolPropertyEntry::set_method_type(oop p) {
  _method_type = OopHandle(OopStorageSet::vm_global(), p);
}

set_method_type creates a new OopHandle for NULL.  There's an test when it's called in SystemDictionary that the value of the oop is NULL but not that the entry is_empty(), so there we call this again and create another OopHandle.

I found this because I also added an assert to the assignment operator to prevent leaking OopHandles.  This was [~eosterlund] 's idea from reviewing JDK-8249768 (which doesn't leak OopHandles).