JDK-8280555 documents a test bug when using ObjectSynchronizer to iterate over all ObjectMonitors. The test code was not protecting against mon.object() being null, and was getting an NPE. While looking for other users of ObjectSynchronizer, I found it is used by the HSDB "Monitor Cache Dump" feature. It has a similar bug that can result in an NPE. The code doing the iterating is:

    ObjectMonitor mon;
    while (i.hasNext()) {
      mon = (ObjectMonitor)i.next();
      if (mon.contentions() != 0 || mon.waiters() != 0 || mon.owner() != null) {
        OopHandle object = mon.object();
        if (object == null) {
          dumpMonitor(tty, mon, true);
        } else {
          dumpMonitor(tty, mon, false);
        }
      }
    }

So not only can mon.object() be null, but the code is also checking for it. However, dumpMonitor() is not handling it right. It executes the following code unconditionally:

    OopHandle obj = mon.object();
    Oop oop = heap.newOop(obj);
    tty.println("  _object: " + obj + ", a " + oop.getKlass().getName().asString());

This code will NPE if mon.object() is NULL.