The unhandled oop detector will clear stack allocated oops in MutexLocker code to detect whether an oop is held around a safepoint (lock), but misses the case in code like JvmtiThreadState::state_for() where taking the lock out is conditional.   It should check for naked oops even if the condition around the lock is not true because it may be that way during testing with the switch, and miss the case when it's true.

  // retrieve or create JvmtiThreadState
  inline static JvmtiThreadState *state_for(JavaThread *thread) {
    JvmtiThreadState *state = thread->jvmti_thread_state();
    if (state == NULL) {
      MutexLocker mu(JvmtiThreadState_lock);
      // check again with the lock held
      state = state_for_while_locked(thread);
    }
    return state;
  }