diff a/src/hotspot/share/oops/instanceMirrorKlass.inline.hpp b/src/hotspot/share/oops/instanceMirrorKlass.inline.hpp
--- a/src/hotspot/share/oops/instanceMirrorKlass.inline.hpp
+++ b/src/hotspot/share/oops/instanceMirrorKlass.inline.hpp
@@ -50,11 +50,17 @@
 
   if (Devirtualizer::do_metadata(closure)) {
     Klass* klass = java_lang_Class::as_Klass_raw(obj);
     // We'll get NULL for primitive mirrors.
     if (klass != NULL) {
-      if (klass->is_instance_klass() && klass->class_loader_data()->has_class_mirror_holder()) {
+      if (klass->class_loader_data() == NULL) {
+        // This is a mirror that belongs to a shared class that has not be loaded yet.
+        // It's only reachable via HeapShared::roots(). All of its fields should be zero
+        // so there's no need to scan.
+        assert(klass->is_shared(), "must be");
+        return;
+      } else if (klass->is_instance_klass() && klass->class_loader_data()->has_class_mirror_holder()) {
         // A non-strong hidden class or an unsafe anonymous class doesn't have its own class loader,
         // so when handling the java mirror for the class we need to make sure its class
         // loader data is claimed, this is done by calling do_cld explicitly.
         // For non-anonymous classes the call to do_cld is made when the class
         // loader itself is handled.