Always crash at java.lang.StringLatin1.toLowerCase

ADDITIONAL SYSTEM INFORMATION :
Host: Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz, 8 cores, 47G, CentOS Linux release 7.1.1503 (Core)

Java VM: OpenJDK 64-Bit Server VM (11+28, mixed mode, tiered, z gc, linux-amd64)

A DESCRIPTION OF THE PROBLEM :
The application crashes after running for some time, caused by java.lang.StringLatin1.toLowerCase

ERROR MESSAGES/STACK TRACES THAT OCCUR :
[Error Message](before the crash)
java.lang.NegativeArraySizeException: -8388608
at java.base/java.lang.StringLatin1.toLowerCase(StringLatin1.java:397)
at java.base/java.lang.String.toLowerCase(String.java:2503)
at java.base/java.lang.String.toLowerCase(String.java:2527)
at com.ctrip.search.engine.query.function.FunctionParser.parse(FunctionParser.java:146)
at com.ctrip.search.engine.query.function.FunctionParser.parse(FunctionParser.java:65)
at com.ctrip.search.engine.query.MultiIndexSearcher.genSortField(MultiIndexSearcher.java:221)
at com.ctrip.search.engine.query.MultiIndexSearcher.genSort(MultiIndexSearcher.java:249)
at com.ctrip.search.engine.query.MultiIndexSearcher.internalSearch(MultiIndexSearcher.java:673)
at com.ctrip.search.engine.query.MultiIndexSearcher.search(MultiIndexSearcher.java:333)
at com.ctrip.search.engine.BaseState.search(BaseState.java:78)
at com.ctrip.search.engine.rpc.httpcore.EngineServer.search(EngineServer.java:135)
at com.ctrip.search.engine.rpc.httpcore.handler.SearchHandler.search(SearchHandler.java:71)
... 9 more

[Crash Logs]
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f9d9095f6e9, pid=29724, tid=29886
#
# JRE version: OpenJDK Runtime Environment (11.0+28) (build 11+28)
# Java VM: OpenJDK 64-Bit Server VM (11+28, mixed mode, tiered, z gc, linux-amd64)
# Problematic frame:
# J 3467 c2 java.lang.StringLatin1.toLowerCase(Ljava/lang/String;[BLjava/util/Locale;)Ljava/lang/String; java.base@11 (180 bytes) @ 0x00007f9d9095f6e9 [0x00007f9d9095f360+0x0000000000000389]
#
# Core dump will be written. Default location: /opt/tars/apps/100004635/releases/version_zmc/scripts/core.29724
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
#

-Stack: [0x00007f9c7f2ec000,0x00007f9c7f36d000], sp=0x00007f9c7f36ae00, free space=507k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
J 3467 c2 java.lang.StringLatin1.toLowerCase(Ljava/lang/String;[BLjava/util/Locale;)Ljava/lang/String; java.base@11 (180 bytes) @ 0x00007f9d9095f6e9 [0x00007f9d9095f360+0x0000000000000389]
J 10357 c2 com.ctrip.search.engine.query.function.FunctionParser.parse(Ljava/lang/String;Ljava/lang/String;Ljava/util/concurrent/atomic/AtomicInteger;)Lcom/ctrip/search/engine/query/function/Function; (439 bytes) @ 0x00007f9d911597a4 [0x00007f9d911596c0+0x00000000000000e4]
J 11852 c2 com.ctrip.search.engine.query.DocGenerator.<init>(Lorg/apache/lucene/search/Weight;[Lorg/apache/lucene/index/IndexReader;[ILcom/ctrip/search/schema/Schema;[Lcom/ctrip/search/util/StringEntry;Ljava/lang/String;)V (1106 bytes) @ 0x00007f9d9138e114 [0x00007f9d9138bb40+0x00000000000025d4]
J 11332 c1 com.ctrip.search.engine.query.MultiIndexSearcher.internalSearch(Lcom/ctrip/search/engine/query/SearchRequest;)Lcom/ctrip/search/engine/query/SearchResponse; (759 bytes) @ 0x00007f9d8a5a8f44 [0x00007f9d8a5a82e0+0x0000000000000c64]
J 11331 c1 com.ctrip.search.engine.query.MultiIndexSearcher.search(Lcom/ctrip/search/engine/query/SearchRequest;)Lcom/ctrip/search/engine/query/SearchResponse; (40 bytes) @ 0x00007f9d8a5a7874 [0x00007f9d8a5a7780+0x00000000000000f4]
J 11330 c1 com.ctrip.search.engine.BaseState.search(Lcom/ctrip/search/engine/query/SearchRequest;)Lcom/ctrip/search/engine/query/SearchResponse; (9 bytes) @ 0x00007f9d8a5a7374 [0x00007f9d8a5a72e0+0x0000000000000094]
J 11264 c1 com.ctrip.search.autocomplete.engine.query.HttpCoreAutocompleteSearchHandler.modifyResponse(Lcom/ctrip/search/engine/query/SearchRequest;Lcom/ctrip/search/engine/query/SearchResponse;I)V (1640 bytes) @ 0x00007f9d8a5620ec [0x00007f9d8a55e240+0x0000000000003eac]
J 12659 c2 com.ctrip.search.autocomplete.engine.query.HttpCoreAutocompleteSearchHandler.handleGet(Lorg/apache/http/HttpRequest;Lorg/apache/http/HttpResponse;)V (2461 bytes) @ 0x00007f9d914db8a8 [0x00007f9d914da640+0x0000000000001268]
J 12734 c2 com.ctrip.search.rpc.httpcore.HttpHandler.run()V (134 bytes) @ 0x00007f9d914cc298 [0x00007f9d914cb760+0x0000000000000b38]
J 11338 c2 java.util.concurrent.FutureTask.run()V java.base@11 (123 bytes) @ 0x00007f9d9129171c [0x00007f9d91291680+0x000000000000009c]
j java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V+92 java.base@11
j java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5 java.base@11
j java.lang.Thread.run()V+11 java.base@11
v ~StubRoutines::call_stub
V [libjvm.so+0x8b0e09] JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, Thread*)+0x3b9
V [libjvm.so+0x8aef5d] JavaCalls::call_virtual(JavaValue*, Handle, Klass*, Symbol*, Symbol*, Thread*)+0x1cd
V [libjvm.so+0x958aec] thread_entry(JavaThread*, Thread*)+0x6c
V [libjvm.so+0xdf2dcd] JavaThread::thread_main_inner()+0x21d
V [libjvm.so+0xdf3177] JavaThread::run()+0x377
V [libjvm.so+0xc387d0] thread_native_entry(Thread*)+0xf0


siginfo: si_signo: 11 (SIGSEGV), si_code: 2 (SEGV_ACCERR), si_addr: 0x0000040770000000

REGRESSION : Last worked in version 12


FREQUENCY : always