--- old/src/share/vm/classfile/dictionary.hpp	2017-08-24 14:18:03.302873712 -0400
+++ new/src/share/vm/classfile/dictionary.hpp	2017-08-24 14:18:03.036341029 -0400
@@ -29,6 +29,7 @@
 #include "classfile/systemDictionary.hpp"
 #include "oops/instanceKlass.hpp"
 #include "oops/oop.hpp"
+#include "runtime/orderAccess.hpp"
 #include "utilities/hashtable.hpp"
 #include "utilities/ostream.hpp"
 
@@ -134,7 +135,7 @@
   // It is essentially a cache to avoid repeated Java up-calls to
   // ClassLoader.checkPackageAccess().
   //
-  ProtectionDomainEntry* _pd_set;
+  ProtectionDomainEntry* volatile _pd_set;
 
  public:
   // Tells whether a protection is in the approved set.
@@ -153,8 +154,14 @@
     return (DictionaryEntry**)HashtableEntry<InstanceKlass*, mtClass>::next_addr();
   }
 
-  ProtectionDomainEntry* pd_set() const { return _pd_set; }
-  void set_pd_set(ProtectionDomainEntry* pd_set) { _pd_set = pd_set; }
+  ProtectionDomainEntry* pd_set() const { return (ProtectionDomainEntry*)OrderAccess::load_ptr_acquire(&_pd_set); }
+  void set_pd_set(ProtectionDomainEntry* new_head) {
+    // Warning: Preserve store ordering.  The SystemDictionary is read
+    //          without locks.  The new ProtectionDomainEntry must be
+    //          complete before other threads can be allowed to see it
+    //          via a store to _pd_set.
+    OrderAccess::release_store_ptr(&_pd_set, new_head);
+  }
 
   // Tells whether the initiating class' protection domain can access the klass in this entry
   bool is_valid_protection_domain(Handle protection_domain) {