--- old/src/hotspot/share/gc/shared/referenceProcessor.cpp	2018-04-23 17:00:21.424538304 +0200
+++ new/src/hotspot/share/gc/shared/referenceProcessor.cpp	2018-04-23 17:00:21.138529389 +0200
@@ -383,13 +383,14 @@
 }
 
 void DiscoveredListIterator::load_ptrs(DEBUG_ONLY(bool allow_null_referent)) {
-  _discovered_addr = java_lang_ref_Reference::discovered_addr_raw(_ref);
-  oop discovered = java_lang_ref_Reference::discovered(_ref);
-  assert(_discovered_addr && oopDesc::is_oop_or_null(discovered),
+  _current_discovered_addr = java_lang_ref_Reference::discovered_addr_raw(_current_discovered);
+  oop discovered = java_lang_ref_Reference::discovered(_current_discovered);
+  assert(_current_discovered_addr && oopDesc::is_oop_or_null(discovered),
          "Expected an oop or NULL for discovered field at " PTR_FORMAT, p2i(discovered));
   _next_discovered = discovered;
-  _referent_addr = java_lang_ref_Reference::referent_addr_raw(_ref);
-  _referent = java_lang_ref_Reference::referent(_ref);
+
+  _referent_addr = java_lang_ref_Reference::referent_addr_raw(_current_discovered);
+  _referent = java_lang_ref_Reference::referent(_current_discovered);
   assert(Universe::heap()->is_in_reserved_or_null(_referent),
          "Wrong oop found in java.lang.Reference object");
   assert(allow_null_referent ?
@@ -401,12 +402,12 @@
 }
 
 void DiscoveredListIterator::remove() {
-  assert(oopDesc::is_oop(_ref), "Dropping a bad reference");
-  RawAccess<>::oop_store(_discovered_addr, oop(NULL));
+  assert(oopDesc::is_oop(_current_discovered), "Dropping a bad reference");
+  RawAccess<>::oop_store(_current_discovered_addr, oop(NULL));
 
   // First _prev_next ref actually points into DiscoveredList (gross).
   oop new_next;
-  if (_next_discovered == _ref) {
+  if (_next_discovered == _current_discovered) {
     // At the end of the list, we should make _prev point to itself.
     // If _ref is the first ref, then _prev_next will be in the DiscoveredList,
     // and _prev will be NULL.