--- old/src/hotspot/share/runtime/objectMonitor.cpp	2019-05-02 15:05:19.618391212 -0400
+++ new/src/hotspot/share/runtime/objectMonitor.cpp	2019-05-02 15:05:19.126391229 -0400
@@ -239,6 +239,8 @@
 // Enter support
 
 void ObjectMonitor::enter(TRAPS) {
+  ADIM_guarantee(_ref_count > 0, "must be positive: ref_count=%d", _ref_count);
+
   // The following code is ordered to check the most common cases first
   // and to reduce RTS->RTO cache line upgrades on SPARC and IA32 processors.
   Thread * const Self = THREAD;
@@ -293,12 +295,14 @@
   JavaThread * jt = (JavaThread *) Self;
   assert(!SafepointSynchronize::is_at_safepoint(), "invariant");
   assert(jt->thread_state() != _thread_blocked, "invariant");
-  assert(this->object() != NULL, "invariant");
-  assert(_contentions >= 0, "invariant");
+  assert(AsyncDeflateIdleMonitors || this->object() != NULL, "invariant");
+  assert(_contentions >= 0, "must not be negative: contentions=%d", _contentions);
 
-  // Prevent deflation at STW-time.  See deflate_idle_monitors() and is_busy().
-  // Ensure the object-monitor relationship remains stable while there's contention.
-  Atomic::inc(&_contentions);
+  // Prevent deflation. See ObjectSynchronizer::deflate_monitor(),
+  // ObjectSynchronizer::deflate_monitor_using_JT() and is_busy().
+  // Ensure the object <-> monitor relationship remains stable while
+  // there's contention.
+  Atomic::add(1, &_contentions);
 
   JFR_ONLY(JfrConditionalFlushWithStacktrace<EventJavaMonitorEnter> flush(jt);)
   EventJavaMonitorEnter event;
@@ -360,7 +364,7 @@
   }
 
   Atomic::dec(&_contentions);
-  assert(_contentions >= 0, "invariant");
+  assert(_contentions >= 0, "must not be negative: contentions=%d", _contentions);
   Self->_Stalled = 0;
 
   // Must either set _recursions = 0 or ASSERT _recursions == 0.
@@ -417,9 +421,90 @@
   return -1;
 }
 
+// Install the displaced mark word (dmw) of a deflating ObjectMonitor
+// into the header of the object associated with the monitor. This
+// idempotent method is called by a thread that is deflating a
+// monitor and by other threads that have detected a race with the
+// deflation process.
+void ObjectMonitor::install_displaced_markword_in_object(const oop obj) {
+  // This function must only be called when (owner == DEFLATER_MARKER
+  // && ref_count <= 0), but we can't guarantee that here because
+  // those values could change when the ObjectMonitor gets moved from
+  // the global free list to a per-thread free list.
+
+  guarantee(obj != NULL, "must be non-NULL");
+  if (object() != obj) {
+    // ObjectMonitor's object ref no longer refers to the target object
+    // so the object's header has already been restored.
+    return;
+  }
+
+  markOop dmw = header();
+  if (dmw == NULL) {
+    // ObjectMonitor's header/dmw has been cleared by the deflating
+    // thread so the object's header has already been restored.
+    return;
+  }
+
+  // A non-NULL dmw has to be either neutral (not locked and not marked)
+  // or is already participating in this restoration protocol.
+  assert(dmw->is_neutral() || (dmw->is_marked() && dmw->hash() == 0),
+         "failed precondition: dmw=" INTPTR_FORMAT, p2i(dmw));
+
+  markOop marked_dmw = NULL;
+  if (!dmw->is_marked() && dmw->hash() == 0) {
+    // This dmw has not yet started the restoration protocol so we
+    // mark a copy of the dmw to begin the protocol.
+    // Note: A dmw with a hashcode does not take this code path.
+    marked_dmw = dmw->set_marked();
+
+    // All of the callers to this function can be racing with each
+    // other trying to update the _header field.
+    dmw = (markOop) Atomic::cmpxchg(marked_dmw, &_header, dmw);
+    if (dmw == NULL) {
+      // ObjectMonitor's header/dmw has been cleared by the deflating
+      // thread so the object's header has already been restored.
+      return;
+    }
+    // The _header field is now marked. The winner's 'dmw' variable
+    // contains the original, unmarked header/dmw value and any
+    // losers have a marked header/dmw value that will be cleaned
+    // up below.
+  }
+
+  if (dmw->is_marked()) {
+    // Clear the mark from the header/dmw copy in preparation for
+    // possible restoration from this thread.
+    assert(dmw->hash() == 0, "hashcode must be 0: dmw=" INTPTR_FORMAT,
+           p2i(dmw));
+    dmw = dmw->set_unmarked();
+  }
+  assert(dmw->is_neutral(), "must be neutral: dmw=" INTPTR_FORMAT, p2i(dmw));
+
+  // Install displaced mark word if the object's header still points
+  // to this ObjectMonitor. All racing callers to this function will
+  // reach this point, but only one can win.
+  obj->cas_set_mark(dmw, markOopDesc::encode(this));
+
+  // Note: It does not matter which thread restored the header/dmw
+  // into the object's header. The thread deflating the monitor just
+  // wanted the object's header restored and it is. The threads that
+  // detected a race with the deflation process also wanted the
+  // object's header restored before they retry their operation and
+  // because it is restored they will only retry once.
+
+  if (marked_dmw != NULL) {
+    // Clear _header to NULL if it is still marked_dmw so a racing
+    // install_displaced_markword_in_object() can bail out sooner.
+    Atomic::cmpxchg((markOop)NULL, &_header, marked_dmw);
+  }
+}
+
 #define MAX_RECHECK_INTERVAL 1000
 
 void ObjectMonitor::EnterI(TRAPS) {
+  ADIM_guarantee(_ref_count > 0, "must be positive: ref_count=%d", _ref_count);
+
   Thread * const Self = THREAD;
   assert(Self->is_Java_thread(), "invariant");
   assert(((JavaThread *) Self)->thread_state() == _thread_blocked, "invariant");
@@ -432,6 +517,17 @@
     return;
   }
 
+  if (_owner == DEFLATER_MARKER) {
+    // The deflation protocol finished the first part (setting owner), but
+    // it failed the second part (making ref_count negative) and bailed.
+    if (Atomic::cmpxchg(Self, &_owner, DEFLATER_MARKER) == DEFLATER_MARKER) {
+      // Acquired the monitor.
+      assert(_succ != Self, "invariant");
+      assert(_Responsible != Self, "invariant");
+      return;
+    }
+  }
+
   assert(InitDone, "Unexpectedly not initialized");
 
   // We try one round of spinning *before* enqueueing Self.
@@ -548,6 +644,15 @@
 
     if (TryLock(Self) > 0) break;
 
+    if (_owner == DEFLATER_MARKER) {
+      // The deflation protocol finished the first part (setting owner), but
+      // it failed the second part (making ref_count negative) and bailed.
+      if (Atomic::cmpxchg(Self, &_owner, DEFLATER_MARKER) == DEFLATER_MARKER) {
+        // Acquired the monitor.
+        break;
+      }
+    }
+
     // The lock is still contested.
     // Keep a tally of the # of futile wakeups.
     // Note that the counter is not protected by a lock or updated by atomics.
@@ -652,6 +757,8 @@
 // In the future we should reconcile EnterI() and ReenterI().
 
 void ObjectMonitor::ReenterI(Thread * Self, ObjectWaiter * SelfNode) {
+  ADIM_guarantee(_ref_count > 0, "must be positive: ref_count=%d", _ref_count);
+
   assert(Self != NULL, "invariant");
   assert(SelfNode != NULL, "invariant");
   assert(SelfNode->_thread == Self, "invariant");
@@ -669,6 +776,15 @@
     if (TryLock(Self) > 0) break;
     if (TrySpin(Self) > 0) break;
 
+    if (_owner == DEFLATER_MARKER) {
+      // The deflation protocol finished the first part (setting owner), but
+      // it failed the second part (making ref_count negative) and bailed.
+      if (Atomic::cmpxchg(Self, &_owner, DEFLATER_MARKER) == DEFLATER_MARKER) {
+        // Acquired the monitor.
+        break;
+      }
+    }
+
     // State transition wrappers around park() ...
     // ReenterI() wisely defers state transitions until
     // it's clear we must park the thread.
@@ -876,7 +992,8 @@
       // way we should encounter this situation is in the presence of
       // unbalanced JNI locking. TODO: CheckJNICalls.
       // See also: CR4414101
-      assert(false, "Non-balanced monitor enter/exit! Likely JNI locking");
+      assert(false, "Non-balanced monitor enter/exit! Likely JNI locking: "
+             "owner=" INTPTR_FORMAT, p2i(_owner));
       return;
     }
   }
@@ -1132,10 +1249,10 @@
   JavaThread *jt = (JavaThread *)THREAD;
 
   guarantee(_owner != Self, "reenter already owner");
-  enter(THREAD);       // enter the monitor
+  enter(THREAD);
+  // Entered the monitor.
   guarantee(_recursions == 0, "reenter recursion");
   _recursions = recursions;
-  return;
 }
 
 
@@ -1926,3 +2043,77 @@
 
   DEBUG_ONLY(InitDone = true;)
 }
+
+// For internal use by ObjectSynchronizer::monitors_iterate().
+ObjectMonitorHandle::ObjectMonitorHandle(ObjectMonitor * om_ptr) {
+  om_ptr->inc_ref_count();
+  _om_ptr = om_ptr;
+}
+
+ObjectMonitorHandle::~ObjectMonitorHandle() {
+  if (_om_ptr != NULL) {
+    _om_ptr->dec_ref_count();
+    _om_ptr = NULL;
+  }
+}
+
+// Save the ObjectMonitor* associated with the specified markOop and
+// increment the ref_count. This function should only be called if
+// the caller has verified mark->has_monitor() == true. The object
+// parameter is needed to verify that ObjectMonitor* has not been
+// deflated and reused for another object.
+//
+// This function returns true if the ObjectMonitor* has been safely
+// saved. This function returns false if we have lost a race with
+// async deflation; the caller should retry as appropriate.
+//
+bool ObjectMonitorHandle::save_om_ptr(oop object, markOop mark) {
+  guarantee(mark->has_monitor(), "sanity check: mark=" INTPTR_FORMAT,
+            p2i(mark));
+
+  ObjectMonitor * om_ptr = mark->monitor();
+  om_ptr->inc_ref_count();
+
+  if (AsyncDeflateIdleMonitors) {
+    // Race here if monitor is not owned! The above ref_count bump
+    // will cause subsequent async deflation to skip it. However,
+    // previous or concurrent async deflation is a race.
+    if (om_ptr->_owner == DEFLATER_MARKER && om_ptr->ref_count() <= 0) {
+      // Async deflation is in progress and our ref_count increment
+      // above lost the race to async deflation. Attempt to restore
+      // the header/dmw to the object's header so that we only retry
+      // once if the deflater thread happens to be slow.
+      om_ptr->install_displaced_markword_in_object(object);
+      om_ptr->dec_ref_count();
+      return false;
+    }
+    // The ObjectMonitor could have been deflated and reused for
+    // another object before we bumped the ref_count so make sure
+    // our object still refers to this ObjectMonitor.
+    const markOop tmp = object->mark();
+    if (!tmp->has_monitor() || tmp->monitor() != om_ptr) {
+      // Async deflation and reuse won the race so we have to retry.
+      // Skip object header restoration since that's already done.
+      om_ptr->dec_ref_count();
+      return false;
+    }
+  }
+
+  ADIM_guarantee(_om_ptr == NULL, "sanity check: _om_ptr=" INTPTR_FORMAT,
+                 p2i(_om_ptr));
+  _om_ptr = om_ptr;
+  return true;
+}
+
+// For internal use by ObjectSynchronizer::inflate().
+void ObjectMonitorHandle::set_om_ptr(ObjectMonitor * om_ptr) {
+  if (_om_ptr == NULL) {
+    ADIM_guarantee(om_ptr != NULL, "cannot clear an unset om_ptr");
+    om_ptr->inc_ref_count();
+    _om_ptr = om_ptr;
+  } else {
+    ADIM_guarantee(om_ptr == NULL, "can only clear a set om_ptr");
+    _om_ptr->dec_ref_count();
+    _om_ptr = NULL;
+  }
+}