--- old/src/hotspot/cpu/x86/macroAssembler_x86.cpp	2019-07-11 14:36:27.000000000 -0400
+++ new/src/hotspot/cpu/x86/macroAssembler_x86.cpp	2019-07-11 14:36:26.000000000 -0400
@@ -1839,8 +1839,28 @@
   // Unconditionally set box->_displaced_header = markOopDesc::unused_mark().
   // Without cast to int32_t movptr will destroy r10 which is typically obj.
   movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
+  // The following code to verify that the object field still refers
+  // to the object we are trying to lock is not needed with safepoint
+  // based deflation. It is also not needed with async deflation when
+  // the DEFLATER_MARKER is allowed to linger in the owner field in an
+  // async deflated ObjectMonitor until replaced by the next owner value.
+  // We keep this code as a sanity check against bugs in other parts
+  // of the async deflation mechanism.
+  //
+  // If we weren't able to swing _owner from NULL to r15_thread
+  // then take the slow path.
+  jccb(Assembler::notZero, DONE_LABEL);
+  // r15_thread is now the owner so verify that the ObjectMonitor
+  // still refers to the same object.
+  cmpptr(objReg, Address(scrReg, OM_OFFSET_NO_MONITOR_VALUE_TAG(object)));
+  // The ObjectMonitor still refers to the same object so
+  // r15_thread's ownership is valid.
+  jccb(Assembler::zero, DONE_LABEL);
+  // The ObjectMonitor does not refer to the same object so
+  // drop ownership.
+  movptr(Address(scrReg, OM_OFFSET_NO_MONITOR_VALUE_TAG(owner)), NULL_WORD);
   // Intentional fall-through into DONE_LABEL ...
-  // Propagate ICC.ZF from CAS above into DONE_LABEL.
+  // Propagate ICC.ZF from cmpptr() above into DONE_LABEL.
 #endif // _LP64
 #if INCLUDE_RTM_OPT
   } // use_rtm()