am f9ac85ca: am 2cc3d41f: Fix race in finalizeAllEnqueued.

* commit 'f9ac85ca7f1a22c088b8eb9887910e7cc2e9abf8':
  Fix race in finalizeAllEnqueued.

1 files changed, 7 insertions, 1 deletions

diff --git a/luni/src/main/java/java/lang/ref/FinalizerReference.java b/luni/src/main/java/java/lang/ref/FinalizerReference.java
index 14eaae4..47dc0b4 100644
--- a/luni/src/main/java/java/lang/ref/FinalizerReference.java
+++ b/luni/src/main/java/java/lang/ref/FinalizerReference.java
@@ -98,7 +98,13 @@ public final class FinalizerReference<T> extends Reference<T> {
                     FinalizerReference<Sentinel> sentinelReference = (FinalizerReference<Sentinel>) r;
                     sentinelReference.referent = null;
                     sentinelReference.zombie = sentinel;
-                    sentinelReference.enqueueInternal();
+                    // Make a single element list, then enqueue the reference on the daemon unenqueued
+                    // list. This is required instead of enqueuing directly on the finalizer queue
+                    // since there could be recently freed objects in the unqueued list which are not
+                    // yet on the finalizer queue. This could cause the sentinel to run before the
+                    // objects are finalized. b/17381967
+                    sentinelReference.pendingNext = sentinelReference;
+                    ReferenceQueue.add(sentinelReference);
                     return;
                 }
             }