In the sun.reflect.annotation.AnnotationSupport class the AnnotationType for a particular annotation class is not obtained via the synchronized getInstance() method, but incorrectly via direct unsynchronized read of Class.annotationType field. The code in AnnotationSupport can therefore dereference a half-constructed AnnotationType instance before it's constructor, executing in another thread, is finished and before final fields in object are frozen.

Class.[get,set]AnnotationType should only be called from within the synchronized AnnotationType.getInstance method.