./share/vm/classfile/dictionary.cpp contains:

OrderAccess::release_store_ptr(&_pd_set, new_head);

But no load-acquire, and also many plain stores to _pd_set field.

That said, the supposed lock-free reads of _pd_set seem to always occur at a safepoint:

  void set_strongly_reachable() {
+ assert(SafepointSynchronize::is_at_safepoint(), "must be at safepoint");

   void verify_protection_domain_set() {
+ assert(SafepointSynchronize::is_at_safepoint(), "must be at safepoint");

the above patch passed full nightly testing in RBT, which suggests that it may be the release_store that is in fact unnecessary.

To allow JDK-8158854 to be finalized I'm filing this as a separate issue to follow up on.