In PSPromotionManager::copy_and_push_safe_barrier we have this:

oop new_obj = o->is_forwarded()
? o->forwardee()
: copy_to_survivor_space<promote_immediately>(o);

o->forwardee() should be o->forwardee_acquire().

This is needed for the same reasons as copy_to_survivor_space uses forwardee_acquire in similar places (see discussion of JDK-8154736). The forwardee was created and initialized before being installed and made visible to other threads via a CAS. But other threads must cooperate by using acquire to get the forwardee.

PSScavengeFromCLDClosure appearls to have the same problem. Anywhere that tries to avoid a call to copy_to_survivor_space by first checking for forwarding and then getting the forwardee needs to deal with this. Note that neither of these is a consequence of the weakening of the CAS by JDK-8154736; these places were problematic even with a full barrier CAS.