During the review of java.lang.ref.Cleaner it was recognized that reachabilityFence was needed to ensure the referent and the cleaner remained live beyond certain operations. A temporary workaround was put in place and later replaced with reachabilityFence once it became available (JDK-8145459). Unfortunately, I think that was done in the wrong place.

The reachabilityFences are at the end of the PhantomCleanable constructor. However, this could permit the cleanup to be triggered before the later assignment of CleanerImpl.PhantomCleanableRef's action field. (This is the same kind of problem as discussed in JDK-8149610.) The fences need to follow that assignment, either at the end of PhantomCleanableRef's constructor or (probably better) at the end of Cleaner.register.