Shenandoah: Missing barriers on deoptimization path

Reported here:
 https://mail.openjdk.org/pipermail/shenandoah-dev/2023-April/019033.html

% CONF=macosx-aarch64-server-fastdebug make images test TEST=gc/shenandoah/compiler/TestReferenceCAS.java TEST_VM_OPTS="-Xcomp"

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/Users/shipilev/Work/shipilev-jdk/src/hotspot/share/gc/shenandoah/shenandoahBarrierSet.inline.hpp:246), pid=67189, tid=8707
# Error: Shenandoah assert_not_in_cset failed; Object should not be in collection set

Referenced from:
  interior location: 0x0000000280100158
  inside Java heap
    not in collection set
  region: | 2|R |BTE 280100000, 28017fd88, 280180000|TAMS 280100000|UWM 280100000|U 511K|T 511K|G 0B|S 0B|L 0B|CP 0

Object:
  0x00000002e6580f78 - klass 0x0000000800006340 java.security.CodeSource
    not allocated after mark start
    not after update watermark
        marked strong
    not marked weak
        in collection set
  mark: marked(0x00000002e66014e3)
  region: | 3275|CS |BTE 2e6580000, 2e6600000, 2e6600000|TAMS 2e6600000|UWM 2e6600000|U 512K|T 0B|G 511K|S 184B|L 475K|CP 0

Forwardee:
  0x00000002e66014e0 - klass 0x0000000800006340 java.security.CodeSource
        allocated after mark start
    not after update watermark
        marked strong
        marked weak
    not in collection set
  mark: mark(is_neutral no_hash age=0)
  region: | 3276|R |BTE 2e6600000, 2e6628dc8, 2e6680000|TAMS 2e6600000|UWM 2e6628dc8|U 163K|T 0B|G 163K|S 184B|L 0B|CP 0

Stack trace suggests we call this from deopt:

--------------- T H R E A D ---------------

Current thread (0x000000013800a210): JavaThread "main" [_thread_in_Java, id=8707, stack(0x000000016dc7c000,0x000000016de7f000)]

Stack: [0x000000016dc7c000,0x000000016de7f000], sp=0x000000016de7a3a0, free space=2040k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.dylib+0x113b1cc] VMError::report_and_die(int, char const*, char const*, char*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x564 (shenandoahBarrierSet.inline.hpp:246)
V [libjvm.dylib+0x113b9e8] VMError::report_and_die(Thread*, char const*, int, unsigned long, VMErrorType, char const*, char*)+0x0
V [libjvm.dylib+0x52eb7c] print_error_for_unit_test(char const*, char const*, char*)+0x0
V [libjvm.dylib+0x52eb10] report_vm_error(char const*, int, char const*, char const*, ...)+0x0
V [libjvm.dylib+0xea3818] ShenandoahAsserts::print_failure(ShenandoahAsserts::SafeLevel, oop, void*, oop, char const*, char const*, char const*, int)+0x2e0
V [libjvm.dylib+0xea54c0] ShenandoahAsserts::assert_not_in_cset(void*, oop, char const*, int)+0x1e8
V [libjvm.dylib+0x40cd58] void ShenandoahBarrierSet::AccessBarrier<286790ull, ShenandoahBarrierSet>::oop_store_common<oop>(oop*, oop)+0x178
V [libjvm.dylib+0x40cb40] void ShenandoahBarrierSet::AccessBarrier<286790ull, ShenandoahBarrierSet>::oop_store_in_heap<oop>(oop*, oop)+0x180
V [libjvm.dylib+0x7b2170] AccessInternal::PostRuntimeDispatch<ShenandoahBarrierSet::AccessBarrier<286790ull, ShenandoahBarrierSet>, (AccessInternal::BarrierType)1, 286790ull>::oop_access_barrier(oop, long, oop)+0xb0
V [libjvm.dylib+0x889120] std::__1::enable_if<!HasDecorator<286790ull, AS_RAW>::value, void>::type AccessInternal::PreRuntimeDispatch::store_at<286790ull, oop>(oop, long, oop)+0xe0
V [libjvm.dylib+0x7b1d30] void AccessInternal::store_at<262148ull, oop>(oop, long, oop)+0x90
V [libjvm.dylib+0xcec4b0] void Access<262144ull>::oop_store_at<oop>(oop, long, oop)+0x90
V [libjvm.dylib+0x55d820] Deoptimization::reassign_fields(frame*, RegisterMap*, GrowableArray<ScopeValue*>*, bool, bool)+0x2604
V [libjvm.dylib+0x557434] rematerialize_objects(JavaThread*, int, CompiledMethod*, frame&, RegisterMap&, GrowableArray<compiledVFrame*>*, bool&)+0x368
V [libjvm.dylib+0x55607c] Deoptimization::fetch_unroll_info_helper(JavaThread*, int)+0x2d4
V [libjvm.dylib+0x561b94] Deoptimization::uncommon_trap(JavaThread*, int, int)+0xa4
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
v ~UncommonTrapBlob 0x000000010dd4916c
J 2604 c2 java.security.SecureClassLoader$1.apply(Ljava/security/SecureClassLoader$CodeSourceKey;)Ljava/security/ProtectionDomain; java.base@21-internal (71 bytes) @ 0x000000010e1bd7ec [0x000000010e1bd700+0x00000000000000ec]
j java.security.SecureClassLoader$1.apply(Ljava/lang/Object;)Ljava/lang/Object;+5 java.base@21-internal
J 1959 c2 java.util.concurrent.ConcurrentHashMap.computeIfAbsent(Ljava/lang/Object;Ljava/util/function/Function;)Ljava/lang/Object; java.base@21-internal (576 bytes) @ 0x000000010de79434 [0x000000010de78fc0+0x0000000000000474]
j java.security.SecureClassLoader.getProtectionDomain(Ljava/security/CodeSource;)Ljava/security/ProtectionDomain;+28 java.base@21-internal
J 2599 c2 java.security.SecureClassLoader.defineClass(Ljava/lang/String;[BIILjava/security/CodeSource;)Ljava/lang/Class; java.base@21-internal (16 bytes) @ 0x000000010e1bad3c [0x000000010e1bacc0+0x000000000000007c]
j jdk.internal.loader.BuiltinClassLoader.defineClass(Ljava/lang/String;Ljdk/internal/loader/Resource;)Ljava/lang/Class;+117 java.base@21-internal
j jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(Ljava/lang/String;)Ljava/lang/Class;+37 java.base@21-internal
j jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(Ljava/lang/String;Z)Ljava/lang/Class;+111 java.base@21-internal
J 2010 c2 jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(Ljava/lang/String;Z)Ljava/lang/Class; java.base@21-internal (40 bytes) @ 0x000000010de0ffac [0x000000010de0ff40+0x000000000000006c]
J 2009 c2 java.lang.ClassLoader.loadClass(Ljava/lang/String;)Ljava/lang/Class; java.base@21-internal (7 bytes) @ 0x000000010de106b8 [0x000000010de10640+0x0000000000000078]
v ~StubRoutines::call_stub 0x000000010dc7016c
J 759 java.lang.Class.forName0(Ljava/lang/String;ZLjava/lang/ClassLoader;Ljava/lang/Class;)Ljava/lang/Class; java.base@21-internal (0 bytes) @ 0x000000010debf498 [0x000000010debf3c0+0x00000000000000d8]
J 758 c2 java.lang.Class.forName(Ljava/lang/String;ZLjava/lang/ClassLoader;Ljava/lang/Class;)Ljava/lang/Class; java.base@21-internal (41 bytes) @ 0x000000010debfabc [0x000000010debfa40+0x000000000000007c]
J 2008 c2 sun.launcher.LauncherHelper.loadMainClass(ILjava/lang/String;)Ljava/lang/Class; java.base@21-internal (277 bytes) @ 0x000000010e0b3264 [0x000000010e0b31c0+0x00000000000000a4]
J 2007 c2 sun.launcher.LauncherHelper.checkAndLoadMain(ZILjava/lang/String;)Ljava/lang/Class; java.base@21-internal (85 bytes) @ 0x000000010de4b9d0 [0x000000010de4b940+0x0000000000000090]
v ~StubRoutines::call_stub 0x000000010dc7016c