8058209: Race in G1 card scanning could allow scanning of memory covered by PLABs

Summary: Read _top before _gc_time_stamp in saved_mark_word() with LoadLoad order to ensure we get a consistent view
Reviewed-by: brutisso, dcubed, dholmes, stefank

src/share/vm/gc_implementation/g1/heapRegion.cpp

@@ -1015,10 +1015,13 @@ HeapWord* G1OffsetTableContigSpace::cross_threshold(HeapWord* start,
 HeapWord* G1OffsetTableContigSpace::saved_mark_word() const {
   G1CollectedHeap* g1h = G1CollectedHeap::heap();
   assert( _gc_time_stamp <= g1h->get_gc_time_stamp(), "invariant" );
-  if (_gc_time_stamp < g1h->get_gc_time_stamp())
-    return top();
-  else
+  HeapWord* local_top = top();
+  OrderAccess::loadload();
+  if (_gc_time_stamp < g1h->get_gc_time_stamp()) {
+    return local_top;
+  } else {
     return Space::saved_mark_word();
+  }
 }
 
 void G1OffsetTableContigSpace::record_top_and_timestamp() {