diff -r 46579c68f7f4 -r 9a5e9537fe1a src/hotspot/share/gc/z/zBarrier.inline.hpp
--- a/src/hotspot/share/gc/z/zBarrier.inline.hpp	Tue Jul 02 12:24:26 2019 +0200
+++ b/src/hotspot/share/gc/z/zBarrier.inline.hpp	Tue Jul 02 12:24:28 2019 +0200
@@ -24,10 +24,12 @@
 #ifndef SHARE_GC_Z_ZBARRIER_INLINE_HPP
 #define SHARE_GC_Z_ZBARRIER_INLINE_HPP
 
+#include "classfile/javaClasses.hpp"
 #include "gc/z/zAddress.inline.hpp"
 #include "gc/z/zBarrier.hpp"
 #include "gc/z/zOop.inline.hpp"
 #include "gc/z/zResurrection.inline.hpp"
+#include "oops/oop.hpp"
 #include "runtime/atomic.hpp"
 
 template <ZBarrierFastPath fast_path, ZBarrierSlowPath slow_path>
@@ -173,7 +175,21 @@
   }
 }
 
+// ON_WEAK barriers should only ever be applied to j.l.r.Reference.referents.
+inline void verify_on_weak(volatile oop* referent_addr) {
+#ifdef ASSERT
+  if (referent_addr != NULL) {
+    uintptr_t base = (uintptr_t)referent_addr - java_lang_ref_Reference::referent_offset;
+    oop obj = cast_to_oop(base);
+    assert(oopDesc::is_oop(obj), "Verification failed for: ref " PTR_FORMAT " obj: " PTR_FORMAT, (uintptr_t)referent_addr, base);
+    assert(java_lang_ref_Reference::is_referent_field(obj, java_lang_ref_Reference::referent_offset), "Sanity");
+  }
+#endif
+}
+
 inline oop ZBarrier::load_barrier_on_weak_oop_field_preloaded(volatile oop* p, oop o) {
+  verify_on_weak(p);
+
   if (is_resurrection_blocked(p, &o)) {
     return weak_barrier<is_good_or_null_fast_path, weak_load_barrier_on_weak_oop_slow_path>(p, o);
   }
@@ -217,6 +233,8 @@
 }
 
 inline oop ZBarrier::weak_load_barrier_on_weak_oop_field_preloaded(volatile oop* p, oop o) {
+  verify_on_weak(p);
+
   if (is_resurrection_blocked(p, &o)) {
     return weak_barrier<is_good_or_null_fast_path, weak_load_barrier_on_weak_oop_slow_path>(p, o);
   }