Martin Buchholz reports:

While writing a test for this, I unearthed yet another race condition in AQS.
Fortunately, it's in new jdk7 code.

In the expression
(h = head) != tail &&
head may be read as null,
then head and tail are both initialized before tail on RHS is read,
yielding NPE

Caused by: java.lang.NullPointerException
	at java.util.concurrent.locks.AbstractQueuedSynchronizer.hasQueuedPredecessors(AbstractQueuedSynchronizer.java:1510)
	at java.util.concurrent.Semaphore$FairSync.tryAcquireShared(Semaphore.java:245)
	at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireSharedInterruptibly(AbstractQueuedSynchronizer.java:1263)
	at java.util.concurrent.Semaphore.acquire(Semaphore.java:312)

We need to read fields in the reverse order.

@@ -1445,8 +1502,10 @@
         // The correctness of this depends on head being initialized
         // before tail and on head.next being accurate if the current
         // thread is first in queue.
-        Node h, s;
-        return (h = head) != tail &&
+        Node t = tail; // Read fields in reverse initialization order
+        Node h = head;
+        Node s;
+        return h != t &&
             ((s = h.next) == null || s.thread != Thread.currentThread());
     }