TypePtr::add_offset() set incorrect offset when the add overflows

The next code shows the problem:

public class Bug647 {

        private String[] values;
        private int count;

        String foo() {
                int i = Integer.MAX_VALUE-1;
                return values[i];
        }

        public static void main(String[] args) {
                Bug647 t = new Bug647();
                String s = t.foo();
        }
}


$ java -Xcomp -XX:CompileOnly=Bug647.foo -XX:+PrintCompilation -cp . Bug647
VM option 'CompileOnly=Bug647.foo'
VM option '+PrintCompilation'
CompileOnly: compileonly *Bug647*.foo
  1 b Bug647::foo (10 bytes)
o62 LoadP === o66 o7 o61 [[o63 30 ]] @java/lang/Object *[int:>=0]+any*, idx=5; #java/lang/String:exact * Oop:java/lang/String:exact *

mach:
 33 loadConL === _ [[ 32 ]] [3000033]
o26 LoadP === _ o7 o25 [[o55 o28 o36 o61 o61 o43 o43 32 ]] @Bug647+24*, name=values, idx=4; #java/lang/String:exact *[int:>=0]:exact *
o7 Parm === o3 [[o63 o62 o55 o44 o26 o36 32 ]] Memory Memory:@BotPTR *+bot, idx=Bot;
o66 IfFalse === o65 [[o62 o63 32 ]] #0
 32 loadP === o66 o7 o26 33 [[]] java/lang/String:exact * Oop:java/lang/String:exact *
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=\matcher.cpp:1484
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (C:\...\hotspot\src\share\vm\opto\matcher.cpp:1484), pid=24028, tid=23040
# Error: assert(m->adr_type() == mach->adr_type(),"matcher should not change adr type")