The attached test fails after 8054478: C2: Incorrectly compiled char[] array access crashes JVM.

Command line:
java -Xbatch -XX:+PrintCompilation -XX:-LoopLimitCheck code


   1172 71 b 4 java.lang.Integer::getChars (131 bytes)
Bad graph detected in compute_lca_of_uses
n: 910 Bool === _ 839 [[ 911 ]] [le]
early(n): 912 IfFalse === 911 [[ 844 644 ]] #0 !orig=[842]
n->in(1): 839 CmpI === _ 780 838 [[ 910 ]]
early(n->in(1)): 912 IfFalse === 911 [[ 844 644 ]] #0 !orig=[842]
n->in(1)->in(1): 780 AddI === _ 783 172 [[ 742 783 827 839 844 ]] !orig=638,171 !jvms: Integer::getChars @ bci:60
early(n->in(1)->in(1)): 784 CountedLoop === 784 612 794 [[ 783 784 785 795 796 798 799 ]] stride: -2 pre of N644 !orig=644,[541],[477]
n->in(1)->in(2): 838 Opaque1 === _ 914 [[ 839 ]]
early(n->in(1)->in(2)): 912 IfFalse === 911 [[ 844 644 ]] #0 !orig=[842]

LCA(n): 837 IfFalse === 793 [[ 911 ]] #0
n->out(0): 911 If === 837 910 [[ 912 913 ]] P=0.000001, C=-1.000000 !orig=[841]
n->out(0)->out(0): 912 IfFalse === 911 [[ 844 644 ]] #0 !orig=[842]
n->out(0)->out(1): 913 IfTrue === 911 [[ 809 ]] #1 !orig=[808],735

idom[0] 837 IfFalse === 793 [[ 911 ]] #0
idom[1] 793 CountedLoopEnd === 792 741 [[ 794 837 ]] [gt] P=0.500000, C=-1.000000 !orig=641,[607],[470]
idom[2] 792 IfTrue === 791 [[ 746 793 ]] #1 !orig=[149],[467],[201] !jvms: Integer::getChars @ bci:58
idom[3] 791 If === 790 775 [[ 792 806 ]] P=0.999999, C=-1.000000 !orig=[148] !jvms: Integer::getChars @ bci:58
idom[4] 790 IfTrue === 789 [[ 745 747 791 ]] #1 !orig=112,[133] !jvms: Integer::getChars @ bci:57
idom[5] 789 If === 788 761 [[ 790 804 ]] P=0.999999, C=-1.000000 !orig=111 !jvms: Integer::getChars @ bci:57
idom[6] 788 IfFalse === 787 [[ 789 ]] #0 !orig=521,[220] !jvms: Integer::getChars @ bci:20
idom[7] 787 If === 786 743 [[ 788 802 ]] P=0.272715, C=5459.000000 !orig=520,218 !jvms: Integer::getChars @ bci:20
idom[8] 786 IfTrue === 785 [[ 757 787 ]] #1 !orig=[528],[201] !jvms: Integer::getChars @ bci:71
idom[9] 785 If === 784 778 [[ 786 800 ]] P=0.999999, C=-1.000000 !orig=[540],475
idom[10] 784 CountedLoop === 784 612 794 [[ 783 784 785 795 796 798 799 ]] stride: -2 pre of N644 !orig=644,[541],[477]
idom[11] 612 IfFalse === 611 [[ 784 ]] #0 !orig=[537],[472],[201] !jvms: Integer::getChars @ bci:71
idom[12] 611 If === 526 610 [[ 612 613 ]] P=0.000001, C=-1.000000 !orig=[536],[470]
idom[13] 526 IfTrue === 525 [[ 483 611 ]] #1 !orig=[149],[467],[201] !jvms: Integer::getChars @ bci:58
idom[14] 525 If === 524 510 [[ 526 546 ]] P=0.999999, C=-1.000000 !orig=[148] !jvms: Integer::getChars @ bci:58
idom[15] 524 IfTrue === 523 [[ 482 484 525 ]] #1 !orig=112,[133] !jvms: Integer::getChars @ bci:57
idom[16] 523 If === 461 496 [[ 524 544 ]] P=0.999999, C=-1.000000 !orig=111 !jvms: Integer::getChars @ bci:57
idom[17] 461 IfTrue === 460 [[ 523 141 ]] #1 !orig=[65] !jvms: Integer::getChars @ bci:23
idom[18] 460 If === 43 129 [[ 461 462 ]] P=0.999999, C=-1.000000 !orig=[55] !jvms: Integer::getChars @ bci:23
idom[19] 43 IfFalse === 41 [[ 460 ]] #0 !jvms: Integer::getChars @ bci:20
idom[20] 41 If === 28 40 [[ 42 43 ]] P=0.272715, C=7506.000000 !jvms: Integer::getChars @ bci:20
idom[21] 28 IfFalse === 26 [[ 41 ]] #0 !jvms: Integer::getChars @ bci:7
idom[22] 26 If === 5 25 [[ 27 28 ]] P=0.000000, C=2047.000000 !jvms: Integer::getChars @ bci:7
idom[23] 5 Parm === 3 [[ 26 ]] Control !jvms: Integer::getChars @ bci:-1

*** Use 837 isn't dominated by def 910 ***
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/loopnode.cpp:3231
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/Users/iggy/work/hs-comp/hotspot/src/share/vm/opto/loopnode.cpp:3231), pid=36851, tid=19203
# assert(!had_error) failed: bad dominance
#
# JRE version: Java(TM) SE Runtime Environment (9.0) (build 1.9.0-internal-debug-iggy_2015_02_11_12_03-b00)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (1.9.0-internal-debug-iggy_2015_02_11_12_03-b00 mixed mode bsd-amd64 compressed oops)
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /Users/iggy/work/8072753/hs_err_pid36851.log
#
# Compiler replay data is saved as:
# /Users/iggy/work/8072753/replay_pid36851.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 19203
Dumping core ...
Abort trap: 6