C1 crashes in Canonicalizer::do_ArrayLength() after the fix for JDK-8150102:

Stack: [0x00007fece4acc000,0x00007fece4bcd000], sp=0x00007fece4bcaf60, free space=1019k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x6306c1] Canonicalizer::do_ArrayLength(ArrayLength*)+0x591;; Canonicalizer::do_ArrayLength(ArrayLength*)+0x591
V [libjvm.so+0x64fa40] GraphBuilder::append_with_bci(Instruction*, int)+0x70;; GraphBuilder::append_with_bci(Instruction*, int)+0x70
V [libjvm.so+0x66021f] GraphBuilder::iterate_bytecodes_for_block(int)+0x1c1f;; GraphBuilder::iterate_bytecodes_for_block(int)+0x1c1f
V [libjvm.so+0x660626] GraphBuilder::iterate_all_blocks(bool)+0x86;; GraphBuilder::iterate_all_blocks(bool)+0x86
V [libjvm.so+0x6612e6] GraphBuilder::GraphBuilder(Compilation*, IRScope*)+0x2b6;; GraphBuilder::GraphBuilder(Compilation*, IRScope*)+0x2b6
V [libjvm.so+0x66948d] IRScope::IRScope(Compilation*, IRScope*, int, ciMethod*, int, bool)+0x28d;; IRScope::IRScope(Compilation*, IRScope*, int, ciMethod*, int, bool)+0x28d
V [libjvm.so+0x66a524] IR::IR(Compilation*, ciMethod*, int)+0x134;; IR::IR(Compilation*, ciMethod*, int)+0x134
V [libjvm.so+0x63d4a2] Compilation::build_hir() [clone .part.98]+0x312;; Compilation::build_hir() [clone .part.98]+0x312
V [libjvm.so+0x641948] Compilation::compile_java_method()+0xac8;; Compilation::compile_java_method()+0xac8
V [libjvm.so+0x641d54] Compilation::compile_method()+0x244;; Compilation::compile_method()+0x244
V [libjvm.so+0x642659] Compilation::Compilation(AbstractCompiler*, ciEnv*, ciMethod*, int, BufferBlob*, DirectiveSet*)+0x3d9;; Compilation::Compilation(AbstractCompiler*, ciEnv*, ciMethod*, int, BufferBlob*, DirectiveSet*)+0x3d9
V [libjvm.so+0x644084] Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x194;; Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x194
V [libjvm.so+0x8e29e4] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x554;; CompileBroker::invoke_compiler_on_method(CompileTask*)+0x554
V [libjvm.so+0x8e3d08] CompileBroker::compiler_thread_loop()+0x458;; CompileBroker::compiler_thread_loop()+0x458
V [libjvm.so+0x1358049] JavaThread::thread_main_inner()+0x1c9;; JavaThread::thread_main_inner()+0x1c9
V [libjvm.so+0x13582a6] JavaThread::run()+0x1c6;; JavaThread::run()+0x1c6
V [libjvm.so+0x10dcb92] java_start(Thread*)+0xd2;; java_start(Thread*)+0xd2
C [libpthread.so.0+0x7df3] start_thread+0xc3