There are 3 nodes involving in the construction of a java.lang.String object.
1. Allocate of itself, aka. alloc
2. AllocateArray of a byte array, which is value:byte[], aka. aa
3. ArrayCopyNode which copys in the contents of value, aka. ac

Lemma
When a String object alloc is scalar replaced, C2 can eliminate aa and ac.

Because alloc is scalar replaced, it must be non-escaped. The field value:byte[] of j.l.String can’t be seen by external world, therefore it must not be global escaped. Because the buffer is marked as stable, it is safe to assume its content are whatever ac copies in. Because all public java.lang.String constructors clone the incoming array, the source of ac is stable as well.

It is possible to rewired aa to the source of ac with the correct offset. That is to say, we can replace both aa and ac with a “shallow copy” of the source of ac. It’s safe if C2 keeps a reference of the source oop for all safepoints.

Corollary
It’s not necessary to limit this optimization on scalar replaced java.lang.String object, or not even j.l.String at all. In general, C2 can eliminate AllocateArray and ArrayCopy pair once it finds a non-global-escaped stable array, which is defined by another stable or immutable array.