Currently, the 'length' input of ArrayCopy nodes created from array cloning is expressed in double-words [1], instead of number of array elements as it could be intuitively expected. Furthermore, depending on the VM configuration (e.g. value of UseCompressedClassPointers), this double-word length might cover parts of the array header such as the array length field in order to align the start of the array copy to double words [2]. Arguably, these are array copy implementation details that should not be dealt with at ArrayCopy creation time.

A potentially simpler alternative, suggested by [~ayang], would be to (in his own words) "pass the actual array length (#slots) as length and move the merge-bytes-to-words-copying optimization to a lower level, e.g. inside conjoint_jbytes. Ofc, BarrierSetC2::clone_at_expansion and its derived siblings need to be adjusted accordingly, e.g. to use the actual elem-type." (see discussion in JDK-8312749 [3] for context).

[1] https://github.com/openjdk/jdk/blob/d02405917406a355a11741bb278ea58c3a4642fb/src/hotspot/share/gc/shared/c2/barrierSetC2.cpp#L678
[2] https://github.com/openjdk/jdk/blob/d02405917406a355a11741bb278ea58c3a4642fb/src/hotspot/share/gc/shared/c2/barrierSetC2.cpp#L650-L671
[3] https://github.com/openjdk/jdk/pull/15288