ADDITIONAL SYSTEM INFORMATION :
# JRE version: OpenJDK Runtime Environment (8.0_392) (build 1.8.0_392-internal-fastdebug--b00)
# Java VM: OpenJDK 64-Bit Server VM (25.392-b00-fastdebug mixed mode linux-amd64 compressed oops)

A DESCRIPTION OF THE PROBLEM :
I ran a regression test on jdk8u392, and I found a crash without any options.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
java compiler.loopopts.FillArrayWithUnsafe

ACTUAL -
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007ff1c33da568, pid=34634, tid=0x00007ff0aa858700
#
# JRE version: OpenJDK Runtime Environment (8.0_392) (build 1.8.0_392-internal-fastdebug--b00)
# Java VM: OpenJDK 64-Bit Server VM (25.392-b00-fastdebug mixed mode linux-amd64 compressed oops)
# Problematic frame:
# V [libjvm.so+0x3ba568] AddPNode::bottom_type() const+0x158
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home//repository//toreport/FillArrayWithUnsafe_09_24_01_27_02/hs_err_pid34634.log
#
# Compiler replay data is saved as:
# /home//repository/toreport/FillArrayWithUnsafe_09_24_01_27_02/replay_pid34634.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
#

---------- BEGIN SOURCE ----------
import java.lang.reflect.Field;

import sun.misc.Unsafe;

public class FillArrayWithUnsafe {

    private static Unsafe unsafe;

    public static void main(String[] args) throws Exception {
        Class klass = Unsafe.class;
        Field field = klass.getDeclaredField("theUnsafe");
        field.setAccessible(true);
        unsafe = (Unsafe) field.get(null);

        byte[] buffer;
        // Make sure method newByteArray is compiled by C2
        for (int i = 0; i < 50000; i++) {
            buffer = newByteArray(100, (byte) 0x80);
        }
    }

    public static byte[] newByteArray(int size, byte val) {
        byte[] arr = new byte[size];
        int offset = unsafe.arrayBaseOffset(byte[].class);
        for (int i = offset; i < offset + size; i++) {
             unsafe.putByte(arr, i, val);
        }
        return arr;
    }
}
---------- END SOURCE ----------

FREQUENCY : always