The code emitted for the count_positives intrinsic is broken when running under the diagnostic option: -XX:UseAVX=3 -XX:+UnlockDiagnosticVMOptions -XX:+AVX3Threshold=0: the len register is repurposed and overwritten, but the tail logic then wrongly assumes len still holds the original value. This means the value returned can be almost arbitrary, with random crashes etc as a result. This bug was introduced by changes in JDK-8281146 and went undetected due lack of coverage by tests.

The proposed fix is to reconstitute the tail part of len from tmp1 before jumping into the tail block.