I'm seeing a reproducible crash in C2 that appears to be a regression in JDK 24.

I bisected it to JDK-8347006 (LoadRangeNode floats above array guard in arraycopy intrinsic).

I don't have a minimal repro, the crash can be reproduced with Bazel (https://github.com/google/bazel).

Repro:

```
$ wget https://github.com/bazelbuild/bazel/releases/download/8.0.1/bazel-8.0.1-linux-x86_64
$ chmod a+rx bazel-8.0.1-linux-x86_64
$ touch WORKSPACE

$ ./jdk-24/bin/java -fullversion
openjdk full version "24-ea+33-3628"

$ ./bazel-8.0.1-linux-x86_64 --server_javabase=$PWD/jdk-24 build --experimental_skyframe_memory_dump=json
...
Server terminated abruptly (error code: 14, error message: 'Socket closed', log file: '~/.cache/bazel/_bazel_cushon/0497f99d607157b827ac41565e3b2983/server/jvm.out')
```

The crash message includes:

```
Current thread (0x00007fc7a80881a0): JavaThread "C2 CompilerThread5" daemon [_thread_in_native, id=2335612, stack(0x00007fc9c6def000,0x00007fc9c6eef000) (1024K)]


Current CompileTask:
C2:3790 7641 ! 4 com.google.devtools.build.lib.util.ObjectGraphTraverser::process (485 bytes)

Stack: [0x00007fc9c6def000,0x00007fc9c6eef000], sp=0x00007fc9c6eea390, free space=1004k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x5b0fef] PredictedCallGenerator::generate(JVMState*)+0x8af
V [libjvm.so+0x780563] Parse::do_call()+0x203
V [libjvm.so+0xd6fab1] Parse::do_one_block()+0x1b1
V [libjvm.so+0xd70165] Parse::do_all_blocks()+0xe5
V [libjvm.so+0xd71a6b] Parse::Parse(JVMState*, ciMethod*, float)+0x69b
V [libjvm.so+0x5af04b] ParseGenerator::generate(JVMState*)+0x8b
```

The source for `com.google.devtools.build.lib.util.ObjectGraphTraverser::process` is here: https://github.com/bazelbuild/bazel/blob/56bf54716094bf6b687366d20b577435213681d5/src/main/java/com/google/devtools/build/lib/util/ObjectGraphTraverser.java#L407

The code includes reflective array operations that are possibly relevant to the changes in JDK-8347006:

```
    if (clazz.isArray()) {
      traversal.objectFound(o, contextOrNull(context, "[] " + clazz.getComponentType().getName()));

      // We only care about objects
      if (!clazz.getComponentType().isPrimitive()) {
        for (int i = 0; i < Array.getLength(o); i++) {
          Object to = Array.get(o, i);
```