ADDITIONAL SYSTEM INFORMATION :
- Operating system: Linux
- Compiler/toolchain: GCC 9.5
- Source commit: a8784a04081a11a41fe0e3bd8ab9fba6af2d3d4d (tag: jdk-17.0.18+4, branch: master)
- Build type: fastdebug
- Coverage: enabled (built with --enable-coverage)
- Build environment: Linux, compiled from source with GCC 9.5

A DESCRIPTION OF THE PROBLEM :
C2 crash in ciObjectFactory::create_new_metadata when running a slightly modified Test6968348 with -Xcomp (interpreted -Xint succeeds)
- I observe a deterministic crash in a fastdebug build of jdk17u when running a minimally modified version of test/hotspot/jtreg/compiler/c2/Test6968348.java under C2 compilation (-Xcomp or default mixed mode). The same program completes successfully under the interpreter (-Xint), printing “PASSED”.
- The modification makes array_long_base_offset remain 0 (due to a loop whose body never executes), after which Unsafe.putLong writes are performed to a long[] using offsets starting at 0. With -Xcomp or default, the VM crashes during compilation in the compiler interface:

  Problematic frame:
  V [libjvm.so+0x5692ef] ciObjectFactory::create_new_metadata(Metadata*)+0x2f

  And during error reporting:
  Internal Error (src/hotspot/share/ci/ciInstanceKlass.cpp:723)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Same as `test/hotspot/jtreg/compiler/c2/Test6968348.java`

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Program runs to completion and prints:
    PASSED
  (As observed with -Xint.)
ACTUAL -
With -Xcomp (or with no extra flags, i.e., mixed mode), the VM aborts with SIGSEGV in ciObjectFactory::create_new_metadata during JIT compilation. An hs_err file is produced. Example header:

    JRE version: OpenJDK Runtime Environment (17.0.18) (build 17.0.18-internal+0-adhoc.syc.jdk17u)
    Java VM: OpenJDK 64-Bit Server VM (17.0.18-internal+0-adhoc.syc.jdk17u, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
    Problematic frame:
    V [libjvm.so+0x5692ef] ciObjectFactory::create_new_metadata(Metadata*)+0x2f


---------- BEGIN SOURCE ----------
package compiler.c2;


import jdk.internal.misc.Unsafe;
import java.lang.reflect.Field;

public class Test6968348 {
    
    static Unsafe unsafe = Unsafe.getUnsafe();

    static final long[] buffer = new long[4096];

    static int array_long_base_offset;

    public static void main(java.lang.String[] args) throws java.lang.Exception {

        int lvInt = 678;
        
        for (lvInt = 0; lvInt < lvInt; lvInt++) {
            array_long_base_offset = unsafe.arrayBaseOffset(long[].class);
        }

        for (int n = 0; n < 100000; n++) {
            test();
        }
        System.out.println("PASSED");
    }

    public static void test() {
        for (long i = array_long_base_offset; i < 4096; i += 8) {
            unsafe.putLong(buffer, i, java.lang.Long.reverseBytes(i));
        }
    }
}
---------- END SOURCE ----------