I successfully created my dependent PR:

https://github.com/openjdk/jdk/pull/10400

but was then a bit surprised by how things worked. It appears that once the initial PR is integrated, my PR then appears to contain the changes from both PRs until I merge with master (there is a nice message from the bot telling me about this). The problem was that in the meantime (again as the bot message stated) reviewers were totally confused by my PR and commented on things from the upstream PR. I hadn't expected that. But also the bots themselves then decided my changes applied to a whole bunch of mailing lists that the real changes do not apply to - so they got spammed until I was able to clear the labels!