ciTypeFlow::is_dominated_by() writes outside dominated array

----------System.out:(28/1588)*----------
## nof_mallocs = 652975, nof_frees = 524884
## memory stomp:
GuardedMemory(0x000000187d68b280) base_addr=0x0000001887278400 tag=0x0000000000000000 user_size=43 user_data=0x0000001887278420
  Header guard @0x0000001887278400 is OK
  Trailer guard @0x000000188727844b is BROKEN
  User data appears to be in use
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=\\os.cpp:517
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (C:\\jprt\\T\\P1\\020259.christian\\s\\hotspot\\src\\share\\vm\\runtime\\os.cpp:517), pid=132060, tid=79812
# fatal error: memory stomping error
#
# JRE version: Java(TM) SE Runtime Environment (9.0) (build 9-internal+0-2016-01-20-020259.christian.jake-nightly2)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (9-internal+0-2016-01-20-020259.christian.jake-nightly2, mixed mode, tiered, compressed oops, g1 gc, windows-amd64)
# Core dump will be written. Default location: C:\\Users\\aurora\\sandbox\\results\\workDir\\runtime\\8007475\\StackMapFrameTest\\hs_err_pid132060.mdmp
#
# An error report file with more information is saved as:
# C:\\Users\\aurora\\sandbox\\results\\workDir\\runtime\\8007475\\StackMapFrameTest\\hs_err_pid132060.log
#
# Compiler replay data is saved as:
# C:\\Users\\aurora\\sandbox\\results\\workDir\\runtime\\8007475\\StackMapFrameTest\\replay_pid132060.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
#
Timeout signalled after 1,920 seconds
----------System.err:(0/0)----------