HotSpot C2 crashes when we use unsafe API to fill an array in a loop. It can be reproduced by the case like below.

        byte[] array = new byte[size];
        int offset = unsafe.arrayBaseOffset(byte[].class);
        for (int i = offset; i < offset + size; i++) {
             unsafe.putByte(array, i, fill);
        }

Crash report

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x0000ffffb60c5988, pid=2413836, tid=2413852
#
# JRE version: OpenJDK Runtime Environment (19.0) (fastdebug build 19-internal-adhoc.penli01.jdksrc)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 19-internal-adhoc.penli01.jdksrc, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
# Problematic frame:
# V  [libjvm.so+0x6c5988]  AddPNode::bottom_type() const+0x78
#
# Core dump will be written. Default location: /tmp/core.2413836
#
# An error report file with more information is saved as:
# /tmp/scratch/0/hs_err_pid2413836.log
#
# Compiler replay data is saved as:
# /tmp/scratch/0/replay_pid2413836.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#


The crash is caused by a NULL pointer issue when doing loop intrinsify_fill optimization for unsafe fill patterns. Although this only occurs with unsafe call, we still think it's better to fix that because such unsafe call is used in a correct way.

Note that this can be reproduced on AArch64 with default VM options. On x86, it's reproducible with additional option "-XX:+OptimizeFill" which is turned off by default.