Request for reviews (XS): 7047069: Array can dynamically change size when assigned to an object field

[Vladimir Kozlov]

http://cr.openjdk.java.net/~kvn/7047069/webrev

Fixed 7047069: Array can dynamically change size when assigned to an object field

I lost my faith in our testing :( This broken code was there for more then 3 
years and nobody hit it?
The initialization of a newly-allocated array with arraycopy is broken when src 
and dest offsets are not constants. The typo in the code convert not constant 
offsets to constant 8: 12 + (-1)*4. So we generates copy from offset 8 which is 
array length and overwrite it and the rest of the beginning of the array.

Added regression test.