RFR(XS): 8202123: C2 Crash in Node::in(unsigned int) const+0x14

[Roland Westrelin]

http://cr.openjdk.java.net/~roland/8202123/webrev.00/

In the last loop of the test, the array store is moved out of loop with
control set right above the loop head and below the loop limit check
predicate. Then only, the loop limit, that includes a load that depends
on the store, becomes loop invariant and the loop is converted to a
counted loop. But because the control of the store is below the loop
limit check predicate, the loop limit check predicate is updated with a
test that doesn't dominate the if node.

This is not targeted for 11 but it seems simple and low risk enough that
it could be included in 11.

Roland.