RFR: 8299179: ArrayFill with store on backedge needs to reduce length by 1

[Emanuel Peter]

**Context**
`ArrayFill` replaces `CountedLoop` like this:
`for(int i = 5; i < 15; i++) { arr[i] = 88; }`
with
`jint_fill(arr, 5, len, 88)` (CallLeafNoFPNode, intrinsified)
where `len = limit - init`.
This is implemented for `byte`, `short` and `int` (`long` not yet supported).

**Solution**
This assumes that the `store` is in the body of the loop. In rare cases, the `store` is pinned to the backedge, and so it is executed after the exit check, hence in all iterations except the last one. In those cases we need to set `len = limit - init - 1`.

**Details**
_How does a store land on the backedge?_
`test_002` was first reported to me. I reduced it down to a conceptually easier `test_102`.
We have a loop, where the first block only has a single successor. This block contains the `store` that it eventually detected as a `ArrayFill`. This block passes the checks of `clone_loop_head` during parsing: the block is copied before the loop and onto the backedge.

**FYI**
I saw that we seem to currently mostly unroll such loops, instead of applying the `ArrayFill`. Follow up RFE [JDK-8299808](https://bugs.openjdk.org/browse/JDK-8299808).

-------------

Commit messages:
 - Merge branch 'master' into JDK-8299179
 - ArrayFill with store on backedge needs to reduce length by 1

Changes: https://git.openjdk.org/jdk/pull/11904/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=11904&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8299179
  Stats: 429 lines in 3 files changed: 429 ins; 0 del; 0 mod
  Patch: https://git.openjdk.org/jdk/pull/11904.diff
  Fetch: git fetch https://git.openjdk.org/jdk pull/11904/head:pull/11904

PR: https://git.openjdk.org/jdk/pull/11904