RFR: 8366490: C2 SuperWord: wrong result because CastP2X is missing ctrl and floats over SafePoint creating stale oops

[Emanuel Peter]

**Analysis**

A `CastP2X` without ctrl can float. If it floats over a `SafePoint` (or call), we may GC and move the oop. But the `CastP2X` value does not end up on the oop-map, and so the pointer is stale (old).

With `StressGCM`, the aliasing runtime check has one `CastP2X` that floats over the SafePoint, and another that stays after the SafePoint. Both read the oop of the same array, so instead of getting the same address, we now get the old and the new oop. And so the aliasing runtime check passes (thinks there is no aliasing), even though there is aliasing. We end up vectorizing, which reorders the loads/stores and would only be safe if there is no aliasing.

**Fix:** add control to the `CastP2X` so that it cannot float too far.

**Details**


rbp = Allcoate array
spill <- rbp + 0x20

call to allocateArrays
-> allocates a lot, and triggers GC. That moves the allocated array behind rbp
-> rbp is oop-mapped, so it is updated automatically to the new oop
-> spill value remains based on the old oop

We now compute the aliasing runtime check:
-> one side of the comparison is computed from rbp (new oop)
-> the other side is computed from the the spill value (old oop)
-> the cmp returns a nonsensical value, and we take the wrong branch
-> vectorize even though we have aliasing!

-------------

Commit messages:
 - fix test flags
 - the fix
 - JDK-8366490

Changes: https://git.openjdk.org/jdk/pull/27045/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=27045&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8366490
  Stats: 152 lines in 5 files changed: 139 ins; 1 del; 12 mod
  Patch: https://git.openjdk.org/jdk/pull/27045.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/27045/head:pull/27045

PR: https://git.openjdk.org/jdk/pull/27045