6930035: C2 type system incorrectly handles case j.l.Object->meet(constant AryPtr)

Summary: Add missing code.
Reviewed-by: never

src/share/vm/opto/type.cpp

@@ -2809,7 +2809,8 @@ const Type *TypeInstPtr::xmeet( const Type *t ) const {
         // then we can subclass in the Java class hierarchy.
         if (klass()->equals(ciEnv::current()->Object_klass())) {
           // that is, tp's array type is a subtype of my klass
-          return TypeAryPtr::make(ptr, tp->ary(), tp->klass(), tp->klass_is_exact(), offset, instance_id);
+          return TypeAryPtr::make(ptr, (ptr == Constant ? tp->const_oop() : NULL),
+                                  tp->ary(), tp->klass(), tp->klass_is_exact(), offset, instance_id);
         }
       }
       // The other case cannot happen, since I cannot be a subtype of an array.
@@ -3415,7 +3416,8 @@ const Type *TypeAryPtr::xmeet( const Type *t ) const {
         // then we can subclass in the Java class hierarchy.
         if( tp->klass()->equals(ciEnv::current()->Object_klass()) ) {
           // that is, my array type is a subtype of 'tp' klass
-          return make( ptr, _ary, _klass, _klass_is_exact, offset, instance_id );
+          return make( ptr, (ptr == Constant ? const_oop() : NULL),
+                       _ary, _klass, _klass_is_exact, offset, instance_id );
         }
       }
       // The other case cannot happen, since t cannot be a subtype of an array.