--- a/hotspot/src/share/vm/ci/ciArray.cpp	Wed Feb 24 09:22:45 2016 -0800
+++ b/hotspot/src/share/vm/ci/ciArray.cpp	Fri Feb 26 01:58:26 2016 +0300
@@ -107,8 +107,9 @@
   intptr_t header = arrayOopDesc::base_offset_in_bytes(elembt);
   intptr_t index = (element_offset - header) >> shift;
   intptr_t offset = header + ((intptr_t)index << shift);
-  if (offset != element_offset || index != (jint)index)
+  if (offset != element_offset || index != (jint)index || index < 0 || index >= length()) {
     return ciConstant();
+  }
   return element_value((jint) index);
 }
 

--- a/hotspot/src/share/vm/opto/memnode.cpp	Wed Feb 24 09:22:45 2016 -0800
+++ b/hotspot/src/share/vm/opto/memnode.cpp	Fri Feb 26 01:58:26 2016 +0300
@@ -1582,6 +1582,15 @@
   return NULL;
 }
 
+static bool is_mismatched_access(ciConstant con, BasicType loadbt) {
+  BasicType conbt = con.basic_type();
+  assert(conbt != T_NARROWOOP, "sanity");
+  if (loadbt == T_NARROWOOP || loadbt == T_ARRAY) {
+    loadbt = T_OBJECT;
+  }
+  return (conbt != loadbt);
+}
+
 // Try to constant-fold a stable array element.
 static const Type* fold_stable_ary_elem(const TypeAryPtr* ary, int off, BasicType loadbt) {
   assert(ary->const_oop(), "array should be constant");
@@ -1590,8 +1599,7 @@
   // Decode the results of GraphKit::array_element_address.
   ciArray* aobj = ary->const_oop()->as_array();
   ciConstant con = aobj->element_value_by_offset(off);
-
-  if (con.basic_type() != T_ILLEGAL && !con.is_null_or_zero()) {
+  if (con.basic_type() != T_ILLEGAL && !is_mismatched_access(con, loadbt) && !con.is_null_or_zero()) {
     const Type* con_type = Type::make_from_constant(con);
     if (con_type != NULL) {
       if (con_type->isa_aryptr()) {
@@ -1642,7 +1650,7 @@
     const bool off_beyond_header = ((uint)off >= (uint)min_base_off);
 
     // Try to constant-fold a stable array element.
-    if (FoldStableValues && ary->is_stable() && ary->const_oop() != NULL) {
+    if (FoldStableValues && !is_mismatched_access() && ary->is_stable() && ary->const_oop() != NULL) {
       // Make sure the reference is not into the header and the offset is constant
       if (off_beyond_header && adr->is_AddP() && off != Type::OffsetBot) {
         const Type* con_type = fold_stable_ary_elem(ary, off, memory_type());

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hotspot/test/compiler/unsafe/UnsafeGetStableArrayElement.java	Fri Feb 26 01:58:26 2016 +0300
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @summary tests on constant folding of unsafe get operations
+ * @library /testlibrary /test/lib
+ *
+ * @run main/bootclasspath -XX:+UnlockDiagnosticVMOptions
+ *                   -Xbatch -XX:-TieredCompilation
+ *                   -XX:+FoldStableValues
+ *                   UnsafeGetStableArrayElement
+ *
+ * @run main/bootclasspath -XX:+UnlockDiagnosticVMOptions
+ *                   -Xbatch -XX:+TieredCompilation -XX:TieredStopAtLevel=1
+ *                   -XX:+FoldStableValues
+ *                   UnsafeGetStableArrayElement
+ */
+import jdk.internal.misc.Unsafe;
+import jdk.internal.vm.annotation.Stable;
+import java.util.concurrent.Callable;
+
+import static jdk.internal.misc.Unsafe.*;
+import static jdk.test.lib.Asserts.*;
+
+public class UnsafeGetStableArrayElement {
+    @Stable static final byte[] STABLE_BYTE_ARRAY = new byte[] { 0, 1, -128, 127};
+
+    static final Unsafe U = Unsafe.getUnsafe();
+
+    static int testChar() {
+        return U.getChar(STABLE_BYTE_ARRAY, ARRAY_BYTE_BASE_OFFSET + 0 * ARRAY_CHAR_INDEX_SCALE) +
+               U.getChar(STABLE_BYTE_ARRAY, ARRAY_BYTE_BASE_OFFSET + 1 * ARRAY_CHAR_INDEX_SCALE);
+    }
+
+    static void run(Callable c) throws Exception {
+        Object first = c.call();
+        for (int i = 0; i < 20_000; i++) {
+            assertEQ(first, c.call());
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        run(UnsafeGetStableArrayElement::testChar);
+    }
+}