--- a/hotspot/src/share/vm/opto/lcm.cpp	Fri Mar 17 16:15:14 2017 -0700
+++ b/hotspot/src/share/vm/opto/lcm.cpp	Mon Mar 20 23:49:33 2017 +0100
@@ -254,10 +254,12 @@
       const TypePtr *adr_type = NULL;  // Do not need this return value here
       const Node* base = mach->get_base_and_disp(offset, adr_type);
       if (base == NULL || base == NodeSentinel) {
-        // Narrow oop address doesn't have base, only index
-        if( val->bottom_type()->isa_narrowoop() &&
-            MacroAssembler::needs_explicit_null_check(offset) )
-          continue;             // Give up if offset is beyond page size
+        // Narrow oop address doesn't have base, only index.
+        // Give up if offset is beyond page size or if heap base is not protected.
+        if (val->bottom_type()->isa_narrowoop() &&
+            (MacroAssembler::needs_explicit_null_check(offset) ||
+             !Universe::narrow_oop_use_implicit_null_checks()))
+          continue;
         // cannot reason about it; is probably not implicit null exception
       } else {
         const TypePtr* tptr;
@@ -269,12 +271,17 @@
           // only regular oops are expected here
           tptr = base->bottom_type()->is_ptr();
         }
-        // Give up if offset is not a compile-time constant
-        if( offset == Type::OffsetBot || tptr->_offset == Type::OffsetBot )
+        // Give up if offset is not a compile-time constant.
+        if (offset == Type::OffsetBot || tptr->_offset == Type::OffsetBot)
           continue;
         offset += tptr->_offset; // correct if base is offseted
-        if( MacroAssembler::needs_explicit_null_check(offset) )
-          continue;             // Give up is reference is beyond 4K page size
+        // Give up if reference is beyond page size.
+        if (MacroAssembler::needs_explicit_null_check(offset))
+          continue;
+        // Give up if base is a decode node and the heap base is not protected.
+        if (base->is_Mach() && base->as_Mach()->ideal_Opcode() == Op_DecodeN &&
+            !Universe::narrow_oop_use_implicit_null_checks())
+          continue;
       }
     }
 

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hotspot/test/compiler/c2/TestNPEHeapBased.java	Mon Mar 20 23:49:33 2017 +0100
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017 SAP SE. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 8176518
+ * @summary Invalid ImplicitNullChecks when heap base not protected
+ *
+ * @run main/othervm -XX:ObjectAlignmentInBytes=16 -XX:HeapBaseMinAddress=64g
+ *      -XX:-TieredCompilation -Xbatch
+ *      compiler.c2.TestNPEHeapBased
+ * @requires vm.bits == "64"
+ */
+
+package compiler.c2;
+public class TestNPEHeapBased {
+
+    TestNPEHeapBased instance = null;
+    int i = 0;
+
+    public void set_i(int value) {
+        instance.i = value;
+    }
+
+
+    static final int loop_cnt = 200000;
+
+    public static void main(String args[]){
+        TestNPEHeapBased xyz = new TestNPEHeapBased();
+        xyz.instance = xyz;
+        for (int x = 0; x < loop_cnt; x++) xyz.set_i(x);
+        xyz.instance = null;
+        try {
+            xyz.set_i(0);
+        } catch (NullPointerException npe) {
+            System.out.println("Got expected NullPointerException:");
+            npe.printStackTrace();
+            return;
+        }
+        throw new InternalError("NullPointerException is missing!");
+    }
+
+}