--- old/src/share/vm/opto/library_call.cpp	2016-11-16 04:47:17.386324895 -0800
+++ new/src/share/vm/opto/library_call.cpp	2016-11-16 04:47:17.271324200 -0800
@@ -2630,23 +2630,24 @@
     val = is_store ? argument(3) : NULL;
   }
 
+  // Can base be NULL? Otherwise, always on-heap access.
+  bool can_access_non_heap = TypePtr::NULL_PTR->higher_equal(_gvn.type(heap_base_oop));
+
   const TypePtr *adr_type = _gvn.type(adr)->isa_ptr();
 
-  // Try to categorize the address.  If it comes up as TypeJavaPtr::BOTTOM,
-  // there was not enough information to nail it down.
+  // Try to categorize the address.
   Compile::AliasType* alias_type = C->alias_type(adr_type);
   assert(alias_type->index() != Compile::AliasIdxBot, "no bare pointers here");
 
-  // Only field, array element or unknown locations are supported.
-  if (alias_type->adr_type() != TypeRawPtr::BOTTOM &&
-      alias_type->adr_type() != TypeOopPtr::BOTTOM &&
-      alias_type->basic_type() == T_ILLEGAL) {
-    return false;
+  if (alias_type->adr_type() == TypeInstPtr::KLASS ||
+      alias_type->adr_type() == TypeAryPtr::RANGE) {
+    return false; // not supported
   }
 
   bool mismatched = false;
   BasicType bt = alias_type->basic_type();
   if (bt != T_ILLEGAL) {
+    assert(alias_type->adr_type()->is_oopptr(), "should be on-heap access");
     if (bt == T_BYTE && adr_type->isa_aryptr()) {
       // Alias type doesn't differentiate between byte[] and boolean[]).
       // Use address type to get the element type.
@@ -2663,6 +2664,8 @@
     mismatched = (bt != type);
   }
 
+  assert(!mismatched || alias_type->adr_type()->is_oopptr(), "off-heap access can't be mismatched");
+
   // First guess at the value type.
   const Type *value_type = Type::get_const_basic_type(type);
 
@@ -2777,7 +2780,7 @@
       (void) store_to_memory(control(), adr, val, type, adr_type, mo, is_volatile, unaligned, mismatched);
     } else {
       // Possibly an oop being stored to Java heap or native memory
-      if (!TypePtr::NULL_PTR->higher_equal(_gvn.type(heap_base_oop))) {
+      if (!can_access_non_heap) {
         // oop to Java heap.
         (void) store_oop_to_unknown(control(), heap_base_oop, adr, adr_type, val, type, mo, mismatched);
       } else {