--- old/src/share/vm/opto/library_call.cpp	2015-11-13 10:39:35.264132692 +0100
+++ new/src/share/vm/opto/library_call.cpp	2015-11-13 10:39:35.188132695 +0100
@@ -1118,14 +1118,34 @@
   Node* tgt_count   = argument(3);
   Node* from_index  = argument(4);
 
-  // Java code which calls this method has range checks for from_index value.
-  src_count = _gvn.transform(new SubINode(src_count, from_index));
-
   // Multiply byte array index by 2 if String is UTF16 encoded
   Node* src_offset = (ae == StrIntrinsicNode::LL) ? from_index : _gvn.transform(new LShiftINode(from_index, intcon(1)));
+  src_count = _gvn.transform(new SubINode(src_count, from_index));
   Node* src_start = array_element_address(src, src_offset, T_BYTE);
   Node* tgt_start = array_element_address(tgt, intcon(0), T_BYTE);
 
+  RegionNode* bailout = new RegionNode(1);
+  record_for_igvn(bailout);
+
+  // Range checks
+  generate_negative_guard(src_offset, bailout);
+  generate_negative_guard(src_count, bailout);
+  generate_negative_guard(tgt_count, bailout);
+  Node* src_byte_count = _gvn.transform(new LShiftINode(src_count, intcon(1)));
+  Node* tgt_byte_count = _gvn.transform(new LShiftINode(tgt_count, intcon(1)));
+  generate_limit_guard(src_offset, (ae == StrIntrinsicNode::LL) ? src_count : src_byte_count, load_array_length(src), bailout);
+  generate_limit_guard(intcon(0), (ae == StrIntrinsicNode::UU) ? tgt_byte_count : tgt_count, load_array_length(tgt), bailout);
+
+  if (bailout->req() > 1) {
+    PreserveJVMState pjvms(this);
+    set_control(_gvn.transform(bailout));
+    uncommon_trap(Deoptimization::Reason_intrinsic,
+                  Deoptimization::Action_maybe_recompile);
+  }
+  if (stopped()) {
+    return true;
+  }
+
   Node* result = make_string_method_node(Op_StrIndexOf, src_start, src_count, tgt_start, tgt_count, ae);
 
   // The result is index relative to from_index if substring was found, -1 otherwise.
@@ -1168,9 +1188,27 @@
 
   Node* src_offset = _gvn.transform(new LShiftINode(from_index, intcon(1)));
   Node* src_start = array_element_address(src, src_offset, T_BYTE);
-
   Node* src_count = _gvn.transform(new SubINode(max, from_index));
 
+  RegionNode* bailout = new RegionNode(1);
+  record_for_igvn(bailout);
+
+  // Range checks
+  generate_negative_guard(src_offset, bailout);
+  generate_negative_guard(src_count, bailout);
+  Node* byte_length = _gvn.transform(new LShiftINode(src_count, intcon(1)));
+  generate_limit_guard(src_offset, byte_length, load_array_length(src), bailout);
+
+  if (bailout->req() > 1) {
+    PreserveJVMState pjvms(this);
+    set_control(_gvn.transform(bailout));
+    uncommon_trap(Deoptimization::Reason_intrinsic,
+                  Deoptimization::Action_maybe_recompile);
+  }
+  if (stopped()) {
+    return true;
+  }
+
   RegionNode* region = new RegionNode(3);
   Node* phi = new PhiNode(region, TypeInt::INT);
 
@@ -1228,6 +1266,27 @@
          (!compress && src_elem == T_BYTE && (dst_elem == T_BYTE || dst_elem == T_CHAR)),
          "Unsupported array types for inline_string_copy");
 
+  RegionNode* bailout = new RegionNode(1);
+  record_for_igvn(bailout);
+
+  // Range checks
+  generate_negative_guard(src_offset, bailout);
+  generate_negative_guard(dst_offset, bailout);
+  generate_negative_guard(length, bailout);
+  Node* byte_length = _gvn.transform(new LShiftINode(length, intcon(1)));
+  generate_limit_guard(src_offset, (compress && src_elem == T_BYTE) ? byte_length : length, load_array_length(src), bailout);
+  generate_limit_guard(dst_offset, (!compress && dst_elem == T_BYTE) ? byte_length : length, load_array_length(dst), bailout);
+
+  if (bailout->req() > 1) {
+    PreserveJVMState pjvms(this);
+    set_control(_gvn.transform(bailout));
+    uncommon_trap(Deoptimization::Reason_intrinsic,
+                  Deoptimization::Action_maybe_recompile);
+  }
+  if (stopped()) {
+    return true;
+  }
+
   // Convert char[] offsets to byte[] offsets
   if (compress && src_elem == T_BYTE) {
     src_offset = _gvn.transform(new LShiftINode(src_offset, intcon(1)));
@@ -1297,8 +1356,11 @@
     RegionNode* bailout = new RegionNode(1);
     record_for_igvn(bailout);
 
-    // Make sure that resulting byte[] length does not overflow Integer.MAX_VALUE
+    // Range checks
     generate_negative_guard(length, bailout);
+    generate_negative_guard(offset, bailout);
+    generate_limit_guard(offset, length, load_array_length(value), bailout);
+    // Make sure that resulting byte[] length does not overflow Integer.MAX_VALUE
     generate_limit_guard(length, intcon(0), intcon(max_jint/2), bailout);
 
     if (bailout->req() > 1) {
@@ -1307,9 +1369,9 @@
       uncommon_trap(Deoptimization::Reason_intrinsic,
                     Deoptimization::Action_maybe_recompile);
     }
-    if (stopped()) return true;
-
-    // Range checks are done by caller.
+    if (stopped()) {
+      return true;
+    }
 
     Node* size = _gvn.transform(new LShiftINode(length, intcon(1)));
     Node* klass_node = makecon(TypeKlassPtr::make(ciTypeArrayKlass::make(T_BYTE)));
@@ -1384,12 +1446,31 @@
     return true;
   }
 
-  // Range checks are done by caller.
-
   // Get length and convert char[] offset to byte[] offset
   Node* length = _gvn.transform(new SubINode(src_end, src_begin));
   src_begin = _gvn.transform(new LShiftINode(src_begin, intcon(1)));
 
+  RegionNode* bailout = new RegionNode(1);
+  record_for_igvn(bailout);
+
+  // Range checks
+  generate_negative_guard(length, bailout);
+  generate_negative_guard(src_begin, bailout);
+  generate_negative_guard(dst_begin, bailout);
+  Node* byte_length = _gvn.transform(new LShiftINode(length, intcon(1)));
+  generate_limit_guard(src_begin, byte_length, load_array_length(value), bailout);
+  generate_limit_guard(dst_begin, length, load_array_length(dst), bailout);
+
+  if (bailout->req() > 1) {
+    PreserveJVMState pjvms(this);
+    set_control(_gvn.transform(bailout));
+    uncommon_trap(Deoptimization::Reason_intrinsic,
+                  Deoptimization::Action_maybe_recompile);
+  }
+  if (stopped()) {
+    return true;
+  }
+
   if (!stopped()) {
     // Calculate starting addresses.
     Node* src_start = array_element_address(value, src_begin, T_BYTE);
--- /dev/null	2015-11-13 07:56:32.801172976 +0100
+++ new/test/compiler/intrinsics/string/TestStringConstruction.java	2015-11-13 10:39:35.496132681 +0100
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8142303
+ * @summary Tests handling of invalid array indices in C2 intrinsic if explicit range check in Java code is not inlined.
+ * @run main/othervm -XX:CompileCommand=inline,java.lang.String::* -XX:CompileCommand=inline,java.lang.StringUTF16::* -XX:CompileCommand=exclude,java.lang.String::checkBoundsOffCount TestStringConstruction
+ */
+public class TestStringConstruction {
+
+    public static void main(String[] args) {
+        char[] chars = new char[42];
+        for (int i = 0; i < 10_000; ++i) {
+            test(chars);
+        }
+    }
+
+    private static String test(char[] chars) {
+        try {
+            // The constructor calls String::checkBoundsOffCount(-1, 42) to perform
+            // range checks on offset and count. If this method is not inlined, C2
+            // does not know about the explicit range checks and does not cut off the
+            // dead code. As a result, -1 is fed as offset into the StringUTF16.compress
+            // intrinsic which is replaced by TOP and causes a failure in the matcher.
+            return new String(chars, -1 , 42);
+        } catch (Exception e) {
+            return "";
+        }
+    }
+}
+