Code in PhiNode::unique_input() causes CastPPs to be eliminated and can result in dependency of a load on a null check to be lost. Here is an example test case:

public class TestEliminatedCastPP {

    static TestEliminatedCastPP saved;
    static TestEliminatedCastPP saved_not_null;

    int f;

    static int test(TestEliminatedCastPP obj, int[] array, boolean flag) {
        int ret = array[0] + array[20];
        saved = obj;
        if (obj == null) {
            return ret;
        }
        saved_not_null = obj;

        int i = 0;
        for (; i < 10; i++);

        ret += array[i];

        TestEliminatedCastPP res;
        if (flag) {
            res = saved;
        } else {
            res = saved_not_null;
        }
        return ret + res.f;
    }

    static public void main(String[] args) {
        int[] array = new int[100];
        TestEliminatedCastPP obj = new TestEliminatedCastPP();
        for (int i = 0; i < 20000; i++) {
            test(obj, array, (i%2) == 0);
        }
        test(null, array, true);
    }
}

Crashes on sparc with:
-XX:+StressGCM

ILW=H(crash)L(never seen in the wild, requires stress option)H(none)=P2