We see assert(i < _max) failed: oob: i=1, _max=1 in C2s local code motion.

lcm.cpp:502 accesses e->in(1)->in(1) where e is an Op_CountedLoopEnd.
e->in(1) should return a loop iteration node. In the failing case the loop iteration node has been optimized out and replaced by a Proj, which has no in(1).

In detail, in the ideal world, I could observe the following optimization steps:

1.) If( Proj_lt (Cmp(AddI(Proj_res(Call(...)), -1) LoadI(...) ) )
2.) CountedLoopEnd( Proj_lt (Cmp(AddI(Proj_res(Call(...)), -1) LoadI(...) ) )
3.) CountedLoopEnd( Proj_le (Cmp(Proj_res(Call(...)), LoadI(...) ) )
4.) CountedLoopEnd( Proj_le(Cmp(x,y))) was matched into one mach node:
     Branch_loopEnd(Proj_res(Call(...)), LoadI(...) )

On pattern 4.) e->in(1)->in(1) fails.

Fix: check whether e->in(1)->req() > 1.