The crash occurs when processing a phi with all inputs to null and the type of the phi is not null. The phi is in a dying part of the graph and is processed before the control flow is killed. The inputs are set to null by logic in PhiNode::Ideal() because it finds an unique input when looking through cast nodes. The phi before its inputs are changed is:

 26 ConP === 0 [[ 27 35 76 83 128 127 154 3323 3300 3301 3259 3236 3237 3195 3172 3173 3131 3108 3109 2852 513 3067 3044 642 724 906 1054 1159 1166 1241 1240 3045 1261 3032 1314 1326 1325 2990 1391 1398 1440 1573 1580 1604 1636 1678 1677 1700 1762 1771 3024 1804 1930 2059 2938 2141 2915 647 2916 2444 2902 2593 2895 2690 2776 2845 513 ]] #NULL
 647 CastPP === 3398 26 [[ 659 708 648 648 656 659 ]] #java/util/Map:NotNull * Interface:java/util/Map:NotNull * !jvms: HashMap::putMapEntries @ bci:1 HashMap::<init> @ bci:13 NamespaceSupport$Context::copyTables @ bci:52 NamespaceSupport$Context::<init> @ bci:30 NamespaceSupport::pushContext @ bci:85
 656 CheckCastPP === 3402 647 [[ 683 708 683 ]] #java/util/LinkedHashMap:NotNull:exact * Oop:java/util/LinkedHashMap:NotNull:exact * !orig=[682] !jvms: HashMap::putMapEntries @ bci:1 HashMap::<init> @ bci:13 NamespaceSupport$Context::copyTables @ bci:52 NamespaceSupport$Context::<init> @ bci:30 NamespaceSupport::pushContext @ bci:85
 695 Region === 695 3402 667 [[ 695 715 696 697 698 699 700 701 702 703 704 705 706 707 708 709 ]] !jvms: HashMap::putMapEntries @ bci:-1 HashMap::<init> @ bci:13 NamespaceSupport$Context::copyTables @ bci:52 NamespaceSupport$Context::<init> @ bci:30 NamespaceSupport::pushContext @ bci:85
 708 Phi === 695 656 647 [[ 877 870 870 840 880 809 ]] #java/util/Map:NotNull * Interface:java/util/Map:NotNull * !jvms: HashMap::putMapEntries @ bci:-1 HashMap::<init> @ bci:13 NamespaceSupport$Context::copyTables @ bci:52 NamespaceSupport$Context::<init> @ bci:30 NamespaceSupport::pushContext @ bci:85

A unique input is found, the logic creates a CheckCastPP with a null input which is transformed to null.