JDK-8251442 added SubTypeCheckNode optimizations that make sure that the control path consistently dies with the data path. However, these are not implemented in CmpPNode::sub because TypeKlassPtr does not keep track of not null_free/flat properties for array klasses.

As a result, the data path dies while the control path (subtype check) is not folded:

   5661 354 b 4 compiler.valhalla.inlinetypes.TestArrays::test96 (19 bytes)
   5662 354 b 4 compiler.valhalla.inlinetypes.TestArrays::test96 (19 bytes) COMPILE SKIPPED: malformed control flow (retry at different tier)

 stderr: [Exception in thread "main" java.lang.RuntimeException: Unexpected compilation level for public boolean compiler.valhalla.inlinetypes.TestArrays.test96(java.lang.Object[]): expected 3 to equal 4
at jdk.test.lib.Asserts.fail(Asserts.java:594)
at jdk.test.lib.Asserts.assertEquals(Asserts.java:205)
at jdk.test.lib.Asserts.assertEQ(Asserts.java:178)
at compiler.valhalla.inlinetypes.InlineTypeTest.run(InlineTypeTest.java:732)
at compiler.valhalla.inlinetypes.InlineTypeTest.run(InlineTypeTest.java:418)
at compiler.valhalla.inlinetypes.TestArrays.main(TestArrays.java:74)