C2: assert failed ("Bad derived pointer") with -XX:+VerifyRegisterAllocator

When using -XX:+VerifyRegisterAllocator, C2 crashes with:

assert(!is_derived || check->bottom_type()->is_ptr()->ptr() == TypePtr::Null) failed: Bad derived pointer

for the following tests, executed with the additional VM options "-Xcomp -XX:-TieredCompilation" and one of "-XX:-DoEscapeAnalysis" or "-XX:+DeoptimizeALot":

gc/stress/jfr/TestStressAllocationGCEventsWithDefNew.java
gc/stress/jfr/TestStressAllocationGCEventsWithG1.java
gc/stress/jfr/TestStressAllocationGCEventsWithParallel.java
gc/stress/jfr/TestStressBigAllocationGCEventsWithDefNew.java
gc/stress/jfr/TestStressBigAllocationGCEventsWithParallel.java
runtime/cds/appcds/CDSandJFR.java
runtime/cds/appcds/customLoader/HelloCustom_JFR.java
runtime/cds/appcds/jigsaw/modulepath/ModulePathAndCP_JFR.java
runtime/cds/appcds/sharedStrings/FlagCombo.java#id0

For example, to reproduce the problem on runtime/cds/appcds/customLoader/HelloCustom_JFR.java, run:

make run-test TEST="runtime/cds/appcds/customLoader/HelloCustom_JFR.java" TEST_VM_OPTS="-XX:+VerifyRegisterAllocator -Xcomp -XX:-TieredCompilation -XX:-DoEscapeAnalysis"

The problem is observed on linux-x64, macosx-x64, and windows-x64 (fastdebug configuration).