PhaseChaitin fails with "assert(lrg._area >= 0.0) failed: negative spill area"

The following test failed in the JDK17 CI:

java/lang/invoke/ArrayLengthTest.java

Here's a snippet from the log file:

#section:testng
----------messages:(4/231)----------
command: testng -ea -esa test.java.lang.invoke.ArrayLengthTest
reason: User specified action: run testng/othervm -ea -esa test.java.lang.invoke.ArrayLengthTest
Mode: othervm [/othervm specified]
elapsed time (seconds): 13.754
----------configuration:(0/0)----------
----------System.out:(21/1162)*----------
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=\\ifg.cpp:898
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (t:\\workspace\\open\\src\\hotspot\\share\\opto\\ifg.cpp:898), pid=30988, tid=13460
# assert(lrg._area >= 0.0) failed: negative spill area
#
# JRE version: Java(TM) SE Runtime Environment (17.0+25) (fastdebug build 17-ea+25-LTS-2208)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 17-ea+25-LTS-2208, compiled mode, sharing, tiered, compressed class ptrs, g1 gc, windows-amd64)
# Core dump will be written. Default location: T:\\testoutput\\test-support\\jtreg_open_test_jdk_jdk_lang\\scratch\\4\\hs_err_pid30988.mdmp
#
# An error report file with more information is saved as:
# T:\\testoutput\\test-support\\jtreg_open_test_jdk_jdk_lang\\scratch\\4\\hs_err_pid30988.log
#
# Compiler replay data is saved as:
# T:\\testoutput\\test-support\\jtreg_open_test_jdk_jdk_lang\\scratch\\4\\replay_pid30988.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
----------System.err:(0/0)----------
----------rerun:(53/5474)*----------

Here's the crashing thread's stack:

--------------- T H R E A D ---------------

Current thread (0x0000023460369420): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=13460, stack(0x000000a4d2f00000,0x000000a4d3000000)]


Current CompileTask:
C2: 9648 1884 b 4 java.util.IdentityHashMap::put (137 bytes)

Stack: [0x000000a4d2f00000,0x000000a4d3000000]
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [jvm.dll+0xad5121] os::platform_print_native_stack+0xf1 (os_windows_x86.cpp:235)
V [jvm.dll+0xcfa865] VMError::report+0x1005 (vmError.cpp:739)
V [jvm.dll+0xcfc1ee] VMError::report_and_die+0x7fe (vmError.cpp:1549)
V [jvm.dll+0xcfc924] VMError::report_and_die+0x64 (vmError.cpp:1330)
V [jvm.dll+0x4c2677] report_vm_error+0xb7 (debug.cpp:282)
V [jvm.dll+0x66bb97] PhaseChaitin::build_ifg_physical+0x837 (ifg.cpp:898)
V [jvm.dll+0x3dd103] PhaseChaitin::Register_Allocate+0x3a3 (chaitin.cpp:451)
V [jvm.dll+0x47972f] Compile::Code_Gen+0x25f (compile.cpp:2727)
V [jvm.dll+0x47855d] Compile::Compile+0x14ed (compile.cpp:817)
V [jvm.dll+0x3ae35c] C2Compiler::compile_method+0x10c (c2compiler.cpp:106)
V [jvm.dll+0x49105e] CompileBroker::invoke_compiler_on_method+0x94e (compileBroker.cpp:2312)
V [jvm.dll+0x48e697] CompileBroker::compiler_thread_loop+0x2b7 (compileBroker.cpp:1986)
V [jvm.dll+0xc8a467] JavaThread::thread_main_inner+0x1f7 (thread.cpp:1311)
V [jvm.dll+0xc818a4] Thread::call_run+0x1b4 (thread.cpp:399)
V [jvm.dll+0xad3a1e] thread_native_entry+0xae (os_windows.cpp:549)
C [ucrtbase.dll+0x1fb80]
C [KERNEL32.DLL+0x84d4]
C [ntdll.dll+0x51781]

The test task's JVM args are:

-Xcomp -XX:+CreateCoredumpOnCrash -ea -esa -XX:CompileThreshold=100 -XX:+UnlockExperimentalVMOptions -server -XX:+TieredCompilation -XX:-UseCompressedOops