C2: Compile::remove_speculative_types must iterate top-down

While working reducing a failing testcase of another bug I stumbled across this bug which starts to fail in JDK 17 b11. Before that it fails with a different assertion in b08, b09 and b10:

assert(t == t_no_spec) failed: dead node in hash table or missed node during speculative cleanup

The testcase works fine in JDK 17 b07. The assertion from b08 is the same as in JDK-8260653 and might be related.

To reproduce:
$ java -Xcomp -XX:-TieredCompilation -XX:CompileOnly=Test Test.java

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/opt/mach5/mesos/work_dir/slaves/3c846bae-ce30-4a97-93ee-9fef4497ccb6-S79067/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/be546687-12db-4ded-a96b-86062b189919/runs/56ca4e2d-638a-4f38-8b25-3d968f5f0d09/workspace/open/src/hotspot/share/opto/phaseX.cpp:1743), pid=751428, tid=751445
# assert(t->meet(t0) == t) failed: Not monotonic
#
# JRE version: Java(TM) SE Runtime Environment (17.0+26) (fastdebug build 17-ea+26-LTS-2439)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 17-ea+26-LTS-2439, compiled mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x160e65e] PhaseCCP::analyze()+0x2be
...........
Command Line: -Xcomp -XX:-TieredCompilation -XX:CompileOnly=Test --add-modules=ALL-DEFAULT jdk.compiler/com.sun.tools.javac.launcher.Main Test.java
...........

Current thread (0x00007fec3c237b80): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=751445, stack(0x00007fec2808c000,0x00007fec2818d000)]


Current CompileTask:
C2: 4756 85 b Test::infiniteLoop (12 bytes)

Stack: [0x00007fec2808c000,0x00007fec2818d000], sp=0x00007fec281882f0, free space=1008k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x160e65e] PhaseCCP::analyze()+0x2be
V [libjvm.so+0xa257ff] Compile::Optimize()+0x70f
V [libjvm.so+0xa280c5] Compile::Compile(ciEnv*, ciMethod*, int, bool, bool, bool, bool, DirectiveSet*)+0x1585
V [libjvm.so+0x84959a] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x1ea
V [libjvm.so+0xa38a89] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xfb9
V [libjvm.so+0xa397f8] CompileBroker::compiler_thread_loop()+0x5a8
V [libjvm.so+0x18b2e91] JavaThread::thread_main_inner()+0x271
V [libjvm.so+0x18baa90] Thread::call_run()+0x100
V [libjvm.so+0x15872b4] thread_native_entry(Thread*)+0x104