Crash/miscompile in CallGenerator::for_method_handle_inline after JDK-8191998

See the thread here: https://www.reddit.com/r/java/comments/o0w953/investigation_jdk15_jit_seems_to_have_bugs

There is a reproducer that fails on current JDK with:

$ build/linux-x86_64-server-slowdebug/images/jdk/bin/java -XX:OnError="gdb - %p" Replication
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/phaseX.cpp:729
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/shade/trunks/jdk/src/hotspot/share/opto/phaseX.cpp:729), pid=3785715, tid=3785728
# assert(!t->empty() || t == Type::TOP) failed: must not be vacuous range

The gdb stack points to the code added by JDK-8191998. Reverting that patch makes the test pass.

I think join_speculative returned an empty type here. This dirty patch also makes the test pass:

diff --git a/src/hotspot/share/opto/callGenerator.cpp b/src/hotspot/share/opto/callGenerator.cpp
index ab7f7897797..6f1c8df778a 100644
--- a/src/hotspot/share/opto/callGenerator.cpp
+++ b/src/hotspot/share/opto/callGenerator.cpp
@@ -1152,7 +1152,8 @@ CallGenerator* CallGenerator::for_method_handle_inline(JVMState* jvms, ciMethod*
           const Type* sig_type = TypeOopPtr::make_from_klass(signature->accessing_klass());
           if (arg_type != NULL && !arg_type->higher_equal(sig_type)) {
             const Type* recv_type = arg_type->join_speculative(sig_type); // keep speculative part
- Node* cast_obj = gvn.transform(new CheckCastPPNode(kit.control(), arg, recv_type));
+ const Type* cast_type = recv_type->empty() ? sig_type : recv_type;
+ Node* cast_obj = gvn.transform(new CheckCastPPNode(kit.control(), arg, cast_type));
             kit.set_argument(0, cast_obj);
           }
         }
@@ -1165,7 +1166,8 @@ CallGenerator* CallGenerator::for_method_handle_inline(JVMState* jvms, ciMethod*
             const Type* sig_type = TypeOopPtr::make_from_klass(t->as_klass());
             if (arg_type != NULL && !arg_type->higher_equal(sig_type)) {
               const Type* narrowed_arg_type = arg_type->join_speculative(sig_type); // keep speculative part
- Node* cast_obj = gvn.transform(new CheckCastPPNode(kit.control(), arg, narrowed_arg_type));
+ const Type* cast_type = narrowed_arg_type->empty() ? sig_type : narrowed_arg_type;
+ Node* cast_obj = gvn.transform(new CheckCastPPNode(kit.control(), arg, cast_type));
               kit.set_argument(receiver_skip + j, cast_obj);
             }
           }

Vladimir, please follow up?