C2: "Bad graph detected in build_loop_late" after a CMove is wrongly split thru phi

Running attached test case with:
java -XX:-BackgroundCompilation TestWrongCMovSplitIf

results in:

n: 817 AddI === _ 355 355 [[ 1132 ]] !orig=[743],[356],803 !jvms: TestWrongCMovSplitIf::testHelper @ bci:37 (line 74) TestWrongCMovSplitIf::test @ bci:43 (line 50)
early(n): 736 IfFalse === 735 [[ 355 372 383 ]] #0 !orig=[727] !jvms: TestWrongCMovSplitIf::testHelper @ bci:28 (line 73) TestWrongCMovSplitIf::test @ bci:43 (line 50)
n->in(1): 355 LoadI === 736 7 354 [[ 817 1132 817 ]] @int[int:>=0] (java/lang/Cloneable,java/io/Serializable):exact+any *, idx=6; #int !orig=[763],[356],803 !jvms: TestWrongCMovSplitIf::testHelper @ bci:36 (line 74) TestWrongCMovSplitIf::test @ bci:43 (line 50)
early(n->in(1)): 736 IfFalse === 735 [[ 355 372 383 ]] #0 !orig=[727] !jvms: TestWrongCMovSplitIf::testHelper @ bci:28 (line 73) TestWrongCMovSplitIf::test @ bci:43 (line 50)
n->in(1)->in(1): 7 Parm === 3 [[ 730 1137 16 355 273 397 385 465 318 453 372 612 441 409 ]] Memory Memory: @BotPTR *+bot, idx=Bot; !orig=[73] !jvms: TestWrongCMovSplitIf::test @ bci:-1 (line 43)
early(n->in(1)->in(1)): 3 Start === 3 0 [[ 3 5 6 7 8 9 10 ]] #{0:control, 1:abIO, 2:memory, 3:rawptr:BotPTR, 4:return_address, 5:int}
n->in(1)->in(2): 354 AddP === _ 334 334 353 [[ 355 ]] !jvms: TestWrongCMovSplitIf::testHelper @ bci:36 (line 74) TestWrongCMovSplitIf::test @ bci:43 (line 50)
early(n->in(1)->in(2)): 724 IfTrue === 723 [[ 735 334 ]] #1
n->in(2): 355 LoadI === 736 7 354 [[ 817 1132 817 ]] @int[int:>=0] (java/lang/Cloneable,java/io/Serializable):exact+any *, idx=6; #int !orig=[763],[356],803 !jvms: TestWrongCMovSplitIf::testHelper @ bci:36 (line 74) TestWrongCMovSplitIf::test @ bci:43 (line 50)
early(n->in(2)): 736 IfFalse === 735 [[ 355 372 383 ]] #0 !orig=[727] !jvms: TestWrongCMovSplitIf::testHelper @ bci:28 (line 73) TestWrongCMovSplitIf::test @ bci:43 (line 50)
n->in(2)->in(1): 7 Parm === 3 [[ 730 1137 16 355 273 397 385 465 318 453 372 612 441 409 ]] Memory Memory: @BotPTR *+bot, idx=Bot; !orig=[73] !jvms: TestWrongCMovSplitIf::test @ bci:-1 (line 43)
early(n->in(2)->in(1)): 3 Start === 3 0 [[ 3 5 6 7 8 9 10 ]] #{0:control, 1:abIO, 2:memory, 3:rawptr:BotPTR, 4:return_address, 5:int}
n->in(2)->in(2): 354 AddP === _ 334 334 353 [[ 355 ]] !jvms: TestWrongCMovSplitIf::testHelper @ bci:36 (line 74) TestWrongCMovSplitIf::test @ bci:43 (line 50)
early(n->in(2)->in(2)): 724 IfTrue === 723 [[ 735 334 ]] #1

LCA(n): 253 IfTrue === 252 [[ 248 ]] #1 !jvms: TestWrongCMovSplitIf::testHelper @ bci:10 (line 66) TestWrongCMovSplitIf::test @ bci:43 (line 50)
n->out(0): 1132 Phi === 248 355 817 [[ 372 ]] #int !orig=[1103],[752]
later(n->out(0)): 248 Region === 248 254 253 [[ 248 723 258 1132 ]] !jvms: TestWrongCMovSplitIf::testHelper @ bci:20 (line 72) TestWrongCMovSplitIf::test @ bci:43 (line 50)
n->out(0)->out(0): 372 StoreI === 736 7 371 1132 [[ 465 409 385 397 16 612 441 453 ]] @java/lang/Class (java/io/Serializable,java/lang/constant/Constable,java/lang/reflect/AnnotatedElement,java/lang/invoke/TypeDescriptor,java/lang/reflect/GenericDeclaration,java/lang/reflect/Type,java/lang/invoke/TypeDescriptor$OfField):exact+116 *, name=field3, idx=7; Memory: @java/lang/Class (java/io/Serializable,java/lang/constant/Constable,java/lang/reflect/AnnotatedElement,java/lang/invoke/TypeDescriptor,java/lang/reflect/GenericDeclaration,java/lang/reflect/Type,java/lang/invoke/TypeDescriptor$OfField):exact+116 *, name=field3, idx=7; !orig=[420] !jvms: TestWrongCMovSplitIf::test @ bci:46 (line 50)
later(n->out(0)->out(0)): 736 IfFalse === 735 [[ 355 372 383 ]] #0 !orig=[727] !jvms: TestWrongCMovSplitIf::testHelper @ bci:28 (line 73) TestWrongCMovSplitIf::test @ bci:43 (line 50)

idoms of early "736 IfFalse":
idom[4]: 252 If
idom[3]: 248 Region
idom[2]: 723 If
idom[1]: 724 IfTrue
idom[0]: 735 RangeCheck
n: 736 IfFalse

idoms of (wrong) LCA "253 IfTrue":
idom[0]: 252 If
n: 253 IfTrue

Real LCA of early "736 IfFalse" (idom[4]) and wrong LCA "253 IfTrue" (idom[0]):
  252 If === 5 251 [[ 253 254 ]] P=0.900000, C=-1.000000 !jvms: TestWrongCMovSplitIf::testHelper @ bci:10 (line 66) TestWrongCMovSplitIf::test @ bci:43 (line 50)

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/roland/jdk-jdk/src/hotspot/share/opto/loopnode.cpp:5957), pid=3104555, tid=3104568
# assert(false) failed: Bad graph detected in build_loop_late
#
# JRE version: OpenJDK Runtime Environment (21.0) (slowdebug build 21-internal-adhoc.roland.jdk-jdk)
# Java VM: OpenJDK 64-Bit Server VM (slowdebug 21-internal-adhoc.roland.jdk-jdk, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xfb4b8a] PhaseIdealLoop::build_loop_late_post_work(Node*, bool)+0x620
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h" (or dumping to /home/roland/tmp/core.3104555)
#
# An error report file with more information is saved as:
# /home/roland/tmp/hs_err_pid3104555.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Aborted