In recent test, we found below assertion failure. Attached Test.java is a reduced case to reproduce.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/penli01/jdk_src/src/hotspot/share/opto/loopopts.cpp:1721), pid=1778535, tid=1778557
# assert(cast != nullptr) failed: must have added a cast to pin the node
#
# JRE version: OpenJDK Runtime Environment (22.0) (fastdebug build 22-internal-adhoc.penli01.jdksrc)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 22-internal-adhoc.penli01.jdksrc, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x12fc21c] PhaseIdealLoop::try_sink_out_of_loop(Node*)+0x9fc
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /mnt/local/core.1778535)
#
# An error report file with more information is saved as:
# /mnt/local/hs_err_pid1778535.log
#
# Compiler replay data is saved as:
# /mnt/local/replay_pid1778535.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)