We witnessed more C2 conditional moves after JDK-8316991 which reduces merges used by CmpP/N and CastPP.
But we are still lacking match rules for conditional moves like:
  match(Set dst (CMoveI (Binary cop (CmpN op1 op2)) (Binary dst src)))
  match(Set dst (CMoveI (Binary cop (CmpP op1 op2)) (Binary dst src)));

How to reproduce the crash:

Run following jtreg tests with fastdebug build on linux-riscv64 platform (not reproducible with release build):

1.
  make test TEST="compiler/eliminateAutobox/TestDoubleBoxing.java"
  make test TEST="compiler/eliminateAutobox/TestFloatBoxing.java"

o281  Binary  === _ o278 o251  [[ o279 ]]

--N: o281  Binary  === _ o278 o251  [[ o279 ]]

   --N: o278  Bool  === _ o251  [[ o281 ]] [eq]
   CMPOP  1  CMPOP
   CMPOPU  1  CMPOPU
   CMPOPEQNE  0  CMPOPEQNE
   CMPOPUEQNELEGT  0  CMPOPUEQNELEGT

   --N: o251  CmpP  === _ o29 o107  [[ o252 o278 o253 o281 ]]
   _CmpP_iRegP_iRegP  100  _CmpP_iRegP_iRegP
   _CmpP_iRegP_immP0  0  _CmpP_iRegP_immP0

      --N: o29  Proj  === o24  [[ o276 o251 o262 o262 ]] #5  Oop:java/lang/Double (java/io/Serializable,java/lang/Comparable,java/lang/constant/Constable,java/lang/constant/ConstantDesc):exact *
      IREGP  0  IREGP
      IREGPNOSP  0  IREGPNOSP
      IREGP_R10  0  IREGP_R10
      IREGP_R11  0  IREGP_R11
      IREGP_R12  0  IREGP_R12
      IREGP_R13  0  IREGP_R13
      IREGP_R14  0  IREGP_R14
      IREGP_R15  0  IREGP_R15
      IREGP_R28  0  IREGP_R28
      IREGP_R30  0  IREGP_R30
      IREGP_R31  0  IREGP_R31
      JAVATHREAD_REGP  0  JAVATHREAD_REGP
      INDIRECT  0  INDIRECT
      INLINE_CACHE_REGP  0  INLINE_CACHE_REGP
      MEMORY  0  INDIRECT
      IREGNORP  0  IREGP
      IREGILNP  0  IREGP
      IREGILNPNOSP  0  IREGPNOSP
      VMEMA  0  INDIRECT

      --N: o107  ConP  === o0  [[ o276 o116 o251 4 ]]  #null
      IMMP  0  IMMP
      IMMP0  0  IMMP0
      IREGP  100  loadConP0
      IREGPNOSP  100  loadConP0
      IREGP_R10  100  loadConP0
      IREGP_R11  100  loadConP0
      IREGP_R12  100  loadConP0
      IREGP_R13  100  loadConP0
      IREGP_R14  100  loadConP0
      IREGP_R15  100  loadConP0
      IREGP_R28  100  loadConP0
      IREGP_R30  100  loadConP0
      IREGP_R31  100  loadConP0
      JAVATHREAD_REGP  100  loadConP0
      INDIRECT  100  loadConP0
      INLINE_CACHE_REGP  100  loadConP0
      MEMORY  100  INDIRECT
      IREGNORP  100  IREGP
      IREGILNP  100  IREGP
      IREGILNPNOSP  100  IREGPNOSP
      VMEMA  100  INDIRECT

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/home/sipeed/jdk/src/hotspot/share/opto/matcher.cpp:1727), pid=361457, tid=361473
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (23.0) (fastdebug build 23-internal-adhoc.sipeed.jdk)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 23-internal-adhoc.sipeed.jdk, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-riscv64)
# Problematic frame:
# V  [libjvm.so+0xf13dd8]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x606
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/sipeed/jdk/build/linux-riscv64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_tier1/scratch/1/hs_err_pid361457.log
#
# Compiler replay data is saved as:
# /home/sipeed/jdk/build/linux-riscv64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_tier1/scratch/1/replay_pid361457.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

2.
  make test TEST="compiler/eliminateAutobox/TestLongBoxing.java"
  make test TEST="compiler/eliminateAutobox/TestIntBoxing.java"
  make test TEST="compiler/eliminateAutobox/TestShortBoxing.java"

o497  Binary  === _ o436 o494  [[ o437 ]]

--N: o497  Binary  === _ o436 o494  [[ o437 ]]

   --N: o436  Bool  === _ o494  [[ o497 ]] [eq]
   CMPOP  1  CMPOP
   CMPOPU  1  CMPOPU
   CMPOPEQNE  0  CMPOPEQNE
   CMPOPUEQNELEGT  0  CMPOPUEQNELEGT

   --N: o494  CmpN  === _ o242 o493  [[ o436 o409 o410 o497 ]]
   _CmpN_iRegN_iRegN  100  _CmpN_iRegN_iRegN
   _CmpN_iRegN_immN0  0  _CmpN_iRegN_immN0

      --N: o242  LoadN  === o227 o27 o240  [[ o496 o494 ]]  @narrowoop: java/lang/Object *[int:>=0] (java/lang/Cloneable,java/io/Serializable)+any * [narrow], idx=4; #narrowoop: java/lang/Long (java/io/Serializable,java/lang/Comparable,java/lang/constant/Constable,java/lang/constant/ConstantDesc):exact *
      IREGN  0  IREGN
      IREGNNOSP  0  IREGNNOSP
      IREGNORP  0  IREGN
      IREGILNP  0  IREGN
      IREGILNPNOSP  0  IREGNNOSP

      --N: o493  ConN  === o0  [[ o494 ]]  #narrowoop: null
      IMMN  0  IMMN
      IMMN0  0  IMMN0
      IREGN  100  loadConN0
      IREGNNOSP  100  loadConN0
      IREGNORP  100  IREGN
      IREGILNP  100  IREGN
      IREGILNPNOSP  100  IREGNNOSP

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/home/sipeed/jdk/src/hotspot/share/opto/matcher.cpp:1727), pid=361713, tid=361739
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (23.0) (fastdebug build 23-internal-adhoc.sipeed.jdk)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 23-internal-adhoc.sipeed.jdk, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-riscv64)
# Problematic frame:
# V  [libjvm.so+0xf13dd8]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x606
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/sipeed/jdk/build/linux-riscv64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_tier1/scratch/0/hs_err_pid361713.log
#
# Compiler replay data is saved as:
# /home/sipeed/jdk/build/linux-riscv64-server-fastdebug/test-support/jtreg_test_hotspot_jtreg_tier1/scratch/0/replay_pid361713.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#