The attached test results in the following assertion failure because CmpU3Nodes are not pushed back to the worklist in PhaseCCP to re-calculate its type. The fix should be straight forward to not only add CmpUNodes but als CmpU3Nodes.

To reproduce:
$ java -XX:CompileCommand=compileonly,Test::test* -Xbatch Test.java

Output:
Missed Value optimization:
dist dump
---------------------------------------------
   1 21 ConI === 0 [[ 48 95 59 97 37 ]] #int:-1
   1 88 AddI === _ 72 26 [[ 97 89 95 72 ]] !jvms: TestPushCmpU3Node::test @ bci:21 (line 44)
   0 95 CmpU3 === _ 88 21 [[ 105 ]] !jvms: TestPushCmpU3Node::test @ bci:5 (line 44)
Current type:
int:-1
Optimized type:
int:-1..0

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/opt/mach5/mesos/work_dir/slaves/a4a7850a-7c35-410a-b879-d77fbb2f6087-S15071/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/cead7373-d355-4dbb-aa68-25913d26eff5/runs/96a451c9-93d1-4fde-8e4e-9c42dec3c065/workspace/open/src/hotspot/share/opto/phaseX.cpp:1834), pid=70403, tid=70417
# assert(!failure) failed: PhaseCCP not at fixpoint: analysis result may be unsound.
#
# JRE version: Java(TM) SE Runtime Environment (23.0+25) (fastdebug build 23-ea+25-2096)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 23-ea+25-2096, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x152a19d] PhaseCCP::analyze()+0x63d
..........
Command Line: -XX:CompileCommand=compileonly,Test::test* -Xbatch --add-modules=ALL-DEFAULT jdk.compiler/com.sun.tools.javac.launcher.SourceLauncher Test.java
..........
Current CompileTask:
C2:991 100 b 4 Test::test (30 bytes)

Stack: [0x00007ee1edd00000,0x00007ee1ede00000], sp=0x00007ee1eddfb140, free space=1004k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x152a19d] PhaseCCP::analyze()+0x63d (phaseX.cpp:1834)
V [libjvm.so+0x9eb87d] Compile::Optimize()+0x77d
V [libjvm.so+0x9ef526] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x1af6
V [libjvm.so+0x844805] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x1d5
V [libjvm.so+0x9fb348] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x928
V [libjvm.so+0x9fbfd8] CompileBroker::compiler_thread_loop()+0x478
V [libjvm.so+0xea43fc] JavaThread::thread_main_inner()+0xcc
V [libjvm.so+0x17bf496] Thread::call_run()+0xb6
V [libjvm.so+0x14a65a7] thread_native_entry(Thread*)+0x127