How to reproduce:
1) jdk fastdebug build
2) make test TEST=test/hotspot/jtreg/gc/shenandoah/options/TestPassiveModeWithCardBarrier.java JTREG="VM_OPTIONS=-Xcomp"
3) In my local test, it failed on Linux/AArch64 and Linux/x86_64.

Note-1: this test case was introduced in JDK-8369013
Note-2: I tried the following commits and the three commits failed all.
    a) f3dfdfa3fdc9, i.e. the commit of JDK-8369013
    b) d8a1c1d04ca, i.e. the latest commit in jdk26 branch
    c) 938bbd5b6, i.e. the latest commit in mainline

Here shows the snippet of error log.
Attached please find the full log with commit 938bbd5b6.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/haosun/local-work/local-jdk-src/src/hotspot/share/opto/node.hpp:425), pid=2853647, tid=2853740
# assert(_outcnt==1) failed: not unique
#
# JRE version: OpenJDK Runtime Environment (27.0) (fastdebug build 27-internal-adhoc.haosun.local-jdk-src)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 27-internal-adhoc.haosun.local-jdk-src, compiled mode, sharing, tiered, compressed oops, compressed class ptrs, shenandoah gc, linux-aarch64)
# Problematic frame:
# V [libjvm.so+0x17b29c0] ShenandoahBarrierSetC2::eliminate_gc_barrier(PhaseMacroExpand*, Node*) const+0x320
#
# Core dump will be written. Default location: Determined by the following: "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (alternatively, falling back to /mnt/local-storage/haosun/work/local-build-fastdebug/test-support/jtreg_test_hotspot_jtreg_gc_shenandoah_options_TestPassiveModeWithCardBarrier_java/scratch/0/core.2853647)
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#