Crash in C2 compiler at Node::rematerialize

The crash is reproducible in JDK6 and JDK7. In JDK8 and JDK9 the crash is not reproducible if TieredCompilation flag is set (src/cpu/x86/vm/c2_globals_x86.hpp).

Crash reproducer attached.
java -d64 -XX:-TieredCompilation -cp lib/runtime/*:build/classes/ org.openbravo.JasperC2CompilerCrash

Comment from Vladimir Kozlov:
==================================================================================
Looks like we will not convert a loop into Counted (canonical) loop if predicate is not present so 5091921 problem will not be created:

    // Loop limit check predicate should be near the loop.
    ProjNode *limit_check_proj = find_predicate_insertion_point(init_control, Deoptimization::Reason_loop_limit_check);
    if (!limit_check_proj) {
      // The limit check predicate is not generated if this method trapped here before.
#ifdef ASSERT
      if (TraceLoopLimitCheck) {
        tty->print("missing loop limit check:");
        loop->dump_head();
        x->dump(1);
      }
#endif
      return false;
    }

The same is for a loop predication.
==================================================================================