JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges

Test case which triggers C2 OSR compilation:

public class Test {

    private int mI = 0;
    private long mJ = 0;
    private float mF = 0f;

    public void testMethod() {
        for (int i0 = 0; i0 < 100; i0++) {
            if (mF != 0) {
                // do nothing
            } else {
                try {
                    mJ = Long.MAX_VALUE;
                    for (int i1 = 0; i1 < 101; i1++) {
                        for (int i2 = 0; i2 < 102; i2++) {
                            mI = new Integer(0x1234);
                        }
                    }
                } catch (Exception ignored) {}
            }
        }
    }

    public static void main(String[] args) {
        Test t = new Test();
        t.testMethod();
    }
}

Command line:
    java -XX:-TieredCompilation -XX:CompileCommand=compileonly,Test::testMethod -XX:+PrintCompilation Test


Error messages:

CompileCommand: compileonly Test.testMethod
### Excluding compile: java.lang.Object::<init>
made not compilable on level 4 java.lang.Object::<init> (1 bytes) excluded by CompileCommand
### Excluding compile: java.lang.Number::<init>
made not compilable on level 4 java.lang.Number::<init> (5 bytes) excluded by CompileCommand
### Excluding compile: java.lang.Integer::<init>
made not compilable on level 4 java.lang.Integer::<init> (10 bytes) excluded by CompileCommand
### Excluding compile: java.lang.Integer::intValue
made not compilable on level 4 java.lang.Integer::intValue (5 bytes) excluded by CompileCommand
    296 1 % ! Test::testMethod @ 37 (83 bytes)
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc: SuppressErrorAt=/multnode.cpp:49
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/home/yangfei/openjdk-jdk/src/hotspot/share/opto/multnode.cpp:49), pid=37756, tid=37768
# assert((Opcode() != Op_If && Opcode() != Op_RangeCheck) || outcnt() == 2) failed: bad if #1
#
# JRE version: OpenJDK Runtime Environment (15.0) (slowdebug build 15-internal+0-adhoc.yangfei.openjdk-jdk)
# Java VM: OpenJDK 64-Bit Server VM (slowdebug 15-internal+0-adhoc.yangfei.openjdk-jdk, mixed mode, sharing, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xe4de5a] MultiNode::proj_out_or_null(unsigned int) const+0xf4
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P" (or dumping to /home/yangfei/1806/core.37756)
#
# An error report file with more information is saved as:
# /home/yangfei/1806/hs_err_pid37756.log
#
# Compiler replay data is saved as:
# /home/yangfei/1806/replay_pid37756.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 37768
Dumping core ...
Aborted (core dumped)


After some analysis, we propose the following fix which is currently under testing:

diff -r 67cc6f3948e3 src/hotspot/share/opto/loopnode.cpp
--- a/src/hotspot/share/opto/loopnode.cpp Wed Mar 04 15:34:53 2020 -0800
+++ b/src/hotspot/share/opto/loopnode.cpp Thu Mar 05 09:32:57 2020 +0800
@@ -2091,7 +2091,7 @@
   // If I am a shared header (multiple backedges), peel off the many
   // backedges into a private merge point and use the merge point as
   // the one true backedge.
- if( _head->req() > 3 ) {
+ if (_head->req() > 3 && !_irreducible) {
     // Merge the many backedges into a single backedge but leave
     // the hottest backedge as separate edge for the following peel.
     merge_many_backedges( phase );