C2 PhaseIdealLoop::do_unroll get wrong opaque node

Following test crashes in release & debug build

    static void test() {
        int ina8[] = new int[1478];
        int in2 = 136;
        long lo3 = 0L;
        try {
            for (int i = 0; i < 34; i++) {
                Math.log1p(1);
            }
        } catch (Exception e) {
            in2 = 1;
        }

        for (int i = 0; i < in2; i++) {
            if (in2 > 10) { // split if and create wrong opaque order
                for (int j = 0; j < in2; j++) {
                    lo3 -= 1L;
                }
            }
        }
    }



Release build
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00002afb35bd70bc, pid=5015, tid=5039
#
# JRE version: OpenJDK Runtime Environment (17.0) (build 17-internal+0-adhoc.shihui.jdk17)
# Java VM: OpenJDK 64-Bit Server VM (17-internal+0-adhoc.shihui.jdk17, mixed mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xc980bc] Node::set_req_X(unsigned int, Node*, PhaseIterGVN*)+0x4c
Current CompileTask:
C2: 57 7 !b compiler.loopopts.TestCanonicalLoopEntryOpaqueOrder::test (81 bytes)

Stack: [0x00002afb68404000,0x00002afb68505000], sp=0x00002afb684ffca0, free space=1007k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xc980bc] Node::set_req_X(unsigned int, Node*, PhaseIterGVN*)+0x4c
V [libjvm.so+0xacabf3] PhaseIdealLoop::do_unroll(IdealLoopTree*, Node_List&, bool)+0x903
V [libjvm.so+0xacf218] IdealLoopTree::iteration_split_impl(PhaseIdealLoop*, Node_List&)+0x508
V [libjvm.so+0xacf534] IdealLoopTree::iteration_split(PhaseIdealLoop*, Node_List&)+0x174
V [libjvm.so+0xacf4a4] IdealLoopTree::iteration_split(PhaseIdealLoop*, Node_List&)+0xe4
V [libjvm.so+0xacf4a4] IdealLoopTree::iteration_split(PhaseIdealLoop*, Node_List&)+0xe4
V [libjvm.so+0xae3055] PhaseIdealLoop::build_and_optimize(LoopOptsMode)+0x9e5
V [libjvm.so+0x5e07c9] PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x179
V [libjvm.so+0x5df0d2] Compile::Optimize()+0x13b2
V [libjvm.so+0x5dff9e] Compile::Compile(ciEnv*, ciMethod*, int, bool, bool, bool, bool, bool, DirectiveSet*)+0xdde
V [libjvm.so+0x5118da] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0xba
V [libjvm.so+0x5e9ff4] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xee4
V [libjvm.so+0x5ead18] CompileBroker::compiler_thread_loop()+0x4c8
V [libjvm.so+0xf10980] JavaThread::thread_main_inner()+0x180
V [libjvm.so+0xf13ec2] Thread::call_run()+0xe2
V [libjvm.so+0xc4d181] thread_native_entry(Thread*)+0xe1

debug build
#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (/data/shihui/codes/jdk17/src/hotspot/share/opto/loopTransform.cpp:1994), pid=16191, tid=16207
# Error: assert(opaq->outcnt() == 1 && opaq->in(1) == limit) failed
#
# JRE version: OpenJDK Runtime Environment (17.0) (fastdebug build 17-internal+0-adhoc.shihui.jdk17)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 17-internal+0-adhoc.shihui.jdk17, mixed mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0x114d301] PhaseIdealLoop::do_unroll(IdealLoopTree*, Node_List&, bool)+0xb41
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp