SIGSEGV in PhaseIdealLoop::build_loop_late_post_work

While testing Apache Lucene with JDK 18 and JDK 19, we have seen the following crash now quite often (once every few days):

The first crash like this was with 18-ea-b26.
It happens very often with jdk-18 GA release.
But also seen with jdk-19-ea+14.

#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f9bdccff07b, pid=2967600, tid=2967613
#
# JRE version: OpenJDK Runtime Environment (18.0+36) (build 18+36-2087)
# Java VM: OpenJDK 64-Bit Server VM (18+36-2087, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, parallel gc, linux-amd64)
# Problematic frame:
# V [libjvm.so+0xab507b] PhaseIdealLoop::build_loop_late_post_work(Node*, bool)+0xdb
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#

--------------- S U M M A R Y ------------

Command Line: -Dcommon.dir=/home/jenkins/workspace/Lucene-main-Linux/lucene -Dgradle.lib.dir=/home/jenkins/.gradle/wrapper/dists/gradle-7.2-all/260hg96vuh6ex27h9vo47iv4d/gradle-7.2/lib -Dgradle.user.home=/home/jenkins/.gradle -Dgradle.worker.jar=/home/jenkins/.gradle/caches/7.2/workerMain/gradle-worker.jar -Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djava.security.manager=org.apache.lucene.tests.util.TestSecurityManager -Djava.security.policy=/home/jenkins/workspace/Lucene-main-Linux/gradle/testing/randomization/policies/tests.policy -Djava.util.logging.config.file=/home/jenkins/workspace/Lucene-main-Linux/gradle/testing/defaults-tests/logging.properties -Djdk.map.althashing.threshold=0 -Djetty.insecurerandom=1 -Djetty.testMode=1 -Djunit4.childvm.count=1 -Djunit4.childvm.id=0 -Dorg.gradle.internal.worker.tmpdir=/home/jenkins/workspace/Lucene-main-Linux/lucene/facet/build/tmp/test/work -Dorg.gradle.native=false -DtempDir=/home/jenkins/workspace/Lucene-main-Linux/lucene/facet/build/tmp/tests-tmp -Dtests.LUCENE_VERSION=10.0.0 -Dtests.asserts=true -Dtests.badapples=false -Dtests.codec=random -Dtests.directory=random -Dtests.docvaluesformat=random -Dtests.dups=0 -Dtests.failfast=false -Dtests.file.encoding=US-ASCII -Dtests.haltonfailure=false -Dtests.heapsize=512m -Dtests.infostream=false -Dtests.jvmargs=-XX:+UseCompressedOops -XX:+UseParallelGC -Dtests.jvms=6 -Dtests.leaveTemporary=false -Dtests.linedocsfile=europarl.lines.txt.gz -Dtests.locale=random -Dtests.minheapsize=256m -Dtests.monster=false -Dtests.multiplier=3 -Dtests.neverUpToDate=true -Dtests.nightly=false -Dtests.postingsformat=random -Dtests.profile=false -Dtests.seed=5AFE8586BB2DA1B9 -Dtests.slow=true -Dtests.slowestSuites=true -Dtests.slowestTests=true -Dtests.timezone=random -Dtests.useSecurityManager=true -Dtests.verbose=false -Dtests.weekly=false -Dtests.workDir=/home/jenkins/workspace/Lucene-main-Linux/lucene/facet/build/tmp/tests-tmp -XX:+UseCompressedOops -XX:+UseParallelGC --add-modules=jdk.unsupported,jdk.management -esa --module-path=/home/jenkins/workspace/Lucene-main-Linux/lucene/test-framework/build/libs/lucene-test-framework-10.0.0-SNAPSHOT.jar:/home/jenkins/workspace/Lucene-main-Linux/lucene/queries/build/libs/lucene-queries-10.0.0-SNAPSHOT.jar:/home/jenkins/workspace/Lucene-main-Linux/lucene/backward-codecs/build/libs/lucene-backward-codecs-10.0.0-SNAPSHOT.jar:/home/jenkins/workspace/Lucene-main-Linux/lucene/codecs/build/libs/lucene-codecs-10.0.0-SNAPSHOT.jar:/home/jenkins/workspace/Lucene-main-Linux/lucene/core/build/libs/lucene-core-10.0.0-SNAPSHOT.jar:/home/jenkins/.gradle/caches/modules-2/files-2.1/com.carrotsearch/hppc/0.9.0/fcc952fb6d378266b943bef9f15e67a4d45cfa88/hppc-0.9.0.jar:/home/jenkins/.gradle/caches/modules-2/files-2.1/com.carrotsearch.randomizedtesting/randomizedtesting-runner/2.7.6/17894fe98cce53f9bd994044d9bea7bd7801cafa/randomizedtesting-runner-2.7.6.jar:/home/jenkins/.gradle/caches/modules-2/files-2.1/junit/junit/4.13.1/cdd00374f1fee76b11e2a9d127405aa3f6be5b6a/junit-4.13.1.jar:/home/jenkins/.gradle/caches/modules-2/files-2.1/org.hamcrest/hamcrest/2.2/1820c0968dba3a11a1b30669bb1f01978a91dedc/hamcrest-2.2.jar --add-modules=ALL-MODULE-PATH --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED -Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/home/jenkins/workspace/Lucene-main-Linux/lucene/facet/build/tmp/tests-tmp -Duser.country=US -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 57'

Host: AMD Ryzen 7 3700X 8-Core Processor, 16 cores, 62G, Ubuntu 20.04.4 LTS
Time: Thu Apr 28 11:26:11 2022 UTC elapsed time: 4.342910 seconds (0d 0h 0m 4s)

--------------- T H R E A D ---------------

Current thread (0x00007f9bd4088c30): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=2967613, stack(0x00007f9bbc7d9000,0x00007f9bbc8da000)]


Current CompileTask:
C2: 4342 4892 4 org.apache.lucene.facet.range.RangeFacetCounts::count (519 bytes)

Stack: [0x00007f9bbc7d9000,0x00007f9bbc8da000], sp=0x00007f9bbc8d5540, free space=1009k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0xab507b] PhaseIdealLoop::build_loop_late_post_work(Node*, bool)+0xdb
V [libjvm.so+0xab5670] PhaseIdealLoop::build_loop_late(VectorSet&, Node_List&, Node_Stack&)+0x180
V [libjvm.so+0xab5f9e] PhaseIdealLoop::build_and_optimize(LoopOptsMode)+0x75e
V [libjvm.so+0x5b009a] Compile::Optimize()+0x5aa
V [libjvm.so+0x5b2228] Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0xe78
V [libjvm.so+0x4f4b51] C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x101
V [libjvm.so+0x5baba8] CompileBroker::invoke_compiler_on_method(CompileTask*)+0xca8
V [libjvm.so+0x5bb6f8] CompileBroker::compiler_thread_loop()+0x4a8
V [libjvm.so+0xd91a62] JavaThread::thread_main_inner()+0xc2
V [libjvm.so+0xd95c10] Thread::call_run()+0xc0
V [libjvm.so+0xbfa4f1] thread_native_entry(Thread*)+0xe1

Threads with active compile tasks:
C2 CompilerThread0 4345 4892 4 org.apache.lucene.facet.range.RangeFacetCounts::count (519 bytes)
C2 CompilerThread3 4345 4901 % 4 org.apache.lucene.facet.range.LongRangeFacetCounts::count @ 144 (240 bytes)
C2 CompilerThread6 4345 4766 % 4 org.apache.lucene.facet.range.TestRangeFacetCounts::testRandomLongsMultiValued @ 581 (1129 bytes)

Not sure how to reproduce this - as always. Looks like the above crash was in Lucene's facet module, so one can try this in a loop:

$ gradlew :lucene:facet:test