VM crashed at the next line when I tried to port 7070134 into HS20:
BoolTest::mask bt = cl->loopexit()->test_trip();
It crushed because cl->loopexit() == NULL. I did not see such crush with latest HS22 sources but it does not mean it can't happen. The check cl->is_valid_counted_loop() should be used in the code to avoid such crush.