The problem is that somehow we start processing a dead control node (!n->in(0)). All control nodes should have in(0) not NULL unless it is dead and was cut from graph. So it is very rare case which we seems never hit before.

The loop in get_ctrl_no_update() which goes through dead CFG nodes (lines 701-703) is wrong:

698 Node *n = (Node*)(((intptr_t)_nodes[i->_idx]) & ~1);
699 if (!n->in(0)) {
700 // Skip dead CFG nodes
701 do {
702 n = (Node*)(((intptr_t)_nodes[n->_idx]) & ~1);
703 } while (!n->in(0));
704 n = find_non_split_ctrl(n);
705 }

_nodes[] points to IdealLoopTree* for control nodes and not to other control nodes so we can't use _nodes[] to scan previous control nodes.

First, we need to find why graph still points to dead control node. And second, we should assert/guarantee (or bailout compilation) when we hit such case.