The internal testing for JDK 14 revealed a case where a precedence edge from a not yet matched CFG node (i.e. a node in the middle of a block) was processed by PhaseCFG::schedule_pinned_nodes. As a result, the is_dominator() check returned a wrong answer which later resulted in a segfault due to a wrong block ordering produced by GCM together with StressGCM. In this case, a load was moved before the associated NULL check. This, however, was only observed by using ZGC but it appears to be unrelated to ZGC itself. With ZGC, an ArrayAllocation expands before a LoadP which is used for a LoadRange node later in such a way that PhaseCFG::schedule_pinned_nodes faces a precedence edge for that LoadRange node from a CFG node that is not yet machted (i.e. in the middle of a block).
The internal test used -XX:+UseZGC and -XX:+StressGCM.