While running tests based on openjdk I've periodically hit the following assertion failure.

Default case invoked for: 
   opcode  = 153, "LoopLimit"
No matching rule for:
--N: o17720	If	=== o17718 o17728 o17727  [[o17721 o17722  959 ]] P=0.999999, C=-1.000000

   --N: o17728	Bool	=== _ o17727  [[o17720 ]] [lt]
   CMPOP  0  CMPOP
   CMPOPU  0  CMPOPU
   CMPOPUCF  0  CMPOPUCF

   --N: o17727	CmpU	=== _ o17857 o2654  [[o17728 o17720 ]] 

      --N: o17857	AddI	=== _ o17725 o17855  [[o17727 ]] 

         --N: o17725	LoopLimit	=== _ o30242 o763  [[o17857 ]] 

            --N: o30242	Binary	=== _ o2639 o2654  [[o17725 ]] 
            _Binary_rRegI_rRegI  0  _Binary_rRegI_rRegI
            _Binary_rax_RegI_rRegI  0  _Binary_rax_RegI_rRegI

               --N: o2639	LoadI	=== o14833 o2614 o2174  [[o18095 o2655 o2685 o2673 o17723 o30242 o18113  950 ]]  @java/util/IdentityHashMap$ValueIterator:NotNull:exact+16 *, name=index, idx=36; #int
               RREGI  0  RREGI
               RAX_REGI  0  RAX_REGI
               RBX_REGI  0  RBX_REGI
               RCX_REGI  0  RCX_REGI
               RDX_REGI  0  RDX_REGI
               RDI_REGI  0  RDI_REGI
               NO_RCX_REGI  0  NO_RCX_REGI
               NO_RAX_RDX_REGI  0  NO_RAX_RDX_REGI
               STACKSLOTI  100  storeSSI

               --N: o2654	LoadRange	=== o2645 o7 o2653  [[o2655 o17727 o19351 o2749 o15663 o17723 o30242 o18063 o18080  942  958 ]]  @java/lang/Object *[int:>=0]+16 *, idx=15; #int:>=0
               RREGI  0  RREGI
               RAX_REGI  0  RAX_REGI
               RBX_REGI  0  RBX_REGI
               RCX_REGI  0  RCX_REGI
               RDX_REGI  0  RDX_REGI
               RDI_REGI  0  RDI_REGI
               NO_RCX_REGI  0  NO_RCX_REGI
               NO_RAX_RDX_REGI  0  NO_RAX_RDX_REGI
               STACKSLOTI  100  storeSSI

            --N: o763	ConI	=== o0  [[o764 o15648 o2513 o18281 o18330 o13910 o18303 o17712 o17835 o17725 o17848 o17983 o18010 o18031 o18363 o18043 o18065 o18092 o18113 o18351 o18125 o18221 o18248 o18269 ]]  #int:2
            IMMI  10  IMMI
            IMMI2  0  IMMI2
            IMMI8  5  IMMI8
            IMMI16  10  IMMI16
            IMMU31  0  IMMU31
            RREGI  100  loadConI
            RAX_REGI  100  loadConI
            RBX_REGI  100  loadConI
            RCX_REGI  100  loadConI
            RDX_REGI  100  loadConI
            RDI_REGI  100  loadConI
            NO_RCX_REGI  100  loadConI
            NO_RAX_RDX_REGI  100  loadConI
            STACKSLOTI  200  storeSSI

         --N: o17855	ConI	=== o0  [[o17856 o17857 o17861 o17862 ]]  #int:-2
         IMMI  10  IMMI
         IMMI8  5  IMMI8
         IMMI16  10  IMMI16
         RREGI  100  loadConI
         RAX_REGI  100  loadConI
         RBX_REGI  100  loadConI
         RCX_REGI  100  loadConI
         RDX_REGI  100  loadConI
         RDI_REGI  100  loadConI
         NO_RCX_REGI  100  loadConI
         NO_RAX_RDX_REGI  100  loadConI
         STACKSLOTI  200  storeSSI

      --N: o2654	LoadRange	=== o2645 o7 o2653  [[o2655 o17727 o19351 o2749 o15663 o17723 o30242 o18063 o18080  942  958 ]]  @java/lang/Object *[int:>=0]+16 *, idx=15; #int:>=0
      RREGI  0  RREGI
      RAX_REGI  0  RAX_REGI
      RBX_REGI  0  RBX_REGI
      RCX_REGI  0  RCX_REGI
      RDX_REGI  0  RDX_REGI
      RDI_REGI  0  RDI_REGI
      NO_RCX_REGI  0  NO_RCX_REGI
      NO_RAX_RDX_REGI  0  NO_RAX_RDX_REGI
      STACKSLOTI  100  storeSSI

I can't easily provide a test case because of the complexity of our application.  The problem is clear from inspection.  LoopLimitNode has the following guard before the code which eliminates it.

  // Delay following optimizations until all loop optimizations
  // done to keep Ideal graph simple.
  if (!can_reshape || phase->C->major_progress())
    return NULL;

major_progress is cleared when starting PhaseIdealLoop and set if progress is made.  The final round of loop opts has a limit on the number of times it runs and if this limit is hit then major_progress is never cleared.  This inhibits the later removal the LoopLimitNode.