diff a/src/hotspot/share/opto/parse2.cpp b/src/hotspot/share/opto/parse2.cpp
--- a/src/hotspot/share/opto/parse2.cpp
+++ b/src/hotspot/share/opto/parse2.cpp
@@ -22,10 +22,11 @@
  *
  */
 
 #include "precompiled.hpp"
 #include "ci/ciMethodData.hpp"
+#include "ci/ciSymbols.hpp"
 #include "classfile/vmSymbols.hpp"
 #include "compiler/compileLog.hpp"
 #include "interpreter/linkResolver.hpp"
 #include "jvm_io.h"
 #include "memory/resourceArea.hpp"
@@ -34,10 +35,12 @@
 #include "opto/addnode.hpp"
 #include "opto/castnode.hpp"
 #include "opto/convertnode.hpp"
 #include "opto/divnode.hpp"
 #include "opto/idealGraphPrinter.hpp"
+#include "opto/idealKit.hpp"
+#include "opto/inlinetypenode.hpp"
 #include "opto/matcher.hpp"
 #include "opto/memnode.hpp"
 #include "opto/mulnode.hpp"
 #include "opto/opaquenode.hpp"
 #include "opto/parse.hpp"
@@ -48,62 +51,284 @@
 #ifndef PRODUCT
 extern uint explicit_null_checks_inserted,
             explicit_null_checks_elided;
 #endif
 
+Node* Parse::record_profile_for_speculation_at_array_load(Node* ld) {
+  // Feed unused profile data to type speculation
+  if (UseTypeSpeculation && UseArrayLoadStoreProfile) {
+    ciKlass* array_type = nullptr;
+    ciKlass* element_type = nullptr;
+    ProfilePtrKind element_ptr = ProfileMaybeNull;
+    bool flat_array = true;
+    bool null_free_array = true;
+    method()->array_access_profiled_type(bci(), array_type, element_type, element_ptr, flat_array, null_free_array);
+    if (element_type != nullptr || element_ptr != ProfileMaybeNull) {
+      ld = record_profile_for_speculation(ld, element_type, element_ptr);
+    }
+  }
+  return ld;
+}
+
+
 //---------------------------------array_load----------------------------------
 void Parse::array_load(BasicType bt) {
   const Type* elemtype = Type::TOP;
-  bool big_val = bt == T_DOUBLE || bt == T_LONG;
   Node* adr = array_addressing(bt, 0, elemtype);
   if (stopped())  return;     // guaranteed null or range check
 
-  pop();                      // index (already used)
-  Node* array = pop();        // the array itself
+  Node* idx = pop();
+  Node* ary = pop();
+
+  // Handle inline type arrays
+  const TypeOopPtr* elemptr = elemtype->make_oopptr();
+  const TypeAryPtr* ary_t = _gvn.type(ary)->is_aryptr();
+  if (ary_t->is_flat()) {
+    // Load from flat inline type array
+    Node* vt = InlineTypeNode::make_from_flat(this, elemtype->inline_klass(), ary, adr);
+    push(vt);
+    return;
+  } else if (ary_t->is_null_free()) {
+    // Load from non-flat inline type array (elements can never be null)
+    bt = T_OBJECT;
+  } else if (!ary_t->is_not_flat()) {
+    // Cannot statically determine if array is a flat array, emit runtime check
+    assert(UseFlatArray && is_reference_type(bt) && elemptr->can_be_inline_type() && !ary_t->is_not_null_free() &&
+           (!elemptr->is_inlinetypeptr() || elemptr->inline_klass()->flat_in_array()), "array can't be flat");
+    IdealKit ideal(this);
+    IdealVariable res(ideal);
+    ideal.declarations_done();
+    ideal.if_then(flat_array_test(ary, /* flat = */ false)); {
+      // non-flat array
+      assert(ideal.ctrl()->in(0)->as_If()->is_flat_array_check(&_gvn), "Should be found");
+      sync_kit(ideal);
+      const TypeAryPtr* adr_type = TypeAryPtr::get_array_body_type(bt);
+      DecoratorSet decorator_set = IN_HEAP | IS_ARRAY | C2_CONTROL_DEPENDENT_LOAD;
+      if (needs_range_check(ary_t->size(), idx)) {
+        // We've emitted a RangeCheck but now insert an additional check between the range check and the actual load.
+        // We cannot pin the load to two separate nodes. Instead, we pin it conservatively here such that it cannot
+        // possibly float above the range check at any point.
+        decorator_set |= C2_UNKNOWN_CONTROL_LOAD;
+      }
+      Node* ld = access_load_at(ary, adr, adr_type, elemptr, bt, decorator_set);
+      if (elemptr->is_inlinetypeptr()) {
+        assert(elemptr->maybe_null(), "null free array should be handled above");
+        ld = InlineTypeNode::make_from_oop(this, ld, elemptr->inline_klass(), false);
+      }
+      ideal.sync_kit(this);
+      ideal.set(res, ld);
+    } ideal.else_(); {
+      // flat array
+      sync_kit(ideal);
+      if (elemptr->is_inlinetypeptr()) {
+        // Element type is known, cast and load from flat representation
+        ciInlineKlass* vk = elemptr->inline_klass();
+        assert(vk->flat_in_array() && elemptr->maybe_null(), "never/always flat - should be optimized");
+        ciArrayKlass* array_klass = ciArrayKlass::make(vk, /* null_free */ true);
+        const TypeAryPtr* arytype = TypeOopPtr::make_from_klass(array_klass)->isa_aryptr();
+        Node* cast = _gvn.transform(new CheckCastPPNode(control(), ary, arytype));
+        Node* casted_adr = array_element_address(cast, idx, T_OBJECT, ary_t->size(), control());
+        // Re-execute flat array load if buffering triggers deoptimization
+        PreserveReexecuteState preexecs(this);
+        jvms()->set_should_reexecute(true);
+        inc_sp(2);
+        Node* vt = InlineTypeNode::make_from_flat(this, vk, cast, casted_adr)->buffer(this, false);
+        ideal.set(res, vt);
+        ideal.sync_kit(this);
+      } else {
+        // Element type is unknown, emit runtime call
+
+        // Below membars keep this access to an unknown flat array correctly
+        // ordered with other unknown and known flat array accesses.
+        insert_mem_bar_volatile(Op_MemBarCPUOrder, C->get_alias_index(TypeAryPtr::INLINES));
+
+        Node* call = nullptr;
+        {
+          // Re-execute flat array load if runtime call triggers deoptimization
+          PreserveReexecuteState preexecs(this);
+          jvms()->set_bci(_bci);
+          jvms()->set_should_reexecute(true);
+          inc_sp(2);
+          kill_dead_locals();
+          call = make_runtime_call(RC_NO_LEAF | RC_NO_IO,
+                                   OptoRuntime::load_unknown_inline_type(),
+                                   OptoRuntime::load_unknown_inline_Java(),
+                                   nullptr, TypeRawPtr::BOTTOM,
+                                   ary, idx);
+        }
+        make_slow_call_ex(call, env()->Throwable_klass(), false);
+        Node* buffer = _gvn.transform(new ProjNode(call, TypeFunc::Parms));
+
+        insert_mem_bar_volatile(Op_MemBarCPUOrder, C->get_alias_index(TypeAryPtr::INLINES));
+
+        // Keep track of the information that the inline type is in flat arrays
+        const Type* unknown_value = elemptr->is_instptr()->cast_to_flat_in_array();
+        buffer = _gvn.transform(new CheckCastPPNode(control(), buffer, unknown_value));
+
+        ideal.sync_kit(this);
+        ideal.set(res, buffer);
+      }
+    } ideal.end_if();
+    sync_kit(ideal);
+    Node* ld = _gvn.transform(ideal.value(res));
+    ld = record_profile_for_speculation_at_array_load(ld);
+    push_node(bt, ld);
+    return;
+  }
 
   if (elemtype == TypeInt::BOOL) {
     bt = T_BOOLEAN;
   }
   const TypeAryPtr* adr_type = TypeAryPtr::get_array_body_type(bt);
-
-  Node* ld = access_load_at(array, adr, adr_type, elemtype, bt,
+  Node* ld = access_load_at(ary, adr, adr_type, elemtype, bt,
                             IN_HEAP | IS_ARRAY | C2_CONTROL_DEPENDENT_LOAD);
-  if (big_val) {
-    push_pair(ld);
-  } else {
-    push(ld);
+  ld = record_profile_for_speculation_at_array_load(ld);
+  // Loading an inline type from a non-flat array
+  if (elemptr != nullptr && elemptr->is_inlinetypeptr()) {
+    assert(!ary_t->is_null_free() || !elemptr->maybe_null(), "inline type array elements should never be null");
+    ld = InlineTypeNode::make_from_oop(this, ld, elemptr->inline_klass(), !elemptr->maybe_null());
   }
+  push_node(bt, ld);
 }
 
 
 //--------------------------------array_store----------------------------------
 void Parse::array_store(BasicType bt) {
   const Type* elemtype = Type::TOP;
-  bool big_val = bt == T_DOUBLE || bt == T_LONG;
-  Node* adr = array_addressing(bt, big_val ? 2 : 1, elemtype);
+  Node* adr = array_addressing(bt, type2size[bt], elemtype);
   if (stopped())  return;     // guaranteed null or range check
+  Node* cast_val = nullptr;
   if (bt == T_OBJECT) {
-    array_store_check();
-    if (stopped()) {
-      return;
-    }
+    cast_val = array_store_check(adr, elemtype);
+    if (stopped()) return;
   }
-  Node* val;                  // Oop to store
-  if (big_val) {
-    val = pop_pair();
-  } else {
-    val = pop();
-  }
-  pop();                      // index (already used)
-  Node* array = pop();        // the array itself
+  Node* val = pop_node(bt); // Value to store
+  Node* idx = pop();        // Index in the array
+  Node* ary = pop();        // The array itself
+
+  const TypeAryPtr* ary_t = _gvn.type(ary)->is_aryptr();
+  const TypeAryPtr* adr_type = TypeAryPtr::get_array_body_type(bt);
 
   if (elemtype == TypeInt::BOOL) {
     bt = T_BOOLEAN;
+  } else if (bt == T_OBJECT) {
+    elemtype = elemtype->make_oopptr();
+    const Type* tval = _gvn.type(cast_val);
+    // Based on the value to be stored, try to determine if the array is not null-free and/or not flat.
+    // This is only legal for non-null stores because the array_store_check always passes for null, even
+    // if the array is null-free. Null stores are handled in GraphKit::gen_inline_array_null_guard().
+    bool not_null_free = !tval->maybe_null() && !tval->is_oopptr()->can_be_inline_type();
+    bool not_flat = not_null_free || (tval->is_inlinetypeptr() && !tval->inline_klass()->flat_in_array());
+    if (!ary_t->is_not_null_free() && not_null_free) {
+      // Storing a non-inline type, mark array as not null-free (-> not flat).
+      ary_t = ary_t->cast_to_not_null_free();
+      Node* cast = _gvn.transform(new CheckCastPPNode(control(), ary, ary_t));
+      replace_in_map(ary, cast);
+      ary = cast;
+    } else if (!ary_t->is_not_flat() && not_flat) {
+      // Storing to a non-flat array, mark array as not flat.
+      ary_t = ary_t->cast_to_not_flat();
+      Node* cast = _gvn.transform(new CheckCastPPNode(control(), ary, ary_t));
+      replace_in_map(ary, cast);
+      ary = cast;
+    }
+
+    if (ary_t->is_flat()) {
+      // Store to flat inline type array
+      assert(!tval->maybe_null(), "should be guaranteed by array store check");
+      // Re-execute flat array store if buffering triggers deoptimization
+      PreserveReexecuteState preexecs(this);
+      inc_sp(3);
+      jvms()->set_should_reexecute(true);
+      cast_val->as_InlineType()->store_flat(this, ary, adr, nullptr, 0, MO_UNORDERED | IN_HEAP | IS_ARRAY);
+      return;
+    } else if (ary_t->is_null_free()) {
+      // Store to non-flat inline type array (elements can never be null)
+      assert(!tval->maybe_null(), "should be guaranteed by array store check");
+      if (elemtype->inline_klass()->is_empty()) {
+        // Ignore empty inline stores, array is already initialized.
+        return;
+      }
+    } else if (!ary_t->is_not_flat() && (tval != TypePtr::NULL_PTR || StressReflectiveCode)) {
+      // Array might be a flat array, emit runtime checks (for nullptr, a simple inline_array_null_guard is sufficient).
+      assert(UseFlatArray && !not_flat && elemtype->is_oopptr()->can_be_inline_type() &&
+             !ary_t->klass_is_exact() && !ary_t->is_not_null_free(), "array can't be a flat array");
+      IdealKit ideal(this);
+      ideal.if_then(flat_array_test(ary, /* flat = */ false)); {
+        // non-flat array
+        assert(ideal.ctrl()->in(0)->as_If()->is_flat_array_check(&_gvn), "Should be found");
+        sync_kit(ideal);
+        Node* cast_ary = inline_array_null_guard(ary, cast_val, 3);
+        inc_sp(3);
+        access_store_at(cast_ary, adr, adr_type, cast_val, elemtype, bt, MO_UNORDERED | IN_HEAP | IS_ARRAY, false);
+        dec_sp(3);
+        ideal.sync_kit(this);
+      } ideal.else_(); {
+        sync_kit(ideal);
+        // flat array
+        Node* null_ctl = top();
+        Node* val = null_check_oop(cast_val, &null_ctl);
+        if (null_ctl != top()) {
+          PreserveJVMState pjvms(this);
+          inc_sp(3);
+          set_control(null_ctl);
+          uncommon_trap(Deoptimization::Reason_null_check, Deoptimization::Action_none);
+          dec_sp(3);
+        }
+        // Try to determine the inline klass
+        ciInlineKlass* vk = nullptr;
+        if (tval->is_inlinetypeptr()) {
+          vk = tval->inline_klass();
+        } else if (elemtype->is_inlinetypeptr()) {
+          vk = elemtype->inline_klass();
+        }
+        Node* casted_ary = ary;
+        if (vk != nullptr && !stopped()) {
+          // Element type is known, cast and store to flat representation
+          assert(vk->flat_in_array() && elemtype->maybe_null(), "never/always flat - should be optimized");
+          ciArrayKlass* array_klass = ciArrayKlass::make(vk, /* null_free */ true);
+          const TypeAryPtr* arytype = TypeOopPtr::make_from_klass(array_klass)->isa_aryptr();
+          casted_ary = _gvn.transform(new CheckCastPPNode(control(), casted_ary, arytype));
+          Node* casted_adr = array_element_address(casted_ary, idx, T_OBJECT, arytype->size(), control());
+          if (!val->is_InlineType()) {
+            assert(!gvn().type(val)->maybe_null(), "inline type array elements should never be null");
+            val = InlineTypeNode::make_from_oop(this, val, vk);
+          }
+          // Re-execute flat array store if buffering triggers deoptimization
+          PreserveReexecuteState preexecs(this);
+          inc_sp(3);
+          jvms()->set_should_reexecute(true);
+          val->as_InlineType()->store_flat(this, casted_ary, casted_adr, nullptr, 0, MO_UNORDERED | IN_HEAP | IS_ARRAY);
+        } else if (!stopped()) {
+          // Element type is unknown, emit runtime call
+
+          // Below membars keep this access to an unknown flat array correctly
+          // ordered with other unknown and known flat array accesses.
+          insert_mem_bar_volatile(Op_MemBarCPUOrder, C->get_alias_index(TypeAryPtr::INLINES));
+
+          make_runtime_call(RC_LEAF,
+                            OptoRuntime::store_unknown_inline_type(),
+                            CAST_FROM_FN_PTR(address, OptoRuntime::store_unknown_inline),
+                            "store_unknown_inline", TypeRawPtr::BOTTOM,
+                            val, casted_ary, idx);
+
+          insert_mem_bar_volatile(Op_MemBarCPUOrder, C->get_alias_index(TypeAryPtr::INLINES));
+        }
+        ideal.sync_kit(this);
+      }
+      ideal.end_if();
+      sync_kit(ideal);
+      return;
+    } else if (!ary_t->is_not_null_free()) {
+      // Array is not flat but may be null free
+      assert(elemtype->is_oopptr()->can_be_inline_type(), "array can't be null-free");
+      ary = inline_array_null_guard(ary, cast_val, 3, true);
+    }
   }
-  const TypeAryPtr* adr_type = TypeAryPtr::get_array_body_type(bt);
-
-  access_store_at(array, adr, adr_type, val, elemtype, bt, MO_UNORDERED | IN_HEAP | IS_ARRAY);
+  inc_sp(3);
+  access_store_at(ary, adr, adr_type, val, elemtype, bt, MO_UNORDERED | IN_HEAP | IS_ARRAY);
+  dec_sp(3);
 }
 
 
 //------------------------------array_addressing-------------------------------
 // Pull array and index from the stack.  Compute pointer-to-element.
@@ -130,21 +355,10 @@
         elemtype = subklass->join_speculative(el);
       }
     }
   }
 
-  // Check for big class initializers with all constant offsets
-  // feeding into a known-size array.
-  const TypeInt* idxtype = _gvn.type(idx)->is_int();
-  // See if the highest idx value is less than the lowest array bound,
-  // and if the idx value cannot be negative:
-  bool need_range_check = true;
-  if (idxtype->_hi < sizetype->_lo && idxtype->_lo >= 0) {
-    need_range_check = false;
-    if (C->log() != nullptr)   C->log()->elem("observe that='!need_range_check'");
-  }
-
   if (!arytype->is_loaded()) {
     // Only fails for some -Xcomp runs
     // The class is unloaded.  We have to run this bytecode in the interpreter.
     ciKlass* klass = arytype->unloaded_klass();
 
@@ -152,55 +366,18 @@
                   Deoptimization::Action_reinterpret,
                   klass, "!loaded array");
     return top();
   }
 
-  // Do the range check
-  if (need_range_check) {
-    Node* tst;
-    if (sizetype->_hi <= 0) {
-      // The greatest array bound is negative, so we can conclude that we're
-      // compiling unreachable code, but the unsigned compare trick used below
-      // only works with non-negative lengths.  Instead, hack "tst" to be zero so
-      // the uncommon_trap path will always be taken.
-      tst = _gvn.intcon(0);
-    } else {
-      // Range is constant in array-oop, so we can use the original state of mem
-      Node* len = load_array_length(ary);
+  ary = create_speculative_inline_type_array_checks(ary, arytype, elemtype);
 
-      // Test length vs index (standard trick using unsigned compare)
-      Node* chk = _gvn.transform( new CmpUNode(idx, len) );
-      BoolTest::mask btest = BoolTest::lt;
-      tst = _gvn.transform( new BoolNode(chk, btest) );
-    }
-    RangeCheckNode* rc = new RangeCheckNode(control(), tst, PROB_MAX, COUNT_UNKNOWN);
-    _gvn.set_type(rc, rc->Value(&_gvn));
-    if (!tst->is_Con()) {
-      record_for_igvn(rc);
-    }
-    set_control(_gvn.transform(new IfTrueNode(rc)));
-    // Branch to failure if out of bounds
-    {
-      PreserveJVMState pjvms(this);
-      set_control(_gvn.transform(new IfFalseNode(rc)));
-      if (C->allow_range_check_smearing()) {
-        // Do not use builtin_throw, since range checks are sometimes
-        // made more stringent by an optimistic transformation.
-        // This creates "tentative" range checks at this point,
-        // which are not guaranteed to throw exceptions.
-        // See IfNode::Ideal, is_range_check, adjust_check.
-        uncommon_trap(Deoptimization::Reason_range_check,
-                      Deoptimization::Action_make_not_entrant,
-                      nullptr, "range_check");
-      } else {
-        // If we have already recompiled with the range-check-widening
-        // heroic optimization turned off, then we must really be throwing
-        // range check exceptions.
-        builtin_throw(Deoptimization::Reason_range_check);
-      }
-    }
+  if (needs_range_check(sizetype, idx)) {
+    create_range_check(idx, ary, sizetype);
+  } else if (C->log() != nullptr) {
+    C->log()->elem("observe that='!need_range_check'");
   }
+
   // Check for always knowing you are throwing a range-check exception
   if (stopped())  return top();
 
   // Make array address computation control dependent to prevent it
   // from floating above the range check during loop optimizations.
@@ -208,10 +385,210 @@
   assert(ptr != top(), "top should go hand-in-hand with stopped");
 
   return ptr;
 }
 
+// Check if we need a range check for an array access. This is the case if the index is either negative or if it could
+// be greater or equal the smallest possible array size (i.e. out-of-bounds).
+bool Parse::needs_range_check(const TypeInt* size_type, const Node* index) const {
+  const TypeInt* index_type = _gvn.type(index)->is_int();
+  return index_type->_hi >= size_type->_lo || index_type->_lo < 0;
+}
+
+void Parse::create_range_check(Node* idx, Node* ary, const TypeInt* sizetype) {
+  Node* tst;
+  if (sizetype->_hi <= 0) {
+    // The greatest array bound is negative, so we can conclude that we're
+    // compiling unreachable code, but the unsigned compare trick used below
+    // only works with non-negative lengths.  Instead, hack "tst" to be zero so
+    // the uncommon_trap path will always be taken.
+    tst = _gvn.intcon(0);
+  } else {
+    // Range is constant in array-oop, so we can use the original state of mem
+    Node* len = load_array_length(ary);
+
+    // Test length vs index (standard trick using unsigned compare)
+    Node* chk = _gvn.transform(new CmpUNode(idx, len) );
+    BoolTest::mask btest = BoolTest::lt;
+    tst = _gvn.transform(new BoolNode(chk, btest) );
+  }
+  RangeCheckNode* rc = new RangeCheckNode(control(), tst, PROB_MAX, COUNT_UNKNOWN);
+  _gvn.set_type(rc, rc->Value(&_gvn));
+  if (!tst->is_Con()) {
+    record_for_igvn(rc);
+  }
+  set_control(_gvn.transform(new IfTrueNode(rc)));
+  // Branch to failure if out of bounds
+  {
+    PreserveJVMState pjvms(this);
+    set_control(_gvn.transform(new IfFalseNode(rc)));
+    if (C->allow_range_check_smearing()) {
+      // Do not use builtin_throw, since range checks are sometimes
+      // made more stringent by an optimistic transformation.
+      // This creates "tentative" range checks at this point,
+      // which are not guaranteed to throw exceptions.
+      // See IfNode::Ideal, is_range_check, adjust_check.
+      uncommon_trap(Deoptimization::Reason_range_check,
+                    Deoptimization::Action_make_not_entrant,
+                    nullptr, "range_check");
+    } else {
+      // If we have already recompiled with the range-check-widening
+      // heroic optimization turned off, then we must really be throwing
+      // range check exceptions.
+      builtin_throw(Deoptimization::Reason_range_check);
+    }
+  }
+}
+
+// For inline type arrays, we can use the profiling information for array accesses to speculate on the type, flatness,
+// and null-freeness. We can either prepare the speculative type for later uses or emit explicit speculative checks with
+// traps now. In the latter case, the speculative type guarantees can avoid additional runtime checks later (e.g.
+// non-null-free implies non-flat which allows us to remove flatness checks). This makes the graph simpler.
+Node* Parse::create_speculative_inline_type_array_checks(Node* array, const TypeAryPtr* array_type,
+                                                         const Type*& element_type) {
+  if (!array_type->is_flat() && !array_type->is_not_flat()) {
+    // For arrays that might be flat, speculate that the array has the exact type reported in the profile data such that
+    // we can rely on a fixed memory layout (i.e. either a flat layout or not).
+    array = cast_to_speculative_array_type(array, array_type, element_type);
+  } else if (UseTypeSpeculation && UseArrayLoadStoreProfile) {
+    // Array is known to be either flat or not flat. If possible, update the speculative type by using the profile data
+    // at this bci.
+    array = cast_to_profiled_array_type(array);
+  }
+
+  // Even though the type does not tell us whether we have an inline type array or not, we can still check the profile data
+  // whether we have a non-null-free or non-flat array. Since non-null-free implies non-flat, we check this first.
+  // Speculating on a non-null-free array doesn't help aaload but could be profitable for a subsequent aastore.
+  if (!array_type->is_null_free() && !array_type->is_not_null_free()) {
+    array = speculate_non_null_free_array(array, array_type);
+  }
+
+  if (!array_type->is_flat() && !array_type->is_not_flat()) {
+    array = speculate_non_flat_array(array, array_type);
+  }
+  return array;
+}
+
+// Speculate that the array has the exact type reported in the profile data. We emit a trap when this turns out to be
+// wrong. On the fast path, we add a CheckCastPP to use the exact type.
+Node* Parse::cast_to_speculative_array_type(Node* const array, const TypeAryPtr*& array_type, const Type*& element_type) {
+  Deoptimization::DeoptReason reason = Deoptimization::Reason_speculate_class_check;
+  ciKlass* speculative_array_type = array_type->speculative_type();
+  if (too_many_traps_or_recompiles(reason) || speculative_array_type == nullptr) {
+    // No speculative type, check profile data at this bci
+    speculative_array_type = nullptr;
+    reason = Deoptimization::Reason_class_check;
+    if (UseArrayLoadStoreProfile && !too_many_traps_or_recompiles(reason)) {
+      ciKlass* profiled_element_type = nullptr;
+      ProfilePtrKind element_ptr = ProfileMaybeNull;
+      bool flat_array = true;
+      bool null_free_array = true;
+      method()->array_access_profiled_type(bci(), speculative_array_type, profiled_element_type, element_ptr, flat_array,
+                                           null_free_array);
+    }
+  }
+  if (speculative_array_type != nullptr) {
+    // Speculate that this array has the exact type reported by profile data
+    Node* casted_array = nullptr;
+    DEBUG_ONLY(Node* old_control = control();)
+    Node* slow_ctl = type_check_receiver(array, speculative_array_type, 1.0, &casted_array);
+    if (stopped()) {
+      // The check always fails and therefore profile information is incorrect. Don't use it.
+      assert(old_control == slow_ctl, "type check should have been removed");
+      set_control(slow_ctl);
+    } else if (!slow_ctl->is_top()) {
+      { PreserveJVMState pjvms(this);
+        set_control(slow_ctl);
+        uncommon_trap_exact(reason, Deoptimization::Action_maybe_recompile);
+      }
+      replace_in_map(array, casted_array);
+      array_type = _gvn.type(casted_array)->is_aryptr();
+      element_type = array_type->elem();
+      return casted_array;
+    }
+  }
+  return array;
+}
+
+// Create a CheckCastPP when the speculative type can improve the current type.
+Node* Parse::cast_to_profiled_array_type(Node* const array) {
+  ciKlass* array_type = nullptr;
+  ciKlass* element_type = nullptr;
+  ProfilePtrKind element_ptr = ProfileMaybeNull;
+  bool flat_array = true;
+  bool null_free_array = true;
+  method()->array_access_profiled_type(bci(), array_type, element_type, element_ptr, flat_array, null_free_array);
+  if (array_type != nullptr) {
+    return record_profile_for_speculation(array, array_type, ProfileMaybeNull);
+  }
+  return array;
+}
+
+// Speculate that the array is non-null-free. This will imply non-flatness. We emit a trap when this turns out to be
+// wrong. On the fast path, we add a CheckCastPP to use the non-null-free type.
+Node* Parse::speculate_non_null_free_array(Node* const array, const TypeAryPtr*& array_type) {
+  bool null_free_array = true;
+  Deoptimization::DeoptReason reason = Deoptimization::Reason_none;
+  if (array_type->speculative() != nullptr &&
+      array_type->speculative()->is_aryptr()->is_not_null_free() &&
+      !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_class_check)) {
+    null_free_array = false;
+    reason = Deoptimization::Reason_speculate_class_check;
+  } else if (UseArrayLoadStoreProfile && !too_many_traps_or_recompiles(Deoptimization::Reason_class_check)) {
+    ciKlass* profiled_array_type = nullptr;
+    ciKlass* profiled_element_type = nullptr;
+    ProfilePtrKind element_ptr = ProfileMaybeNull;
+    bool flat_array = true;
+    method()->array_access_profiled_type(bci(), profiled_array_type, profiled_element_type, element_ptr, flat_array,
+                                         null_free_array);
+    reason = Deoptimization::Reason_class_check;
+  }
+  if (!null_free_array) {
+    { // Deoptimize if null-free array
+      BuildCutout unless(this, null_free_array_test(array, /* null_free = */ false), PROB_MAX);
+      uncommon_trap_exact(reason, Deoptimization::Action_maybe_recompile);
+    }
+    assert(!stopped(), "null-free array should have been caught earlier");
+    Node* casted_array = _gvn.transform(new CheckCastPPNode(control(), array, array_type->cast_to_not_null_free()));
+    replace_in_map(array, casted_array);
+    array_type = _gvn.type(casted_array)->is_aryptr();
+    return casted_array;
+  }
+  return array;
+}
+
+// Speculate that the array is non-flat. We emit a trap when this turns out to be wrong. On the fast path, we add a
+// CheckCastPP to use the non-flat type.
+Node* Parse::speculate_non_flat_array(Node* const array, const TypeAryPtr* const array_type) {
+  bool flat_array = true;
+  Deoptimization::DeoptReason reason = Deoptimization::Reason_none;
+  if (array_type->speculative() != nullptr &&
+      array_type->speculative()->is_aryptr()->is_not_flat() &&
+      !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_class_check)) {
+    flat_array = false;
+    reason = Deoptimization::Reason_speculate_class_check;
+  } else if (UseArrayLoadStoreProfile && !too_many_traps_or_recompiles(reason)) {
+    ciKlass* profiled_array_type = nullptr;
+    ciKlass* profiled_element_type = nullptr;
+    ProfilePtrKind element_ptr = ProfileMaybeNull;
+    bool null_free_array = true;
+    method()->array_access_profiled_type(bci(), profiled_array_type, profiled_element_type, element_ptr, flat_array,
+                                         null_free_array);
+    reason = Deoptimization::Reason_class_check;
+  }
+  if (!flat_array) {
+    { // Deoptimize if flat array
+      BuildCutout unless(this, flat_array_test(array, /* flat = */ false), PROB_MAX);
+      uncommon_trap_exact(reason, Deoptimization::Action_maybe_recompile);
+    }
+    assert(!stopped(), "flat array should have been caught earlier");
+    Node* casted_array = _gvn.transform(new CheckCastPPNode(control(), array, array_type->cast_to_not_flat()));
+    replace_in_map(array, casted_array);
+    return casted_array;
+  }
+  return array;
+}
 
 // returns IfNode
 IfNode* Parse::jump_if_fork_int(Node* a, Node* b, BoolTest::mask mask, float prob, float cnt) {
   Node   *cmp = _gvn.transform(new CmpINode(a, b)); // two cases: shiftcount > 32 and shiftcount <= 32
   Node   *tst = _gvn.transform(new BoolNode(cmp, mask));
@@ -1440,11 +1817,11 @@
     adjust_map_after_if(BoolTest(btest).negate(), c, 1.0-prob, next_block);
   }
 }
 
 //------------------------------------do_if------------------------------------
-void Parse::do_if(BoolTest::mask btest, Node* c) {
+void Parse::do_if(BoolTest::mask btest, Node* c, bool can_trap, bool new_path, Node** ctrl_taken) {
   int target_bci = iter().get_dest();
 
   Block* branch_block = successor_for_bci(target_bci);
   Block* next_block   = successor_for_bci(iter().next_bci());
 
@@ -1524,33 +1901,445 @@
   { PreserveJVMState pjvms(this);
     taken_branch = _gvn.transform(taken_branch);
     set_control(taken_branch);
 
     if (stopped()) {
-      if (C->eliminate_boxing()) {
-        // Mark the successor block as parsed
+      if (C->eliminate_boxing() && !new_path) {
+        // Mark the successor block as parsed (if we haven't created a new path)
         branch_block->next_path_num();
       }
     } else {
-      adjust_map_after_if(taken_btest, c, prob, branch_block);
+      adjust_map_after_if(taken_btest, c, prob, branch_block, can_trap);
       if (!stopped()) {
-        merge(target_bci);
+        if (new_path) {
+          // Merge by using a new path
+          merge_new_path(target_bci);
+        } else if (ctrl_taken != nullptr) {
+          // Don't merge but save taken branch to be wired by caller
+          *ctrl_taken = control();
+        } else {
+          merge(target_bci);
+        }
       }
     }
   }
 
   untaken_branch = _gvn.transform(untaken_branch);
   set_control(untaken_branch);
 
   // Branch not taken.
-  if (stopped()) {
+  if (stopped() && ctrl_taken == nullptr) {
     if (C->eliminate_boxing()) {
-      // Mark the successor block as parsed
+      // Mark the successor block as parsed (if caller does not re-wire control flow)
       next_block->next_path_num();
     }
   } else {
-    adjust_map_after_if(untaken_btest, c, untaken_prob, next_block);
+    adjust_map_after_if(untaken_btest, c, untaken_prob, next_block, can_trap);
+  }
+}
+
+
+static ProfilePtrKind speculative_ptr_kind(const TypeOopPtr* t) {
+  if (t->speculative() == nullptr) {
+    return ProfileUnknownNull;
+  }
+  if (t->speculative_always_null()) {
+    return ProfileAlwaysNull;
+  }
+  if (t->speculative_maybe_null()) {
+    return ProfileMaybeNull;
+  }
+  return ProfileNeverNull;
+}
+
+void Parse::acmp_always_null_input(Node* input, const TypeOopPtr* tinput, BoolTest::mask btest, Node* eq_region) {
+  inc_sp(2);
+  Node* cast = null_check_common(input, T_OBJECT, true, nullptr,
+                                 !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_check) &&
+                                 speculative_ptr_kind(tinput) == ProfileAlwaysNull);
+  dec_sp(2);
+  if (btest == BoolTest::ne) {
+    {
+      PreserveJVMState pjvms(this);
+      replace_in_map(input, cast);
+      int target_bci = iter().get_dest();
+      merge(target_bci);
+    }
+    record_for_igvn(eq_region);
+    set_control(_gvn.transform(eq_region));
+  } else {
+    replace_in_map(input, cast);
+  }
+}
+
+Node* Parse::acmp_null_check(Node* input, const TypeOopPtr* tinput, ProfilePtrKind input_ptr, Node*& null_ctl) {
+  inc_sp(2);
+  null_ctl = top();
+  Node* cast = null_check_oop(input, &null_ctl,
+                              input_ptr == ProfileNeverNull || (input_ptr == ProfileUnknownNull && !too_many_traps_or_recompiles(Deoptimization::Reason_null_check)),
+                              false,
+                              speculative_ptr_kind(tinput) == ProfileNeverNull &&
+                              !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_check));
+  dec_sp(2);
+  assert(!stopped(), "null input should have been caught earlier");
+  return cast;
+}
+
+void Parse::acmp_known_non_inline_type_input(Node* input, const TypeOopPtr* tinput, ProfilePtrKind input_ptr, ciKlass* input_type, BoolTest::mask btest, Node* eq_region) {
+  Node* ne_region = new RegionNode(1);
+  Node* null_ctl;
+  Node* cast = acmp_null_check(input, tinput, input_ptr, null_ctl);
+  ne_region->add_req(null_ctl);
+
+  Node* slow_ctl = type_check_receiver(cast, input_type, 1.0, &cast);
+  {
+    PreserveJVMState pjvms(this);
+    inc_sp(2);
+    set_control(slow_ctl);
+    Deoptimization::DeoptReason reason;
+    if (tinput->speculative_type() != nullptr && !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_class_check)) {
+      reason = Deoptimization::Reason_speculate_class_check;
+    } else {
+      reason = Deoptimization::Reason_class_check;
+    }
+    uncommon_trap_exact(reason, Deoptimization::Action_maybe_recompile);
+  }
+  ne_region->add_req(control());
+
+  record_for_igvn(ne_region);
+  set_control(_gvn.transform(ne_region));
+  if (btest == BoolTest::ne) {
+    {
+      PreserveJVMState pjvms(this);
+      if (null_ctl == top()) {
+        replace_in_map(input, cast);
+      }
+      int target_bci = iter().get_dest();
+      merge(target_bci);
+    }
+    record_for_igvn(eq_region);
+    set_control(_gvn.transform(eq_region));
+  } else {
+    if (null_ctl == top()) {
+      replace_in_map(input, cast);
+    }
+    set_control(_gvn.transform(ne_region));
+  }
+}
+
+void Parse::acmp_unknown_non_inline_type_input(Node* input, const TypeOopPtr* tinput, ProfilePtrKind input_ptr, BoolTest::mask btest, Node* eq_region) {
+  Node* ne_region = new RegionNode(1);
+  Node* null_ctl;
+  Node* cast = acmp_null_check(input, tinput, input_ptr, null_ctl);
+  ne_region->add_req(null_ctl);
+
+  {
+    BuildCutout unless(this, inline_type_test(cast, /* is_inline = */ false), PROB_MAX);
+    inc_sp(2);
+    uncommon_trap_exact(Deoptimization::Reason_class_check, Deoptimization::Action_maybe_recompile);
+  }
+
+  ne_region->add_req(control());
+
+  record_for_igvn(ne_region);
+  set_control(_gvn.transform(ne_region));
+  if (btest == BoolTest::ne) {
+    {
+      PreserveJVMState pjvms(this);
+      if (null_ctl == top()) {
+        replace_in_map(input, cast);
+      }
+      int target_bci = iter().get_dest();
+      merge(target_bci);
+    }
+    record_for_igvn(eq_region);
+    set_control(_gvn.transform(eq_region));
+  } else {
+    if (null_ctl == top()) {
+      replace_in_map(input, cast);
+    }
+    set_control(_gvn.transform(ne_region));
+  }
+}
+
+void Parse::do_acmp(BoolTest::mask btest, Node* left, Node* right) {
+  ciKlass* left_type = nullptr;
+  ciKlass* right_type = nullptr;
+  ProfilePtrKind left_ptr = ProfileUnknownNull;
+  ProfilePtrKind right_ptr = ProfileUnknownNull;
+  bool left_inline_type = true;
+  bool right_inline_type = true;
+
+  // Leverage profiling at acmp
+  if (UseACmpProfile) {
+    method()->acmp_profiled_type(bci(), left_type, right_type, left_ptr, right_ptr, left_inline_type, right_inline_type);
+    if (too_many_traps_or_recompiles(Deoptimization::Reason_class_check)) {
+      left_type = nullptr;
+      right_type = nullptr;
+      left_inline_type = true;
+      right_inline_type = true;
+    }
+    if (too_many_traps_or_recompiles(Deoptimization::Reason_null_check)) {
+      left_ptr = ProfileUnknownNull;
+      right_ptr = ProfileUnknownNull;
+    }
+  }
+
+  if (UseTypeSpeculation) {
+    record_profile_for_speculation(left, left_type, left_ptr);
+    record_profile_for_speculation(right, right_type, right_ptr);
+  }
+
+  if (!EnableValhalla) {
+    Node* cmp = CmpP(left, right);
+    cmp = optimize_cmp_with_klass(cmp);
+    do_if(btest, cmp);
+    return;
+  }
+
+  // Check for equality before potentially allocating
+  if (left == right) {
+    do_if(btest, makecon(TypeInt::CC_EQ));
+    return;
+  }
+
+  // Allocate inline type operands and re-execute on deoptimization
+  if (left->is_InlineType()) {
+    if (_gvn.type(right)->is_zero_type() ||
+        (right->is_InlineType() && _gvn.type(right->as_InlineType()->get_is_init())->is_zero_type())) {
+      // Null checking a scalarized but nullable inline type. Check the IsInit
+      // input instead of the oop input to avoid keeping buffer allocations alive.
+      Node* cmp = CmpI(left->as_InlineType()->get_is_init(), intcon(0));
+      do_if(btest, cmp);
+      return;
+    } else {
+      PreserveReexecuteState preexecs(this);
+      inc_sp(2);
+      jvms()->set_should_reexecute(true);
+      left = left->as_InlineType()->buffer(this)->get_oop();
+    }
+  }
+  if (right->is_InlineType()) {
+    PreserveReexecuteState preexecs(this);
+    inc_sp(2);
+    jvms()->set_should_reexecute(true);
+    right = right->as_InlineType()->buffer(this)->get_oop();
+  }
+
+  // First, do a normal pointer comparison
+  const TypeOopPtr* tleft = _gvn.type(left)->isa_oopptr();
+  const TypeOopPtr* tright = _gvn.type(right)->isa_oopptr();
+  Node* cmp = CmpP(left, right);
+  cmp = optimize_cmp_with_klass(cmp);
+  if (tleft == nullptr || !tleft->can_be_inline_type() ||
+      tright == nullptr || !tright->can_be_inline_type()) {
+    // This is sufficient, if one of the operands can't be an inline type
+    do_if(btest, cmp);
+    return;
+  }
+
+  // Don't add traps to unstable if branches because additional checks are required to
+  // decide if the operands are equal/substitutable and we therefore shouldn't prune
+  // branches for one if based on the profiling of the acmp branches.
+  // Also, OptimizeUnstableIf would set an incorrect re-rexecution state because it
+  // assumes that there is a 1-1 mapping between the if and the acmp branches and that
+  // hitting a trap means that we will take the corresponding acmp branch on re-execution.
+  const bool can_trap = true;
+
+  Node* eq_region = nullptr;
+  if (btest == BoolTest::eq) {
+    do_if(btest, cmp, !can_trap, true);
+    if (stopped()) {
+      // Pointers are equal, operands must be equal
+      return;
+    }
+  } else {
+    assert(btest == BoolTest::ne, "only eq or ne");
+    Node* is_not_equal = nullptr;
+    eq_region = new RegionNode(3);
+    {
+      PreserveJVMState pjvms(this);
+      // Pointers are not equal, but more checks are needed to determine if the operands are (not) substitutable
+      do_if(btest, cmp, !can_trap, false, &is_not_equal);
+      if (!stopped()) {
+        eq_region->init_req(1, control());
+      }
+    }
+    if (is_not_equal == nullptr || is_not_equal->is_top()) {
+      record_for_igvn(eq_region);
+      set_control(_gvn.transform(eq_region));
+      return;
+    }
+    set_control(is_not_equal);
+  }
+
+  // Prefer speculative types if available
+  if (!too_many_traps_or_recompiles(Deoptimization::Reason_speculate_class_check)) {
+    if (tleft->speculative_type() != nullptr) {
+      left_type = tleft->speculative_type();
+    }
+    if (tright->speculative_type() != nullptr) {
+      right_type = tright->speculative_type();
+    }
+  }
+
+  if (speculative_ptr_kind(tleft) != ProfileMaybeNull && speculative_ptr_kind(tleft) != ProfileUnknownNull) {
+    ProfilePtrKind speculative_left_ptr = speculative_ptr_kind(tleft);
+    if (speculative_left_ptr == ProfileAlwaysNull && !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_assert)) {
+      left_ptr = speculative_left_ptr;
+    } else if (speculative_left_ptr == ProfileNeverNull && !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_check)) {
+      left_ptr = speculative_left_ptr;
+    }
+  }
+  if (speculative_ptr_kind(tright) != ProfileMaybeNull && speculative_ptr_kind(tright) != ProfileUnknownNull) {
+    ProfilePtrKind speculative_right_ptr = speculative_ptr_kind(tright);
+    if (speculative_right_ptr == ProfileAlwaysNull && !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_assert)) {
+      right_ptr = speculative_right_ptr;
+    } else if (speculative_right_ptr == ProfileNeverNull && !too_many_traps_or_recompiles(Deoptimization::Reason_speculate_null_check)) {
+      right_ptr = speculative_right_ptr;
+    }
+  }
+
+  if (left_ptr == ProfileAlwaysNull) {
+    // Comparison with null. Assert the input is indeed null and we're done.
+    acmp_always_null_input(left, tleft, btest, eq_region);
+    return;
+  }
+  if (right_ptr == ProfileAlwaysNull) {
+    // Comparison with null. Assert the input is indeed null and we're done.
+    acmp_always_null_input(right, tright, btest, eq_region);
+    return;
+  }
+  if (left_type != nullptr && !left_type->is_inlinetype()) {
+    // Comparison with an object of known type
+    acmp_known_non_inline_type_input(left, tleft, left_ptr, left_type, btest, eq_region);
+    return;
+  }
+  if (right_type != nullptr && !right_type->is_inlinetype()) {
+    // Comparison with an object of known type
+    acmp_known_non_inline_type_input(right, tright, right_ptr, right_type, btest, eq_region);
+    return;
+  }
+  if (!left_inline_type) {
+    // Comparison with an object known not to be an inline type
+    acmp_unknown_non_inline_type_input(left, tleft, left_ptr, btest, eq_region);
+    return;
+  }
+  if (!right_inline_type) {
+    // Comparison with an object known not to be an inline type
+    acmp_unknown_non_inline_type_input(right, tright, right_ptr, btest, eq_region);
+    return;
+  }
+
+  // Pointers are not equal, check if first operand is non-null
+  Node* ne_region = new RegionNode(6);
+  Node* null_ctl;
+  Node* not_null_right = acmp_null_check(right, tright, right_ptr, null_ctl);
+  ne_region->init_req(1, null_ctl);
+
+  // First operand is non-null, check if it is an inline type
+  Node* is_value = inline_type_test(not_null_right);
+  IfNode* is_value_iff = create_and_map_if(control(), is_value, PROB_FAIR, COUNT_UNKNOWN);
+  Node* not_value = _gvn.transform(new IfFalseNode(is_value_iff));
+  ne_region->init_req(2, not_value);
+  set_control(_gvn.transform(new IfTrueNode(is_value_iff)));
+
+  // The first operand is an inline type, check if the second operand is non-null
+  Node* not_null_left = acmp_null_check(left, tleft, left_ptr, null_ctl);
+  ne_region->init_req(3, null_ctl);
+
+  // Check if both operands are of the same class.
+  Node* kls_left = load_object_klass(not_null_left);
+  Node* kls_right = load_object_klass(not_null_right);
+  Node* kls_cmp = CmpP(kls_left, kls_right);
+  Node* kls_bol = _gvn.transform(new BoolNode(kls_cmp, BoolTest::ne));
+  IfNode* kls_iff = create_and_map_if(control(), kls_bol, PROB_FAIR, COUNT_UNKNOWN);
+  Node* kls_ne = _gvn.transform(new IfTrueNode(kls_iff));
+  set_control(_gvn.transform(new IfFalseNode(kls_iff)));
+  ne_region->init_req(4, kls_ne);
+
+  if (stopped()) {
+    record_for_igvn(ne_region);
+    set_control(_gvn.transform(ne_region));
+    if (btest == BoolTest::ne) {
+      {
+        PreserveJVMState pjvms(this);
+        int target_bci = iter().get_dest();
+        merge(target_bci);
+      }
+      record_for_igvn(eq_region);
+      set_control(_gvn.transform(eq_region));
+    }
+    return;
+  }
+
+  // Both operands are values types of the same class, we need to perform a
+  // substitutability test. Delegate to ValueObjectMethods::isSubstitutable().
+  Node* ne_io_phi = PhiNode::make(ne_region, i_o());
+  Node* mem = reset_memory();
+  Node* ne_mem_phi = PhiNode::make(ne_region, mem);
+
+  Node* eq_io_phi = nullptr;
+  Node* eq_mem_phi = nullptr;
+  if (eq_region != nullptr) {
+    eq_io_phi = PhiNode::make(eq_region, i_o());
+    eq_mem_phi = PhiNode::make(eq_region, mem);
+  }
+
+  set_all_memory(mem);
+
+  kill_dead_locals();
+  ciMethod* subst_method = ciEnv::current()->ValueObjectMethods_klass()->find_method(ciSymbols::isSubstitutable_name(), ciSymbols::object_object_boolean_signature());
+  CallStaticJavaNode *call = new CallStaticJavaNode(C, TypeFunc::make(subst_method), SharedRuntime::get_resolve_static_call_stub(), subst_method);
+  call->set_override_symbolic_info(true);
+  call->init_req(TypeFunc::Parms, not_null_left);
+  call->init_req(TypeFunc::Parms+1, not_null_right);
+  inc_sp(2);
+  set_edges_for_java_call(call, false, false);
+  Node* ret = set_results_for_java_call(call, false, true);
+  dec_sp(2);
+
+  // Test the return value of ValueObjectMethods::isSubstitutable()
+  // This is the last check, do_if can emit traps now.
+  Node* subst_cmp = _gvn.transform(new CmpINode(ret, intcon(1)));
+  Node* ctl = C->top();
+  if (btest == BoolTest::eq) {
+    PreserveJVMState pjvms(this);
+    do_if(btest, subst_cmp, can_trap);
+    if (!stopped()) {
+      ctl = control();
+    }
+  } else {
+    assert(btest == BoolTest::ne, "only eq or ne");
+    PreserveJVMState pjvms(this);
+    do_if(btest, subst_cmp, can_trap, false, &ctl);
+    if (!stopped()) {
+      eq_region->init_req(2, control());
+      eq_io_phi->init_req(2, i_o());
+      eq_mem_phi->init_req(2, reset_memory());
+    }
+  }
+  ne_region->init_req(5, ctl);
+  ne_io_phi->init_req(5, i_o());
+  ne_mem_phi->init_req(5, reset_memory());
+
+  record_for_igvn(ne_region);
+  set_control(_gvn.transform(ne_region));
+  set_i_o(_gvn.transform(ne_io_phi));
+  set_all_memory(_gvn.transform(ne_mem_phi));
+
+  if (btest == BoolTest::ne) {
+    {
+      PreserveJVMState pjvms(this);
+      int target_bci = iter().get_dest();
+      merge(target_bci);
+    }
+
+    record_for_igvn(eq_region);
+    set_control(_gvn.transform(eq_region));
+    set_i_o(_gvn.transform(eq_io_phi));
+    set_all_memory(_gvn.transform(eq_mem_phi));
   }
 }
 
 bool Parse::path_is_suitable_for_uncommon_trap(float prob) const {
   // Don't want to speculate on uncommon traps when running with -Xcomp
@@ -1577,11 +2366,11 @@
 // Adjust the JVM state to reflect the result of taking this path.
 // Basically, it means inspecting the CmpNode controlling this
 // branch, seeing how it constrains a tested value, and then
 // deciding if it's worth our while to encode this constraint
 // as graph nodes in the current abstract interpretation map.
-void Parse::adjust_map_after_if(BoolTest::mask btest, Node* c, float prob, Block* path) {
+void Parse::adjust_map_after_if(BoolTest::mask btest, Node* c, float prob, Block* path, bool can_trap) {
   if (!c->is_Cmp()) {
     maybe_add_predicate_after_if(path);
     return;
   }
 
@@ -1589,11 +2378,11 @@
     return;                             // nothing to do
   }
 
   bool is_fallthrough = (path == successor_for_bci(iter().next_bci()));
 
-  if (path_is_suitable_for_uncommon_trap(prob)) {
+  if (can_trap && path_is_suitable_for_uncommon_trap(prob)) {
     repush_if_args();
     Node* call = uncommon_trap(Deoptimization::Reason_unstable_if,
                   Deoptimization::Action_reinterpret,
                   nullptr,
                   (is_fallthrough ? "taken always" : "taken never"));
@@ -1686,10 +2475,13 @@
             assert(tcc != obj_type && tcc->higher_equal(obj_type), "must improve");
             // Delay transform() call to allow recovery of pre-cast value
             // at the control merge.
             _gvn.set_type_bottom(ccast);
             record_for_igvn(ccast);
+            if (tboth->is_inlinetypeptr()) {
+              ccast = InlineTypeNode::make_from_oop(this, ccast, tboth->exact_klass(true)->as_inline_klass());
+            }
             // Here's the payoff.
             replace_in_map(obj, ccast);
           }
        }
     }
@@ -1790,10 +2582,14 @@
       if (obj_type->speculative_type_not_null() != nullptr) {
         ciKlass* k = obj_type->speculative_type();
         inc_sp(2);
         obj = maybe_cast_profiled_obj(obj, k);
         dec_sp(2);
+        if (obj->is_InlineType()) {
+          assert(obj->as_InlineType()->is_allocated(&_gvn), "must be allocated");
+          obj = obj->as_InlineType()->get_oop();
+        }
         // Make the CmpP use the casted obj
         addp = basic_plus_adr(obj, addp->in(AddPNode::Offset));
         load_klass = load_klass->clone();
         load_klass->set_req(2, addp);
         load_klass = _gvn.transform(load_klass);
@@ -2636,37 +3432,41 @@
   handle_if_null:
     // If this is a backwards branch in the bytecodes, add Safepoint
     maybe_add_safepoint(iter().get_dest());
     a = null();
     b = pop();
-    if (!_gvn.type(b)->speculative_maybe_null() &&
-        !too_many_traps(Deoptimization::Reason_speculate_null_check)) {
-      inc_sp(1);
-      Node* null_ctl = top();
-      b = null_check_oop(b, &null_ctl, true, true, true);
-      assert(null_ctl->is_top(), "no null control here");
-      dec_sp(1);
-    } else if (_gvn.type(b)->speculative_always_null() &&
-               !too_many_traps(Deoptimization::Reason_speculate_null_assert)) {
-      inc_sp(1);
-      b = null_assert(b);
-      dec_sp(1);
-    }
-    c = _gvn.transform( new CmpPNode(b, a) );
+    if (b->is_InlineType()) {
+      // Null checking a scalarized but nullable inline type. Check the IsInit
+      // input instead of the oop input to avoid keeping buffer allocations alive
+      c = _gvn.transform(new CmpINode(b->as_InlineType()->get_is_init(), zerocon(T_INT)));
+    } else {
+      if (!_gvn.type(b)->speculative_maybe_null() &&
+          !too_many_traps(Deoptimization::Reason_speculate_null_check)) {
+        inc_sp(1);
+        Node* null_ctl = top();
+        b = null_check_oop(b, &null_ctl, true, true, true);
+        assert(null_ctl->is_top(), "no null control here");
+        dec_sp(1);
+      } else if (_gvn.type(b)->speculative_always_null() &&
+                 !too_many_traps(Deoptimization::Reason_speculate_null_assert)) {
+        inc_sp(1);
+        b = null_assert(b);
+        dec_sp(1);
+      }
+      c = _gvn.transform( new CmpPNode(b, a) );
+    }
     do_ifnull(btest, c);
     break;
 
   case Bytecodes::_if_acmpeq: btest = BoolTest::eq; goto handle_if_acmp;
   case Bytecodes::_if_acmpne: btest = BoolTest::ne; goto handle_if_acmp;
   handle_if_acmp:
     // If this is a backwards branch in the bytecodes, add Safepoint
     maybe_add_safepoint(iter().get_dest());
     a = pop();
     b = pop();
-    c = _gvn.transform( new CmpPNode(b, a) );
-    c = optimize_cmp_with_klass(c);
-    do_if(btest, c);
+    do_acmp(btest, b, a);
     break;
 
   case Bytecodes::_ifeq: btest = BoolTest::eq; goto handle_ifxx;
   case Bytecodes::_ifne: btest = BoolTest::ne; goto handle_ifxx;
   case Bytecodes::_iflt: btest = BoolTest::lt; goto handle_ifxx;
@@ -2717,11 +3517,11 @@
     break;
   case Bytecodes::_instanceof:
     do_instanceof();
     break;
   case Bytecodes::_anewarray:
-    do_anewarray();
+    do_newarray();
     break;
   case Bytecodes::_newarray:
     do_newarray((BasicType)iter().get_index());
     break;
   case Bytecodes::_multianewarray:
