--- a/hotspot/src/share/vm/opto/cfgnode.cpp	Tue Jan 12 14:55:15 2016 +0000
+++ b/hotspot/src/share/vm/opto/cfgnode.cpp	Mon Jan 18 21:34:28 2016 +0100
@@ -1171,9 +1171,7 @@
 Node* PhiNode::unique_input(PhaseTransform* phase, bool uncast) {
   //  1) One unique direct input,
   // or if uncast is true:
-  //  2) some of the inputs have an intervening ConstraintCast and
-  //     the type of input is the same or sharper (more specific)
-  //     than the phi's type.
+  //  2) some of the inputs have an intervening ConstraintCast
   //  3) an input is a self loop
   //
   //  1) input   or   2) input     or   3) input __
@@ -1193,7 +1191,21 @@
     Node* n = in(i);
     if (n == NULL)
       continue;
-    Node* un = uncast ? n->uncast() : n;
+    Node* un = n;
+    if (uncast) {
+#ifdef ASSERT
+      Node* m = un->uncast();
+#endif
+      while (un != NULL && un->req() == 2 && un->is_ConstraintCast()) {
+        Node* next = un->in(1);
+        if (phase->type(next)->isa_rawptr() && phase->type(un)->isa_oopptr()) {
+          // risk exposing raw ptr at safepoint
+          break;
+        }
+        un = next;
+      }
+      assert(m == un || un->in(1) == m, "Only expected at CheckCastPP from allocation");
+    }
     if (un == NULL || un == this || phase->type(un) == Type::TOP) {
       continue; // ignore if top, or in(i) and "this" are in a data cycle
     }

--- a/hotspot/src/share/vm/opto/node.hpp	Tue Jan 12 14:55:15 2016 +0000
+++ b/hotspot/src/share/vm/opto/node.hpp	Mon Jan 18 21:34:28 2016 +0100
@@ -655,7 +655,7 @@
       DEFINE_CLASS_ID(Phi,   Type, 0)
       DEFINE_CLASS_ID(ConstraintCast, Type, 1)
         DEFINE_CLASS_ID(CastII, ConstraintCast, 0)
-      DEFINE_CLASS_ID(CheckCastPP, Type, 2)
+        DEFINE_CLASS_ID(CheckCastPP, ConstraintCast, 1)
       DEFINE_CLASS_ID(CMove, Type, 3)
       DEFINE_CLASS_ID(SafePointScalarObject, Type, 4)
       DEFINE_CLASS_ID(DecodeNarrowPtr, Type, 5)

--- a/hotspot/test/compiler/c2/8007294/Test8007294.java	Tue Jan 12 14:55:15 2016 +0000
+++ b/hotspot/test/compiler/c2/8007294/Test8007294.java	Mon Jan 18 21:34:28 2016 +0100
@@ -24,6 +24,7 @@
 /*
  * @test
  * @bug 8007294
+ * @bug 8146999
  * @summary ReduceFieldZeroing doesn't check for dependent load and can lead to incorrect execution
  * @run main/othervm -XX:+IgnoreUnrecognizedVMOptions -XX:+AlwaysIncrementalInline -XX:-UseOnStackReplacement -XX:-BackgroundCompilation Test8007294
  *
@@ -82,6 +83,7 @@
             }
         }
         for (int i = 0; i < 20000; i++) {
+            test2(0);  // pollute profile
             int res = test2(1);
             if (res != 2) {
                 System.out.println("FAILED test2 = " + res);