LibJS: Don't mark blocks for unification multiple times

This would cause a UAF otherwise

1 files changed, 2 insertions, 0 deletions

diff --git a/Userland/Libraries/LibJS/Bytecode/Pass/UnifySameBlocks.cpp b/Userland/Libraries/LibJS/Bytecode/Pass/UnifySameBlocks.cpp
index 184c3fe86c..9fcbd00466 100644
--- a/Userland/Libraries/LibJS/Bytecode/Pass/UnifySameBlocks.cpp
+++ b/Userland/Libraries/LibJS/Bytecode/Pass/UnifySameBlocks.cpp
@@ -24,6 +24,8 @@ void UnifySameBlocks::perform(PassPipelineExecutable& executable)
         auto& block = executable.executable.basic_blocks[i];
         auto block_bytes = block.instruction_stream();
         for (auto& candidate_block : executable.executable.basic_blocks.span().slice(i + 1)) {
+            if (equal_blocks.contains(&*candidate_block))
+                continue;
             // FIXME: This can probably be relaxed a bit...
             if (candidate_block->size() != block.size())
                 continue;