This fixes a use-after-free in JavaScriptCore’s B3 optimizer between strength reduction’s select specialization and pure common-subexpression elimination (PureCSE). When reduceStrength specializes a Select that reaches a Check within selectSpecializationBound, it splits the block and processes the values between the source and the Check; Void values in that range (such as an intermediate Check) are removed from the block with m_proc.deleteValue(value).

Before the fix, those deleted Values were not removed from the PureCSE map (B3PureCSE::m_map stores raw Value* keyed by ValueKey), so a later CSE lookup (findMatch) on a matching key could return a pointer to an already-deleted Value and the compiler would dereference it — a use-after-free during compilation.

The fix adds PureCSE::remove(key, value) and calls it before deleteValue for the Void case; it also computes the ValueKey BEFORE cloneValue mutates the Value (the added comment notes this), so the correct key is removed.

The restored invariant is that the PureCSE map never retains a pointer to a freed Value. The new B3 unit test testCheckSelectAndDeadCheckCSE reproduces the pattern (a Select with a constant arm, an intermediate Check, and a later Check on the same condition that is a CSE candidate). Established by the diff.

A use-after-free during JIT compilation of attacker-controlled JavaScript. Compile-time UAFs in JSC are high-value: the attacker shapes both the freed object and the reuse, and the corruption occurs inside the engine’s own compiler, historically a reliable route to arbitrary read/write and code execution within the WebContent process.