crash in BackwardPass::ReverseCopyProp

[zhunki]

the following poc will crash the latest build on ubuntu.

function opt() {
	let v4 = 9;
	for (let v5 = 0; v5 < v4; v5 = v5 / v4) {
		v4 = v5;
	}
	const v6 = v4--;
}
for(i = 0;i < 1000; i++){
	opt();
}

#0 0x0000555555e96e6d in BackwardPass::ReverseCopyProp(IR::Instr*) ()
#1 0x0000555555e90fb5 in BackwardPass::ProcessBlock(BasicBlock*) ()
#2 0x0000555555e8d66d in BackwardPass::OptBlock(BasicBlock*) ()
#3 0x0000555555e8cf1e in BackwardPass::Optimize() ()
#4 0x0000555555d485ca in GlobOpt::BackwardPass(Js::Phase) ()
#5 0x0000555555d488a8 in GlobOpt::Optimize() ()
#6 0x0000555555d4155f in Func::TryCodegen() ()
#7 0x0000555555d4125c in Func::Codegen(Memory::JitArenaAllocator*, JITTimeWorkItem*, ThreadContextInfo*, ScriptContextInfo*, JITOutputIDL*, Js::EntryPointInfo*, FunctionJITRuntimeInfo const*, JITTimePolymorphicInlineCacheInfo*, void*, Js::ScriptContextProfiler*, bool) ()
#8 0x0000555555cc0e29 in NativeCodeGenerator::CodeGen(Memory::PageAllocatorBase<Memory::VirtualAllocWrapper, Memory::SegmentBaseMemory::VirtualAllocWrapper, Memory::PageSegmentBaseMemory::VirtualAllocWrapper >, CodeGenWorkItemIDL, JITOutputIDL&, bool, Js::EntryPointInfo*) ()
#9 0x0000555555cc10cd in NativeCodeGenerator::CodeGen(Memory::PageAllocatorBase<Memory::VirtualAllocWrapper, Memory::SegmentBaseMemory::VirtualAllocWrapper, Memory::PageSegmentBaseMemory::VirtualAllocWrapper >, CodeGenWorkItem, bool) ()
#10 0x0000555555cc1953 in NativeCodeGenerator::Process(JsUtil::Job*, JsUtil::ParallelThreadData*) ()
#11 0x0000555555cd4a0e in JsUtil::BackgroundJobProcessor::Process(JsUtil::Job*, JsUtil::ParallelThreadData*) ()
#12 0x0000555555cd4b15 in JsUtil::BackgroundJobProcessor::Run(JsUtil::ParallelThreadData*) ()
#13 0x0000555555cd3a47 in JsUtil::BackgroundJobProcessor::StaticThreadProc(void*) ()
#14 0x000055555571f9fd in CorUnix::CPalThread::ThreadEntry(void*) ()
#15 0x00007ffff7aa2609 in start_thread (arg=) at pthread_create.c:477
#16 0x00007ffff7857293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[ppenzin]

Can confirm this is happening.