RewriteStatepointsForGC collects parse points for further processing. During the collection if a callsite is found in an unreachable block (DominatorTree::isReachableFromEntry()) then all unreachable blocks are removed by removeUnreachableBlocks(). Some of the removed blocks could have been reachable according to DominatorTree::isReachableFromEntry(). In this case the collected parse points became stale and resulted in a crash when accessed.
The fix does the following: if a parse point is detected in an unreachable block then the removeUnreachableBlocks() method is called, the DominatorTree is updated and all parse points are collected again.
The proposed test crashes with the old version and passes with the new.