Fix issue 16103 (VM crash): incorrect merging of sin/cos.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
 #include "vm/dart_entry.h"
 #include "vm/flow_graph_builder.h"
@@ skipping 403 matching lines @@
             curr_instr,
             MergedMathInstr::ResultIndexOf(curr_instr->kind()),
             kTypedDataFloat64ArrayCid);
         AppendLoadIndexedForMerged(
             other_op,
             MergedMathInstr::ResultIndexOf(other_op->kind()),
             kTypedDataFloat64ArrayCid);
         ZoneGrowableArray<Value*>* args = new ZoneGrowableArray<Value*>(1);
         args->Add(new Value(curr_instr->value()->definition()));
 
-        // Replace with TruncDivMod.
-        MergedMathInstr* div_mod = new MergedMathInstr(
+        // Replace with SinCos.
+        MergedMathInstr* sin_cos = new MergedMathInstr(
             args,
             curr_instr->DeoptimizationTarget(),
             MergedMathInstr::kSinCos);
-        curr_instr->ReplaceWith(div_mod, current_iterator());
-        other_op->ReplaceUsesWith(div_mod);
+        curr_instr->ReplaceWith(sin_cos, current_iterator());
+        other_op->ReplaceUsesWith(sin_cos);
         other_op->RemoveFromGraph();
+        // Only one merge possible. Because canonicalization happens later,
+        // more candidates are possible.
+        // TODO(srdjan): Allow merging of sin/cos into sincos.
+        break;
       }
     }
   }
 }
 
 
 // Optimize (a << b) & c pattern: if c is a positive Smi or zero, then the
 // shift can be a truncating Smi shift-left and result is always Smi.
 // Merging occurs only per basic-block.
 void FlowGraphOptimizer::TryOptimizePatterns() {
@@ skipping 7881 matching lines @@
   }
 
   // Insert materializations at environment uses.
   for (intptr_t i = 0; i < exits.length(); i++) {
     CreateMaterializationAt(exits[i], alloc, alloc->cls(), *fields);
   }
 }
 
 
 }  // namespace dart