Bug 264078 – Abstract Interpreter computes wrong value for GetLocal

• Component: JavaScriptCore
• Status: RESOLVED WORKSFORME

[EntryHi]

=================test.js==================
function f0() {
  function f4() {
    return f4;
  }
  for (let v23 = 0; v23 < 10; v23++) {
    print(v23)
    function f24(a25, ...a26) {
      const v27 = [...a26];
      for (let v28 = 0; v28 < 100; v28++) {}
      v27.hasInstance;
    }
    f24();
  }
  f4();
}


for (let v32 = 0; v32 < 10; v32++) {
  f0();
}
==========================================

Run args: ./jsc -f test.js --useConcurrentJIT=0  --jitPolicyScale=0

JSC always prints '0' for `v23`. Actually, v23 is 0~9.

This bug may be related to Abstract Interpreter and DFG constant folding.

Abstract Interpreter computes wrong value for node GetLocal.
DFGAbstractInterpreterInlines.h
```
    case GetLocal: {
        VariableAccessData* variableAccessData = node->variableAccessData();
        AbstractValue value = m_state.operand(variableAccessData->operand()); // value=0, because of a SetLocal before the GetLocal
        DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(variableAccessData->flushFormat())));
        if (value.value())
            m_state.setShouldTryConstantFolding(true);
        setForNode(node, value);
        break;
    }
    ...
    case SetLocal: {
        m_state.operand(node->operand()) = forNode(node->child1());
        break;
    }
```
However, the value of GetLocal can be modified by SetLocal after the GetLocal becuase of the loop back edge, but AI ignores this situation.
In this way, DFG constant folding converts GetLocal to PhantomLocal and Constant.
DFGConstantFoldingPhase.cpp
```
            FrozenValue* value = m_graph.freeze(m_state.forNode(node).value())；//value=0
            if (!*value)
                continue;
            
            if (node->op() == GetLocal) {
                m_insertionSet.insertNode(
                    indexInBlock, SpecNone, PhantomLocal, node->origin,
                    OpInfo(node->variableAccessData()));
                m_graph.dethread();
            } else
                m_insertionSet.insertCheck(m_graph, indexInBlock, node);
            m_graph.convertToConstant(node, value); // constant 0 
```

[Radar WebKit Bug Importer]

<rdar://problem/118153042>

[Yusuke Suzuki]

OK, it looks like it is fixed via some of similar DFG AI fixes.