Currently we record the abstract values at the head of a block at the time that the backend runs. This causes weirdness if a subsequent run of the CFA proves less things (or different things) than a past run, and we had already performed optimizations based on the past run. The solution is to save the intersection of all proofs. This makes constant folding a lot easier to reason about.
Created attachment 233151 [details] the patch
Landed in http://trac.webkit.org/changeset/170016