AI rule for MultiPutByOffset executes its effects in the wrong order

[Saam Barati]

Look at this code:
```
        observeTransitions(clobberLimit, transitions);
        if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
            m_state.setIsValid(false);
        setForNode(node->child2(), resultingValue);
        if (!!originalValue && !resultingValue)
            m_state.setIsValid(false);
```

However, we first need to execute the last three lines before the first three lines. This is because that's how the execution of the node happens at runtime. This can lead to bad results when resultingValue is the same as the base, e.g:
```
o.f = o;
```

[Saam Barati]

<rdar://problem/43535257>

[Saam Barati]

Created attachment 350139 [details]
patch

[Michael Saboff]

Comment on attachment 350139 [details]
patch

r=me

[WebKit Commit Bot]

Comment on attachment 350139 [details]
patch

Clearing flags on attachment: 350139

Committed r236223: <https://trac.webkit.org/changeset/236223>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Mark Lam]

*** Bug 188694 has been marked as a duplicate of this bug. ***