[MERGE #6085 @meg-gupta] OS#19078643: Fix constant branch folding when equal sources can be Undefined

Merge pull request #6085 from meg-gupta:fixundefined

We constant fold branches with same sources. The outcome of this folding is different when the source has a valueType of Undefined.
Previously, we checked for this case with ValueType::IsUndefined. But this check does not include valueTypes like - Undefined | Boolean, in which case we cannot constant fold.
With this fix, we handle the case where we can have a definite valueType which could be Undefined.

Author: Meghana Gupta

lib/Backend/GlobOpt.cpp

@@ -6666,7 +6666,8 @@ GlobOpt::CanProveConditionalBranch(IR::Instr *instr, Value *src1Val, Value *src2
             {
                 return undefinedCmp;
             }
-            return val1->GetValueInfo()->IsPrimitive() && val1->GetValueInfo()->IsNotFloat();
+            ValueInfo * valInfo = val1->GetValueInfo();
+            return !valInfo->HasBeenUndefined() && valInfo->IsPrimitive() && valInfo->IsNotFloat();
         }
         return false;
     };

test/Optimizer/bugconstfoldundefined.baseline

@@ -0,0 +1 @@
+1,6333966881283110000

test/Optimizer/bugconstfoldundefined.js

@@ -0,0 +1,38 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+var obj1 = {};
+var litObj1 = {};
+var func1 = function () {
+  if (ary.push(arguments[0])) {
+  }
+};
+obj1.method0 = func1;
+var ary = Array();
+var FloatArr0 = [
+  6333966881283110000,
+  1
+];
+var VarArr0 = Array();
+var v3 = 0;
+function v4() {
+  return caller1_bar();
+}
+function v5() {
+  return v4();
+}
+function caller1_bar() {
+  v3++;
+  if (v3 < 10) {
+    v4();
+    var id33 = {} instanceof Boolean;
+  }
+  if (ary.shift(), (obj1.method0.call(litObj1, FloatArr0), id33 <= id33 ? VarArr0 : FloatArr0.reverse())) {
+  }
+}
+v5();
+WScript.Echo(ary.slice().reduce(function () {
+}));
+

test/Optimizer/rlexe.xml

@@ -1567,6 +1567,14 @@
       <tags>exclude_dynapogo,exclude_nonative</tags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bugconstfoldundefined.js</files>
+      <baseline>bugconstfoldundefined.baseline</baseline>
+      <compile-flags>-maxinterpretcount:6 -maxsimplejitruncount:4 -werexceptionsupport -oopjit-  -mic:1 -off:simplejit -forcejitloopbody</compile-flags>
+      <tags>exclude_dynapogo,exclude_nonative</tags>
+    </default>
+  </test>
   <test>
     <default>
       <files>bcebug.js</files>