[MERGE #5395 @paolosevMSFT] OS#17614914 - SCCLiveness::ProcessStackSymUse lifetime nullptr deref

Merge pull request #5395 from paolosevMSFT:17614914

In bug 17614914 JIT is causing a bad code gen, but the root problem is that with a script like:

```
Object.prototype.length = undefined;
var ary = new Array();
var func0 = function() {
    for (var _strvar2 in ary) {
        console.log(_strvar2);
    }
};
func0();
```

a built-in property like Array.length should not be enumerated even if it is defined in Object.prototype.
This PR fixes this problem by ignoring the builtin properties in ForInObjectEnumerator::MoveAndGetNext().

Author: paolosevMSFT

lib/Runtime/Library/ForInObjectEnumerator.cpp

@@ -210,6 +210,8 @@ namespace Js
                     return nullptr;
                 }
 
+                RecyclableObject* previousObject = this->shadowData->currentObject;
+
                 RecyclableObject * object;
                 if (!this->enumeratingPrototype)
                 {
@@ -249,6 +251,21 @@ namespace Js
                     }
                 }
                 while (true);
+
+                // Ignore special properties (ex: Array.length)
+                if (previousObject != nullptr)
+                {
+                    uint specialPropertyCount = previousObject->GetSpecialPropertyCount();
+                    if (specialPropertyCount > 0)
+                    {
+                        PropertyId const* specialPropertyIds = previousObject->GetSpecialPropertyIds();
+                        Assert(specialPropertyIds != nullptr);
+                        for (uint i = 0; i < specialPropertyCount; i++)
+                        {
+                            TestAndSetEnumerated(specialPropertyIds[i]);
+                        }
+                    }
+                }
             }
         }
     }

test/Bugs/bug_OS17614914.js

@@ -0,0 +1,18 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+Object.prototype.length = undefined;
+var ary = Array();
+ary.prop1 = 1;
+Object.defineProperty(ary, "prop2", {
+    value: 1,
+    enumerable: false
+});
+for (var prop in ary) {
+    if (prop !== "prop1") {
+        console.log(`Fail: ${prop} property should not show in for-in`);
+    }
+}
+console.log("pass");

test/Bugs/rlexe.xml

@@ -501,4 +501,9 @@
       <files>withSplitScope.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_OS17614914.js</files>
+    </default>
+  </test>  
 </regress-exe>