Do PathDepBranchFolding at the end of OptBlock, this will avoid redandant creation of values in local table in addition to global table for the initial block.

Also fix bug - when LdFld value was not found in the value table, it means its value was killed due to call which can be calling Object.defineProperty, dont skip such a LdFld

Author: Meghana Gupta

lib/Backend/FlowGraph.cpp

@@ -4524,9 +4524,7 @@ static bool IsCopyTypeInstr(IR::Instr *instr)
     case Js::OpCode::LdC_A_I4:
     case Js::OpCode::Ld_I4:
     case Js::OpCode::Ld_A:
-    case Js::OpCode::StFld:
-    case Js::OpCode::LdFld:
-    case Js::OpCode::InitFld: return true;
+    case Js::OpCode::LdFld: return true;
     default:
         return false;
     }
@@ -4686,30 +4684,6 @@ BasicBlock::CheckLegalityAndFoldPathDepBranches(GlobOpt* globOpt)
         {
             unskippedInlineeEnd = currentInlineeEnd = instr;
         }
-        else if (instr->GetDst())
-        {
-            if (instr->GetDst()->GetSym())
-            {
-                if (IsCopyTypeInstr(instr))
-                {
-                    UpdateValueForCopyTypeInstr(instr);
-                }
-                else if(instr->m_opcode == Js::OpCode::NewScObjectLiteral)
-                {
-                    Value **localValue = localSymToValueMap->FindOrInsertNew(instr->GetDst()->GetSym());
-                    if (instr->GetDst()->GetValueType() == ValueType::UninitializedObject)
-                    {
-                        *localValue = globOpt->NewGenericValue(ValueType::UninitializedObject, instr->GetDst());
-                    }
-                }
-                else
-                {
-                    // complex instr, can't track value, insert nullptr
-                    Value **localValue = localSymToValueMap->FindOrInsertNew(instr->GetDst()->GetSym());
-                    *localValue = nullptr;
-                }
-            }
-        }
     } NEXT_INSTR_IN_BLOCK;
 
     IR::Instr * instr = this->GetLastInstr();
@@ -4750,6 +4724,13 @@ BasicBlock::CheckLegalityAndFoldPathDepBranches(GlobOpt* globOpt)
             if (IsCopyTypeInstr(instr))
             {
                 UpdateValueForCopyTypeInstr(instr);
+
+                Value *dstValue = UpdateValueForCopyTypeInstr(instr);
+                if (instr->m_opcode == Js::OpCode::LdFld && !dstValue)
+                {
+                    // We cannot skip a LdFld if we didnt find its valueInfo in the localValueTable
+                    return;
+                }
             }
             else
             {
@@ -4850,6 +4831,14 @@ BasicBlock::CheckLegalityAndFoldPathDepBranches(GlobOpt* globOpt)
             if (currentInlineeEnd != nullptr && currentInlineeEnd != unskippedInlineeEnd)
             {
                 this->GetLastInstr()->InsertBefore(currentInlineeEnd->Copy());
+                if (currentInlineeEnd->m_func->m_hasInlineArgsOpt)
+                {
+                    globOpt->RecordInlineeFrameInfo(currentInlineeEnd);
+                }
+                globOpt->EndTrackingOfArgObjSymsForInlinee();
+
+                Assert(globOpt->currentBlock->globOptData.inlinedArgOutSize >= currentInlineeEnd->GetArgOutSize(/*getInterpreterArgOutCount*/ false));
+                globOpt->currentBlock->globOptData.inlinedArgOutSize -= currentInlineeEnd->GetArgOutSize(/*getInterpreterArgOutCount*/ false);
                 currentInlineeEnd = nullptr;
             }
             // We are adding an unconditional branch, go over all the current successors and remove the ones that are dead now

lib/Backend/GlobOpt.cpp

@@ -475,7 +475,6 @@ GlobOpt::OptBlock(BasicBlock *block)
     PrepareLoopArrayCheckHoist();
 
     block->MergePredBlocksValueMaps(this);
-    block->PathDepBranchFolding(this);
 
     this->intOverflowCurrentlyMattersInRange = true;
     this->intOverflowDoesNotMatterRange = this->currentBlock->intOverflowDoesNotMatterRange;
@@ -613,6 +612,8 @@ GlobOpt::OptBlock(BasicBlock *block)
         }
     }
 
+    block->PathDepBranchFolding(this);
+
 #if DBG
     // The set of live lossy int32 syms should be a subset of all live int32 syms
     this->tempBv->And(block->globOptData.liveInt32Syms, block->globOptData.liveLossyInt32Syms);
@@ -6776,8 +6777,6 @@ GlobOpt::CanProveConditionalBranch(IR::Instr *instr, Value *src1Val, Value *src2
     }
     case Js::OpCode::BrFalse_I4:
     {
-        // this path would probably work outside of asm.js, but we should verify that if we ever hit this scenario
-        Assert(GetIsAsmJSFunc());
         constVal = 0;
         if (!src1Val->GetValueInfo()->TryGetIntConstantValue(&constVal))
         {