[MERGE #6190 @zenparsing] Move type transitions above def processing in backward pass

Merge pull request #6190 from zenparsing:adjust-slot-redux

Author: Kevin Smith

lib/Backend/BackwardPass.cpp

@@ -3021,6 +3021,11 @@ BackwardPass::ProcessBlock(BasicBlock * block)
 
         bool hasLiveFields = (block->upwardExposedFields && !block->upwardExposedFields->IsEmpty());
 
+        if (this->tag == Js::DeadStorePhase && block->stackSymToFinalType != nullptr)
+        {
+            this->InsertTypeTransitionsAtPotentialKills();
+        }
+
         IR::Opnd * opnd = instr->GetDst();
         if (opnd != nullptr)
         {
@@ -3069,11 +3074,6 @@ BackwardPass::ProcessBlock(BasicBlock * block)
             TrackFloatSymEquivalence(instr);
         }
 
-        if (this->tag == Js::DeadStorePhase && block->stackSymToFinalType != nullptr)
-        {
-            this->InsertTypeTransitionsAtPotentialKills();
-        }
-
         opnd = instr->GetSrc1();
         if (opnd != nullptr)
         {

test/Optimizer/aux_slot_type_transition_2.js

@@ -0,0 +1,16 @@
+// -maxinterpretcount:1 -maxsimplejitruncount:1 -bgjit-
+function test() {
+  var f = function () {};
+  f.p1 = 1;
+  (function () {
+    Object.defineProperty(f, 'length', { writable: true });
+    f.length = undefined;
+    f.p2 = 2;
+  }());
+}
+
+test();
+test();
+test();
+
+print('Pass');

test/Optimizer/rlexe.xml

@@ -1617,4 +1617,10 @@
       <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>aux_slot_type_transition_2.js</files>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1</compile-flags>
+    </default>
+  </test>
 </regress-exe>