Move type transition before use processing in backward pass.

When we insert type transitions, we need to know whether an aux slot
pointer is in use so that we can correctly generate
AdjustObjTypeReloadAyxSlotPtr intrs. Since use processing can clear aux
slot syms from the upward exposed set, we move type transitions before
use processing.

Author: Kevin Smith

lib/Backend/BackwardPass.cpp

@@ -3062,6 +3062,11 @@ BackwardPass::ProcessBlock(BasicBlock * block)
             TrackFloatSymEquivalence(instr);
         }
 
+        if (this->tag == Js::DeadStorePhase && block->stackSymToFinalType != nullptr)
+        {
+            this->InsertTypeTransitionsAtPotentialKills();
+        }
+
         opnd = instr->GetSrc1();
         if (opnd != nullptr)
         {
@@ -3738,11 +3743,6 @@ BackwardPass::ProcessBlock(BasicBlock * block)
                 "We didn't remove lazy bailout after prepass even though we don't need it?"
             );
 
-            if (block->stackSymToFinalType != nullptr)
-            {
-                this->InsertTypeTransitionsAtPotentialKills();
-            }
-
             // NoImplicitCallUses transfers need to be processed after determining whether implicit calls need to be disabled
             // for the current instruction, because the instruction where the def occurs also needs implicit calls disabled.
             // Array value type for the destination needs to be updated before transfers have been processed by

test/Optimizer/aux_slot_type_transition.js

@@ -0,0 +1,25 @@
+function test0(){
+  function f() { obj.p9 = obj.p1 }
+  let obj = {};
+  obj.p1 = null;
+  obj.p2 = null;
+  obj.p3 = null;
+  obj.p4 = null;
+  obj.p5 = null;
+  obj.p6 = null;
+  obj.p7 = null;
+  obj.p8 = null;
+  f();
+  +obj.p9;
+};
+
+// generate profile
+test0();
+
+// Run Simple JIT
+test0();
+
+// run JITted code
+test0();
+
+print("Pass");

test/Optimizer/rlexe.xml

@@ -1605,4 +1605,10 @@
       <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -force:inline</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>aux_slot_type_transition.js</files>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1</compile-flags>
+    </default>
+  </test>
 </regress-exe>