[JSC] DFG iterator_next / iterator_open should emit Phantom for uses before emitting ForceOSRExit

https://bugs.webkit.org/show_bug.cgi?id=309204
rdar://171766191

Reviewed by Keith Miller.

If we would like to emit ForceOSRExit in ByteCodeParser, we need to put
Phantom to make sure that used locals are alive in DFG. Otherwise, DFG
thinks that this is dead, and emitting undefined when OSR happens.

Test: JSTests/stress/iterator-next-liveness.js

* JSTests/stress/iterator-next-liveness.js: Added.
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):

Canonical link: https://commits.webkit.org/308677@main

Author: Constellation

JSTests/stress/iterator-next-liveness.js

@@ -0,0 +1,12 @@
+const len = 500; // seems to happen most frequently between about 500-2000
+const es = new Array(len);
+const fs = new Array(len);
+const as = [
+  ['foo', [1]],
+  ['foo', [1, 2]]
+];
+for (const [a, [b, c, d]] of as) {
+  for (const e of es) {
+    for (const f of fs) {}
+  }
+}

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -9286,6 +9286,8 @@ void ByteCodeParser::parseBlock(unsigned limit)
             if (!generatedCase) {
                 Node* result = jsConstant(JSValue());
                 addToGraph(ForceOSRExit);
+                addToGraph(Phantom, get(bytecode.m_symbolIterator));
+                addToGraph(Phantom, get(bytecode.m_iterable));
                 set(bytecode.m_iterator, result);
                 set(bytecode.m_next, result);
 
@@ -9533,6 +9535,9 @@ void ByteCodeParser::parseBlock(unsigned limit)
             if (!generatedCase) {
                 Node* result = jsConstant(JSValue());
                 addToGraph(ForceOSRExit);
+                addToGraph(Phantom, get(bytecode.m_next));
+                addToGraph(Phantom, get(bytecode.m_iterator));
+                addToGraph(Phantom, get(bytecode.m_iterable));
                 set(bytecode.m_value, result);
                 set(bytecode.m_done, result);