ASSERTION in m_graph[tailNodeIndex].op() == Flush || m_graph[tailNodeIndex].op() == SetLocal on plus.google.com
https://bugs.webkit.org/show_bug.cgi?id=97656

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

There were two bugs here:
        
1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,
   rather than the last, of the GetLocals into the vars-at-tail table.
        
2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the
   vars-at-tail table, when for captured variables only the last of those should be.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getLocal):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests: 

* fast/js/dfg-redundant-load-of-captured-variable-proven-constant-expected.txt: Added.
* fast/js/dfg-redundant-load-of-captured-variable-proven-constant.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-redundant-load-of-captured-variable-proven-constant.js: Added.
(o.f):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129948 268f45cc-cd09-0410-ab3c-d52691b4dbfc