Web Process crash when starting the web inspector after r174025.
<https://webkit.org/b/137340>

Reviewed by Filip Pizlo.

After r174025, we can generate a bad graph in the DFG fixup phase like so:

    102:<!0:-> StoreBarrier(Check:KnownCell:@19, ..., bc#44)
    60:<!0:->  PutStructure(Check:KnownCell:@19, ..., bc#44)
    103:<!0:-> Check(Check:NotCell:@54, ..., bc#44)
            // ^-- PutByOffset's StoreBarrier has been elided and replaced
            //     with a speculation check which can OSR exit.
    61:<!0:->  PutByOffset(Check:KnownCell:@19, ..., bc#44)

As a result, the structure change will get executed even if we end up OSR
exiting before the PutByOffset.  In the baseline JIT code, the structure now
erroneously tells the put operation that there is a value in that property
slot when it is actually uninitialized (hence, the crash).

The fix is to insert the Check at the earliest point possible:

1. If the checked node is in the same bytecode as the PutByOffset, then
   the earliest point where we can insert the Check is right after the
   checked node.

2. If the checked node is from a preceding bytecode (before the PutByOffset),
   then the earliest point where we can insert the Check is at the start
   of the current bytecode.

Also reverted the workaround from r174749: https://webkit.org/b/137758.

Benchmark results appear to be a wash on aggregate.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::indexOfNode):
(JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::insertCheck):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertOutOfOrder):
(JSC::DFG::InsertionSet::insertOutOfOrderNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@174856 268f45cc-cd09-0410-ab3c-d52691b4dbfc