FrameState should use canonical values when refining locals.

Summary: If we build IR as follows:

B0:
  t1:Arr = LdLoc<Arr, 0> t0:FramePtr
  t2:Arr = AssertType<Cell> t1:Arr

B1:
  t3:Arr=PackedKind = AssertType<Arr=PackedKind> t2:Arr

then IRBuilder::reoptimize will turn it into:

B0:
  t1:Arr = LdLoc<Arr, 0> t0:FramePtr
  t2:Arr = Mov t1:Arr

B1:
  t3:Arr=PackedKind = AssertType<Arr=PackedKind> t1:Arr

which is a problem for fixed-point FrameState as it would say that the
value of local 0 at the start of B1 is t2, but reoptimize will replace
all uses of t2 with t1 as it's running copyProp on each
instruction. This gets us in trouble in B1 because FrameState will not
realize that the new value of the local is t3.

To fix this, just make FrameState use canonical values when walking locals.

Reviewed By: @ottoni

Differential Revision: D1647937

Signature: t1:1647937:1414692383:33fa9ae714c0bd8d378a852961fd9216853f4774