Better fix for #5950: only update ByteCodeUpwardExposedUsed when instr branches to its own bc offset when branch is also to a different block

lib/Backend/BackwardPass.cpp

@@ -2675,10 +2675,9 @@ BackwardPass::ProcessBailOutInfo(IR::Instr * instr, BailOutInfo * bailOutInfo)
                 uint32 targetOffset = target->GetByteCodeOffset();
 
                 // If the instr's label has the same bytecode offset as the instr then move the targetOffset
-                // to the next bytecode instr. This condition can be true on conditional branches, ex: a
-                // while loop with no body (passing the loop's condition would branch the IP back to executing
-                // the loop's condition), in these cases do not move the targetOffset.
-                if (targetOffset == instr->GetByteCodeOffset() && branchInstr->IsUnconditional())
+                // to the next bytecode instr. This can happen when we have airlock blocks or compensation
+                // code, but also for infinite loops. Don't do it for the latter.
+                if (targetOffset == instr->GetByteCodeOffset() && block != target->GetBasicBlock())
                 {
                     // This can happen if the target is a break or airlock block.
                     Assert(

test/FlowGraph/byteCodeUpwardExposedUsed.js

@@ -0,0 +1,71 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function test0() {
+    var IntArr0 = [1];
+    var strvar0 = '';
+    function v1() {
+        var __loopvar1000 = function () {
+            try {
+            } finally {
+            }
+            LABEL0:
+            for (_strvar0 in IntArr0) {
+                switch (strvar0) {
+                    default:
+                        break LABEL0;
+                    case 'Æ':
+                }
+            }
+        }();
+    }
+    v1();
+}
+test0();
+test0();
+
+function test1() {
+    var IntArr0 = [];
+    var VarArr0 = [''];
+    var strvar0 = '';
+    LABEL1:
+    for (; ;) {
+        for (var _strvar0 of IntArr0) {
+        }
+        switch (strvar0) {
+            default:
+                break LABEL1;
+            case '+':
+        }
+    }
+    async function func183() {
+        class class35 {
+            static func219(argMath271 = Math.acos(strvar0 + 21623524.9) - b) {
+                class class42 extends BaseClass {
+                    constructor() {
+                    }
+                    func221() {
+                        if (false) {
+                        }
+                    }
+                    static func223() {
+                        fPolyProp = function () {
+                            if (undefined) {
+                            }
+                        };
+                    }
+                }
+                for (_strvar3 of VarArr0) {
+                    strvar7.concat(IntArr1.push(obj0, a instanceof ('AsyncFunction' ? func4 : Object), ary));
+                }
+            }
+        }
+    }
+}
+test1();
+test1();
+test1();
+
+console.log("PASSED");

test/FlowGraph/rlexe.xml

@@ -24,4 +24,10 @@
       <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -bgjit- -oopjit- -off:jitloopbody</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>byteCodeUpwardExposedUsed.js</files>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -bgjit- -oopjit-</compile-flags>
+    </default>
+  </test>
 </regress-exe>