Bug 263520

Hello, I found a bug related to Abstract Interpreter in JSC. =================test.js================ function f0() { const v6 = arguments[-6]; print(v6) } for (let v11 = 0; v11 < 99; v11++) { f0(1); for (let v13 = 0; v13 < 100; v13++) { for (let v14 = 0; v14 < 101 ; v14++) {} } } ========================================= Run args: ./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=0.1 JSC should print 99 "undefined", but it prints 2 "undefined" and 97 "1"(arguments[0]) actually. I found the problem is in DFGAbstractInterpreterInlines.h when AI handles GetMyArgumentsByVal node. AI ignores the situation where the index is negative when callee is inlined and computes wrong result for GetMyArgumentsByVal.