Assertion failure: target->GetBasicBlock()->isAirLockBlock in ChakraCore/lib/Backend/BackwardPass.cpp, line 2702

## Version
commit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

## Platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

## Build
- Debug Mode

```
./build.sh --debug --static
```

## PoC
```
function opt(arg) {
arg == -1;
try {
do {} while (arg < 2);
} catch(e) {}
}
for (const i in "ab") {
for (let j = 0; j < 100; j++) {
opt();
}
}
```

## Execution steps & Output
```
./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js
ASSERTION 361628: (/home/wjm/ChakraCore/lib/Backend/BackwardPass.cpp, line 2702) target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource
Failure: (target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource)
Signal: SIGILL (Illegal instruction)
```
## Backtrace
```
(lldb) run
Process 361795 launched: '/home/wjm/ChakraCore/cmake-build-debug/ch' (x86_64)
ASSERTION 361795: (/home/wjm/ChakraCore/lib/Backend/BackwardPass.cpp, line 2702) target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource
Failure: (target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource)
Process 361795 stopped
* thread #1, name = 'ch', stop reason = signal SIGILL: illegal instruction operand
frame #0: 0x0000555556d3bafa ch`BackwardPass::ProcessBailOutInfo(this=0x00007fffffff8ac0, instr=0x00007ff7e7ba4be8, bailOutInfo=0x00007ff7e7ba4ac8) at BackwardPass.cpp:2696:21
2693 if (targetOffset == instr->GetByteCodeOffset() && block != target->GetBasicBlock())
2694 {
2695 // This can happen if the target is a break or airlock block.
-> 2696 Assert(
2697 target->GetBasicBlock()->isAirLockBlock ||
2698 target->GetBasicBlock()->isAirLockCompensationBlock ||
2699 target->GetBasicBlock()->isBreakBlock ||
(lldb) thread backtrace
* thread #1, name = 'ch', stop reason = signal SIGILL: illegal instruction operand
* frame #0: 0x0000555556d3bafa ch`BackwardPass::ProcessBailOutInfo(this=0x00007fffffff8ac0, instr=0x00007ff7e7ba4be8, bailOutInfo=0x00007ff7e7ba4ac8) at BackwardPass.cpp:2696:21
frame #1: 0x0000555556d3b6e4 ch`BackwardPass::ProcessBailOutInfo(this=0x00007fffffff8ac0, instr=0x00007ff7e7ba4be8) at BackwardPass.cpp:2195:23
frame #2: 0x0000555556d3685a ch`BackwardPass::ProcessBlock(this=0x00007fffffff8ac0, block=0x00007ff7e7ba3518) at BackwardPass.cpp:3024:96
frame #3: 0x0000555556d2f2bb ch`BackwardPass::OptBlock(this=0x00007fffffff8ac0, block=0x00007ff7e7ba3518) at BackwardPass.cpp:1711:11
frame #4: 0x0000555556d2ed1f ch`BackwardPass::Optimize(this=0x00007fffffff8ac0) at BackwardPass.cpp:430:15
frame #5: 0x0000555556b447a4 ch`GlobOpt::BackwardPass(this=0x00007fffffff97a0, tag=DeadStorePhase) at GlobOpt.cpp:160:18
frame #6: 0x0000555556b44ac9 ch`GlobOpt::Optimize(this=0x00007fffffff97a0) at GlobOpt.cpp:213:15
frame #7: 0x0000555556b262ab ch`Func::TryCodegen(this=0x00007fffffff9e50) at Func.cpp:457:21
frame #8: 0x0000555556b25ae0 ch`Func::Codegen(alloc=0x00007fffffffa410, workItem=0x00007ff7e7bf5030, threadContextInfo=0x0000555557eb7198, scriptContextInfo=0x0000555557ee9118, outputData=0x00007fffffffa850, epInfo=0x00007ff7e7c48120, runtimeInfo=0x0000000000000000, polymorphicInlineCacheInfo=0x00007ff7e7c3fa40, codeGenAllocators=0x0000555557ef7ae8, codeGenProfiler=0x0000000000000000, isBackgroundJIT=false) at Func.cpp:325:18
frame #9: 0x000055555690ef90 ch`NativeCodeGenerator::CodeGen(this=0x0000555557eea8e8, pageAllocator=0x0000555557eb7520, workItemData=0x0000555557ef6f60, jitWriteData=0x00007fffffffa850, foreground=true, epInfo=0x00007ff7e7c48120) at NativeCodeGenerator.cpp:890:9
frame #10: 0x0000555556910c28 ch`NativeCodeGenerator::CodeGen(this=0x0000555557eea8e8, pageAllocator=0x0000555557eb7520, workItem=0x0000555557ef6f38, foreground=true) at NativeCodeGenerator.cpp:1007:5
frame #11: 0x0000555556913a24 ch`NativeCodeGenerator::Process(this=0x0000555557eea8e8, job=0x0000555557ef6f40, threadData=0x0000000000000000) at NativeCodeGenerator.cpp:1907:13
frame #12: 0x00005555569b83d4 ch`JsUtil::ForegroundJobProcessor::Process(job=0x0000555557ef6f40) at Jobs.cpp:426:36
frame #13: 0x0000555556920e29 ch`void JsUtil::ForegroundJobProcessor::PrioritizeJobAndWait(this=0x0000555557ea2ce8, manager=0x0000555557eea8e8, holder=0x00007ff7e7c48120, function=0x00007ff7e7c76730) at Jobs.inl:207:36
frame #14: 0x00005555569182e4 ch`void JsUtil::JobProcessor::PrioritizeJobAndWait(this=0x0000555557ea2ce8, manager=0x0000555557eea8e8, holder=0x00007ff7e7c48120, function=0x00007ff7e7c76730) at Jobs.inl:81:58
frame #15: 0x0000555556912786 ch`NativeCodeGenerator::CheckCodeGen(function=0x00007ff7e7c76730) at NativeCodeGenerator.cpp:1644:37
frame #16: 0x0000555556978bac ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...) at Thunks.S:36
frame #17: 0x00007ff7e7b704cb
frame #18: 0x0000555555fb2977 ch`Js::InterpreterStackFrame::CallLoopBody(this=0x00007fffffffbf90, address=0x00007ff7e7b70400)(Js::RecyclableObject*, Js::CallInfo, ...)) at InterpreterStackFrame.cpp:6362:13
frame #19: 0x0000555555fb1c32 ch`Js::InterpreterStackFrame::DoLoopBodyStart(this=0x00007fffffffbf90, loopNumber=1, layoutSize=SmallLayout, doProfileLoopCheck=true, isFirstIteration=false) at InterpreterStackFrame.cpp:6162:35
frame #20: 0x0000555555fb5997 ch`void Js::InterpreterStackFrame::LoopBodyStart(this=0x00007fffffffbf90, loopNumber=1, layoutSize=SmallLayout, isFirstIteration=false) at InterpreterStackFrame.cpp:5994:9
frame #21: 0x0000555556002d38 ch`unsigned char const* Js::InterpreterStackFrame::OP_ProfiledLoopBodyStart<(Js::LayoutSize)0, false>(this=0x00007fffffffbf90, loopId=1) at InterpreterStackFrame.cpp:5902:9
frame #22: 0x0000555555fcd716 ch`unsigned char const* Js::InterpreterStackFrame::OP_ProfiledLoopBodyStart<(Js::LayoutSize)0, false>(this=0x00007fffffffbf90, ip="\U00000012\U00000003") at InterpreterStackFrame.cpp:5774:16
frame #23: 0x0000555555e704b1 ch`Js::InterpreterStackFrame::ProcessUnprofiled(this=0x00007fffffffbf90) at InterpreterHandler.inl:52:3
frame #24: 0x0000555555e522be ch`Js::InterpreterStackFrame::Process(this=0x00007fffffffbf90) at InterpreterStackFrame.cpp:3495:22
frame #25: 0x0000555555e50dd3 ch`Js::InterpreterStackFrame::InterpreterHelper(function=0x00007ff7e7c766e0, args=ArgumentReader @ 0x00007fffffffc530, returnAddress=0x00007ff7e7bd0fa2, addressOfReturnAddress=0x00007fffffffc578, asmJsReturn=0x0000000000000000) at InterpreterStackFrame.cpp:2153:40
frame #26: 0x0000555555e4feb0 ch`Js::InterpreterStackFrame::InterpreterThunk(layout=0x00007fffffffc590) at InterpreterStackFrame.cpp:1833:16
frame #27: 0x00007ff7e7bd0fa2
frame #28: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #29: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e7c766e0, entryPoint=(ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...)), args=Arguments @ 0x00007fffffffc798, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #30: 0x00005555561cf2f4 ch`Js::JavascriptFunction::CallRootFunctionInternal(obj=0x00007ff7e7c766e0, args=Arguments @ 0x00007fffffffc810, scriptContext=0x0000555557ee9118, inScript=true) at JavascriptFunction.cpp:772:24
frame #31: 0x00005555561cf10c ch`Js::JavascriptFunction::CallRootFunction(obj=0x00007ff7e7c766e0, args=, scriptContext=0x0000555557ee9118, inScript=true) at JavascriptFunction.cpp:717:15
frame #32: 0x00005555561cf0b1 ch`Js::JavascriptFunction::CallRootFunction(this=0x00007ff7e7c766e0, args=, scriptContext=0x0000555557ee9118, inScript=true) at JavascriptFunction.cpp:832:16
frame #33: 0x0000555555894a8e ch`RunScriptCore(this=0x00007fffffffcbe0, scriptContext=0x0000555557ee9118, _actionEntryPopper=0x00007fffffffcbc0)::$_85::operator()(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const at Jsrt.cpp:3705:49
frame #34: 0x0000555555894624 ch`_JsErrorCode ContextAPIWrapper(this=0x00007fffffffcb78, scriptContext=0x0000555557ee9118)::$_85)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const at JsrtInternal.h:237:16
frame #35: 0x0000555555893fc4 ch`_JsErrorCode ContextAPIWrapper_Core(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_85)::'lambda'(Js::ScriptContext*)>(fn=(anonymous class) @ 0x00007fffffffcb78)::$_85) at JsrtInternal.h:192:23
frame #36: 0x00005555558608f6 ch`_JsErrorCode ContextAPIWrapper(fn=(anonymous class) @ 0x00007fffffffcbe0)::$_85) at JsrtInternal.h:235:27
frame #37: 0x00005555558607fb ch`RunScriptCore(scriptSource=0x00007ff7e7c44000, script="function opt(arg) {\n arg == -1;\n try {\n do {} while (arg < 2);\n } catch(e) {}\n}\nfor (const i in \"ab\") {\n for (let j = 0; j < 100; j++) {\n opt();\n }\n}\n// CRASH INFO\n// ==========\n// TERMSIG: 4\n// STDERR:\n// ASSERTION 483591: (/home/wjm/ChakraCore/lib/Backend/BackwardPass.cpp, line 2702) target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource\n// Failure: (target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource)\n// STDOUT:\n// ARGS: /home/wjm/ChakraCore/out/Debug/ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- -reprl fuzzcode.js\n// EXECUTION TIME: 23 ms\n\n\n/*\n\nTitle: \n\n## Version"..., cb=1374, loadScriptFlag=LoadScriptFlag_Utf8Source | LoadScriptFlag_ExternalArrayBuffer, sourceContext=0, sourceUrl=u"/home/wjm/DiTing-pocs/chakra/bug06_AirLock.js", parseOnly=false, parseAttributes=JsParseScriptAttributeNone, isSourceModule=false, result=0x0000000000000000) at Jsrt.cpp:3656:12
frame #38: 0x0000555555862f6e ch`::JsRun(JsValueRef, JsSourceContext, JsValueRef, JsParseScriptAttributes, JsValueRef *) [inlined] CompileRun(scriptVal=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000, parseOnly=false) at Jsrt.cpp:5019:12
frame #39: 0x0000555555862db9 ch`::JsRun(scriptVal=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000) at Jsrt.cpp:5041
frame #40: 0x0000555555787293 ch`ChakraRTInterface::JsRun(script=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000) at ChakraRtInterface.h:487:179
frame #41: 0x0000555555784924 ch`RunScript(fileName="bug06_AirLock.js", fileContents="function opt(arg) {\n arg == -1;\n try {\n do {} while (arg < 2);\n } catch(e) {}\n}\nfor (const i in \"ab\") {\n for (let j = 0; j < 100; j++) {\n opt();\n }\n}\n// CRASH INFO\n// ==========\n// TERMSIG: 4\n// STDERR:\n// ASSERTION 483591: (/home/wjm/ChakraCore/lib/Backend/BackwardPass.cpp, line 2702) target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource\n// Failure: (target->GetBasicBlock()->isAirLockBlock || target->GetBasicBlock()->isAirLockCompensationBlock || target->GetBasicBlock()->isBreakBlock || target->GetBasicBlock()->isBreakCompensationBlockAtSink || target->GetBasicBlock()->isBreakCompensationBlockAtSource)\n// STDOUT:\n// ARGS: /home/wjm/ChakraCore/out/Debug/ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- -reprl fuzzcode.js\n// EXECUTION TIME: 23 ms\n\n\n/*\n\nTitle: \n\n## Version"..., fileLength=1374, fileContentsFinalizeCallback=(ch`WScriptJsrt::FinalizeFree(void*) at WScriptJsrt.cpp:217), bufferValue=0x0000000000000000, fullPath="/home/wjm/DiTing-pocs/chakra/bug06_AirLock.js", parserStateCache=0x0000000000000000)(void*), void*, char*, void*) at ch.cpp:451:25
frame #42: 0x00005555557863f0 ch`ExecuteTest(fileName="bug06_AirLock.js") at ch.cpp:917:13
frame #43: 0x00005555557864ac ch`ExecuteTestWithMemoryCheck(fileName="bug06_AirLock.js") at ch.cpp:967:10
frame #44: 0x0000555555786d7a ch`main(argc=5, c_argv=0x00007fffffffd648) at ch.cpp:1274:20
frame #45: 0x00007ffff778d1e2 libc.so.6`__libc_start_main + 242
frame #46: 0x0000555555783b7e ch`_start + 46
```