Bug 246275

function func(a,c) {
  a[0] = 1.2;
  return a.indexOf('test', c) 
}
noInline(func);
var a = [1.1, 2.2];
for (var i = 0; i < 20; i++) {
  func(a, i);
}
func(a,  {
    valueOf: () => {
    a[0] = {}; 
    return 0;
  }
});
print(a[0])

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0.1

The above js scripts should print [Object], but jsc wrongly prints 1.2.
In DFGBytecodeParser, indexOf is inlined into ArrayIndexOf node instead of Call. In Fixup, ArrayIndexOf is converted to JSConstant node.
So valueOf is no longer invoked. Thus, a[0]={} is not executed.