[js] Fix order of reassignment logic

Mostly just to match the naming of `newValue` and the subtyping idea of
the forUseAs where we try to find something that is a subtype of the
current variable's type, not the other way around.

Change-Id: I3144025a0e1850892936087fdf275d318943f963
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9159757
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>

Author: Liedtke

Sources/Fuzzilli/CodeGen/CodeGenerators.swift

@@ -2104,7 +2104,7 @@ public let CodeGenerators: [CodeGenerator] = [
     CodeGenerator("UpdateGenerator", inputs: .one) { b, v in
         let newValue = b.randomVariable(forUseAs: b.type(of: v))
         b.reassign(
-            variable: newValue, value: v, with: chooseUniform(from: BinaryOperator.allCases))
+            variable: v, value: newValue, with: chooseUniform(from: BinaryOperator.allCases))
     },
 
     CodeGenerator("DupGenerator") { b in
@@ -2114,7 +2114,7 @@ public let CodeGenerators: [CodeGenerator] = [
     CodeGenerator("ReassignmentGenerator", inputs: .one) { b, v in
         let newValue = b.randomVariable(forUseAs: b.type(of: v))
         guard newValue != v else { return }
-        b.reassign(variable: newValue, value: v)
+        b.reassign(variable: v, value: newValue)
     },
 
     CodeGenerator("DestructArrayGenerator", inputs: .preferred(.iterable)) {