LibJS/Bytecode: End for's variable scope after update block generation

The update block can generate bytecode that refers to the lexical
environment, so we have to end the scope after it has been generated.
Previously the Jump to the update block would terminate the block,
causing us to leave the lexical environment just before jumping to the
update block.

Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp

@@ -782,9 +782,6 @@ Bytecode::CodeGenerationErrorOr<void> ForStatement::generate_bytecode(Bytecode::
     generator.end_breakable_scope();
     generator.end_continuable_scope();
 
-    if (has_lexical_environment)
-        generator.end_variable_scope();
-
     if (!generator.is_current_block_terminated()) {
         if (m_update) {
             generator.emit<Bytecode::Op::Jump>().set_targets(
@@ -803,6 +800,9 @@ Bytecode::CodeGenerationErrorOr<void> ForStatement::generate_bytecode(Bytecode::
         generator.emit<Bytecode::Op::Load>(result_reg);
     }
 
+    if (has_lexical_environment)
+        generator.end_variable_scope();
+
     return {};
 }