Bugzilla

It's definitely responsible for that regression. I'm not sure yet why though. Something interesting about that benchmark is it defines a few functions on `Array.prototype` and makes pretty heavy use of them:
```js

Array.prototype.findGraphNode = function(obj) {
    for(var i=0;i<this.length;i++) {
        if(this[i].pos == obj.pos) { return this[i]; }
    }
    return false;
};
Array.prototype.removeGraphNode = function(obj) {
    for(var i=0;i<this.length;i++) {
        if(this[i].pos == obj.pos) { this.splice(i,1); }
    }
    return false;
};
```

It looks like the regression holds if I turn `MConstantProto` into a trivial wrapper for `MConstant` and treat it as such. I'm wondering if one of the many checks of `isConstant()` gates a meaningful optimization for that test, which we're now blocking because the instruction isn't an `MConstant` anymore, even though it could be treated as such.

It's definitely responsible for that regression. I'm not sure yet why though.

EDIT: the following is wrong - was profiling the wrong test 🤦‍♂️
Something interesting about that benchmark is it defines a few functions on `Array.prototype` and makes pretty heavy use of them:
```js

Array.prototype.findGraphNode = function(obj) {
    for(var i=0;i<this.length;i++) {
        if(this[i].pos == obj.pos) { return this[i]; }
    }
    return false;
};
Array.prototype.removeGraphNode = function(obj) {
    for(var i=0;i<this.length;i++) {
        if(this[i].pos == obj.pos) { this.splice(i,1); }
    }
    return false;
};
```

It looks like the regression holds if I turn `MConstantProto` into a trivial wrapper for `MConstant` and treat it as such. I'm wondering if one of the many checks of `isConstant()` gates a meaningful optimization for that test, which we're now blocking because the instruction isn't an `MConstant` anymore, even though it could be treated as such.