1380953 - Ion retrieves "prototype" property too often from NewTarget

Status: RESOLVED DUPLICATE of bug 1607670

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[André Bargull [:anba]]

Test case:
---
var q = 0;
function fn() {}
var newTarget = Object.defineProperty(fn.bind(), "prototype", {
    get() {
        ++q;
        return null;
    }
});

for (var i = 0; i < 10; ++i) {
    Reflect.construct(fn, [], newTarget);
}

print(q);
---

Actual:
- When called with "--no-ion", prints "10"
- When called with "--ion-eager --no-threads", prints "16"

Expected:
- Always prints "10".

Comment 1

[André Bargull [:anba]]

I guess this happens because of the MCallGetProperty here: http://searchfox.org/mozilla-central/rev/cbd628b085ac809bf5a536109e6288aa91cbdff0/js/src/jit/IonBuilder.cpp#4869-4871

Comment 2

[André Bargull [:anba]]

Fixed in bug 1607670.