Bug 861419 - Consider values in prototype when reading global names during Ion compilation.

js/src/ion/IonBuilder.cpp

@@ -5636,6 +5636,8 @@ IonBuilder::jsop_getgname(HandlePropertyName name)
         // or non-writable.
         return jsop_getname(name);
     }
+    if (!propertyTypes->hasPropagatedProperty())
+        globalType->getFromPrototypes(cx, id, propertyTypes);
 
     // If the property is permanent, a shape guard isn't necessary.
 

js/src/jit-test/tests/ion/bug861419.js

@@ -0,0 +1,17 @@
+
+try {
+    arguments.toSource = (function() {
+        __proto__.y = x
+    })
+    y = this
+    print(x = 8)
+    a = arguments
+    for (v of this) {}
+} catch (e) {}
+function f() {
+  "HELLO " + y
+}
+f()
+f()
+y = 1[7]
+f()