Bug 1076091 - Don't bake in the initial undefined values of global names, r=jandem.

js/src/jit-test/tests/ion/bug1076091.js

@@ -0,0 +1,11 @@
+
+Object.defineProperty(this, "x", {
+    get: function() {
+        return this.y
+    }
+})
+x
+x
+y = Int16Array
+var y
+assertEq(x, Int16Array)

js/src/jit/IonBuilder.cpp

@@ -9025,10 +9025,6 @@ IonBuilder::jsop_getprop(PropertyName *name)
     MDefinition *obj = current->pop();
     types::TemporaryTypeSet *types = bytecodeTypes(pc);
 
-    // Try to optimize to a specific constant.
-    if (!getPropTryInferredConstant(&emitted, obj, name, types) || emitted)
-        return emitted;
-
     // Try to optimize arguments.length.
     if (!getPropTryArgumentsLength(&emitted, obj) || emitted)
         return emitted;
@@ -9040,6 +9036,12 @@ IonBuilder::jsop_getprop(PropertyName *name)
     BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
                                                        obj, name, types);
 
+    // Try to optimize to a specific constant.
+    if (barrier == BarrierKind::NoBarrier) {
+        if (!getPropTryInferredConstant(&emitted, obj, name, types) || emitted)
+            return emitted;
+    }
+
     // Always use a call if we are performing analysis and
     // not actually emitting code, to simplify later analysis. Also skip deeper
     // analysis if there are no known types for this operation, as it will