Fix this longstanding bug that luckily did not bite us yet: Use Class.prototype.foo$bailout.call(th…

sdk/lib/_internal/compiler/implementation/ssa/codegen.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 class SsaCodeGeneratorTask extends CompilerTask {
 
   final JavaScriptBackend backend;
 
@@ skipping 2594 matching lines @@
         if (inputLength > maxBailoutParameters) {
           maxBailoutParameters = inputLength;
         }
       });
     }
     HInstruction input = guard.guarded;
     HBailoutTarget target = guard.bailoutTarget;
     Namer namer = backend.namer;
     Element element = work.element;
     List<js.Expression> arguments = <js.Expression>[];
+    if (element.isInstanceMember()) {
+      arguments.add(new js.This());
+    }
     arguments.add(new js.LiteralNumber("${guard.state}"));
     // TODO(ngeoffray): try to put a variable at a deterministic
     // location, so that multiple bailout calls put the variable at
     // the same parameter index.
     int i = 0;
     for (; i < target.inputs.length; i++) {
       assert(guard.inputs.indexOf(target.inputs[i]) >= 0);
       use(target.inputs[i]);
       arguments.add(pop());
     }
 
-    js.Expression bailoutTarget;
+    js.Call call;
     if (element.isInstanceMember()) {
-      // TODO(ngeoffray): This does not work in case we come from a
-      // super call. We must make bailout names unique.
+      String className =
+          backend.namer.isolateAccess(element.getEnclosingClass());
+      js.VariableUse classReference = new js.VariableUse(className);
+      js.PropertyAccess prototype =
+          new js.PropertyAccess.field(classReference, "prototype");
       String bailoutName = namer.getBailoutName(element);
-      bailoutTarget = new js.PropertyAccess.field(new js.This(), bailoutName);
+      js.PropertyAccess method =
+          new js.PropertyAccess.field(prototype, bailoutName);
+      call = jsPropertyCall(method, "call", arguments);
     } else {
       assert(!element.isField());
-      bailoutTarget = new js.VariableUse(namer.isolateBailoutAccess(element));
+      js.Expression bailoutTarget
+          = new js.VariableUse(namer.isolateBailoutAccess(element));
+      call = new js.Call(bailoutTarget, arguments);
     }
-    js.Call call = new js.Call(bailoutTarget, arguments);
     attachLocation(call, guard);
     return new js.Return(call);
   }
 
   void visitTypeGuard(HTypeGuard node) {
     HInstruction input = node.guarded;
     DartType indexingBehavior =
         backend.jsIndexingBehaviorInterface.computeType(compiler);
     if (node.isInteger(types)) {
       // if (input is !int) bailout
@@ skipping 457 matching lines @@
   if (leftType.canBeNull() && rightType.canBeNull()) {
     if (left.isConstantNull() || right.isConstantNull() ||
         (leftType.isPrimitive() && leftType == rightType)) {
       return '==';
     }
     return null;
   } else {
     return '===';
   }
 }