Fix this longstanding bug that luckily did not bite us yet: Use Class.prototype.foo$bailout.call(th…

sdk/lib/_internal/compiler/implementation/ssa/codegen.dart

Index: sdk/lib/_internal/compiler/implementation/ssa/codegen.dart
===================================================================
--- sdk/lib/_internal/compiler/implementation/ssa/codegen.dart	(revision 14946)
+++ sdk/lib/_internal/compiler/implementation/ssa/codegen.dart	(working copy)
@@ -2612,6 +2612,9 @@
     Namer namer = backend.namer;
     Element element = work.element;
     List<js.Expression> arguments = <js.Expression>[];
+    if (element.isInstanceMember()) {
+      arguments.add(new js.This());
+    }
     arguments.add(new js.LiteralNumber("${guard.state}"));
     // TODO(ngeoffray): try to put a variable at a deterministic
     // location, so that multiple bailout calls put the variable at
@@ -2623,17 +2626,23 @@
       arguments.add(pop());
     }
 
-    js.Expression bailoutTarget;
+    js.Call call;
     if (element.isInstanceMember()) {
-      // TODO(ngeoffray): This does not work in case we come from a
-      // super call. We must make bailout names unique.
+      String className =
+          backend.namer.isolateAccess(element.getEnclosingClass());
+      js.VariableUse classReference = new js.VariableUse(className);
+      js.PropertyAccess prototype =
+          new js.PropertyAccess.field(classReference, "prototype");
       String bailoutName = namer.getBailoutName(element);
-      bailoutTarget = new js.PropertyAccess.field(new js.This(), bailoutName);
+      js.PropertyAccess method =
+          new js.PropertyAccess.field(prototype, bailoutName);
+      call = jsPropertyCall(method, "call", arguments);
     } else {
       assert(!element.isField());
-      bailoutTarget = new js.VariableUse(namer.isolateBailoutAccess(element));
+      js.Expression bailoutTarget
+          = new js.VariableUse(namer.isolateBailoutAccess(element));
+      call = new js.Call(bailoutTarget, arguments);
     }
-    js.Call call = new js.Call(bailoutTarget, arguments);
     attachLocation(call, guard);
     return new js.Return(call);
   }