Caching Error in Chakra

[natashenka]

The following code behaves incorrectly (inconsistent with the standard and other engines) in Chakra due to a missing cache update:

  function Base() { }

  Base.prototype = {
    f() {
      return "Base " + this.toString();
    },
    x: 15,
    toString() {
      return "this is Base";
    }
  };

  function Derived() {
    this.derivedDataProperty = "xxx";
  }
  Derived.prototype = {
    __proto__: Base.prototype,
    toString() { return "this is Derived"; },
    x: 27,
    f() {

      var a = super.x;

      print(this.x);
      return "Derived";
    }
  };

  print(new Base().f());
  print(new Derived().f());

It should print 27 as the value of Derived.x, but instead prints 15. This code hits an assert in the debug build:

ASSERTION 5639: (/home/user/test_everywhere/ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp, line 277) *propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext)
Failure: (*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext))
Illegal instruction (core dumped)

[Penguinwizzard]

Self assigned due to looking at another bug hitting the same assert at the moment.

[Penguinwizzard]

@suwc: @LouisLaf suggested sending this your way.