ES6 constructor returns class instead of object upon constructorCache hit.

Github issue chakra-core#1496
ES6 constructor returns class instead of object upon constructorCache hit.
constructorCache->ctorHasNoExplicitReturnValue set to 'true' for ES6 class
constructors, therefore opcode 'GetNewScObject' is optimized away in
inliner. Fix by de-asserting Flags_HasNoExplicitReturnValue for ES6 class
constructors.

Author: Suwei Chen

lib/Parser/Parse.cpp

@@ -6336,7 +6336,7 @@ ParseNodePtr Parser::GenerateEmptyConstructor(bool extends)
     pnodeFnc->sxFnc.SetIsClassMember(TRUE);
     pnodeFnc->sxFnc.SetIsClassConstructor(TRUE);
     pnodeFnc->sxFnc.SetIsBaseClassConstructor(!extends);
-    pnodeFnc->sxFnc.SetHasNonThisStmt(extends);
+    pnodeFnc->sxFnc.SetHasNonThisStmt();
     pnodeFnc->sxFnc.SetIsGeneratedDefault(TRUE);
 
     pnodeFnc->ichLim = m_pscan->IchLimTok();
@@ -7152,6 +7152,7 @@ ParseNodePtr Parser::ParseClassDecl(BOOL isDeclaration, LPCOLESTR pNameHint, uin
             pnodeConstructor->sxFnc.hintOffset = constructorShortNameHintOffset;
             pnodeConstructor->sxFnc.pid = pnodeName && pnodeName->sxVar.pid ? pnodeName->sxVar.pid : wellKnownPropertyPids.constructor;
             pnodeConstructor->sxFnc.SetIsClassConstructor(TRUE);
+            pnodeConstructor->sxFnc.SetHasNonThisStmt();
             pnodeConstructor->sxFnc.SetIsBaseClassConstructor(pnodeExtends == nullptr);
         }
         else

lib/Runtime/ByteCode/ByteCodeEmitter.cpp

@@ -2727,6 +2727,11 @@ void ByteCodeGenerator::EmitFunctionBody(FuncInfo *funcInfo)
     }
     Assert(!pnode->CapturesSyms());
     EmitTopLevelStatement(pnode, funcInfo, false);
+
+    if (funcInfo->IsClassConstructor())
+    {
+        funcInfo->GetParsedFunctionBody()->SetHasNoExplicitReturnValue(false);
+    }
 }
 
 void ByteCodeGenerator::EmitProgram(ParseNode *pnodeProg)

test/es6/bug_issue_1496.baseline

@@ -0,0 +1,10 @@
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9

test/es6/bug_issue_1496.js

@@ -0,0 +1,40 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+// GitHub Issue1496: ES6 constructor returns class instead of object upon constructorCache hit
+//
+// -mic:1 -maxsimplejitruncount:2
+
+var Test = {};
+
+class A {
+    constructor(foo) { this.foo = foo; }
+    toB() {
+        return new Test.B(this);
+    }
+}
+
+class B {
+    constructor(bar) { this.bar = bar; }
+}
+
+Test.B = B;
+
+for (var i=0; i<10; i++)
+{
+    var a = new A(i);
+    var b = a.toB();
+
+    try
+    {
+        WScript.Echo(b.bar.foo);        
+    }
+    catch (e)
+    {
+        WScript.Echo(e);
+        WScript.Echo(b);
+        break;
+    }
+}

test/es6/rlexe.xml

@@ -1331,4 +1331,12 @@
     <compile-flags>-force:deferparse -args summary -endargs</compile-flags>
   </default>
 </test>
+<test>
+  <default>
+    <files>bug_issue_1496.js</files>
+    <compile-flags>-mic:1 -maxsimplejitruncount:2</compile-flags>
+    <baseline>bug_issue_1496.baseline</baseline>
+    <tags>BugFix,exclude_dynapogo</tags>
+  </default>
+</test>
 </regress-exe>