Follow instrDef chain in GetBytecodeArgOutCapture

Author: rajatd

lib/Backend/IR.cpp

@@ -3464,6 +3464,11 @@ IR::Instr* Instr::GetBytecodeArgOutCapture()
         this->m_opcode == Js::OpCode::ArgOut_A_InlineBuiltIn);
     Assert(this->m_dst->GetStackSym()->m_isArgCaptured);
     IR::Instr* instr = this->GetSrc1()->GetStackSym()->m_instrDef;
+    while (instr->m_opcode != Js::OpCode::BytecodeArgOutCapture)
+    {
+        Assert(instr->GetSrc1() && instr->GetSrc1()->GetStackSym() && instr->GetSrc1()->GetStackSym()->IsSingleDef());
+        instr = instr->GetSrc1()->GetStackSym()->m_instrDef;
+    }
     Assert(instr->m_opcode == Js::OpCode::BytecodeArgOutCapture);
     return instr;
 }

test/inlining/callTarget.js

@@ -72,3 +72,12 @@ test2();
 test2();
 test2();
 WScript.Echo("PASSED\n");
+
+function test3(a, b)
+{
+    return String.prototype.replace.call(a, b, "a")
+}
+test3("foobar", /foo/i)
+test3("foobar", /foo/i)
+test3("foobar", /foo/i)
+print("passed")