[js] Record load in MCreateThis alias set.

js/src/jit/AliasAnalysisShared.cpp

@@ -134,6 +134,7 @@ GetObject(const MDefinition* ins)
       case MDefinition::Op_SetArgumentsObjectArg:
       case MDefinition::Op_GetFrameArgument:
       case MDefinition::Op_SetFrameArgument:
+      case MDefinition::Op_CreateThis:
       case MDefinition::Op_CompareExchangeTypedArrayElement:
       case MDefinition::Op_AtomicExchangeTypedArrayElement:
       case MDefinition::Op_AtomicTypedArrayElementBinop:

js/src/jit/MIR.h

@@ -5007,9 +5007,10 @@ class MCreateThis
     TRIVIAL_NEW_WRAPPERS
     NAMED_OPERANDS((0, getCallee), (1, getNewTarget))
 
-    // Although creation of |this| modifies global state, it is safely repeatable.
+    // Performs a property read from |newTarget| if |newTarget| is a JSFunction
+    // with an own |.prototype| property.
     AliasSet getAliasSet() const override {
-        return AliasSet::None();
+        return AliasSet::Load(AliasSet::Any);
     }
     bool possiblyCalls() const override {
         return true;