[Andrew Branch (andrewbranch)]

Fixes #34481

Various JS constructs indicate to the binder that a function is actually a constructor:

• Assigning to this inside the body
• The /** @constructor */ JSDoc tag
• Assigning to its prototype or prototype properties

A missing one was defining a prototype property via Object.defineProperty. So if you have the code

function Graphic() {
}

Object.defineProperty(Graphic.prototype, "instance", {
  get: function() {
    return this;
  }
});

The Object.defineProperty to the prototype is the sole indicator that Graphic is a constructor, but it was being missed, so the symbol Graphic was not marked as a class. However, when the checker tries to get the type of this, it rightly assumes that Graphic must be a class, and hence the crash.

---

It’s also notable that the provided repro had something like this:

function Graphic() {
  Object.defineProperty(this, "_inlineContent", { value: 3 });
}

which we don’t recognize as a bindable declaration onto Graphic at all—if we did, this bug would have remained undiscovered. Similarly, if the original code had any assignment to this, or any property assignment to Graphic.prototype, or used the JSDoc /** @constructor */ tag, the crash wouldn‘t have occurred because a different declaration would have marked Graphic as class-like.