diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 20787f3431..a5adda4379 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3717,6 +3717,8 @@ IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest*
     if (type->unknown())
         return true;
 
+    MOZ_ASSERT(!type->hasType(TypeSet::MagicArgType()));
+
     // Don't emit MFilterTypeSet if it doesn't improve the typeset.
     if (subject->resultTypeSet()) {
         if (subject->resultTypeSet()->equals(type))
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 699842abf3..f432ae37f2 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3756,9 +3756,10 @@ class MCreateThisWithTemplate
         return initialHeap_;
     }
 
-    // Although creation of |this| modifies global state, it is safely repeatable.
+    // Performs a property read from |newTarget| if |newTarget| is a JSFunction
+    // with an own |.prototype| property.
     AliasSet getAliasSet() const override {
-        return AliasSet::None();
+        return AliasSet::Load(AliasSet::Any);
     }
 
     MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;