Bugzilla

Or this, did it in parallel, after :decoder posted his testcase:

```
function f() {
    x = [];
    x.z = [];
    function g() {
        x.__proto__ = {};
        return {};
    }
    for (let i = 0; i < 99; i++) {}
    x.z = g();
    function h() {
        x.z;
    }
    return h();
}
f()
f()
```

asserts js shell on m-c rev b2f1edb41241 compiled with --enable-debug --enable-more-deterministic with --fuzzing-safe --no-threads --ion-warmup-threshold=0 at:

Assertion failure: [infer failure] Missing type in object [Array * 0x8c8d768ab80] z: [Object * 0x8c8d768ab50], at js/src/vm/TypeInference.cpp:266

Or this, did it in parallel, after :decoder posted his testcase:

```js
function f() {
    x = [];
    x.z = [];
    function g() {
        x.__proto__ = {};
        return {};
    }
    for (let i = 0; i < 99; i++) {}
    x.z = g();
    function h() {
        x.z;
    }
    return h();
}
f()
f()
```

asserts js shell on m-c rev b2f1edb41241 compiled with --enable-debug --enable-more-deterministic with --fuzzing-safe --no-threads --ion-warmup-threshold=0 at:

Assertion failure: [infer failure] Missing type in object [Array * 0x8c8d768ab80] z: [Object * 0x8c8d768ab50], at js/src/vm/TypeInference.cpp:266

Or this, did it in parallel, after :decoder posted his testcase:

```js
function f() {
    x = [];
    x.z = [];
    function g() {
        x.__proto__ = {};
        return {};
    }
    for (let i = 0; i < 99; i++) {}
    x.z = g();
    function h() {
        x.z;
    }
    return h();
}
f();
f();
```

asserts js shell on m-c rev b2f1edb41241 compiled with --enable-debug --enable-more-deterministic with --fuzzing-safe --no-threads --ion-warmup-threshold=0 at:

Assertion failure: [infer failure] Missing type in object [Array * 0x8c8d768ab80] z: [Object * 0x8c8d768ab50], at js/src/vm/TypeInference.cpp:266