Bugzilla

Here's a version without comments:
```
    let obj = {"x":1};
    let proto = {};
    proto.__defineGetter__("d", function() {
    function jit2(arg) {
      obj.x = 1.1;
      return arg.c.x;
    }
    for(let i = 0;i < 0x10000;i++)
      jit2(g_compile);
    x = jit2(this);
    })
    function jit(val, l) {
      if(l == 3)
        jit.prototype.__proto__ = proto;
      this.d;
      this.c = val;
      if(l == 2) {
        g_compile = this;
        new jit(1.1, 3);
      }
      this.b = 2.2;
    }
    for(let i = 0;i < 0x4000;i++)
      new jit(obj, 1);
    new jit(obj, 2);
```

And here's a version of gkw's testcase without the proxy:
```
m = {
    get e() {
        function g(z) {
            return z.y.x;
        }
        for (let i = 0; i < 1; i++) {
            g(x);
        }
        g(this);
    }
};
function foo(c) {
    x = c;
    new f("", 3);
}
function f(u, v) {
    if (v == 3) {
        f.prototype.__proto__ = m;
    }
    this.e;
    this.y = u;
    if (v == 2) {
	global = this
    }
    this.n = 2;
    foo(this)
}
new f([]);
```