Bugzilla

The assertion started with [0c0c89b7a859a19ddc9d788a45d16c3e150b1bc8](https://hg.mozilla.org/mozilla-central/rev/0c0c89b7a859) (bug 1595776), so maybe Jan can take a look?

Slightly reduced test case:
```js
function test() {
  for (var i = 0; i < 10; ++i) {
    typeof arguments[0] == "object" ? 0 : arguments = 0;

    for (;;) {}
    // while(true) {} // No error when a |while| loop is used.
  }
}
test();
```

Interestingly there is no assertion failure when `while(true)` is used instead of `for (;;)`.

The assertion started with [0c0c89b7a859a19ddc9d788a45d16c3e150b1bc8](https://hg.mozilla.org/mozilla-central/rev/0c0c89b7a859) (bug 1595776), so maybe Jan can take a look?

Slightly reduced test case:
```js
function test() {
  for (var i = 0; i < 10; ++i) {
    // Create an IC specialized for lazy arguments when Baseline runs.
    arguments[0];

    // Overwrite |arguments|, so that Ion assumes it's never lazy arguments.
    arguments = 0;

    for (;;) {}
    // while(true) {} // No error when a |while| loop is used.
  }
}
test();
```

Interestingly there is no assertion failure when `while(true)` is used instead of `for (;;)`.