Bugzilla

Actually I'm not sure yet if this requires `MArrayPush`, the same thing might apply to `MStoreElementHole`.

Actually it doesn't require `MArrayPush`, the same thing applies to `MStoreElementHole`.
```js
function f(a) {
  var vals = Object.getOwnPropertyNames(a).map(p => a[p]);
  for (var i = 0; i < vals.length; i++) {
    var v = vals[i];
    queue[queue.length] = [v];
  }
}

gczeal(12);
gczeal(19, 5);

var a = [{x:{0:0}}, {x:{0:0}}];
var queue = [a];

while (queue.length) {
  var arr = queue.shift();
  f(arr);
}
```