crashes js debug shell on JM changeset 32e8c937a409 with -m, -a, -j and -n at js::types::TypeFailure with the following message:
[infer failure] Missing type in object jitstats:prototype:new HOTLOOP: int
autoBisect shows this is probably related to the following changeset:
The first bad revision is:
user: Brian Hackett
date: Mon May 09 07:12:47 2011 -0700
summary: [INFER] Remove on stack recompilation, allow removed on stack JIT frames to rejoin into the interpreter, bug 650163.
We needed a type barrier for getProperty accesses which go through the class getProperty hook.