Function argument's prototype seem cached and wrongly reused

Testcase attached (fixed-testcase.js).

0) 2 classes are defined A1, A2. They share the same prototype instance.
1) 2 instances are created a1 and a2.
2) function f is called with a1 and a2 as parameters.
3) as expected, a1 and a2 have the same undefined titiProp in the caller and inside the function. That is fine.
4) A2 class prototype is updated, a new a21 instance is created from updated A2
5) function f is called with a1 and a21 as parameters.
6) a1 and a21 titiProp is not equal in the caller BUT still are considered equals inside the function.

If step 2) is skipped, then the properies are seen as not being equals. It seems that the first call cached some content.

If a property is added to a21 before to call the function, then the properties are not considered equal. Adding the property force the cache to be refreshed.