When a property is found in a prototype of the object, the linkage we emit is incorrect, as we emit a method bound to the prototype instance, but guarding on the map and switchpointing on an event listener for the map. Here's a little reproducer that will print "Expecting 2: 1" in the second line instead of "Expecting 2: 2" as – well – expected. The reason for this is that the second invocation of function "inner" will keep its linkage for "dyn:getProp:x" bound to the prototype - in this case, the scope obect of f(x) invocation from the first invocation with f(1), and neither the map guard nor the prototype guard will be invalidated.

function f(x) {
  return (function inner() {
      var y; (function dummy() { return y })() // force own scope for the inner function
      with({}) { // 'with' block turns off fast scopes
          // Getter for 'x' will now use prototype-bound linking.
          // Unfortunately, it'll get bound to the scope of the first invocation of f(x).
          return x
      }
  })();
}
print("Expecting 1: " + f(1))
print("Expecting 2: " + f(2))