Working on JDK-8133925 I found that prototype layouts where prototypes start with the same shape but diverge before first being used are currently not covered by our test suite (neither our own tests nor test262).

This includes code like the following:

function create() {
    function C() { return this; }
    return new C();
}

var c1 = create();
var c2 = create();

function p(o) { print(o.x) }

c1.__proto__.x = 123;

p(c1);
p(c2);

Since both instances of C have the same prototype shape (although prototype instances are different), we might want to use the same property map for the top level objects as well. However, we need to catch the case where one of the prototype instances is modified before a callsite sees one of the C instances.

(If a prototype is modified after its map has been used in a callsite we will catch changes through the property listener/prototype switchpoint mechanism. This is also covered by our tests.)