ion/recover-objects.js contains the following (currently disabled) test:

function unknownLoad(i) {
    var obj = { foo: i };
    // Unknown properties are inlined as undefined.
    assertEq(obj.bar, undefined);
    assertRecoveredOnBailout(obj, true);
}

To scalar-replace obj.bar with undefined, we need to ensure that the prototype chain hasn't been modified. In Ion, we could rely on TI. In Warp, we generate ObjectStaticProto + GuardShape, which isn't trivial to scalar-replace.

This might be another case where a fuse is the nicest approach.

We no longer load the prototype after bug 1792228, so we don't have to support
MObjectStaticProto during scalar replacement. This also means scalar
replacement when loading undefined properties is now trivially supported.

https://hg.mozilla.org/mozilla-central/rev/7f6ed6a483ff