The invariant we have for mutable __proto__ which requires type objects with unknown properties to be treated as interchangeable is pretty confusing and makes it a lot harder than it should be to reason about type sets while writing optimizations. It would be simpler to ensure that mutating __proto__ marks every type set containing the original type as unknown, with a GC-like crawl of every type set in the compartment. Would remember which type objects we did the crawl for with a bit that poisons future type sets, so that we only have to crawl for each distinct type object in scripts that mutate prototypes over and over again. We could also totally disable inference in compartments which mutate __proto__, but that seems like overkill. This feature is almost never used on the web (in part due to the inability to emulate it in IE. Thanks, IE!) and the only real concern is making sure this doesn't cause problems for the fair number of places where XPConnect does JS_SetPrototype.

Fixed as part of bug 670185.