The attached testcase asserts on TI revision 6c8e0affe03e (run with -j -m -n -a), tested on 64 bit.

If a GC is triggered during analysis or compilation, we do not clear analysis information or destroy JITScripts. GC things pointed to by the JITScripts are pinned, but with TI enabled the jitcode can bake in shape numbers when constructing objects inline and these numbers will be invalidated if the GC is regenerating shapes. The fix just releases all jitcode on every GC; there is no need to keep the jitcode around even if we are compiling, as the compiler does not update the JSScript until it is finished (we do need to abandon compilation if a GC was triggered by it, which this patch does).