Bug 769911 introduces ListBase proxies and Bug 830086 disables all ListBase proxy optimization as they are not checking any the expando object of the ListBase proxy. AFAIU, ListBase proxy are not part of the shell and cannot be emulated in anyway with the shell. They are emulating Array-like behavior for DOM objects and any property is stored on the "expando" (object wrapped by the proxy). Ion caches for reading slots should check the expando of the ListBase proxy in the code produced by generateReadSlot. In addition, it would be good to add a ListBase proxy in the js/src/shell/js.cpp such as we can benchmark performances before and after the modification, to determine if this is worth back-porting to any previous versions.

Bug 830086 disables just the missing-property IC optimization for ListBase proxies, I hope, right? If you'd like I can probably try to write up a shell patch to add some sort of ListBase-like thing there.