--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -4041,18 +4041,23 @@ TypeNewScript::maybeAnalyze(JSContext *c
         JSObject *objBase = preliminaryObjects->get(i);
         if (!objBase)
             continue;
         PlainObject *obj = &objBase->as<PlainObject>();
 
         // For now, we require all preliminary objects to have only simple
         // lineages of plain data properties.
         Shape *shape = obj->lastProperty();
-        if (shape->inDictionary() || !OnlyHasDataProperties(shape))
+        if (shape->inDictionary() ||
+            !OnlyHasDataProperties(shape) ||
+            shape->getObjectFlags() != 0 ||
+            shape->getObjectMetadata() != nullptr)
+        {
             return true;
+        }
 
         maxSlotSpan = Max<size_t>(maxSlotSpan, obj->slotSpan());
 
         if (prefixShape) {
             MOZ_ASSERT(shape->numFixedSlots() == prefixShape->numFixedSlots());
             prefixShape = CommonPrefix(prefixShape, shape);
         } else {
             prefixShape = shape;

--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -635,17 +635,22 @@ js::NewReshapedObject(JSContext *cx, Han
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()].set(nshape->propid());
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape, without updating type information. */
     RootedId id(cx);
-    RootedShape newShape(cx, res->lastProperty());
+    RootedShape newShape(cx, EmptyShape::getInitialShape(cx, res->getClass(),
+                                                         res->getTaggedProto(),
+                                                         res->getMetadata(),
+                                                         res->getParent(),
+                                                         res->numFixedSlots(),
+                                                         shape->getObjectFlags()));
     for (unsigned i = 0; i < ids.length(); i++) {
         id = ids[i];
         MOZ_ASSERT(!res->contains(cx, id));
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
         Rooted<UnownedBaseShape*> nbase(cx, newShape->base()->unowned());