--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1563,16 +1563,17 @@ TypeCompartment::init(JSContext *cx)
     /*
      * Initialize the empty type object. This is not threaded onto the objects list,
      * will never be collected during GC, and does not have a proto or any properties
      * that need to be marked. It *can* have empty shapes, which are weak references.
      */
 #ifdef DEBUG
     typeEmpty.name_ = JSID_VOID;
 #endif
+    typeEmpty.hasSpecialEquality = true;
     typeEmpty.unknownProperties = true;
 
     if (cx && cx->getRunOptions() & JSOPTION_TYPE_INFERENCE)
         inferenceEnabled = true;
 
     JS_InitArenaPool(&pool, "typeinfer", 512, 8, NULL);
 }
 

--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -1202,18 +1202,20 @@ inline TypeObject::TypeObject(jsid name,
 #ifdef DEBUG
     this->name_ = name;
 #endif
 
     InferSpew(ISpewOps, "newObject: %s", this->name());
 
     if (proto) {
         TypeObject *prototype = proto->getType();
-        if (prototype->unknownProperties)
+        if (prototype->unknownProperties) {
+            hasSpecialEquality = true;
             unknownProperties = true;
+        }
         instanceNext = prototype->instanceList;
         prototype->instanceList = this;
     }
 }
 
 inline TypeFunction::TypeFunction(jsid name, JSObject *proto)
     : TypeObject(name, proto), handler(NULL), script(NULL), isGeneric(false)
 {