- Fixed bug with splay benchmark
- Bug caused by temporary JS string data leaking into ObjShape
  propCache and later being corrupted during GC