test.js

function bar(x) {
  try { // just to prevent inlining
    return x;  
  } catch (e) { }
}

function foo(o) {
  var sum = 0;
  for (var i = 0; i < 10; i++) {
    sum += bar(o.x);  /* o.x will not be hoisted out of the loop */
                      /* but corresponding map check would be *removed* */
                      /* so V8 partially understands immutability of the hidden class of o */
  }
  return sum;
}

var o = Object.freeze({x: 10});

for (var j = 0 ; j < 10000; j++) {
  foo(o);
}