This issue can be reproduce with --ion-eager. gczeal(4); for (var i = 0; i < 0;) ; We hit a typebarrier when we read "i" and bailout to a point where we can start a new compilation cycle without any updated type information. I made a work around which check that the bailout does not return to an OSR point and skip the next compilation if this is the case.
Would this be fixed by bug 746691?
In fact, until bug 746691 we should probably consider gczeal to be unsupported with --ion-eager.
Created attachment 620539 [details] [diff] [review] Skip next OSR if a GC remove the forbidOSR just after the bailout. Skip all JSOP_GOTO and the next JSOP_LOOPENTRY to avoid the first OSR after a bailout.