I was running some old perf tests and noticed this issue on the test in bug 604905.

Because Ion/Warp don't compile catch-blocks, we risk bailing out a few times and then being stuck in Baseline (due to bailoutExpected) if some variable is assigned a different type in the catch-block. A simple fix is to not specialize OSR phis if there's a try-catch, similar to some other backend optimizations we disable when try-catch is present, but ideally we'd have a more targeted fix..

Here's a micro-benchmark for this where we're much slower than we should be:

function f() {
  var x;
  try {
    doesNotExist();
  } catch (e) {
    x = {x: 1};
  }
  var t = dateNow();
  var res = 0;
  for (var i = 0; i < 100_000_000; i++) {
    res += x.x;
  }
  print(dateNow() - t);
  print(res);
}
f();

This is fixed in bug 1673497 by disabling OSR phi specialization if an OSR phi guard fails, which allows us to fall back to a Value phi in this case. The speedup for this microbenchmark is about 10x.