In v8-raytrace, when run with no option (JM first, Ion second), the function line 681 got invalidated just after it got compiled because the UNINLINEABLE flag is set on the function and no type inside the function are changed. The uninlinebale flag should not cause the recompilation of Ion script which are not inlining this function — we should not freeze on this flag when compiling (not inlining) this function. 1/ Do not freeze if this can be avoided. 2/ Determine if this DO-NOT-INLINED is justified because JM was able to run for a while and this DO-NOT-INLINE is potentially wrong. In raytrace, the incriminated setFlags is the first after the first Ion compilation attempt and give the following backtrace under gdb: Temporary breakpoint 2, js::types::TypeObject::setFlags (this=0x7ffff0a00f40, cx=0xded640, flags=524288) at /home/nicolas/mozilla/ionmonkey/js/src/jsinfer.cpp:2908 2908 if ((this->flags & flags) == flags) (gdb) bt #0 js::types::TypeObject::setFlags (this=0x7ffff0a00f40, cx=0xded640, flags=524288) at /home/nicolas/mozilla/ionmonkey/js/src/jsinfer.cpp:2908 #1 0x00000000004299bd in js::types::MarkTypeObjectFlags (cx=0xded640, obj=0x7ffff0a18dc0, flags=524288) at /home/nicolas/mozilla/ionmonkey/js/src/jsinferinlines.h:393 #2 0x000000000068ffbd in js::ContextStack::ensureOnTop (this=0xded698, cx=0xded640, report=js::REPORT_ERROR, nvars=3, extend=js::ContextStack::CAN_EXTEND, pushedSeg=0x7fffffff9f60, dest=0xc) at /home/nicolas/mozilla/ionmonkey/js/src/vm/Stack.cpp:873 #3 0x0000000000690290 in js::ContextStack::pushInvokeArgs (this=0xded698, cx=0xded640, argc=1, iag=0x7fffffff9f30, report=js::REPORT_ERROR) at /home/nicolas/mozilla/ionmonkey/js/src/vm/Stack.cpp:920 #4 0x0000000000511b1d in js::Invoke (cx=0xded640, thisv=..., fval=..., argc=1, argv=0x7fffffffa430, rval=0x7fffffffa3e8) at /home/nicolas/mozilla/ionmonkey/js/src/jsinterp.cpp:355 #5 0x00000000008982d0 in js::ion::InvokeFunction (cx=0xded640, fun=0x7ffff0a18680, argc=1, argv=0x7fffffffa428, rval=0x7fffffffa3e8) at /home/nicolas/mozilla/ionmonkey/js/src/ion/VMFunctions.cpp:100 #6 0x00007ffff7e839e0 in ?? ()