With a patch for Bug 803710, With the following command line: $ IONFLAGS=logs,scripts,aborts ./_build/js-bug803710-dbg-x64-gcc45 --ion-crash-on-unexpected-disable --ion-eager ./jit-test/tests/basic/bug630865-6.js And once IonGraph has finished the logs, “du” gives an hint of the number of identical compilation happening before the crash. Also “diff” cannot make any difference of either *.gv files or *.png files produced for the top-level script. $ du func*-pass16-*.png 680K func00-pass16-Allocate Registers [LSRA]-lir.gv.png 660K func01-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func02-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func03-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func04-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func05-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func06-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func07-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func08-pass16-Allocate Registers [LSRA]-lir.gv.png 576K func09-pass16-Allocate Registers [LSRA]-lir.gv.png In all cases, the compiled script is ./jit-test/tests/basic/bug630865-6.js:1 , and even with --ion-eager, we should never invalidate to produce the same result except in case of a GC, which is not the case here. I've attached the stack trace blaming GetPropertyCache as being the reason behind the invalidation of the script which is running this GetPropertyCache. The problem of this test case seems to be that TI is freezing on the shape of the lambda, which is altered by the GetPropertyCache of the “prototype” property.