I've been eying this object creation path suspiciously for the last week and wondering why it wasn't breaking any tests. When I pulled yesterday morning, js1_8_5/extensions/sps-generators.js and js1_8_5/extensions/typedarray.js started failing when objects allocated from here move. These don't fail with --no-ion and the call site of the allocation is indeed out of Ion, under GetIntrinsicValue. I think these sites will mostly be long live, so just automatically tenuring is probably the right decision here.

Comment on attachment 749659 [details] [diff] [review] v0 Review of attachment 749659 [details] [diff] [review]: ----------------------------------------------------------------- Yup, these objects should all pretty much live as long as the global they're cloned into.

Why was this causing test failures?

Right, so after a bit of debugging and talking with Brian on IRC, we should expect (and do see) crashes from not having these be tenured. The reason is that jitcode is allowed to bake in singletons, shapes, intrinsics, templates, and constants. Since, self-hosted code currently always (and I think in general always) falls into the intrinsic case, we're baking these into jitcode.