Ran into this while diagnosing an issue in my patch for bug 859609. Consider the following loop: function makeFun() { return function () { ... }; } function main() { var fn = makeFun(); for (var i = 0; i < 10000; i++) { ... fn(...) ... } } Interpreter will execute the initial single call to makeFun, and not record type info. Subsequently, it will OSR into baseline at the loop, and later on baseline will OSR into Ion at the loop. The OSR-block's definition of |fn| will have an object type in its typeset, and the non-OSR-block's definition of |fn| will have no type information (since it never ran in baseline). In this case, the phi's type will be generalized to Value. It would work out better if the processing noticed that the Phi is unifying an object typed definition with an untyped definition, and inserted a fallible object unbox in front of the untyped definition.. allowing it to propogate the object type to the phi.