try { a = [Boolean, Boolean] for (m = 0; m < 9; m++) { c = m } } catch (e) {} try { b = a.join() gcPreserveCode() for (n = c; n < 22; ++n) { x = n } x <<= x for (v of b) { y = Uint16Array(x) } y = [] print("foo") } catch (e) {} prints nothing on js opt shell on m-c changeset e3785e299ab6 without any CLI arguments, when the testcase is passed in as a CLI argument. However it prints "foo" with --no-baseline --no-ion --no-ti. My configure flags are: --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-threadsafe <more NSPR compilation flags>

Brian, is it expected that the testcase below works fine without TI but OOMs with TI enabled? This happens also with the JITs disabled. It looks like we're not GC'ing the old arrays or something. It would be nice if we could fix this, the code doesn't look very unreasonable. function f() { gcPreserveCode(); for (var j=0; j<100; j++) y = Uint16Array(22 * 1000 * 1000); } f();

Brian, re-ping please?

I get the same output now with either set of CLI flags. If we were OOM'ing before then this was fixed by bug 932982, as we give singleton types to all large typed arrays and before bug 932982 we marked these whenever doing a GC which preserved jitcode.