Crash with JS function that uses arguments and returns an instance of itself

[imgx64]

TypeScript Version: next (2.4.0-dev.20170530)

Code
This function in a JavaScript file:

function Foo() {
  arguments;
  return new Foo();
}

is causing a compiler crash:

C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:68480
                throw e;
                ^

RangeError: Maximum call stack size exceeded
    at checkNonNullExpression (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:39031:37)
    at resolveNewExpression (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:40336:34)
    at resolveSignature (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:40542:28)
    at getResolvedSignature (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:40572:26)
    at checkCallExpression (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:40599:29)
    at checkExpressionWorker (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:42069:28)
    at checkExpression (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:42021:42)
    at checkExpressionCached (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:41902:38)
    at C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:40961:32
    at traverse (C:\Users\redacted\ts-bug\node_modules\typescript\lib\typescript.js:7371:28)

If I remove or rename arguments, remove the return statement, or change new Foo() into something else, the file transpiles successfully.

To quickly reproduce:

mkdir ts-bug
cd ts-bug
npm init --yes
npm install typescript@next
cat >test.js # copy-paste below file

node test.js

test.js:

var ts = require("typescript");
var fs = require("fs");

var program = `
function Foo() {
  arguments;
  return new Foo();
}
`;

var transpileOptions = {
  compilerOptions: {
    allowJs: true
  },
  fileName: "./foo.js"
};
ts.transpileModule(program, transpileOptions);

[imgx64]

This is a regression in TypeScript 2.3.1. It works correctly in 2.3.0.

[sandersn]

We have special-case code that creates a synthetic parameter args whenever a Javascript function uses arguments. This defeats the recursion detection code in type checking since the synthetic signatures is no longer === to the original signature. And every recursive loop creates a new synthetic signature, so the recursion detection never succeeds.

[sandersn]

Fix is up at #16330