commit 50e3be5d0c750483f8e2367cb8b8e0c3c26bba11 Author: Jan de Mooij jdemooij@mozilla.com Date: Tue Sep 25 12:33:42 2018 +0200

Bug 1493903 - Don't inline push with more than 1 argument. r=tcampbell a=dveditz

--HG-- extra : source : b193307614e2f56615e7b5fe5ca97c2f6638c29d extra : intermediate-source : dc688e0c970278799f4d0ca9bde78545380e4110 --- js/src/jit/MCallOptimize.cpp | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index 2bee4b605280..1e600583c4cb 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -775,6 +775,12 @@ IonBuilder::inlineArrayPush(CallInfo& callInfo) return InliningStatus_NotInlined; }

+ // XXX bug 1493903. + if (callInfo.argc() != 1) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm); + return InliningStatus_NotInlined; + } + MDefinition* obj = convertUnboxedObjects(callInfo.thisArg()); for (uint32_t i = 0; i < callInfo.argc(); i++) { MDefinition* value = callInfo.getArg(i);