commit 19a1fbba648f1dd12e7bfc31f7c3f82cfc89cf33 Author: Jan de Mooij <jdemooij@mozilla.com> Date: Tue Sep 25 12:33:42 2018 +0200 Bug 1493903 - Don't inline push with more than 1 argument. r=tcampbell a=dveditz --HG-- extra : source : b193307614e2f56615e7b5fe5ca97c2f6638c29d extra : intermediate-source : dc688e0c970278799f4d0ca9bde78545380e4110 --- js/src/jit/MCallOptimize.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index 2bee4b605280..1e600583c4cb 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -775,6 +775,12 @@ IonBuilder::inlineArrayPush(CallInfo& callInfo) return InliningStatus_NotInlined; } + // XXX bug 1493903. + if (callInfo.argc() != 1) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm); + return InliningStatus_NotInlined; + } + MDefinition* obj = convertUnboxedObjects(callInfo.thisArg()); for (uint32_t i = 0; i < callInfo.argc(); i++) { MDefinition* value = callInfo.getArg(i);