[tbb-commits] [tor-browser/tor-browser-60.2.1esr-8.5-1] Bug 1493903 - Don't inline push with more than 1 argument. r=tcampbell a=dveditz

[gk at torproject.org]

commit 50e3be5d0c750483f8e2367cb8b8e0c3c26bba11
Author: Jan de Mooij <jdemooij at mozilla.com>
Date:   Tue Sep 25 12:33:42 2018 +0200

    Bug 1493903 - Don't inline push with more than 1 argument. r=tcampbell a=dveditz
    
    --HG--
    extra : source : b193307614e2f56615e7b5fe5ca97c2f6638c29d
    extra : intermediate-source : dc688e0c970278799f4d0ca9bde78545380e4110
---
 js/src/jit/MCallOptimize.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 2bee4b605280..1e600583c4cb 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -775,6 +775,12 @@ IonBuilder::inlineArrayPush(CallInfo& callInfo)
         return InliningStatus_NotInlined;
     }
 
+    // XXX bug 1493903.
+    if (callInfo.argc() != 1) {
+        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
+        return InliningStatus_NotInlined;
+    }
+
     MDefinition* obj = convertUnboxedObjects(callInfo.thisArg());
     for (uint32_t i = 0; i < callInfo.argc(); i++) {
         MDefinition* value = callInfo.getArg(i);