diff --git a/js/src/ion/x64/Trampoline-x64.cpp b/js/src/ion/x64/Trampoline-x64.cpp
index f6b702f04743..f0487671978d 100644
--- a/js/src/ion/x64/Trampoline-x64.cpp
+++ b/js/src/ion/x64/Trampoline-x64.cpp
@@ -282,9 +282,10 @@ IonRuntime::generateInvalidator(JSContext *cx)
     masm.addq(Imm32(sizeof(uintptr_t)), rsp);
 
     // Push registers such that we can access them from [base + code].
-    masm.reserveStack(Registers::Total * sizeof(void *));
-    for (uint32_t i = 0; i < Registers::Total; i++)
-        masm.movq(Register::FromCode(i), Operand(rsp, i * sizeof(void *)));
+    for (uint32_t i = Registers::Total; i > 0; ) {
+        i--;
+        masm.Push(Register::FromCode(i));
+    }
 
     // Push xmm registers, such that we can access them from [base + code].
     masm.reserveStack(FloatRegisters::Total * sizeof(double));
@@ -415,9 +416,10 @@ static void
 GenerateBailoutThunk(JSContext *cx, MacroAssembler &masm, uint32_t frameClass)
 {
     // Push registers such that we can access them from [base + code].
-    masm.reserveStack(Registers::Total * sizeof(void *));
-    for (uint32_t i = 0; i < Registers::Total; i++)
-        masm.movq(Register::FromCode(i), Operand(rsp, i * sizeof(void *)));
+    for (uint32_t i = Registers::Total; i > 0; ) {
+        i--;
+        masm.Push(Register::FromCode(i));
+    }
 
     // Push xmm registers, such that we can access them from [base + code].
     masm.reserveStack(FloatRegisters::Total * sizeof(double));