Bug 1493903 - Don't inline push with more than 1 argument. r=tcampbell

--HG--
extra : rebase_source : b193307614e2f56615e7b5fe5ca97c2f6638c29d

js/src/jit/MCallOptimize.cpp

@@ -817,6 +817,12 @@ IonBuilder::inlineArrayPush(CallInfo& callInfo)
         return InliningStatus_NotInlined;
     }
 
+    // XXX bug 1493903.
+    if (callInfo.argc() != 1) {
+        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
+        return InliningStatus_NotInlined;
+    }
+
     MDefinition* obj = convertUnboxedObjects(callInfo.thisArg());
     for (uint32_t i = 0; i < callInfo.argc(); i++) {
         MDefinition* value = callInfo.getArg(i);