Bug 867482. r=bhackett

js/src/ion/MCallOptimize.cpp

@@ -410,6 +410,14 @@ IonBuilder::inlineArrayConcat(CallInfo &callInfo)
         return InliningStatus_NotInlined;
     }
 
+    // Don't inline if 'this' is packed and the argument may not be packed
+    // (the result array will reuse the 'this' type).
+    if (!thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED) &&
+        argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED))
+    {
+        return InliningStatus_NotInlined;
+    }
+
     // Constraints modeling this concat have not been generated by inference,
     // so check that type information already reflects possible side effects of
     // this call.

js/src/methodjit/FastBuiltins.cpp

@@ -1017,7 +1017,11 @@ mjit::Compiler::inlineNativeFunction(uint32_t argc, bool callingNew)
                                       types::OBJECT_FLAG_LENGTH_OVERFLOW) &&
             !types::ArrayPrototypeHasIndexedProperty(cx, outerScript))
         {
-            return compileArrayConcat(thisTypes, argTypes, thisValue, arg);
+            // Don't inline if 'this' is packed and the argument may not be packed.
+            bool argPacked = !argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
+            bool thisPacked = !thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
+            if (!(thisPacked && !argPacked))
+                return compileArrayConcat(thisTypes, argTypes, thisValue, arg);
         }
     } else if (argc == 2) {
         FrameEntry *arg1 = frame.peek(-2);