diff --git a/src/compiler/js-inlining-heuristic.cc b/src/compiler/js-inlining-heuristic.cc
index fdbd24eb7eb..9a92c707b26 100644
--- a/src/compiler/js-inlining-heuristic.cc
+++ b/src/compiler/js-inlining-heuristic.cc
@@ -584,6 +584,11 @@ bool JSInliningHeuristic::TryReuseDispatch(Node* node, Node* callee,
   // Bailout if the call is not polymorphic anymore (other reducers might
   // have replaced the callee phi with a constant).
   if (callee->opcode() != IrOpcode::kPhi) return false;
+  // The callee may be a different (wider) phi than the one CollectFunctions
+  // snapshotted -- e.g. JSCallReducer's Function.prototype.call reduction can
+  // shift the receiver into the target slot after the candidate was deferred.
+  // Re-check the bound that the caller's stack arrays were sized against.
+  if (callee->op()->ValueInputCount() > kMaxCallPolymorphism) return false;
 
   // If there is a control node between the callee computation
   // and the call, bail out.