Add m-esr52 at 52.6.0

1 files changed, 4930 insertions, 0 deletions

diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
new file mode 100644
index 000000000..13e50820e
--- /dev/null
+++ b/js/src/jit/Lowering.cpp
@@ -0,0 +1,4930 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "jit/Lowering.h"
+
+#include "mozilla/DebugOnly.h"
+
+#include "jit/JitSpewer.h"
+#include "jit/LIR.h"
+#include "jit/MIR.h"
+#include "jit/MIRGraph.h"
+#include "wasm/WasmSignalHandlers.h"
+
+#include "jsobjinlines.h"
+#include "jsopcodeinlines.h"
+
+#include "jit/shared/Lowering-shared-inl.h"
+
+using namespace js;
+using namespace jit;
+
+using mozilla::DebugOnly;
+using JS::GenericNaN;
+
+LBoxAllocation
+LIRGenerator::useBoxFixedAtStart(MDefinition* mir, ValueOperand op)
+{
+#if defined(JS_NUNBOX32)
+    return useBoxFixed(mir, op.typeReg(), op.payloadReg(), true);
+#elif defined(JS_PUNBOX64)
+    return useBoxFixed(mir, op.valueReg(), op.scratchReg(), true);
+#endif
+}
+
+LBoxAllocation
+LIRGenerator::useBoxAtStart(MDefinition* mir, LUse::Policy policy)
+{
+    return useBox(mir, policy, /* useAtStart = */ true);
+}
+
+void
+LIRGenerator::visitCloneLiteral(MCloneLiteral* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+    MOZ_ASSERT(ins->input()->type() == MIRType::Object);
+
+    LCloneLiteral* lir = new(alloc()) LCloneLiteral(useRegisterAtStart(ins->input()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitParameter(MParameter* param)
+{
+    ptrdiff_t offset;
+    if (param->index() == MParameter::THIS_SLOT)
+        offset = THIS_FRAME_ARGSLOT;
+    else
+        offset = 1 + param->index();
+
+    LParameter* ins = new(alloc()) LParameter;
+    defineBox(ins, param, LDefinition::FIXED);
+
+    offset *= sizeof(Value);
+#if defined(JS_NUNBOX32)
+# if MOZ_BIG_ENDIAN
+    ins->getDef(0)->setOutput(LArgument(offset));
+    ins->getDef(1)->setOutput(LArgument(offset + 4));
+# else
+    ins->getDef(0)->setOutput(LArgument(offset + 4));
+    ins->getDef(1)->setOutput(LArgument(offset));
+# endif
+#elif defined(JS_PUNBOX64)
+    ins->getDef(0)->setOutput(LArgument(offset));
+#endif
+}
+
+void
+LIRGenerator::visitCallee(MCallee* ins)
+{
+    define(new(alloc()) LCallee(), ins);
+}
+
+void
+LIRGenerator::visitIsConstructing(MIsConstructing* ins)
+{
+    define(new(alloc()) LIsConstructing(), ins);
+}
+
+static void
+TryToUseImplicitInterruptCheck(MIRGraph& graph, MBasicBlock* backedge)
+{
+    // Implicit interrupt checks require wasm signal handlers to be installed.
+    if (!wasm::HaveSignalHandlers() || JitOptions.ionInterruptWithoutSignals)
+        return;
+
+    // To avoid triggering expensive interrupts (backedge patching) in
+    // requestMajorGC and requestMinorGC, use an implicit interrupt check only
+    // if the loop body can not trigger GC or affect GC state like the store
+    // buffer. We do this by checking there are no safepoints attached to LIR
+    // instructions inside the loop.
+
+    MBasicBlockIterator block = graph.begin(backedge->loopHeaderOfBackedge());
+    LInterruptCheck* check = nullptr;
+    while (true) {
+        LBlock* lir = block->lir();
+        for (LInstructionIterator iter = lir->begin(); iter != lir->end(); iter++) {
+            if (iter->isInterruptCheck()) {
+                if (!check) {
+                    MOZ_ASSERT(*block == backedge->loopHeaderOfBackedge());
+                    check = iter->toInterruptCheck();
+                }
+                continue;
+            }
+
+            MOZ_ASSERT_IF(iter->isPostWriteBarrierO() || iter->isPostWriteBarrierV(),
+                          iter->safepoint());
+
+            if (iter->safepoint())
+                return;
+        }
+        if (*block == backedge)
+            break;
+        block++;
+    }
+
+    check->setImplicit();
+}
+
+void
+LIRGenerator::visitGoto(MGoto* ins)
+{
+    if (!gen->compilingWasm() && ins->block()->isLoopBackedge())
+        TryToUseImplicitInterruptCheck(graph, ins->block());
+
+    add(new(alloc()) LGoto(ins->target()));
+}
+
+void
+LIRGenerator::visitTableSwitch(MTableSwitch* tableswitch)
+{
+    MDefinition* opd = tableswitch->getOperand(0);
+
+    // There should be at least 1 successor. The default case!
+    MOZ_ASSERT(tableswitch->numSuccessors() > 0);
+
+    // If there are no cases, the default case is always taken.
+    if (tableswitch->numSuccessors() == 1) {
+        add(new(alloc()) LGoto(tableswitch->getDefault()));
+        return;
+    }
+
+    // If we don't know the type.
+    if (opd->type() == MIRType::Value) {
+        LTableSwitchV* lir = newLTableSwitchV(tableswitch);
+        add(lir);
+        return;
+    }
+
+    // Case indices are numeric, so other types will always go to the default case.
+    if (opd->type() != MIRType::Int32 && opd->type() != MIRType::Double) {
+        add(new(alloc()) LGoto(tableswitch->getDefault()));
+        return;
+    }
+
+    // Return an LTableSwitch, capable of handling either an integer or
+    // floating-point index.
+    LAllocation index;
+    LDefinition tempInt;
+    if (opd->type() == MIRType::Int32) {
+        index = useRegisterAtStart(opd);
+        tempInt = tempCopy(opd, 0);
+    } else {
+        index = useRegister(opd);
+        tempInt = temp(LDefinition::GENERAL);
+    }
+    add(newLTableSwitch(index, tempInt, tableswitch));
+}
+
+void
+LIRGenerator::visitCheckOverRecursed(MCheckOverRecursed* ins)
+{
+    LCheckOverRecursed* lir = new(alloc()) LCheckOverRecursed();
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDefVar(MDefVar* ins)
+{
+    LDefVar* lir = new(alloc()) LDefVar(useRegisterAtStart(ins->environmentChain()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDefLexical(MDefLexical* ins)
+{
+    LDefLexical* lir = new(alloc()) LDefLexical();
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDefFun(MDefFun* ins)
+{
+    MDefinition* fun = ins->fun();
+    MOZ_ASSERT(fun->type() == MIRType::Object);
+
+    LDefFun* lir = new(alloc()) LDefFun(useRegisterAtStart(fun),
+                                        useRegisterAtStart(ins->environmentChain()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewArray(MNewArray* ins)
+{
+    LNewArray* lir = new(alloc()) LNewArray(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewArrayCopyOnWrite(MNewArrayCopyOnWrite* ins)
+{
+    LNewArrayCopyOnWrite* lir = new(alloc()) LNewArrayCopyOnWrite(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewArrayDynamicLength(MNewArrayDynamicLength* ins)
+{
+    MDefinition* length = ins->length();
+    MOZ_ASSERT(length->type() == MIRType::Int32);
+
+    LNewArrayDynamicLength* lir = new(alloc()) LNewArrayDynamicLength(useRegister(length), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewTypedArray(MNewTypedArray* ins)
+{
+    LNewTypedArray* lir = new(alloc()) LNewTypedArray(temp(), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewTypedArrayDynamicLength(MNewTypedArrayDynamicLength* ins)
+{
+    MDefinition* length = ins->length();
+    MOZ_ASSERT(length->type() == MIRType::Int32);
+
+    LNewTypedArrayDynamicLength* lir = new(alloc()) LNewTypedArrayDynamicLength(useRegister(length), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewObject(MNewObject* ins)
+{
+    LNewObject* lir = new(alloc()) LNewObject(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewTypedObject(MNewTypedObject* ins)
+{
+    LNewTypedObject* lir = new(alloc()) LNewTypedObject(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewNamedLambdaObject(MNewNamedLambdaObject* ins)
+{
+    LNewNamedLambdaObject* lir = new(alloc()) LNewNamedLambdaObject(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewCallObject(MNewCallObject* ins)
+{
+    LNewCallObject* lir = new(alloc()) LNewCallObject(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewSingletonCallObject(MNewSingletonCallObject* ins)
+{
+    LNewSingletonCallObject* lir = new(alloc()) LNewSingletonCallObject(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewDerivedTypedObject(MNewDerivedTypedObject* ins)
+{
+    LNewDerivedTypedObject* lir =
+        new(alloc()) LNewDerivedTypedObject(useRegisterAtStart(ins->type()),
+                                            useRegisterAtStart(ins->owner()),
+                                            useRegisterAtStart(ins->offset()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNewStringObject(MNewStringObject* ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType::String);
+
+    LNewStringObject* lir = new(alloc()) LNewStringObject(useRegister(ins->input()), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitInitElem(MInitElem* ins)
+{
+    LInitElem* lir = new(alloc()) LInitElem(useRegisterAtStart(ins->getObject()),
+                                            useBoxAtStart(ins->getId()),
+                                            useBoxAtStart(ins->getValue()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitInitElemGetterSetter(MInitElemGetterSetter* ins)
+{
+    LInitElemGetterSetter* lir =
+        new(alloc()) LInitElemGetterSetter(useRegisterAtStart(ins->object()),
+                                           useBoxAtStart(ins->idValue()),
+                                           useRegisterAtStart(ins->value()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitMutateProto(MMutateProto* ins)
+{
+    LMutateProto* lir = new(alloc()) LMutateProto(useRegisterAtStart(ins->getObject()),
+                                                  useBoxAtStart(ins->getValue()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitInitProp(MInitProp* ins)
+{
+    LInitProp* lir = new(alloc()) LInitProp(useRegisterAtStart(ins->getObject()),
+                                            useBoxAtStart(ins->getValue()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitInitPropGetterSetter(MInitPropGetterSetter* ins)
+{
+    LInitPropGetterSetter* lir =
+        new(alloc()) LInitPropGetterSetter(useRegisterAtStart(ins->object()),
+                                           useRegisterAtStart(ins->value()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCreateThisWithTemplate(MCreateThisWithTemplate* ins)
+{
+    LCreateThisWithTemplate* lir = new(alloc()) LCreateThisWithTemplate(temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCreateThisWithProto(MCreateThisWithProto* ins)
+{
+    LCreateThisWithProto* lir =
+        new(alloc()) LCreateThisWithProto(useRegisterOrConstantAtStart(ins->getCallee()),
+                                          useRegisterOrConstantAtStart(ins->getNewTarget()),
+                                          useRegisterOrConstantAtStart(ins->getPrototype()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCreateThis(MCreateThis* ins)
+{
+    LCreateThis* lir = new(alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()),
+                                                useRegisterOrConstantAtStart(ins->getNewTarget()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCreateArgumentsObject(MCreateArgumentsObject* ins)
+{
+    LAllocation callObj = useFixedAtStart(ins->getCallObject(), CallTempReg0);
+    LCreateArgumentsObject* lir = new(alloc()) LCreateArgumentsObject(callObj, tempFixed(CallTempReg1),
+                                                                      tempFixed(CallTempReg2),
+                                                                      tempFixed(CallTempReg3));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGetArgumentsObjectArg(MGetArgumentsObjectArg* ins)
+{
+    LAllocation argsObj = useRegister(ins->getArgsObject());
+    LGetArgumentsObjectArg* lir = new(alloc()) LGetArgumentsObjectArg(argsObj, temp());
+    defineBox(lir, ins);
+}
+
+void
+LIRGenerator::visitSetArgumentsObjectArg(MSetArgumentsObjectArg* ins)
+{
+    LAllocation argsObj = useRegister(ins->getArgsObject());
+    LSetArgumentsObjectArg* lir =
+        new(alloc()) LSetArgumentsObjectArg(argsObj, useBox(ins->getValue()), temp());
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitReturnFromCtor(MReturnFromCtor* ins)
+{
+    LReturnFromCtor* lir = new(alloc()) LReturnFromCtor(useBox(ins->getValue()),
+                                                        useRegister(ins->getObject()));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitComputeThis(MComputeThis* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+    MOZ_ASSERT(ins->input()->type() == MIRType::Value);
+
+    // Don't use useBoxAtStart because ComputeThis has a safepoint and needs to
+    // have its inputs in different registers than its return value so that
+    // they aren't clobbered.
+    LComputeThis* lir = new(alloc()) LComputeThis(useBox(ins->input()));
+    defineBox(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitArrowNewTarget(MArrowNewTarget* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+    MOZ_ASSERT(ins->callee()->type() == MIRType::Object);
+
+    LArrowNewTarget* lir = new(alloc()) LArrowNewTarget(useRegister(ins->callee()));
+    defineBox(lir, ins);
+}
+
+bool
+LIRGenerator::lowerCallArguments(MCall* call)
+{
+    uint32_t argc = call->numStackArgs();
+
+    // Align the arguments of a call such that the callee would keep the same
+    // alignment as the caller.
+    uint32_t baseSlot = 0;
+    if (JitStackValueAlignment > 1)
+        baseSlot = AlignBytes(argc, JitStackValueAlignment);
+    else
+        baseSlot = argc;
+
+    // Save the maximum number of argument, such that we can have one unique
+    // frame size.
+    if (baseSlot > maxargslots_)
+        maxargslots_ = baseSlot;
+
+    for (size_t i = 0; i < argc; i++) {
+        MDefinition* arg = call->getArg(i);
+        uint32_t argslot = baseSlot - i;
+
+        // Values take a slow path.
+        if (arg->type() == MIRType::Value) {
+            LStackArgV* stack = new(alloc()) LStackArgV(argslot, useBox(arg));
+            add(stack);
+        } else {
+            // Known types can move constant types and/or payloads.
+            LStackArgT* stack = new(alloc()) LStackArgT(argslot, arg->type(), useRegisterOrConstant(arg));
+            add(stack);
+        }
+
+        if (!alloc().ensureBallast())
+            return false;
+    }
+    return true;
+}
+
+void
+LIRGenerator::visitCall(MCall* call)
+{
+    MOZ_ASSERT(CallTempReg0 != CallTempReg1);
+    MOZ_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
+    MOZ_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
+    MOZ_ASSERT(call->getFunction()->type() == MIRType::Object);
+
+    // In case of oom, skip the rest of the allocations.
+    if (!lowerCallArguments(call)) {
+        gen->abort("OOM: LIRGenerator::visitCall");
+        return;
+    }
+
+    WrappedFunction* target = call->getSingleTarget();
+
+    LInstruction* lir;
+
+    if (call->isCallDOMNative()) {
+        // Call DOM functions.
+        MOZ_ASSERT(target && target->isNative());
+        Register cxReg, objReg, privReg, argsReg;
+        GetTempRegForIntArg(0, 0, &cxReg);
+        GetTempRegForIntArg(1, 0, &objReg);
+        GetTempRegForIntArg(2, 0, &privReg);
+        mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &argsReg);
+        MOZ_ASSERT(ok, "How can we not have four temp registers?");
+        lir = new(alloc()) LCallDOMNative(tempFixed(cxReg), tempFixed(objReg),
+                                          tempFixed(privReg), tempFixed(argsReg));
+    } else if (target) {
+        // Call known functions.
+        if (target->isNative()) {
+            Register cxReg, numReg, vpReg, tmpReg;
+            GetTempRegForIntArg(0, 0, &cxReg);
+            GetTempRegForIntArg(1, 0, &numReg);
+            GetTempRegForIntArg(2, 0, &vpReg);
+
+            // Even though this is just a temp reg, use the same API to avoid
+            // register collisions.
+            mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &tmpReg);
+            MOZ_ASSERT(ok, "How can we not have four temp registers?");
+
+            lir = new(alloc()) LCallNative(tempFixed(cxReg), tempFixed(numReg),
+                                           tempFixed(vpReg), tempFixed(tmpReg));
+        } else {
+            lir = new(alloc()) LCallKnown(useFixedAtStart(call->getFunction(), CallTempReg0),
+                                          tempFixed(CallTempReg2));
+        }
+    } else {
+        // Call anything, using the most generic code.
+        lir = new(alloc()) LCallGeneric(useFixedAtStart(call->getFunction(), CallTempReg0),
+                                        tempFixed(ArgumentsRectifierReg),
+                                        tempFixed(CallTempReg2));
+    }
+    defineReturn(lir, call);
+    assignSafepoint(lir, call);
+}
+
+void
+LIRGenerator::visitApplyArgs(MApplyArgs* apply)
+{
+    MOZ_ASSERT(apply->getFunction()->type() == MIRType::Object);
+
+    // Assert if we cannot build a rectifier frame.
+    MOZ_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
+    MOZ_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
+
+    // Assert if the return value is already erased.
+    MOZ_ASSERT(CallTempReg2 != JSReturnReg_Type);
+    MOZ_ASSERT(CallTempReg2 != JSReturnReg_Data);
+
+    LApplyArgsGeneric* lir = new(alloc()) LApplyArgsGeneric(
+        useFixedAtStart(apply->getFunction(), CallTempReg3),
+        useFixedAtStart(apply->getArgc(), CallTempReg0),
+        useBoxFixedAtStart(apply->getThis(), CallTempReg4, CallTempReg5),
+        tempFixed(CallTempReg1),  // object register
+        tempFixed(CallTempReg2)); // stack counter register
+
+    // Bailout is needed in the case of possible non-JSFunction callee or too
+    // many values in the arguments array.  I'm going to use NonJSFunctionCallee
+    // for the code even if that is not an adequate description.
+    assignSnapshot(lir, Bailout_NonJSFunctionCallee);
+
+    defineReturn(lir, apply);
+    assignSafepoint(lir, apply);
+}
+
+void
+LIRGenerator::visitApplyArray(MApplyArray* apply)
+{
+    MOZ_ASSERT(apply->getFunction()->type() == MIRType::Object);
+
+    // Assert if we cannot build a rectifier frame.
+    MOZ_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
+    MOZ_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
+
+    // Assert if the return value is already erased.
+    MOZ_ASSERT(CallTempReg2 != JSReturnReg_Type);
+    MOZ_ASSERT(CallTempReg2 != JSReturnReg_Data);
+
+    LApplyArrayGeneric* lir = new(alloc()) LApplyArrayGeneric(
+        useFixedAtStart(apply->getFunction(), CallTempReg3),
+        useFixedAtStart(apply->getElements(), CallTempReg0),
+        useBoxFixedAtStart(apply->getThis(), CallTempReg4, CallTempReg5),
+        tempFixed(CallTempReg1),  // object register
+        tempFixed(CallTempReg2)); // stack counter register
+
+    // Bailout is needed in the case of possible non-JSFunction callee,
+    // too many values in the array, or empty space at the end of the
+    // array.  I'm going to use NonJSFunctionCallee for the code even
+    // if that is not an adequate description.
+    assignSnapshot(lir, Bailout_NonJSFunctionCallee);
+
+    defineReturn(lir, apply);
+    assignSafepoint(lir, apply);
+}
+
+void
+LIRGenerator::visitBail(MBail* bail)
+{
+    LBail* lir = new(alloc()) LBail();
+    assignSnapshot(lir, bail->bailoutKind());
+    add(lir, bail);
+}
+
+void
+LIRGenerator::visitUnreachable(MUnreachable* unreachable)
+{
+    LUnreachable* lir = new(alloc()) LUnreachable();
+    add(lir, unreachable);
+}
+
+void
+LIRGenerator::visitEncodeSnapshot(MEncodeSnapshot* mir)
+{
+    LEncodeSnapshot* lir = new(alloc()) LEncodeSnapshot();
+    assignSnapshot(lir, Bailout_Inevitable);
+    add(lir, mir);
+}
+
+void
+LIRGenerator::visitAssertFloat32(MAssertFloat32* assertion)
+{
+    MIRType type = assertion->input()->type();
+    DebugOnly<bool> checkIsFloat32 = assertion->mustBeFloat32();
+
+    if (type != MIRType::Value && !JitOptions.eagerCompilation) {
+        MOZ_ASSERT_IF(checkIsFloat32, type == MIRType::Float32);
+        MOZ_ASSERT_IF(!checkIsFloat32, type != MIRType::Float32);
+    }
+}
+
+void
+LIRGenerator::visitAssertRecoveredOnBailout(MAssertRecoveredOnBailout* assertion)
+{
+    MOZ_CRASH("AssertRecoveredOnBailout nodes are always recovered on bailouts.");
+}
+
+void
+LIRGenerator::visitArraySplice(MArraySplice* ins)
+{
+    LArraySplice* lir = new(alloc()) LArraySplice(useRegisterAtStart(ins->object()),
+                                                  useRegisterAtStart(ins->start()),
+                                                  useRegisterAtStart(ins->deleteCount()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGetDynamicName(MGetDynamicName* ins)
+{
+    MDefinition* envChain = ins->getEnvironmentChain();
+    MOZ_ASSERT(envChain->type() == MIRType::Object);
+
+    MDefinition* name = ins->getName();
+    MOZ_ASSERT(name->type() == MIRType::String);
+
+    LGetDynamicName* lir = new(alloc()) LGetDynamicName(useFixedAtStart(envChain, CallTempReg0),
+                                                        useFixedAtStart(name, CallTempReg1),
+                                                        tempFixed(CallTempReg2),
+                                                        tempFixed(CallTempReg3),
+                                                        tempFixed(CallTempReg4));
+
+    assignSnapshot(lir, Bailout_DynamicNameNotFound);
+    defineReturn(lir, ins);
+}
+
+void
+LIRGenerator::visitCallDirectEval(MCallDirectEval* ins)
+{
+    MDefinition* envChain = ins->getEnvironmentChain();
+    MOZ_ASSERT(envChain->type() == MIRType::Object);
+
+    MDefinition* string = ins->getString();
+    MOZ_ASSERT(string->type() == MIRType::String);
+
+    MDefinition* newTargetValue = ins->getNewTargetValue();
+
+    LInstruction* lir = new(alloc()) LCallDirectEval(useRegisterAtStart(envChain),
+                                                     useRegisterAtStart(string),
+                                                     useBoxAtStart(newTargetValue));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+static JSOp
+ReorderComparison(JSOp op, MDefinition** lhsp, MDefinition** rhsp)
+{
+    MDefinition* lhs = *lhsp;
+    MDefinition* rhs = *rhsp;
+
+    if (lhs->maybeConstantValue()) {
+        *rhsp = lhs;
+        *lhsp = rhs;
+        return ReverseCompareOp(op);
+    }
+    return op;
+}
+
+void
+LIRGenerator::visitTest(MTest* test)
+{
+    MDefinition* opd = test->getOperand(0);
+    MBasicBlock* ifTrue = test->ifTrue();
+    MBasicBlock* ifFalse = test->ifFalse();
+
+    // String is converted to length of string in the type analysis phase (see
+    // TestPolicy).
+    MOZ_ASSERT(opd->type() != MIRType::String);
+
+    // Testing a constant.
+    if (MConstant* constant = opd->maybeConstantValue()) {
+        bool b;
+        if (constant->valueToBoolean(&b)) {
+            add(new(alloc()) LGoto(b ? ifTrue : ifFalse));
+            return;
+        }
+    }
+
+    if (opd->type() == MIRType::Value) {
+        LDefinition temp0, temp1;
+        if (test->operandMightEmulateUndefined()) {
+            temp0 = temp();
+            temp1 = temp();
+        } else {
+            temp0 = LDefinition::BogusTemp();
+            temp1 = LDefinition::BogusTemp();
+        }
+        LTestVAndBranch* lir =
+            new(alloc()) LTestVAndBranch(ifTrue, ifFalse, useBox(opd), tempDouble(), temp0, temp1);
+        add(lir, test);
+        return;
+    }
+
+    if (opd->type() == MIRType::ObjectOrNull) {
+        LDefinition temp0 = test->operandMightEmulateUndefined() ? temp() : LDefinition::BogusTemp();
+        add(new(alloc()) LTestOAndBranch(useRegister(opd), ifTrue, ifFalse, temp0), test);
+        return;
+    }
+
+    // Objects are truthy, except if it might emulate undefined.
+    if (opd->type() == MIRType::Object) {
+        if (test->operandMightEmulateUndefined())
+            add(new(alloc()) LTestOAndBranch(useRegister(opd), ifTrue, ifFalse, temp()), test);
+        else
+            add(new(alloc()) LGoto(ifTrue));
+        return;
+    }
+
+    // These must be explicitly sniffed out since they are constants and have
+    // no payload.
+    if (opd->type() == MIRType::Undefined || opd->type() == MIRType::Null) {
+        add(new(alloc()) LGoto(ifFalse));
+        return;
+    }
+
+    // All symbols are truthy.
+    if (opd->type() == MIRType::Symbol) {
+        add(new(alloc()) LGoto(ifTrue));
+        return;
+    }
+
+    // Check if the operand for this test is a compare operation. If it is, we want
+    // to emit an LCompare*AndBranch rather than an LTest*AndBranch, to fuse the
+    // compare and jump instructions.
+    if (opd->isCompare() && opd->isEmittedAtUses()) {
+        MCompare* comp = opd->toCompare();
+        MDefinition* left = comp->lhs();
+        MDefinition* right = comp->rhs();
+
+        // Try to fold the comparison so that we don't have to handle all cases.
+        bool result;
+        if (comp->tryFold(&result)) {
+            add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
+            return;
+        }
+
+        // Emit LCompare*AndBranch.
+
+        // Compare and branch null/undefined.
+        // The second operand has known null/undefined type,
+        // so just test the first operand.
+        if (comp->compareType() == MCompare::Compare_Null ||
+            comp->compareType() == MCompare::Compare_Undefined)
+        {
+            if (left->type() == MIRType::Object || left->type() == MIRType::ObjectOrNull) {
+                MOZ_ASSERT(left->type() == MIRType::ObjectOrNull ||
+                           comp->operandMightEmulateUndefined(),
+                           "MCompare::tryFold should handle the never-emulates-undefined case");
+
+                LDefinition tmp =
+                    comp->operandMightEmulateUndefined() ? temp() : LDefinition::BogusTemp();
+                LIsNullOrLikeUndefinedAndBranchT* lir =
+                    new(alloc()) LIsNullOrLikeUndefinedAndBranchT(comp, useRegister(left),
+                                                                  ifTrue, ifFalse, tmp);
+                add(lir, test);
+                return;
+            }
+
+            LDefinition tmp, tmpToUnbox;
+            if (comp->operandMightEmulateUndefined()) {
+                tmp = temp();
+                tmpToUnbox = tempToUnbox();
+            } else {
+                tmp = LDefinition::BogusTemp();
+                tmpToUnbox = LDefinition::BogusTemp();
+            }
+
+            LIsNullOrLikeUndefinedAndBranchV* lir =
+                new(alloc()) LIsNullOrLikeUndefinedAndBranchV(comp, ifTrue, ifFalse, useBox(left),
+                                                              tmp, tmpToUnbox);
+            add(lir, test);
+            return;
+        }
+
+        // Compare and branch booleans.
+        if (comp->compareType() == MCompare::Compare_Boolean) {
+            MOZ_ASSERT(left->type() == MIRType::Value);
+            MOZ_ASSERT(right->type() == MIRType::Boolean);
+
+            LCompareBAndBranch* lir = new(alloc()) LCompareBAndBranch(comp, useBox(left),
+                                                                      useRegisterOrConstant(right),
+                                                                      ifTrue, ifFalse);
+            add(lir, test);
+            return;
+        }
+
+        // Compare and branch Int32 or Object pointers.
+        if (comp->isInt32Comparison() ||
+            comp->compareType() == MCompare::Compare_UInt32 ||
+            comp->compareType() == MCompare::Compare_Object)
+        {
+            JSOp op = ReorderComparison(comp->jsop(), &left, &right);
+            LAllocation lhs = useRegister(left);
+            LAllocation rhs;
+            if (comp->isInt32Comparison() || comp->compareType() == MCompare::Compare_UInt32)
+                rhs = useAnyOrConstant(right);
+            else
+                rhs = useRegister(right);
+            LCompareAndBranch* lir = new(alloc()) LCompareAndBranch(comp, op, lhs, rhs,
+                                                                    ifTrue, ifFalse);
+            add(lir, test);
+            return;
+        }
+
+        // Compare and branch Int64.
+        if (comp->compareType() == MCompare::Compare_Int64 ||
+            comp->compareType() == MCompare::Compare_UInt64)
+        {
+            JSOp op = ReorderComparison(comp->jsop(), &left, &right);
+            LCompareI64AndBranch* lir = new(alloc()) LCompareI64AndBranch(comp, op,
+                                                                          useInt64Register(left),
+                                                                          useInt64OrConstant(right),
+                                                                          ifTrue, ifFalse);
+            add(lir, test);
+            return;
+        }
+
+        // Compare and branch doubles.
+        if (comp->isDoubleComparison()) {
+            LAllocation lhs = useRegister(left);
+            LAllocation rhs = useRegister(right);
+            LCompareDAndBranch* lir = new(alloc()) LCompareDAndBranch(comp, lhs, rhs,
+                                                                      ifTrue, ifFalse);
+            add(lir, test);
+            return;
+        }
+
+        // Compare and branch floats.
+        if (comp->isFloat32Comparison()) {
+            LAllocation lhs = useRegister(left);
+            LAllocation rhs = useRegister(right);
+            LCompareFAndBranch* lir = new(alloc()) LCompareFAndBranch(comp, lhs, rhs,
+                                                                      ifTrue, ifFalse);
+            add(lir, test);
+            return;
+        }
+
+        // Compare values.
+        if (comp->compareType() == MCompare::Compare_Bitwise) {
+            LCompareBitwiseAndBranch* lir =
+                new(alloc()) LCompareBitwiseAndBranch(comp, ifTrue, ifFalse,
+                                                      useBoxAtStart(left),
+                                                      useBoxAtStart(right));
+            add(lir, test);
+            return;
+        }
+    }
+
+    // Check if the operand for this test is a bitand operation. If it is, we want
+    // to emit an LBitAndAndBranch rather than an LTest*AndBranch.
+    if (opd->isBitAnd() && opd->isEmittedAtUses()) {
+        MDefinition* lhs = opd->getOperand(0);
+        MDefinition* rhs = opd->getOperand(1);
+        if (lhs->type() == MIRType::Int32 && rhs->type() == MIRType::Int32) {
+            ReorderCommutative(&lhs, &rhs, test);
+            lowerForBitAndAndBranch(new(alloc()) LBitAndAndBranch(ifTrue, ifFalse), test, lhs, rhs);
+            return;
+        }
+    }
+
+    if (opd->isIsObject() && opd->isEmittedAtUses()) {
+        MDefinition* input = opd->toIsObject()->input();
+        MOZ_ASSERT(input->type() == MIRType::Value);
+
+        LIsObjectAndBranch* lir = new(alloc()) LIsObjectAndBranch(ifTrue, ifFalse,
+                                                                  useBoxAtStart(input));
+        add(lir, test);
+        return;
+    }
+
+    if (opd->isIsNoIter()) {
+        MOZ_ASSERT(opd->isEmittedAtUses());
+
+        MDefinition* input = opd->toIsNoIter()->input();
+        MOZ_ASSERT(input->type() == MIRType::Value);
+
+        LIsNoIterAndBranch* lir = new(alloc()) LIsNoIterAndBranch(ifTrue, ifFalse,
+                                                                  useBox(input));
+        add(lir, test);
+        return;
+    }
+
+    switch (opd->type()) {
+      case MIRType::Double:
+        add(new(alloc()) LTestDAndBranch(useRegister(opd), ifTrue, ifFalse));
+        break;
+      case MIRType::Float32:
+        add(new(alloc()) LTestFAndBranch(useRegister(opd), ifTrue, ifFalse));
+        break;
+      case MIRType::Int32:
+      case MIRType::Boolean:
+        add(new(alloc()) LTestIAndBranch(useRegister(opd), ifTrue, ifFalse));
+        break;
+      case MIRType::Int64:
+        add(new(alloc()) LTestI64AndBranch(useInt64Register(opd), ifTrue, ifFalse));
+        break;
+      default:
+        MOZ_CRASH("Bad type");
+    }
+}
+
+void
+LIRGenerator::visitGotoWithFake(MGotoWithFake* gotoWithFake)
+{
+    add(new(alloc()) LGoto(gotoWithFake->target()));
+}
+
+void
+LIRGenerator::visitFunctionDispatch(MFunctionDispatch* ins)
+{
+    LFunctionDispatch* lir = new(alloc()) LFunctionDispatch(useRegister(ins->input()));
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitObjectGroupDispatch(MObjectGroupDispatch* ins)
+{
+    LObjectGroupDispatch* lir = new(alloc()) LObjectGroupDispatch(useRegister(ins->input()), temp());
+    add(lir, ins);
+}
+
+static inline bool
+CanEmitCompareAtUses(MInstruction* ins)
+{
+    if (!ins->canEmitAtUses())
+        return false;
+
+    bool foundTest = false;
+    for (MUseIterator iter(ins->usesBegin()); iter != ins->usesEnd(); iter++) {
+        MNode* node = iter->consumer();
+        if (!node->isDefinition())
+            return false;
+        if (!node->toDefinition()->isTest())
+            return false;
+        if (foundTest)
+            return false;
+        foundTest = true;
+    }
+    return true;
+}
+
+void
+LIRGenerator::visitCompare(MCompare* comp)
+{
+    MDefinition* left = comp->lhs();
+    MDefinition* right = comp->rhs();
+
+    // Try to fold the comparison so that we don't have to handle all cases.
+    bool result;
+    if (comp->tryFold(&result)) {
+        define(new(alloc()) LInteger(result), comp);
+        return;
+    }
+
+    // Move below the emitAtUses call if we ever implement
+    // LCompareSAndBranch. Doing this now wouldn't be wrong, but doesn't
+    // make sense and avoids confusion.
+    if (comp->compareType() == MCompare::Compare_String) {
+        LCompareS* lir = new(alloc()) LCompareS(useRegister(left), useRegister(right));
+        define(lir, comp);
+        assignSafepoint(lir, comp);
+        return;
+    }
+
+    // Strict compare between value and string
+    if (comp->compareType() == MCompare::Compare_StrictString) {
+        MOZ_ASSERT(left->type() == MIRType::Value);
+        MOZ_ASSERT(right->type() == MIRType::String);
+
+        LCompareStrictS* lir = new(alloc()) LCompareStrictS(useBox(left), useRegister(right),
+                                                            tempToUnbox());
+        define(lir, comp);
+        assignSafepoint(lir, comp);
+        return;
+    }
+
+    // Unknown/unspecialized compare use a VM call.
+    if (comp->compareType() == MCompare::Compare_Unknown) {
+        LCompareVM* lir = new(alloc()) LCompareVM(useBoxAtStart(left), useBoxAtStart(right));
+        defineReturn(lir, comp);
+        assignSafepoint(lir, comp);
+        return;
+    }
+
+    // Sniff out if the output of this compare is used only for a branching.
+    // If it is, then we will emit an LCompare*AndBranch instruction in place
+    // of this compare and any test that uses this compare. Thus, we can
+    // ignore this Compare.
+    if (CanEmitCompareAtUses(comp)) {
+        emitAtUses(comp);
+        return;
+    }
+
+    // Compare Null and Undefined.
+    if (comp->compareType() == MCompare::Compare_Null ||
+        comp->compareType() == MCompare::Compare_Undefined)
+    {
+        if (left->type() == MIRType::Object || left->type() == MIRType::ObjectOrNull) {
+            MOZ_ASSERT(left->type() == MIRType::ObjectOrNull ||
+                       comp->operandMightEmulateUndefined(),
+                       "MCompare::tryFold should have folded this away");
+
+            define(new(alloc()) LIsNullOrLikeUndefinedT(useRegister(left)), comp);
+            return;
+        }
+
+        LDefinition tmp, tmpToUnbox;
+        if (comp->operandMightEmulateUndefined()) {
+            tmp = temp();
+            tmpToUnbox = tempToUnbox();
+        } else {
+            tmp = LDefinition::BogusTemp();
+            tmpToUnbox = LDefinition::BogusTemp();
+        }
+
+        LIsNullOrLikeUndefinedV* lir = new(alloc()) LIsNullOrLikeUndefinedV(useBox(left),
+                                                                            tmp, tmpToUnbox);
+        define(lir, comp);
+        return;
+    }
+
+    // Compare booleans.
+    if (comp->compareType() == MCompare::Compare_Boolean) {
+        MOZ_ASSERT(left->type() == MIRType::Value);
+        MOZ_ASSERT(right->type() == MIRType::Boolean);
+
+        LCompareB* lir = new(alloc()) LCompareB(useBox(left), useRegisterOrConstant(right));
+        define(lir, comp);
+        return;
+    }
+
+    // Compare Int32 or Object pointers.
+    if (comp->isInt32Comparison() ||
+        comp->compareType() == MCompare::Compare_UInt32 ||
+        comp->compareType() == MCompare::Compare_Object)
+    {
+        JSOp op = ReorderComparison(comp->jsop(), &left, &right);
+        LAllocation lhs = useRegister(left);
+        LAllocation rhs;
+        if (comp->isInt32Comparison() ||
+            comp->compareType() == MCompare::Compare_UInt32)
+        {
+            rhs = useAnyOrConstant(right);
+        } else {
+            rhs = useRegister(right);
+        }
+        define(new(alloc()) LCompare(op, lhs, rhs), comp);
+        return;
+    }
+
+    // Compare Int64.
+    if (comp->compareType() == MCompare::Compare_Int64 ||
+        comp->compareType() == MCompare::Compare_UInt64)
+    {
+        JSOp op = ReorderComparison(comp->jsop(), &left, &right);
+        define(new(alloc()) LCompareI64(op, useInt64Register(left), useInt64OrConstant(right)),
+               comp);
+        return;
+    }
+
+    // Compare doubles.
+    if (comp->isDoubleComparison()) {
+        define(new(alloc()) LCompareD(useRegister(left), useRegister(right)), comp);
+        return;
+    }
+
+    // Compare float32.
+    if (comp->isFloat32Comparison()) {
+        define(new(alloc()) LCompareF(useRegister(left), useRegister(right)), comp);
+        return;
+    }
+
+    // Compare values.
+    if (comp->compareType() == MCompare::Compare_Bitwise) {
+        LCompareBitwise* lir = new(alloc()) LCompareBitwise(useBoxAtStart(left),
+                                                            useBoxAtStart(right));
+        define(lir, comp);
+        return;
+    }
+
+    MOZ_CRASH("Unrecognized compare type.");
+}
+
+void
+LIRGenerator::lowerBitOp(JSOp op, MInstruction* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    if (lhs->type() == MIRType::Int32) {
+        MOZ_ASSERT(rhs->type() == MIRType::Int32);
+        ReorderCommutative(&lhs, &rhs, ins);
+        lowerForALU(new(alloc()) LBitOpI(op), ins, lhs, rhs);
+        return;
+    }
+
+    if (lhs->type() == MIRType::Int64) {
+        MOZ_ASSERT(rhs->type() == MIRType::Int64);
+        ReorderCommutative(&lhs, &rhs, ins);
+        lowerForALUInt64(new(alloc()) LBitOpI64(op), ins, lhs, rhs);
+        return;
+    }
+
+    LBitOpV* lir = new(alloc()) LBitOpV(op, useBoxAtStart(lhs), useBoxAtStart(rhs));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitTypeOf(MTypeOf* ins)
+{
+    MDefinition* opd = ins->input();
+    MOZ_ASSERT(opd->type() == MIRType::Value);
+
+    LTypeOfV* lir = new(alloc()) LTypeOfV(useBox(opd), tempToUnbox());
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitToAsync(MToAsync* ins)
+{
+    LToAsync* lir = new(alloc()) LToAsync(useRegisterAtStart(ins->input()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitToId(MToId* ins)
+{
+    LToIdV* lir = new(alloc()) LToIdV(useBox(ins->input()), tempDouble());
+    defineBox(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitBitNot(MBitNot* ins)
+{
+    MDefinition* input = ins->getOperand(0);
+
+    if (input->type() == MIRType::Int32) {
+        lowerForALU(new(alloc()) LBitNotI(), ins, input);
+        return;
+    }
+
+    LBitNotV* lir = new(alloc()) LBitNotV(useBoxAtStart(input));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+static bool
+CanEmitBitAndAtUses(MInstruction* ins)
+{
+    if (!ins->canEmitAtUses())
+        return false;
+
+    if (ins->getOperand(0)->type() != MIRType::Int32 || ins->getOperand(1)->type() != MIRType::Int32)
+        return false;
+
+    MUseIterator iter(ins->usesBegin());
+    if (iter == ins->usesEnd())
+        return false;
+
+    MNode* node = iter->consumer();
+    if (!node->isDefinition())
+        return false;
+
+    if (!node->toDefinition()->isTest())
+        return false;
+
+    iter++;
+    return iter == ins->usesEnd();
+}
+
+void
+LIRGenerator::visitBitAnd(MBitAnd* ins)
+{
+    // Sniff out if the output of this bitand is used only for a branching.
+    // If it is, then we will emit an LBitAndAndBranch instruction in place
+    // of this bitand and any test that uses this bitand. Thus, we can
+    // ignore this BitAnd.
+    if (CanEmitBitAndAtUses(ins))
+        emitAtUses(ins);
+    else
+        lowerBitOp(JSOP_BITAND, ins);
+}
+
+void
+LIRGenerator::visitBitOr(MBitOr* ins)
+{
+    lowerBitOp(JSOP_BITOR, ins);
+}
+
+void
+LIRGenerator::visitBitXor(MBitXor* ins)
+{
+    lowerBitOp(JSOP_BITXOR, ins);
+}
+
+void
+LIRGenerator::lowerShiftOp(JSOp op, MShiftInstruction* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    if (lhs->type() == MIRType::Int32) {
+        MOZ_ASSERT(rhs->type() == MIRType::Int32);
+
+        if (ins->type() == MIRType::Double) {
+            MOZ_ASSERT(op == JSOP_URSH);
+            lowerUrshD(ins->toUrsh());
+            return;
+        }
+
+        LShiftI* lir = new(alloc()) LShiftI(op);
+        if (op == JSOP_URSH) {
+            if (ins->toUrsh()->fallible())
+                assignSnapshot(lir, Bailout_OverflowInvalidate);
+        }
+        lowerForShift(lir, ins, lhs, rhs);
+        return;
+    }
+
+    if (lhs->type() == MIRType::Int64) {
+        MOZ_ASSERT(rhs->type() == MIRType::Int64);
+        lowerForShiftInt64(new(alloc()) LShiftI64(op), ins, lhs, rhs);
+        return;
+    }
+
+    MOZ_ASSERT(ins->specialization() == MIRType::None);
+
+    if (op == JSOP_URSH) {
+        // Result is either int32 or double so we have to use BinaryV.
+        lowerBinaryV(JSOP_URSH, ins);
+        return;
+    }
+
+    LBitOpV* lir = new(alloc()) LBitOpV(op, useBoxAtStart(lhs), useBoxAtStart(rhs));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitLsh(MLsh* ins)
+{
+    lowerShiftOp(JSOP_LSH, ins);
+}
+
+void
+LIRGenerator::visitRsh(MRsh* ins)
+{
+    lowerShiftOp(JSOP_RSH, ins);
+}
+
+void
+LIRGenerator::visitUrsh(MUrsh* ins)
+{
+    lowerShiftOp(JSOP_URSH, ins);
+}
+
+void
+LIRGenerator::visitSignExtend(MSignExtend* ins)
+{
+    LInstructionHelper<1, 1, 0>* lir;
+
+    if (ins->mode() == MSignExtend::Byte)
+        lir = new(alloc()) LSignExtend(useByteOpRegisterAtStart(ins->input()), ins->mode());
+    else
+        lir = new(alloc()) LSignExtend(useRegisterAtStart(ins->input()), ins->mode());
+
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitRotate(MRotate* ins)
+{
+    MDefinition* input = ins->input();
+    MDefinition* count = ins->count();
+
+    if (ins->type() == MIRType::Int32) {
+        auto* lir = new(alloc()) LRotate();
+        lowerForShift(lir, ins, input, count);
+    } else if (ins->type() == MIRType::Int64) {
+        auto* lir = new(alloc()) LRotateI64();
+        lowerForShiftInt64(lir, ins, input, count);
+    } else {
+        MOZ_CRASH("unexpected type in visitRotate");
+    }
+}
+
+void
+LIRGenerator::visitFloor(MFloor* ins)
+{
+    MIRType type = ins->input()->type();
+    MOZ_ASSERT(IsFloatingPointType(type));
+
+    LInstructionHelper<1, 1, 0>* lir;
+    if (type == MIRType::Double)
+        lir = new(alloc()) LFloor(useRegister(ins->input()));
+    else
+        lir = new(alloc()) LFloorF(useRegister(ins->input()));
+
+    assignSnapshot(lir, Bailout_Round);
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitCeil(MCeil* ins)
+{
+    MIRType type = ins->input()->type();
+    MOZ_ASSERT(IsFloatingPointType(type));
+
+    LInstructionHelper<1, 1, 0>* lir;
+    if (type == MIRType::Double)
+        lir = new(alloc()) LCeil(useRegister(ins->input()));
+    else
+        lir = new(alloc()) LCeilF(useRegister(ins->input()));
+
+    assignSnapshot(lir, Bailout_Round);
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitRound(MRound* ins)
+{
+    MIRType type = ins->input()->type();
+    MOZ_ASSERT(IsFloatingPointType(type));
+
+    LInstructionHelper<1, 1, 1>* lir;
+    if (type == MIRType::Double)
+        lir = new (alloc()) LRound(useRegister(ins->input()), tempDouble());
+    else
+        lir = new (alloc()) LRoundF(useRegister(ins->input()), tempFloat32());
+
+    assignSnapshot(lir, Bailout_Round);
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitMinMax(MMinMax* ins)
+{
+    MDefinition* first = ins->getOperand(0);
+    MDefinition* second = ins->getOperand(1);
+
+    ReorderCommutative(&first, &second, ins);
+
+    LMinMaxBase* lir;
+    switch (ins->specialization()) {
+      case MIRType::Int32:
+        lir = new(alloc()) LMinMaxI(useRegisterAtStart(first), useRegisterOrConstant(second));
+        break;
+      case MIRType::Float32:
+        lir = new(alloc()) LMinMaxF(useRegisterAtStart(first), useRegister(second));
+        break;
+      case MIRType::Double:
+        lir = new(alloc()) LMinMaxD(useRegisterAtStart(first), useRegister(second));
+        break;
+      default:
+        MOZ_CRASH();
+    }
+
+    defineReuseInput(lir, ins, 0);
+}
+
+void
+LIRGenerator::visitAbs(MAbs* ins)
+{
+    MDefinition* num = ins->input();
+    MOZ_ASSERT(IsNumberType(num->type()));
+
+    LInstructionHelper<1, 1, 0>* lir;
+    switch (num->type()) {
+      case MIRType::Int32:
+        lir = new(alloc()) LAbsI(useRegisterAtStart(num));
+        // needed to handle abs(INT32_MIN)
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Overflow);
+        break;
+      case MIRType::Float32:
+        lir = new(alloc()) LAbsF(useRegisterAtStart(num));
+        break;
+      case MIRType::Double:
+        lir = new(alloc()) LAbsD(useRegisterAtStart(num));
+        break;
+      default:
+        MOZ_CRASH();
+    }
+
+    defineReuseInput(lir, ins, 0);
+}
+
+void
+LIRGenerator::visitClz(MClz* ins)
+{
+    MDefinition* num = ins->num();
+
+    MOZ_ASSERT(IsIntType(ins->type()));
+
+    if (ins->type() == MIRType::Int32) {
+        LClzI* lir = new(alloc()) LClzI(useRegisterAtStart(num));
+        define(lir, ins);
+        return;
+    }
+
+    auto* lir = new(alloc()) LClzI64(useInt64RegisterAtStart(num));
+    defineInt64(lir, ins);
+}
+
+void
+LIRGenerator::visitCtz(MCtz* ins)
+{
+    MDefinition* num = ins->num();
+
+    MOZ_ASSERT(IsIntType(ins->type()));
+
+    if (ins->type() == MIRType::Int32) {
+        LCtzI* lir = new(alloc()) LCtzI(useRegisterAtStart(num));
+        define(lir, ins);
+        return;
+    }
+
+    auto* lir = new(alloc()) LCtzI64(useInt64RegisterAtStart(num));
+    defineInt64(lir, ins);
+}
+
+void
+LIRGenerator::visitPopcnt(MPopcnt* ins)
+{
+    MDefinition* num = ins->num();
+
+    MOZ_ASSERT(IsIntType(ins->type()));
+
+    if (ins->type() == MIRType::Int32) {
+        LPopcntI* lir = new(alloc()) LPopcntI(useRegisterAtStart(num), temp());
+        define(lir, ins);
+        return;
+    }
+
+    auto* lir = new(alloc()) LPopcntI64(useInt64RegisterAtStart(num), temp());
+    defineInt64(lir, ins);
+}
+
+void
+LIRGenerator::visitSqrt(MSqrt* ins)
+{
+    MDefinition* num = ins->input();
+    MOZ_ASSERT(IsFloatingPointType(num->type()));
+
+    LInstructionHelper<1, 1, 0>* lir;
+    if (num->type() == MIRType::Double)
+        lir = new(alloc()) LSqrtD(useRegisterAtStart(num));
+    else
+        lir = new(alloc()) LSqrtF(useRegisterAtStart(num));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitAtan2(MAtan2* ins)
+{
+    MDefinition* y = ins->y();
+    MOZ_ASSERT(y->type() == MIRType::Double);
+
+    MDefinition* x = ins->x();
+    MOZ_ASSERT(x->type() == MIRType::Double);
+
+    LAtan2D* lir = new(alloc()) LAtan2D(useRegisterAtStart(y), useRegisterAtStart(x),
+                                        tempFixed(CallTempReg0));
+    defineReturn(lir, ins);
+}
+
+void
+LIRGenerator::visitHypot(MHypot* ins)
+{
+    LHypot* lir = nullptr;
+    uint32_t length = ins->numOperands();
+    for (uint32_t i = 0; i < length; ++i)
+        MOZ_ASSERT(ins->getOperand(i)->type() == MIRType::Double);
+
+    switch(length) {
+      case 2:
+        lir = new(alloc()) LHypot(useRegisterAtStart(ins->getOperand(0)),
+                                  useRegisterAtStart(ins->getOperand(1)),
+                                  tempFixed(CallTempReg0));
+        break;
+      case 3:
+        lir = new(alloc()) LHypot(useRegisterAtStart(ins->getOperand(0)),
+                                  useRegisterAtStart(ins->getOperand(1)),
+                                  useRegisterAtStart(ins->getOperand(2)),
+                                  tempFixed(CallTempReg0));
+        break;
+      case 4:
+        lir = new(alloc()) LHypot(useRegisterAtStart(ins->getOperand(0)),
+                                  useRegisterAtStart(ins->getOperand(1)),
+                                  useRegisterAtStart(ins->getOperand(2)),
+                                  useRegisterAtStart(ins->getOperand(3)),
+                                  tempFixed(CallTempReg0));
+        break;
+      default:
+        MOZ_CRASH("Unexpected number of arguments to LHypot.");
+    }
+
+    defineReturn(lir, ins);
+}
+
+void
+LIRGenerator::visitPow(MPow* ins)
+{
+    MDefinition* input = ins->input();
+    MOZ_ASSERT(input->type() == MIRType::Double);
+
+    MDefinition* power = ins->power();
+    MOZ_ASSERT(power->type() == MIRType::Int32 || power->type() == MIRType::Double);
+
+    LInstruction* lir;
+    if (power->type() == MIRType::Int32) {
+        // Note: useRegisterAtStart here is safe, the temp is a GP register so
+        // it will never get the same register.
+        lir = new(alloc()) LPowI(useRegisterAtStart(input), useFixedAtStart(power, CallTempReg1),
+                                 tempFixed(CallTempReg0));
+    } else {
+        lir = new(alloc()) LPowD(useRegisterAtStart(input), useRegisterAtStart(power),
+                                 tempFixed(CallTempReg0));
+    }
+    defineReturn(lir, ins);
+}
+
+void
+LIRGenerator::visitMathFunction(MMathFunction* ins)
+{
+    MOZ_ASSERT(IsFloatingPointType(ins->type()));
+    MOZ_ASSERT_IF(ins->input()->type() != MIRType::SinCosDouble,
+                  ins->type() == ins->input()->type());
+
+    if (ins->input()->type() == MIRType::SinCosDouble) {
+        MOZ_ASSERT(ins->type() == MIRType::Double);
+        redefine(ins, ins->input(), ins->function());
+        return;
+    }
+
+    LInstruction* lir;
+    if (ins->type() == MIRType::Double) {
+        // Note: useRegisterAtStart is safe here, the temp is not a FP register.
+        lir = new(alloc()) LMathFunctionD(useRegisterAtStart(ins->input()),
+                                          tempFixed(CallTempReg0));
+    } else {
+        lir = new(alloc()) LMathFunctionF(useRegisterAtStart(ins->input()),
+                                          tempFixed(CallTempReg0));
+    }
+    defineReturn(lir, ins);
+}
+
+// Try to mark an add or sub instruction as able to recover its input when
+// bailing out.
+template <typename S, typename T>
+static void
+MaybeSetRecoversInput(S* mir, T* lir)
+{
+    MOZ_ASSERT(lir->mirRaw() == mir);
+    if (!mir->fallible() || !lir->snapshot())
+        return;
+
+    if (lir->output()->policy() != LDefinition::MUST_REUSE_INPUT)
+        return;
+
+    // The original operands to an add or sub can't be recovered if they both
+    // use the same register.
+    if (lir->lhs()->isUse() && lir->rhs()->isUse() &&
+        lir->lhs()->toUse()->virtualRegister() == lir->rhs()->toUse()->virtualRegister())
+    {
+        return;
+    }
+
+    // Add instructions that are on two different values can recover
+    // the input they clobbered via MUST_REUSE_INPUT. Thus, a copy
+    // of that input does not need to be kept alive in the snapshot
+    // for the instruction.
+
+    lir->setRecoversInput();
+
+    const LUse* input = lir->getOperand(lir->output()->getReusedInput())->toUse();
+    lir->snapshot()->rewriteRecoveredInput(*input);
+}
+
+void
+LIRGenerator::visitAdd(MAdd* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    MOZ_ASSERT(lhs->type() == rhs->type());
+
+    if (ins->specialization() == MIRType::Int32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int32);
+        ReorderCommutative(&lhs, &rhs, ins);
+        LAddI* lir = new(alloc()) LAddI;
+
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_OverflowInvalidate);
+
+        lowerForALU(lir, ins, lhs, rhs);
+        MaybeSetRecoversInput(ins, lir);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Int64) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int64);
+        ReorderCommutative(&lhs, &rhs, ins);
+        LAddI64* lir = new(alloc()) LAddI64;
+        lowerForALUInt64(lir, ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Double) {
+        MOZ_ASSERT(lhs->type() == MIRType::Double);
+        ReorderCommutative(&lhs, &rhs, ins);
+        lowerForFPU(new(alloc()) LMathD(JSOP_ADD), ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Float32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Float32);
+        ReorderCommutative(&lhs, &rhs, ins);
+        lowerForFPU(new(alloc()) LMathF(JSOP_ADD), ins, lhs, rhs);
+        return;
+    }
+
+    lowerBinaryV(JSOP_ADD, ins);
+}
+
+void
+LIRGenerator::visitSub(MSub* ins)
+{
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+
+    MOZ_ASSERT(lhs->type() == rhs->type());
+
+    if (ins->specialization() == MIRType::Int32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int32);
+
+        LSubI* lir = new(alloc()) LSubI;
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Overflow);
+
+        lowerForALU(lir, ins, lhs, rhs);
+        MaybeSetRecoversInput(ins, lir);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Int64) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int64);
+        LSubI64* lir = new(alloc()) LSubI64;
+        lowerForALUInt64(lir, ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Double) {
+        MOZ_ASSERT(lhs->type() == MIRType::Double);
+        lowerForFPU(new(alloc()) LMathD(JSOP_SUB), ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Float32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Float32);
+        lowerForFPU(new(alloc()) LMathF(JSOP_SUB), ins, lhs, rhs);
+        return;
+    }
+
+    lowerBinaryV(JSOP_SUB, ins);
+}
+
+void
+LIRGenerator::visitMul(MMul* ins)
+{
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+    MOZ_ASSERT(lhs->type() == rhs->type());
+
+    if (ins->specialization() == MIRType::Int32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int32);
+        ReorderCommutative(&lhs, &rhs, ins);
+
+        // If our RHS is a constant -1 and we don't have to worry about
+        // overflow, we can optimize to an LNegI.
+        if (!ins->fallible() && rhs->isConstant() && rhs->toConstant()->toInt32() == -1)
+            defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(lhs)), ins, 0);
+        else
+            lowerMulI(ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Int64) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int64);
+        ReorderCommutative(&lhs, &rhs, ins);
+        LMulI64* lir = new(alloc()) LMulI64;
+        lowerForMulInt64(lir, ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Double) {
+        MOZ_ASSERT(lhs->type() == MIRType::Double);
+        ReorderCommutative(&lhs, &rhs, ins);
+
+        // If our RHS is a constant -1.0, we can optimize to an LNegD.
+        if (!ins->mustPreserveNaN() && rhs->isConstant() && rhs->toConstant()->toDouble() == -1.0)
+            defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(lhs)), ins, 0);
+        else
+            lowerForFPU(new(alloc()) LMathD(JSOP_MUL), ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Float32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Float32);
+        ReorderCommutative(&lhs, &rhs, ins);
+
+        // We apply the same optimizations as for doubles
+        if (!ins->mustPreserveNaN() && rhs->isConstant() && rhs->toConstant()->toFloat32() == -1.0f)
+            defineReuseInput(new(alloc()) LNegF(useRegisterAtStart(lhs)), ins, 0);
+        else
+            lowerForFPU(new(alloc()) LMathF(JSOP_MUL), ins, lhs, rhs);
+        return;
+    }
+
+    lowerBinaryV(JSOP_MUL, ins);
+}
+
+void
+LIRGenerator::visitDiv(MDiv* ins)
+{
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+    MOZ_ASSERT(lhs->type() == rhs->type());
+
+    if (ins->specialization() == MIRType::Int32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int32);
+        lowerDivI(ins);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Int64) {
+        MOZ_ASSERT(lhs->type() == MIRType::Int64);
+        lowerDivI64(ins);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Double) {
+        MOZ_ASSERT(lhs->type() == MIRType::Double);
+        lowerForFPU(new(alloc()) LMathD(JSOP_DIV), ins, lhs, rhs);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Float32) {
+        MOZ_ASSERT(lhs->type() == MIRType::Float32);
+        lowerForFPU(new(alloc()) LMathF(JSOP_DIV), ins, lhs, rhs);
+        return;
+    }
+
+    lowerBinaryV(JSOP_DIV, ins);
+}
+
+void
+LIRGenerator::visitMod(MMod* ins)
+{
+    MOZ_ASSERT(ins->lhs()->type() == ins->rhs()->type());
+
+    if (ins->specialization() == MIRType::Int32) {
+        MOZ_ASSERT(ins->type() == MIRType::Int32);
+        MOZ_ASSERT(ins->lhs()->type() == MIRType::Int32);
+        lowerModI(ins);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Int64) {
+        MOZ_ASSERT(ins->type() == MIRType::Int64);
+        MOZ_ASSERT(ins->lhs()->type() == MIRType::Int64);
+        lowerModI64(ins);
+        return;
+    }
+
+    if (ins->specialization() == MIRType::Double) {
+        MOZ_ASSERT(ins->type() == MIRType::Double);
+        MOZ_ASSERT(ins->lhs()->type() == MIRType::Double);
+        MOZ_ASSERT(ins->rhs()->type() == MIRType::Double);
+
+        // Note: useRegisterAtStart is safe here, the temp is not a FP register.
+        LModD* lir = new(alloc()) LModD(useRegisterAtStart(ins->lhs()), useRegisterAtStart(ins->rhs()),
+                                        tempFixed(CallTempReg0));
+        defineReturn(lir, ins);
+        return;
+    }
+
+    lowerBinaryV(JSOP_MOD, ins);
+}
+
+void
+LIRGenerator::lowerBinaryV(JSOp op, MBinaryInstruction* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    MOZ_ASSERT(lhs->type() == MIRType::Value);
+    MOZ_ASSERT(rhs->type() == MIRType::Value);
+
+    LBinaryV* lir = new(alloc()) LBinaryV(op, useBoxAtStart(lhs), useBoxAtStart(rhs));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitConcat(MConcat* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    MOZ_ASSERT(lhs->type() == MIRType::String);
+    MOZ_ASSERT(rhs->type() == MIRType::String);
+    MOZ_ASSERT(ins->type() == MIRType::String);
+
+    LConcat* lir = new(alloc()) LConcat(useFixedAtStart(lhs, CallTempReg0),
+                                        useFixedAtStart(rhs, CallTempReg1),
+                                        tempFixed(CallTempReg0),
+                                        tempFixed(CallTempReg1),
+                                        tempFixed(CallTempReg2),
+                                        tempFixed(CallTempReg3),
+                                        tempFixed(CallTempReg4));
+    defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg5)));
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCharCodeAt(MCharCodeAt* ins)
+{
+    MDefinition* str = ins->getOperand(0);
+    MDefinition* idx = ins->getOperand(1);
+
+    MOZ_ASSERT(str->type() == MIRType::String);
+    MOZ_ASSERT(idx->type() == MIRType::Int32);
+
+    LCharCodeAt* lir = new(alloc()) LCharCodeAt(useRegister(str), useRegister(idx));
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitFromCharCode(MFromCharCode* ins)
+{
+    MDefinition* code = ins->getOperand(0);
+
+    MOZ_ASSERT(code->type() == MIRType::Int32);
+
+    LFromCharCode* lir = new(alloc()) LFromCharCode(useRegister(code));
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitFromCodePoint(MFromCodePoint* ins)
+{
+    MDefinition* codePoint = ins->getOperand(0);
+
+    MOZ_ASSERT(codePoint->type() == MIRType::Int32);
+
+    LFromCodePoint* lir = new(alloc()) LFromCodePoint(useRegister(codePoint));
+    assignSnapshot(lir, Bailout_BoundsCheck);
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitStart(MStart* start)
+{
+    LStart* lir = new(alloc()) LStart;
+
+    // Create a snapshot that captures the initial state of the function.
+    assignSnapshot(lir, Bailout_ArgumentCheck);
+    if (start->block()->graph().entryBlock() == start->block())
+        lirGraph_.setEntrySnapshot(lir->snapshot());
+
+    add(lir);
+}
+
+void
+LIRGenerator::visitNop(MNop* nop)
+{
+}
+
+void
+LIRGenerator::visitLimitedTruncate(MLimitedTruncate* nop)
+{
+    redefine(nop, nop->input());
+}
+
+void
+LIRGenerator::visitOsrEntry(MOsrEntry* entry)
+{
+    LOsrEntry* lir = new(alloc()) LOsrEntry(temp());
+    defineFixed(lir, entry, LAllocation(AnyRegister(OsrFrameReg)));
+}
+
+void
+LIRGenerator::visitOsrValue(MOsrValue* value)
+{
+    LOsrValue* lir = new(alloc()) LOsrValue(useRegister(value->entry()));
+    defineBox(lir, value);
+}
+
+void
+LIRGenerator::visitOsrReturnValue(MOsrReturnValue* value)
+{
+    LOsrReturnValue* lir = new(alloc()) LOsrReturnValue(useRegister(value->entry()));
+    defineBox(lir, value);
+}
+
+void
+LIRGenerator::visitOsrEnvironmentChain(MOsrEnvironmentChain* object)
+{
+    LOsrEnvironmentChain* lir = new(alloc()) LOsrEnvironmentChain(useRegister(object->entry()));
+    define(lir, object);
+}
+
+void
+LIRGenerator::visitOsrArgumentsObject(MOsrArgumentsObject* object)
+{
+    LOsrArgumentsObject* lir = new(alloc()) LOsrArgumentsObject(useRegister(object->entry()));
+    define(lir, object);
+}
+
+void
+LIRGenerator::visitToDouble(MToDouble* convert)
+{
+    MDefinition* opd = convert->input();
+    mozilla::DebugOnly<MToFPInstruction::ConversionKind> conversion = convert->conversion();
+
+    switch (opd->type()) {
+      case MIRType::Value:
+      {
+        LValueToDouble* lir = new(alloc()) LValueToDouble(useBox(opd));
+        assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Null:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly &&
+                   conversion != MToFPInstruction::NonNullNonStringPrimitives);
+        lowerConstantDouble(0, convert);
+        break;
+
+      case MIRType::Undefined:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly);
+        lowerConstantDouble(GenericNaN(), convert);
+        break;
+
+      case MIRType::Boolean:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly);
+        MOZ_FALLTHROUGH;
+
+      case MIRType::Int32:
+      {
+        LInt32ToDouble* lir = new(alloc()) LInt32ToDouble(useRegisterAtStart(opd));
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Float32:
+      {
+        LFloat32ToDouble* lir = new (alloc()) LFloat32ToDouble(useRegisterAtStart(opd));
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Double:
+        redefine(convert, opd);
+        break;
+
+      default:
+        // Objects might be effectful. Symbols will throw.
+        // Strings are complicated - we don't handle them yet.
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitToFloat32(MToFloat32* convert)
+{
+    MDefinition* opd = convert->input();
+    mozilla::DebugOnly<MToFloat32::ConversionKind> conversion = convert->conversion();
+
+    switch (opd->type()) {
+      case MIRType::Value:
+      {
+        LValueToFloat32* lir = new(alloc()) LValueToFloat32(useBox(opd));
+        assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Null:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly &&
+                   conversion != MToFPInstruction::NonNullNonStringPrimitives);
+        lowerConstantFloat32(0, convert);
+        break;
+
+      case MIRType::Undefined:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly);
+        lowerConstantFloat32(GenericNaN(), convert);
+        break;
+
+      case MIRType::Boolean:
+        MOZ_ASSERT(conversion != MToFPInstruction::NumbersOnly);
+        MOZ_FALLTHROUGH;
+
+      case MIRType::Int32:
+      {
+        LInt32ToFloat32* lir = new(alloc()) LInt32ToFloat32(useRegisterAtStart(opd));
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Double:
+      {
+        LDoubleToFloat32* lir = new(alloc()) LDoubleToFloat32(useRegisterAtStart(opd));
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Float32:
+        redefine(convert, opd);
+        break;
+
+      default:
+        // Objects might be effectful. Symbols will throw.
+        // Strings are complicated - we don't handle them yet.
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitToInt32(MToInt32* convert)
+{
+    MDefinition* opd = convert->input();
+
+    switch (opd->type()) {
+      case MIRType::Value:
+      {
+        LValueToInt32* lir =
+            new(alloc()) LValueToInt32(useBox(opd), tempDouble(), temp(), LValueToInt32::NORMAL);
+        assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, convert);
+        assignSafepoint(lir, convert);
+        break;
+      }
+
+      case MIRType::Null:
+        MOZ_ASSERT(convert->conversion() == MacroAssembler::IntConversion_Any);
+        define(new(alloc()) LInteger(0), convert);
+        break;
+
+      case MIRType::Boolean:
+        MOZ_ASSERT(convert->conversion() == MacroAssembler::IntConversion_Any ||
+                   convert->conversion() == MacroAssembler::IntConversion_NumbersOrBoolsOnly);
+        redefine(convert, opd);
+        break;
+
+      case MIRType::Int32:
+        redefine(convert, opd);
+        break;
+
+      case MIRType::Float32:
+      {
+        LFloat32ToInt32* lir = new(alloc()) LFloat32ToInt32(useRegister(opd));
+        assignSnapshot(lir, Bailout_PrecisionLoss);
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::Double:
+      {
+        LDoubleToInt32* lir = new(alloc()) LDoubleToInt32(useRegister(opd));
+        assignSnapshot(lir, Bailout_PrecisionLoss);
+        define(lir, convert);
+        break;
+      }
+
+      case MIRType::String:
+      case MIRType::Symbol:
+      case MIRType::Object:
+      case MIRType::Undefined:
+        // Objects might be effectful. Symbols throw. Undefined coerces to NaN, not int32.
+        MOZ_CRASH("ToInt32 invalid input type");
+
+      default:
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitTruncateToInt32(MTruncateToInt32* truncate)
+{
+    MDefinition* opd = truncate->input();
+
+    switch (opd->type()) {
+      case MIRType::Value:
+      {
+        LValueToInt32* lir = new(alloc()) LValueToInt32(useBox(opd), tempDouble(), temp(),
+                                                        LValueToInt32::TRUNCATE);
+        assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, truncate);
+        assignSafepoint(lir, truncate);
+        break;
+      }
+
+      case MIRType::Null:
+      case MIRType::Undefined:
+        define(new(alloc()) LInteger(0), truncate);
+        break;
+
+      case MIRType::Int32:
+      case MIRType::Boolean:
+        redefine(truncate, opd);
+        break;
+
+      case MIRType::Double:
+        lowerTruncateDToInt32(truncate);
+        break;
+
+      case MIRType::Float32:
+        lowerTruncateFToInt32(truncate);
+        break;
+
+      default:
+        // Objects might be effectful. Symbols throw.
+        // Strings are complicated - we don't handle them yet.
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitWasmTruncateToInt32(MWasmTruncateToInt32* ins)
+{
+    MDefinition* input = ins->input();
+    switch (input->type()) {
+      case MIRType::Double:
+      case MIRType::Float32: {
+        auto* lir = new(alloc()) LWasmTruncateToInt32(useRegisterAtStart(input));
+        define(lir, ins);
+        break;
+      }
+      default:
+        MOZ_CRASH("unexpected type in WasmTruncateToInt32");
+    }
+}
+
+void
+LIRGenerator::visitWrapInt64ToInt32(MWrapInt64ToInt32* ins)
+{
+    define(new(alloc()) LWrapInt64ToInt32(useInt64AtStart(ins->input())), ins);
+}
+
+void
+LIRGenerator::visitToString(MToString* ins)
+{
+    MDefinition* opd = ins->input();
+
+    switch (opd->type()) {
+      case MIRType::Null: {
+        const JSAtomState& names = GetJitContext()->runtime->names();
+        LPointer* lir = new(alloc()) LPointer(names.null);
+        define(lir, ins);
+        break;
+      }
+
+      case MIRType::Undefined: {
+        const JSAtomState& names = GetJitContext()->runtime->names();
+        LPointer* lir = new(alloc()) LPointer(names.undefined);
+        define(lir, ins);
+        break;
+      }
+
+      case MIRType::Boolean: {
+        LBooleanToString* lir = new(alloc()) LBooleanToString(useRegister(opd));
+        define(lir, ins);
+        break;
+      }
+
+      case MIRType::Double: {
+        LDoubleToString* lir = new(alloc()) LDoubleToString(useRegister(opd), temp());
+
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+
+      case MIRType::Int32: {
+        LIntToString* lir = new(alloc()) LIntToString(useRegister(opd));
+
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+
+      case MIRType::String:
+        redefine(ins, ins->input());
+        break;
+
+      case MIRType::Value: {
+        LValueToString* lir = new(alloc()) LValueToString(useBox(opd), tempToUnbox());
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+
+      default:
+        // Float32, symbols, and objects are not supported.
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitToObjectOrNull(MToObjectOrNull* ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType::Value);
+
+    LValueToObjectOrNull* lir = new(alloc()) LValueToObjectOrNull(useBox(ins->input()));
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitRegExp(MRegExp* ins)
+{
+    if (ins->mustClone()) {
+        LRegExp* lir = new(alloc()) LRegExp();
+        defineReturn(lir, ins);
+        assignSafepoint(lir, ins);
+    } else {
+        RegExpObject* source = ins->source();
+        define(new(alloc()) LPointer(source), ins);
+    }
+}
+
+void
+LIRGenerator::visitRegExpMatcher(MRegExpMatcher* ins)
+{
+    MOZ_ASSERT(ins->regexp()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    MOZ_ASSERT(ins->lastIndex()->type() == MIRType::Int32);
+
+    LRegExpMatcher* lir = new(alloc()) LRegExpMatcher(useFixedAtStart(ins->regexp(), RegExpMatcherRegExpReg),
+                                                      useFixedAtStart(ins->string(), RegExpMatcherStringReg),
+                                                      useFixedAtStart(ins->lastIndex(), RegExpMatcherLastIndexReg));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitRegExpSearcher(MRegExpSearcher* ins)
+{
+    MOZ_ASSERT(ins->regexp()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    MOZ_ASSERT(ins->lastIndex()->type() == MIRType::Int32);
+
+    LRegExpSearcher* lir = new(alloc()) LRegExpSearcher(useFixedAtStart(ins->regexp(), RegExpTesterRegExpReg),
+                                                        useFixedAtStart(ins->string(), RegExpTesterStringReg),
+                                                        useFixedAtStart(ins->lastIndex(), RegExpTesterLastIndexReg));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitRegExpTester(MRegExpTester* ins)
+{
+    MOZ_ASSERT(ins->regexp()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    MOZ_ASSERT(ins->lastIndex()->type() == MIRType::Int32);
+
+    LRegExpTester* lir = new(alloc()) LRegExpTester(useFixedAtStart(ins->regexp(), RegExpTesterRegExpReg),
+                                                    useFixedAtStart(ins->string(), RegExpTesterStringReg),
+                                                    useFixedAtStart(ins->lastIndex(), RegExpTesterLastIndexReg));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitRegExpPrototypeOptimizable(MRegExpPrototypeOptimizable* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+    LRegExpPrototypeOptimizable* lir = new(alloc()) LRegExpPrototypeOptimizable(useRegister(ins->object()),
+                                                                                temp());
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitRegExpInstanceOptimizable(MRegExpInstanceOptimizable* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->proto()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+    LRegExpInstanceOptimizable* lir = new(alloc()) LRegExpInstanceOptimizable(useRegister(ins->object()),
+                                                                              useRegister(ins->proto()),
+                                                                              temp());
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitGetFirstDollarIndex(MGetFirstDollarIndex* ins)
+{
+    MOZ_ASSERT(ins->str()->type() == MIRType::String);
+    MOZ_ASSERT(ins->type() == MIRType::Int32);
+    LGetFirstDollarIndex* lir = new(alloc()) LGetFirstDollarIndex(useRegister(ins->str()),
+                                                                  temp(), temp(), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitStringReplace(MStringReplace* ins)
+{
+    MOZ_ASSERT(ins->pattern()->type() == MIRType::String);
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    MOZ_ASSERT(ins->replacement()->type() == MIRType::String);
+
+    LStringReplace* lir = new(alloc()) LStringReplace(useRegisterOrConstantAtStart(ins->string()),
+                                                      useRegisterAtStart(ins->pattern()),
+                                                      useRegisterOrConstantAtStart(ins->replacement()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitBinarySharedStub(MBinarySharedStub* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+    MDefinition* rhs = ins->getOperand(1);
+
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+
+    LBinarySharedStub* lir = new(alloc()) LBinarySharedStub(useBoxFixedAtStart(lhs, R0),
+                                                            useBoxFixedAtStart(rhs, R1));
+    defineSharedStubReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitUnarySharedStub(MUnarySharedStub* ins)
+{
+    MDefinition* input = ins->getOperand(0);
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+
+    LUnarySharedStub* lir = new(alloc()) LUnarySharedStub(useBoxFixedAtStart(input, R0));
+    defineSharedStubReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitNullarySharedStub(MNullarySharedStub* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+
+    LNullarySharedStub* lir = new(alloc()) LNullarySharedStub();
+
+    defineSharedStubReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitLambda(MLambda* ins)
+{
+    if (ins->info().singletonType || ins->info().useSingletonForClone) {
+        // If the function has a singleton type, this instruction will only be
+        // executed once so we don't bother inlining it.
+        //
+        // If UseSingletonForClone is true, we will assign a singleton type to
+        // the clone and we have to clone the script, we can't do that inline.
+        LLambdaForSingleton* lir = new(alloc())
+            LLambdaForSingleton(useRegisterAtStart(ins->environmentChain()));
+        defineReturn(lir, ins);
+        assignSafepoint(lir, ins);
+    } else {
+        LLambda* lir = new(alloc()) LLambda(useRegister(ins->environmentChain()), temp());
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitLambdaArrow(MLambdaArrow* ins)
+{
+    MOZ_ASSERT(ins->environmentChain()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->newTargetDef()->type() == MIRType::Value);
+
+    LLambdaArrow* lir = new(alloc()) LLambdaArrow(useRegister(ins->environmentChain()),
+                                                  useBox(ins->newTargetDef()));
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitKeepAliveObject(MKeepAliveObject* ins)
+{
+    MDefinition* obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    add(new(alloc()) LKeepAliveObject(useKeepalive(obj)), ins);
+}
+
+void
+LIRGenerator::visitSlots(MSlots* ins)
+{
+    define(new(alloc()) LSlots(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitElements(MElements* ins)
+{
+    define(new(alloc()) LElements(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitConstantElements(MConstantElements* ins)
+{
+    define(new(alloc()) LPointer(ins->value().unwrap(/*safe - pointer does not flow back to C++*/),
+                                 LPointer::NON_GC_THING),
+           ins);
+}
+
+void
+LIRGenerator::visitConvertElementsToDoubles(MConvertElementsToDoubles* ins)
+{
+    LInstruction* check = new(alloc()) LConvertElementsToDoubles(useRegister(ins->elements()));
+    add(check, ins);
+    assignSafepoint(check, ins);
+}
+
+void
+LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->value()->type() == MIRType::Int32);
+
+    LMaybeToDoubleElement* lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
+                                                                    useRegisterAtStart(ins->value()),
+                                                                    tempDouble());
+    defineBox(lir, ins);
+}
+
+void
+LIRGenerator::visitMaybeCopyElementsForWrite(MMaybeCopyElementsForWrite* ins)
+{
+    LInstruction* check = new(alloc()) LMaybeCopyElementsForWrite(useRegister(ins->object()), temp());
+    add(check, ins);
+    assignSafepoint(check, ins);
+}
+
+void
+LIRGenerator::visitLoadSlot(MLoadSlot* ins)
+{
+    switch (ins->type()) {
+      case MIRType::Value:
+        defineBox(new(alloc()) LLoadSlotV(useRegisterAtStart(ins->slots())), ins);
+        break;
+
+      case MIRType::Undefined:
+      case MIRType::Null:
+        MOZ_CRASH("typed load must have a payload");
+
+      default:
+        define(new(alloc()) LLoadSlotT(useRegisterForTypedLoad(ins->slots(), ins->type())), ins);
+        break;
+    }
+}
+
+void
+LIRGenerator::visitFunctionEnvironment(MFunctionEnvironment* ins)
+{
+    define(new(alloc()) LFunctionEnvironment(useRegisterAtStart(ins->function())), ins);
+}
+
+void
+LIRGenerator::visitInterruptCheck(MInterruptCheck* ins)
+{
+    LInstruction* lir = new(alloc()) LInterruptCheck();
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitWasmTrap(MWasmTrap* ins)
+{
+    add(new(alloc()) LWasmTrap, ins);
+}
+
+void
+LIRGenerator::visitWasmReinterpret(MWasmReinterpret* ins)
+{
+    if (ins->type() == MIRType::Int64)
+        defineInt64(new(alloc()) LWasmReinterpretToI64(useRegisterAtStart(ins->input())), ins);
+    else if (ins->input()->type() == MIRType::Int64)
+        define(new(alloc()) LWasmReinterpretFromI64(useInt64RegisterAtStart(ins->input())), ins);
+    else
+        define(new(alloc()) LWasmReinterpret(useRegisterAtStart(ins->input())), ins);
+}
+
+void
+LIRGenerator::visitStoreSlot(MStoreSlot* ins)
+{
+    LInstruction* lir;
+
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+        lir = new(alloc()) LStoreSlotV(useRegister(ins->slots()), useBox(ins->value()));
+        add(lir, ins);
+        break;
+
+      case MIRType::Double:
+        add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
+        break;
+
+      case MIRType::Float32:
+        MOZ_CRASH("Float32 shouldn't be stored in a slot.");
+
+      default:
+        add(new(alloc()) LStoreSlotT(useRegister(ins->slots()),
+                                     useRegisterOrConstant(ins->value())), ins);
+        break;
+    }
+}
+
+void
+LIRGenerator::visitFilterTypeSet(MFilterTypeSet* ins)
+{
+    redefine(ins, ins->input());
+}
+
+void
+LIRGenerator::visitTypeBarrier(MTypeBarrier* ins)
+{
+    // Requesting a non-GC pointer is safe here since we never re-enter C++
+    // from inside a type barrier test.
+
+    const TemporaryTypeSet* types = ins->resultTypeSet();
+    bool needTemp = !types->unknownObject() && types->getObjectCount() > 0;
+
+    MIRType inputType = ins->getOperand(0)->type();
+    MOZ_ASSERT(inputType == ins->type());
+
+    // Handle typebarrier that will always bail.
+    // (Emit LBail for visibility).
+    if (ins->alwaysBails()) {
+        LBail* bail = new(alloc()) LBail();
+        assignSnapshot(bail, Bailout_Inevitable);
+        add(bail, ins);
+        redefine(ins, ins->input());
+        return;
+    }
+
+    // Handle typebarrier with Value as input.
+    if (inputType == MIRType::Value) {
+        LDefinition tmp = needTemp ? temp() : tempToUnbox();
+        LTypeBarrierV* barrier = new(alloc()) LTypeBarrierV(useBox(ins->input()), tmp);
+        assignSnapshot(barrier, Bailout_TypeBarrierV);
+        add(barrier, ins);
+        redefine(ins, ins->input());
+        return;
+    }
+
+    // The payload needs to be tested if it either might be null or might have
+    // an object that should be excluded from the barrier.
+    bool needsObjectBarrier = false;
+    if (inputType == MIRType::ObjectOrNull)
+        needsObjectBarrier = true;
+    if (inputType == MIRType::Object && !types->hasType(TypeSet::AnyObjectType()) &&
+        ins->barrierKind() != BarrierKind::TypeTagOnly)
+    {
+        needsObjectBarrier = true;
+    }
+
+    if (needsObjectBarrier) {
+        LDefinition tmp = needTemp ? temp() : LDefinition::BogusTemp();
+        LTypeBarrierO* barrier = new(alloc()) LTypeBarrierO(useRegister(ins->getOperand(0)), tmp);
+        assignSnapshot(barrier, Bailout_TypeBarrierO);
+        add(barrier, ins);
+        redefine(ins, ins->getOperand(0));
+        return;
+    }
+
+    // Handle remaining cases: No-op, unbox did everything.
+    redefine(ins, ins->getOperand(0));
+}
+
+void
+LIRGenerator::visitMonitorTypes(MMonitorTypes* ins)
+{
+    // Requesting a non-GC pointer is safe here since we never re-enter C++
+    // from inside a type check.
+
+    const TemporaryTypeSet* types = ins->typeSet();
+    bool needTemp = !types->unknownObject() && types->getObjectCount() > 0;
+    LDefinition tmp = needTemp ? temp() : tempToUnbox();
+
+    LMonitorTypes* lir = new(alloc()) LMonitorTypes(useBox(ins->input()), tmp);
+    assignSnapshot(lir, Bailout_MonitorTypes);
+    add(lir, ins);
+}
+
+// Returns true iff |def| is a constant that's either not a GC thing or is not
+// allocated in the nursery.
+static bool
+IsNonNurseryConstant(MDefinition* def)
+{
+    if (!def->isConstant())
+        return false;
+    Value v = def->toConstant()->toJSValue();
+    return !v.isMarkable() || !IsInsideNursery(v.toMarkablePointer());
+}
+
+void
+LIRGenerator::visitPostWriteBarrier(MPostWriteBarrier* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    // LPostWriteBarrier assumes that if it has a constant object then that
+    // object is tenured, and does not need to be tested for being in the
+    // nursery. Ensure that assumption holds by lowering constant nursery
+    // objects to a register.
+    bool useConstantObject = IsNonNurseryConstant(ins->object());
+
+    switch (ins->value()->type()) {
+      case MIRType::Object:
+      case MIRType::ObjectOrNull: {
+        LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
+        LPostWriteBarrierO* lir =
+            new(alloc()) LPostWriteBarrierO(useConstantObject
+                                            ? useOrConstant(ins->object())
+                                            : useRegister(ins->object()),
+                                            useRegister(ins->value()), tmp);
+        add(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+      case MIRType::Value: {
+        LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
+        LPostWriteBarrierV* lir =
+            new(alloc()) LPostWriteBarrierV(useConstantObject
+                                            ? useOrConstant(ins->object())
+                                            : useRegister(ins->object()),
+                                            useBox(ins->value()),
+                                            tmp);
+        add(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+      default:
+        // Currently, only objects can be in the nursery. Other instruction
+        // types cannot hold nursery pointers.
+        break;
+    }
+}
+
+void
+LIRGenerator::visitPostWriteElementBarrier(MPostWriteElementBarrier* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    // LPostWriteElementBarrier assumes that if it has a constant object then that
+    // object is tenured, and does not need to be tested for being in the
+    // nursery. Ensure that assumption holds by lowering constant nursery
+    // objects to a register.
+    bool useConstantObject =
+        ins->object()->isConstant() &&
+        !IsInsideNursery(&ins->object()->toConstant()->toObject());
+
+    switch (ins->value()->type()) {
+      case MIRType::Object:
+      case MIRType::ObjectOrNull: {
+        LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
+        LPostWriteElementBarrierO* lir =
+            new(alloc()) LPostWriteElementBarrierO(useConstantObject
+                                                   ? useOrConstant(ins->object())
+                                                   : useRegister(ins->object()),
+                                                   useRegister(ins->value()),
+                                                   useRegister(ins->index()),
+                                                   tmp);
+        add(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+      case MIRType::Value: {
+        LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
+        LPostWriteElementBarrierV* lir =
+            new(alloc()) LPostWriteElementBarrierV(useConstantObject
+                                                   ? useOrConstant(ins->object())
+                                                   : useRegister(ins->object()),
+                                                   useRegister(ins->index()),
+                                                   useBox(ins->value()),
+                                                   tmp);
+        add(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+      default:
+        // Currently, only objects can be in the nursery. Other instruction
+        // types cannot hold nursery pointers.
+        break;
+    }
+}
+
+void
+LIRGenerator::visitArrayLength(MArrayLength* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    define(new(alloc()) LArrayLength(useRegisterAtStart(ins->elements())), ins);
+}
+
+void
+LIRGenerator::visitSetArrayLength(MSetArrayLength* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    MOZ_ASSERT(ins->index()->isConstant());
+    add(new(alloc()) LSetArrayLength(useRegister(ins->elements()),
+                                     useRegisterOrConstant(ins->index())), ins);
+}
+
+void
+LIRGenerator::visitGetNextEntryForIterator(MGetNextEntryForIterator* ins)
+{
+    MOZ_ASSERT(ins->iter()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->result()->type() == MIRType::Object);
+    auto lir = new(alloc()) LGetNextEntryForIterator(useRegister(ins->iter()),
+                                                     useRegister(ins->result()),
+                                                     temp(), temp(), temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitTypedArrayLength(MTypedArrayLength* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    define(new(alloc()) LTypedArrayLength(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitTypedArrayElements(MTypedArrayElements* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Elements);
+    define(new(alloc()) LTypedArrayElements(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitSetDisjointTypedElements(MSetDisjointTypedElements* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::None);
+
+    MDefinition* target = ins->target();
+    MOZ_ASSERT(target->type() == MIRType::Object);
+
+    MDefinition* targetOffset = ins->targetOffset();
+    MOZ_ASSERT(targetOffset->type() == MIRType::Int32);
+
+    MDefinition* source = ins->source();
+    MOZ_ASSERT(source->type() == MIRType::Object);
+
+    auto lir = new(alloc()) LSetDisjointTypedElements(useRegister(target),
+                                                      useRegister(targetOffset),
+                                                      useRegister(source),
+                                                      temp());
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitTypedObjectDescr(MTypedObjectDescr* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+    define(new(alloc()) LTypedObjectDescr(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitTypedObjectElements(MTypedObjectElements* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Elements);
+    define(new(alloc()) LTypedObjectElements(useRegister(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitSetTypedObjectOffset(MSetTypedObjectOffset* ins)
+{
+    add(new(alloc()) LSetTypedObjectOffset(useRegister(ins->object()),
+                                           useRegister(ins->offset()),
+                                           temp(), temp()),
+        ins);
+}
+
+void
+LIRGenerator::visitInitializedLength(MInitializedLength* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    define(new(alloc()) LInitializedLength(useRegisterAtStart(ins->elements())), ins);
+}
+
+void
+LIRGenerator::visitSetInitializedLength(MSetInitializedLength* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    MOZ_ASSERT(ins->index()->isConstant());
+    add(new(alloc()) LSetInitializedLength(useRegister(ins->elements()),
+                                           useRegisterOrConstant(ins->index())), ins);
+}
+
+void
+LIRGenerator::visitUnboxedArrayLength(MUnboxedArrayLength* ins)
+{
+    define(new(alloc()) LUnboxedArrayLength(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitUnboxedArrayInitializedLength(MUnboxedArrayInitializedLength* ins)
+{
+    define(new(alloc()) LUnboxedArrayInitializedLength(useRegisterAtStart(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitIncrementUnboxedArrayInitializedLength(MIncrementUnboxedArrayInitializedLength* ins)
+{
+    add(new(alloc()) LIncrementUnboxedArrayInitializedLength(useRegister(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitSetUnboxedArrayInitializedLength(MSetUnboxedArrayInitializedLength* ins)
+{
+    add(new(alloc()) LSetUnboxedArrayInitializedLength(useRegister(ins->object()),
+                                                       useRegisterOrConstant(ins->length()),
+                                                       temp()), ins);
+}
+
+void
+LIRGenerator::visitNot(MNot* ins)
+{
+    MDefinition* op = ins->input();
+
+    // String is converted to length of string in the type analysis phase (see
+    // TestPolicy).
+    MOZ_ASSERT(op->type() != MIRType::String);
+
+    // - boolean: x xor 1
+    // - int32: LCompare(x, 0)
+    // - double: LCompare(x, 0)
+    // - null or undefined: true
+    // - object: false if it never emulates undefined, else LNotO(x)
+    switch (op->type()) {
+      case MIRType::Boolean: {
+        MConstant* cons = MConstant::New(alloc(), Int32Value(1));
+        ins->block()->insertBefore(ins, cons);
+        lowerForALU(new(alloc()) LBitOpI(JSOP_BITXOR), ins, op, cons);
+        break;
+      }
+      case MIRType::Int32:
+        define(new(alloc()) LNotI(useRegisterAtStart(op)), ins);
+        break;
+      case MIRType::Int64:
+        define(new(alloc()) LNotI64(useInt64RegisterAtStart(op)), ins);
+        break;
+      case MIRType::Double:
+        define(new(alloc()) LNotD(useRegister(op)), ins);
+        break;
+      case MIRType::Float32:
+        define(new(alloc()) LNotF(useRegister(op)), ins);
+        break;
+      case MIRType::Undefined:
+      case MIRType::Null:
+        define(new(alloc()) LInteger(1), ins);
+        break;
+      case MIRType::Symbol:
+        define(new(alloc()) LInteger(0), ins);
+        break;
+      case MIRType::Object:
+        if (!ins->operandMightEmulateUndefined()) {
+            // Objects that don't emulate undefined can be constant-folded.
+            define(new(alloc()) LInteger(0), ins);
+        } else {
+            // All others require further work.
+            define(new(alloc()) LNotO(useRegister(op)), ins);
+        }
+        break;
+      case MIRType::Value: {
+        LDefinition temp0, temp1;
+        if (ins->operandMightEmulateUndefined()) {
+            temp0 = temp();
+            temp1 = temp();
+        } else {
+            temp0 = LDefinition::BogusTemp();
+            temp1 = LDefinition::BogusTemp();
+        }
+
+        LNotV* lir = new(alloc()) LNotV(useBox(op), tempDouble(), temp0, temp1);
+        define(lir, ins);
+        break;
+      }
+
+      default:
+        MOZ_CRASH("Unexpected MIRType.");
+    }
+}
+
+void
+LIRGenerator::visitBoundsCheck(MBoundsCheck* ins)
+{
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->length()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->type() == MIRType::Int32);
+
+    if (!ins->fallible())
+        return;
+
+    LInstruction* check;
+    if (ins->minimum() || ins->maximum()) {
+        check = new(alloc()) LBoundsCheckRange(useRegisterOrConstant(ins->index()),
+                                               useAny(ins->length()),
+                                               temp());
+    } else {
+        check = new(alloc()) LBoundsCheck(useRegisterOrConstant(ins->index()),
+                                          useAnyOrConstant(ins->length()));
+    }
+    assignSnapshot(check, Bailout_BoundsCheck);
+    add(check, ins);
+}
+
+void
+LIRGenerator::visitBoundsCheckLower(MBoundsCheckLower* ins)
+{
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    if (!ins->fallible())
+        return;
+
+    LInstruction* check = new(alloc()) LBoundsCheckLower(useRegister(ins->index()));
+    assignSnapshot(check, Bailout_BoundsCheck);
+    add(check, ins);
+}
+
+void
+LIRGenerator::visitInArray(MInArray* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->initLength()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+
+    LAllocation object;
+    if (ins->needsNegativeIntCheck())
+        object = useRegister(ins->object());
+
+    LInArray* lir = new(alloc()) LInArray(useRegister(ins->elements()),
+                                          useRegisterOrConstant(ins->index()),
+                                          useRegister(ins->initLength()),
+                                          object);
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitLoadElement(MLoadElement* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    switch (ins->type()) {
+      case MIRType::Value:
+      {
+        LLoadElementV* lir = new(alloc()) LLoadElementV(useRegister(ins->elements()),
+                                                        useRegisterOrConstant(ins->index()));
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Hole);
+        defineBox(lir, ins);
+        break;
+      }
+      case MIRType::Undefined:
+      case MIRType::Null:
+        MOZ_CRASH("typed load must have a payload");
+
+      default:
+      {
+        LLoadElementT* lir = new(alloc()) LLoadElementT(useRegister(ins->elements()),
+                                                        useRegisterOrConstant(ins->index()));
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Hole);
+        define(lir, ins);
+        break;
+      }
+    }
+}
+
+void
+LIRGenerator::visitLoadElementHole(MLoadElementHole* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->initLength()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+
+    LLoadElementHole* lir = new(alloc()) LLoadElementHole(useRegister(ins->elements()),
+                                                          useRegisterOrConstant(ins->index()),
+                                                          useRegister(ins->initLength()));
+    if (ins->needsNegativeIntCheck())
+        assignSnapshot(lir, Bailout_NegativeIndex);
+    defineBox(lir, ins);
+}
+
+void
+LIRGenerator::visitLoadUnboxedObjectOrNull(MLoadUnboxedObjectOrNull* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    if (ins->type() == MIRType::Object || ins->type() == MIRType::ObjectOrNull) {
+        LLoadUnboxedPointerT* lir = new(alloc()) LLoadUnboxedPointerT(useRegister(ins->elements()),
+                                                                      useRegisterOrConstant(ins->index()));
+        if (ins->nullBehavior() == MLoadUnboxedObjectOrNull::BailOnNull)
+            assignSnapshot(lir, Bailout_TypeBarrierO);
+        define(lir, ins);
+    } else {
+        MOZ_ASSERT(ins->type() == MIRType::Value);
+        MOZ_ASSERT(ins->nullBehavior() != MLoadUnboxedObjectOrNull::BailOnNull);
+
+        LLoadUnboxedPointerV* lir = new(alloc()) LLoadUnboxedPointerV(useRegister(ins->elements()),
+                                                                      useRegisterOrConstant(ins->index()));
+        defineBox(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitLoadUnboxedString(MLoadUnboxedString* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->type() == MIRType::String);
+
+    LLoadUnboxedPointerT* lir = new(alloc()) LLoadUnboxedPointerT(useRegister(ins->elements()),
+                                                                  useRegisterOrConstant(ins->index()));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitStoreElement(MStoreElement* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+      {
+        LInstruction* lir = new(alloc()) LStoreElementV(elements, index, useBox(ins->value()));
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Hole);
+        add(lir, ins);
+        break;
+      }
+
+      default:
+      {
+        const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+        LInstruction* lir = new(alloc()) LStoreElementT(elements, index, value);
+        if (ins->fallible())
+            assignSnapshot(lir, Bailout_Hole);
+        add(lir, ins);
+        break;
+      }
+    }
+}
+
+void
+LIRGenerator::visitStoreElementHole(MStoreElementHole* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    const LUse object = useRegister(ins->object());
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    // Use a temp register when adding new elements to unboxed arrays.
+    LDefinition tempDef = LDefinition::BogusTemp();
+    if (ins->unboxedType() != JSVAL_TYPE_MAGIC)
+        tempDef = temp();
+
+    LInstruction* lir;
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+        lir = new(alloc()) LStoreElementHoleV(object, elements, index, useBox(ins->value()),
+                                              tempDef);
+        break;
+
+      default:
+      {
+        const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+        lir = new(alloc()) LStoreElementHoleT(object, elements, index, value, tempDef);
+        break;
+      }
+    }
+
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitFallibleStoreElement(MFallibleStoreElement* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    const LUse object = useRegister(ins->object());
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    // Use a temp register when adding new elements to unboxed arrays.
+    LDefinition tempDef = LDefinition::BogusTemp();
+    if (ins->unboxedType() != JSVAL_TYPE_MAGIC)
+        tempDef = temp();
+
+    LInstruction* lir;
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+        lir = new(alloc()) LFallibleStoreElementV(object, elements, index, useBox(ins->value()),
+                                                  tempDef);
+        break;
+      default:
+        const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+        lir = new(alloc()) LFallibleStoreElementT(object, elements, index, value, tempDef);
+        break;
+    }
+
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+
+void
+LIRGenerator::visitStoreUnboxedObjectOrNull(MStoreUnboxedObjectOrNull* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->value()->type() == MIRType::Object ||
+               ins->value()->type() == MIRType::Null ||
+               ins->value()->type() == MIRType::ObjectOrNull);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrNonDoubleConstant(ins->index());
+    const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+
+    LInstruction* lir = new(alloc()) LStoreUnboxedPointer(elements, index, value);
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitStoreUnboxedString(MStoreUnboxedString* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->value()->type() == MIRType::String);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+    const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+
+    LInstruction* lir = new(alloc()) LStoreUnboxedPointer(elements, index, value);
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitConvertUnboxedObjectToNative(MConvertUnboxedObjectToNative* ins)
+{
+    LInstruction* check = new(alloc()) LConvertUnboxedObjectToNative(useRegister(ins->object()));
+    add(check, ins);
+    assignSafepoint(check, ins);
+}
+
+void
+LIRGenerator::visitEffectiveAddress(MEffectiveAddress* ins)
+{
+    define(new(alloc()) LEffectiveAddress(useRegister(ins->base()), useRegister(ins->index())), ins);
+}
+
+void
+LIRGenerator::visitArrayPopShift(MArrayPopShift* ins)
+{
+    LUse object = useRegister(ins->object());
+
+    switch (ins->type()) {
+      case MIRType::Value:
+      {
+        LArrayPopShiftV* lir = new(alloc()) LArrayPopShiftV(object, temp(), temp());
+        defineBox(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+      case MIRType::Undefined:
+      case MIRType::Null:
+        MOZ_CRASH("typed load must have a payload");
+
+      default:
+      {
+        LArrayPopShiftT* lir = new(alloc()) LArrayPopShiftT(object, temp(), temp());
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+    }
+}
+
+void
+LIRGenerator::visitArrayPush(MArrayPush* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Int32);
+
+    LUse object = useRegister(ins->object());
+
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+      {
+        LArrayPushV* lir = new(alloc()) LArrayPushV(object, useBox(ins->value()), temp());
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+
+      default:
+      {
+        const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+        LArrayPushT* lir = new(alloc()) LArrayPushT(object, value, temp());
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+    }
+}
+
+void
+LIRGenerator::visitArraySlice(MArraySlice* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->begin()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->end()->type() == MIRType::Int32);
+
+    LArraySlice* lir = new(alloc()) LArraySlice(useFixedAtStart(ins->object(), CallTempReg0),
+                                                useFixedAtStart(ins->begin(), CallTempReg1),
+                                                useFixedAtStart(ins->end(), CallTempReg2),
+                                                tempFixed(CallTempReg3),
+                                                tempFixed(CallTempReg4));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitArrayJoin(MArrayJoin* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::String);
+    MOZ_ASSERT(ins->array()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->sep()->type() == MIRType::String);
+
+    LArrayJoin* lir = new(alloc()) LArrayJoin(useRegisterAtStart(ins->array()),
+                                              useRegisterAtStart(ins->sep()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitSinCos(MSinCos *ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::SinCosDouble);
+    MOZ_ASSERT(ins->input()->type() == MIRType::Double  ||
+               ins->input()->type() == MIRType::Float32 ||
+               ins->input()->type() == MIRType::Int32);
+
+    LSinCos *lir = new (alloc()) LSinCos(useRegisterAtStart(ins->input()),
+                                         tempFixed(CallTempReg0),
+                                         temp());
+    defineSinCos(lir, ins);
+}
+
+void
+LIRGenerator::visitStringSplit(MStringSplit* ins)
+{
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    MOZ_ASSERT(ins->separator()->type() == MIRType::String);
+
+    LStringSplit* lir = new(alloc()) LStringSplit(useRegisterAtStart(ins->string()),
+                                                  useRegisterAtStart(ins->separator()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitLoadUnboxedScalar(MLoadUnboxedScalar* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    MOZ_ASSERT(IsNumberType(ins->type()) || IsSimdType(ins->type()) ||
+               ins->type() == MIRType::Boolean);
+
+    // We need a temp register for Uint32Array with known double result.
+    LDefinition tempDef = LDefinition::BogusTemp();
+    if (ins->readType() == Scalar::Uint32 && IsFloatingPointType(ins->type()))
+        tempDef = temp();
+
+    if (ins->requiresMemoryBarrier()) {
+        LMemoryBarrier* fence = new(alloc()) LMemoryBarrier(MembarBeforeLoad);
+        add(fence, ins);
+    }
+    LLoadUnboxedScalar* lir = new(alloc()) LLoadUnboxedScalar(elements, index, tempDef);
+    if (ins->fallible())
+        assignSnapshot(lir, Bailout_Overflow);
+    define(lir, ins);
+    if (ins->requiresMemoryBarrier()) {
+        LMemoryBarrier* fence = new(alloc()) LMemoryBarrier(MembarAfterLoad);
+        add(fence, ins);
+    }
+}
+
+void
+LIRGenerator::visitClampToUint8(MClampToUint8* ins)
+{
+    MDefinition* in = ins->input();
+
+    switch (in->type()) {
+      case MIRType::Boolean:
+        redefine(ins, in);
+        break;
+
+      case MIRType::Int32:
+        defineReuseInput(new(alloc()) LClampIToUint8(useRegisterAtStart(in)), ins, 0);
+        break;
+
+      case MIRType::Double:
+        // LClampDToUint8 clobbers its input register. Making it available as
+        // a temp copy describes this behavior to the register allocator.
+        define(new(alloc()) LClampDToUint8(useRegisterAtStart(in), tempCopy(in, 0)), ins);
+        break;
+
+      case MIRType::Value:
+      {
+        LClampVToUint8* lir = new(alloc()) LClampVToUint8(useBox(in), tempDouble());
+        assignSnapshot(lir, Bailout_NonPrimitiveInput);
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+        break;
+      }
+
+      default:
+        MOZ_CRASH("unexpected type");
+    }
+}
+
+void
+LIRGenerator::visitLoadTypedArrayElementHole(MLoadTypedArrayElementHole* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    MOZ_ASSERT(ins->type() == MIRType::Value);
+
+    const LUse object = useRegister(ins->object());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    LLoadTypedArrayElementHole* lir = new(alloc()) LLoadTypedArrayElementHole(object, index);
+    if (ins->fallible())
+        assignSnapshot(lir, Bailout_Overflow);
+    defineBox(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitLoadTypedArrayElementStatic(MLoadTypedArrayElementStatic* ins)
+{
+    LLoadTypedArrayElementStatic* lir =
+        new(alloc()) LLoadTypedArrayElementStatic(useRegisterAtStart(ins->ptr()));
+
+    // In case of out of bounds, may bail out, or may jump to ool code.
+    if (ins->fallible())
+        assignSnapshot(lir, Bailout_BoundsCheck);
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitStoreUnboxedScalar(MStoreUnboxedScalar* ins)
+{
+    MOZ_ASSERT(IsValidElementsType(ins->elements(), ins->offsetAdjustment()));
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    if (ins->isSimdWrite()) {
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Float32x4, ins->value()->type() == MIRType::Float32x4);
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Int8x16, ins->value()->type() == MIRType::Int8x16);
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Int16x8, ins->value()->type() == MIRType::Int16x8);
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Int32x4, ins->value()->type() == MIRType::Int32x4);
+    } else if (ins->isFloatWrite()) {
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Float32, ins->value()->type() == MIRType::Float32);
+        MOZ_ASSERT_IF(ins->writeType() == Scalar::Float64, ins->value()->type() == MIRType::Double);
+    } else {
+        MOZ_ASSERT(ins->value()->type() == MIRType::Int32);
+    }
+
+    LUse elements = useRegister(ins->elements());
+    LAllocation index = useRegisterOrConstant(ins->index());
+    LAllocation value;
+
+    // For byte arrays, the value has to be in a byte register on x86.
+    if (ins->isByteWrite())
+        value = useByteOpRegisterOrNonDoubleConstant(ins->value());
+    else
+        value = useRegisterOrNonDoubleConstant(ins->value());
+
+    // Optimization opportunity for atomics: on some platforms there
+    // is a store instruction that incorporates the necessary
+    // barriers, and we could use that instead of separate barrier and
+    // store instructions.  See bug #1077027.
+    if (ins->requiresMemoryBarrier()) {
+        LMemoryBarrier* fence = new(alloc()) LMemoryBarrier(MembarBeforeStore);
+        add(fence, ins);
+    }
+    add(new(alloc()) LStoreUnboxedScalar(elements, index, value), ins);
+    if (ins->requiresMemoryBarrier()) {
+        LMemoryBarrier* fence = new(alloc()) LMemoryBarrier(MembarAfterStore);
+        add(fence, ins);
+    }
+}
+
+void
+LIRGenerator::visitStoreTypedArrayElementHole(MStoreTypedArrayElementHole* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->length()->type() == MIRType::Int32);
+
+    if (ins->isFloatWrite()) {
+        MOZ_ASSERT_IF(ins->arrayType() == Scalar::Float32, ins->value()->type() == MIRType::Float32);
+        MOZ_ASSERT_IF(ins->arrayType() == Scalar::Float64, ins->value()->type() == MIRType::Double);
+    } else {
+        MOZ_ASSERT(ins->value()->type() == MIRType::Int32);
+    }
+
+    LUse elements = useRegister(ins->elements());
+    LAllocation length = useAnyOrConstant(ins->length());
+    LAllocation index = useRegisterOrConstant(ins->index());
+    LAllocation value;
+
+    // For byte arrays, the value has to be in a byte register on x86.
+    if (ins->isByteWrite())
+        value = useByteOpRegisterOrNonDoubleConstant(ins->value());
+    else
+        value = useRegisterOrNonDoubleConstant(ins->value());
+    add(new(alloc()) LStoreTypedArrayElementHole(elements, length, index, value), ins);
+}
+
+void
+LIRGenerator::visitLoadFixedSlot(MLoadFixedSlot* ins)
+{
+    MDefinition* obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    MIRType type = ins->type();
+
+    if (type == MIRType::Value) {
+        LLoadFixedSlotV* lir = new(alloc()) LLoadFixedSlotV(useRegisterAtStart(obj));
+        defineBox(lir, ins);
+    } else {
+        LLoadFixedSlotT* lir = new(alloc()) LLoadFixedSlotT(useRegisterForTypedLoad(obj, type));
+        define(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitLoadFixedSlotAndUnbox(MLoadFixedSlotAndUnbox* ins)
+{
+    MDefinition* obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    LLoadFixedSlotAndUnbox* lir = new(alloc()) LLoadFixedSlotAndUnbox(useRegisterAtStart(obj));
+    if (ins->fallible())
+        assignSnapshot(lir, ins->bailoutKind());
+
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitStoreFixedSlot(MStoreFixedSlot* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    if (ins->value()->type() == MIRType::Value) {
+        LStoreFixedSlotV* lir = new(alloc()) LStoreFixedSlotV(useRegister(ins->object()),
+                                                              useBox(ins->value()));
+        add(lir, ins);
+    } else {
+        LStoreFixedSlotT* lir = new(alloc()) LStoreFixedSlotT(useRegister(ins->object()),
+                                                              useRegisterOrConstant(ins->value()));
+        add(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitGetNameCache(MGetNameCache* ins)
+{
+    MOZ_ASSERT(ins->envObj()->type() == MIRType::Object);
+
+    // Set the performs-call flag so that we don't omit the overrecursed check.
+    // This is necessary because the cache can attach a scripted getter stub
+    // that calls this script recursively.
+    gen->setPerformsCall();
+
+    LGetNameCache* lir = new(alloc()) LGetNameCache(useRegister(ins->envObj()));
+    defineBox(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallGetIntrinsicValue(MCallGetIntrinsicValue* ins)
+{
+    LCallGetIntrinsicValue* lir = new(alloc()) LCallGetIntrinsicValue();
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGetPropertyCache(MGetPropertyCache* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    MDefinition* id = ins->idval();
+    MOZ_ASSERT(id->type() == MIRType::String ||
+               id->type() == MIRType::Symbol ||
+               id->type() == MIRType::Int32 ||
+               id->type() == MIRType::Value);
+
+    if (ins->monitoredResult()) {
+        // Set the performs-call flag so that we don't omit the overrecursed
+        // check. This is necessary because the cache can attach a scripted
+        // getter stub that calls this script recursively.
+        gen->setPerformsCall();
+    }
+
+    // If this is a GETPROP, the id is a constant string. Allow passing it as a
+    // constant to reduce register allocation pressure.
+    bool useConstId = id->type() == MIRType::String || id->type() == MIRType::Symbol;
+
+    if (ins->type() == MIRType::Value) {
+        LGetPropertyCacheV* lir =
+            new(alloc()) LGetPropertyCacheV(useRegister(ins->object()),
+                                            useBoxOrTypedOrConstant(id, useConstId));
+        defineBox(lir, ins);
+        assignSafepoint(lir, ins);
+    } else {
+        LGetPropertyCacheT* lir =
+            new(alloc()) LGetPropertyCacheT(useRegister(ins->object()),
+                                            useBoxOrTypedOrConstant(id, useConstId));
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    if (ins->type() == MIRType::Value) {
+        LGetPropertyPolymorphicV* lir =
+            new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->object()));
+        assignSnapshot(lir, Bailout_ShapeGuard);
+        defineBox(lir, ins);
+    } else {
+        LDefinition maybeTemp = (ins->type() == MIRType::Double) ? temp() : LDefinition::BogusTemp();
+        LGetPropertyPolymorphicT* lir =
+            new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->object()), maybeTemp);
+        assignSnapshot(lir, Bailout_ShapeGuard);
+        define(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    if (ins->value()->type() == MIRType::Value) {
+        LSetPropertyPolymorphicV* lir =
+            new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->object()),
+                                                  useBox(ins->value()),
+                                                  temp());
+        assignSnapshot(lir, Bailout_ShapeGuard);
+        add(lir, ins);
+    } else {
+        LAllocation value = useRegisterOrConstant(ins->value());
+        LSetPropertyPolymorphicT* lir =
+            new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->object()), value,
+                                                  ins->value()->type(), temp());
+        assignSnapshot(lir, Bailout_ShapeGuard);
+        add(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitBindNameCache(MBindNameCache* ins)
+{
+    MOZ_ASSERT(ins->environmentChain()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+
+    LBindNameCache* lir = new(alloc()) LBindNameCache(useRegister(ins->environmentChain()));
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallBindVar(MCallBindVar* ins)
+{
+    MOZ_ASSERT(ins->environmentChain()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+
+    LCallBindVar* lir = new(alloc()) LCallBindVar(useRegister(ins->environmentChain()));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitGuardObjectIdentity(MGuardObjectIdentity* ins)
+{
+    LGuardObjectIdentity* guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->object()),
+                                                                    useRegister(ins->expected()));
+    assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
+    add(guard, ins);
+    redefine(ins, ins->object());
+}
+
+void
+LIRGenerator::visitGuardClass(MGuardClass* ins)
+{
+    LDefinition t = temp();
+    LGuardClass* guard = new(alloc()) LGuardClass(useRegister(ins->object()), t);
+    assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
+    add(guard, ins);
+}
+
+void
+LIRGenerator::visitGuardObject(MGuardObject* ins)
+{
+    // The type policy does all the work, so at this point the input
+    // is guaranteed to be an object.
+    MOZ_ASSERT(ins->input()->type() == MIRType::Object);
+    redefine(ins, ins->input());
+}
+
+void
+LIRGenerator::visitGuardString(MGuardString* ins)
+{
+    // The type policy does all the work, so at this point the input
+    // is guaranteed to be a string.
+    MOZ_ASSERT(ins->input()->type() == MIRType::String);
+    redefine(ins, ins->input());
+}
+
+void
+LIRGenerator::visitGuardSharedTypedArray(MGuardSharedTypedArray* ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType::Object);
+    LGuardSharedTypedArray* guard =
+        new(alloc()) LGuardSharedTypedArray(useRegister(ins->object()), temp());
+    assignSnapshot(guard, Bailout_NonSharedTypedArrayInput);
+    add(guard, ins);
+}
+
+void
+LIRGenerator::visitPolyInlineGuard(MPolyInlineGuard* ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType::Object);
+    redefine(ins, ins->input());
+}
+
+void
+LIRGenerator::visitGuardReceiverPolymorphic(MGuardReceiverPolymorphic* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Object);
+
+    LGuardReceiverPolymorphic* guard =
+        new(alloc()) LGuardReceiverPolymorphic(useRegister(ins->object()), temp());
+    assignSnapshot(guard, Bailout_ShapeGuard);
+    add(guard, ins);
+    redefine(ins, ins->object());
+}
+
+void
+LIRGenerator::visitGuardUnboxedExpando(MGuardUnboxedExpando* ins)
+{
+    LGuardUnboxedExpando* guard =
+        new(alloc()) LGuardUnboxedExpando(useRegister(ins->object()));
+    assignSnapshot(guard, ins->bailoutKind());
+    add(guard, ins);
+    redefine(ins, ins->object());
+}
+
+void
+LIRGenerator::visitLoadUnboxedExpando(MLoadUnboxedExpando* ins)
+{
+    LLoadUnboxedExpando* lir =
+        new(alloc()) LLoadUnboxedExpando(useRegisterAtStart(ins->object()));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitAssertRange(MAssertRange* ins)
+{
+    MDefinition* input = ins->input();
+    LInstruction* lir = nullptr;
+
+    switch (input->type()) {
+      case MIRType::Boolean:
+      case MIRType::Int32:
+        lir = new(alloc()) LAssertRangeI(useRegisterAtStart(input));
+        break;
+
+      case MIRType::Double:
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
+        break;
+
+      case MIRType::Float32:
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempDouble(), tempDouble());
+        break;
+
+      case MIRType::Value:
+        lir = new(alloc()) LAssertRangeV(useBox(input), tempToUnbox(), tempDouble(), tempDouble());
+        break;
+
+      default:
+        MOZ_CRASH("Unexpected Range for MIRType");
+        break;
+    }
+
+    lir->setMir(ins);
+    add(lir);
+}
+
+void
+LIRGenerator::visitCallGetProperty(MCallGetProperty* ins)
+{
+    LCallGetProperty* lir = new(alloc()) LCallGetProperty(useBoxAtStart(ins->value()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallGetElement(MCallGetElement* ins)
+{
+    MOZ_ASSERT(ins->lhs()->type() == MIRType::Value);
+    MOZ_ASSERT(ins->rhs()->type() == MIRType::Value);
+
+    LCallGetElement* lir = new(alloc()) LCallGetElement(useBoxAtStart(ins->lhs()),
+                                                        useBoxAtStart(ins->rhs()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallSetProperty(MCallSetProperty* ins)
+{
+    LInstruction* lir = new(alloc()) LCallSetProperty(useRegisterAtStart(ins->object()),
+                                                      useBoxAtStart(ins->value()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDeleteProperty(MDeleteProperty* ins)
+{
+    LCallDeleteProperty* lir = new(alloc()) LCallDeleteProperty(useBoxAtStart(ins->value()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDeleteElement(MDeleteElement* ins)
+{
+    LCallDeleteElement* lir = new(alloc()) LCallDeleteElement(useBoxAtStart(ins->value()),
+                                                              useBoxAtStart(ins->index()));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitSetPropertyCache(MSetPropertyCache* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    MDefinition* id = ins->idval();
+    MOZ_ASSERT(id->type() == MIRType::String ||
+               id->type() == MIRType::Symbol ||
+               id->type() == MIRType::Int32 ||
+               id->type() == MIRType::Value);
+
+    // If this is a SETPROP, the id is a constant string. Allow passing it as a
+    // constant to reduce register allocation pressure.
+    bool useConstId = id->type() == MIRType::String || id->type() == MIRType::Symbol;
+    bool useConstValue = IsNonNurseryConstant(ins->value());
+
+    // Set the performs-call flag so that we don't omit the overrecursed check.
+    // This is necessary because the cache can attach a scripted setter stub
+    // that calls this script recursively.
+    gen->setPerformsCall();
+
+    // If the index might be an integer, we need some extra temp registers for
+    // the dense and typed array element stubs.
+    LDefinition tempToUnboxIndex = LDefinition::BogusTemp();
+    LDefinition tempD = LDefinition::BogusTemp();
+    LDefinition tempF32 = LDefinition::BogusTemp();
+
+    if (id->mightBeType(MIRType::Int32)) {
+        if (id->type() != MIRType::Int32)
+            tempToUnboxIndex = tempToUnbox();
+        tempD = tempDouble();
+        tempF32 = hasUnaliasedDouble() ? tempFloat32() : LDefinition::BogusTemp();
+    }
+
+    LInstruction* lir =
+        new(alloc()) LSetPropertyCache(useRegister(ins->object()),
+                                       useBoxOrTypedOrConstant(id, useConstId),
+                                       useBoxOrTypedOrConstant(ins->value(), useConstValue),
+                                       temp(),
+                                       tempToUnboxIndex, tempD, tempF32);
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallSetElement(MCallSetElement* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Value);
+    MOZ_ASSERT(ins->value()->type() == MIRType::Value);
+
+    LCallSetElement* lir = new(alloc()) LCallSetElement(useRegisterAtStart(ins->object()),
+                                                        useBoxAtStart(ins->index()),
+                                                        useBoxAtStart(ins->value()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCallInitElementArray(MCallInitElementArray* ins)
+{
+    LCallInitElementArray* lir = new(alloc()) LCallInitElementArray(useRegisterAtStart(ins->object()),
+                                                                    useBoxAtStart(ins->value()));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitIteratorStart(MIteratorStart* ins)
+{
+    if (ins->object()->type() == MIRType::Value) {
+        LCallIteratorStartV* lir = new(alloc()) LCallIteratorStartV(useBoxAtStart(ins->object()));
+        defineReturn(lir, ins);
+        assignSafepoint(lir, ins);
+        return;
+    }
+
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+
+    // Call a stub if this is not a simple for-in loop.
+    if (ins->flags() != JSITER_ENUMERATE) {
+        LCallIteratorStartO* lir = new(alloc()) LCallIteratorStartO(useRegisterAtStart(ins->object()));
+        defineReturn(lir, ins);
+        assignSafepoint(lir, ins);
+    } else {
+        LIteratorStartO* lir = new(alloc()) LIteratorStartO(useRegister(ins->object()), temp(), temp(), temp());
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitIteratorMore(MIteratorMore* ins)
+{
+    LIteratorMore* lir = new(alloc()) LIteratorMore(useRegister(ins->iterator()), temp());
+    defineBox(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitIsNoIter(MIsNoIter* ins)
+{
+    MOZ_ASSERT(ins->hasOneUse());
+    emitAtUses(ins);
+}
+
+void
+LIRGenerator::visitIteratorEnd(MIteratorEnd* ins)
+{
+    LIteratorEnd* lir = new(alloc()) LIteratorEnd(useRegister(ins->iterator()), temp(), temp(), temp());
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitStringLength(MStringLength* ins)
+{
+    MOZ_ASSERT(ins->string()->type() == MIRType::String);
+    define(new(alloc()) LStringLength(useRegisterAtStart(ins->string())), ins);
+}
+
+void
+LIRGenerator::visitArgumentsLength(MArgumentsLength* ins)
+{
+    define(new(alloc()) LArgumentsLength(), ins);
+}
+
+void
+LIRGenerator::visitGetFrameArgument(MGetFrameArgument* ins)
+{
+    LGetFrameArgument* lir = new(alloc()) LGetFrameArgument(useRegisterOrConstant(ins->index()));
+    defineBox(lir, ins);
+}
+
+void
+LIRGenerator::visitNewTarget(MNewTarget* ins)
+{
+    LNewTarget* lir = new(alloc()) LNewTarget();
+    defineBox(lir, ins);
+}
+
+void
+LIRGenerator::visitSetFrameArgument(MSetFrameArgument* ins)
+{
+    MDefinition* input = ins->input();
+
+    if (input->type() == MIRType::Value) {
+        LSetFrameArgumentV* lir = new(alloc()) LSetFrameArgumentV(useBox(input));
+        add(lir, ins);
+    } else if (input->type() == MIRType::Undefined || input->type() == MIRType::Null) {
+        Value val = input->type() == MIRType::Undefined ? UndefinedValue() : NullValue();
+        LSetFrameArgumentC* lir = new(alloc()) LSetFrameArgumentC(val);
+        add(lir, ins);
+    } else {
+        LSetFrameArgumentT* lir = new(alloc()) LSetFrameArgumentT(useRegister(input));
+        add(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitRunOncePrologue(MRunOncePrologue* ins)
+{
+    LRunOncePrologue* lir = new(alloc()) LRunOncePrologue;
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitRest(MRest* ins)
+{
+    MOZ_ASSERT(ins->numActuals()->type() == MIRType::Int32);
+
+    LRest* lir = new(alloc()) LRest(useFixedAtStart(ins->numActuals(), CallTempReg0),
+                                    tempFixed(CallTempReg1),
+                                    tempFixed(CallTempReg2),
+                                    tempFixed(CallTempReg3));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitThrow(MThrow* ins)
+{
+    MDefinition* value = ins->getOperand(0);
+    MOZ_ASSERT(value->type() == MIRType::Value);
+
+    LThrow* lir = new(alloc()) LThrow(useBoxAtStart(value));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitIn(MIn* ins)
+{
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+
+    MOZ_ASSERT(lhs->type() == MIRType::Value);
+    MOZ_ASSERT(rhs->type() == MIRType::Object);
+
+    LIn* lir = new(alloc()) LIn(useBoxAtStart(lhs), useRegisterAtStart(rhs));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitInstanceOf(MInstanceOf* ins)
+{
+    MDefinition* lhs = ins->getOperand(0);
+
+    MOZ_ASSERT(lhs->type() == MIRType::Value || lhs->type() == MIRType::Object);
+
+    if (lhs->type() == MIRType::Object) {
+        LInstanceOfO* lir = new(alloc()) LInstanceOfO(useRegister(lhs));
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+    } else {
+        LInstanceOfV* lir = new(alloc()) LInstanceOfV(useBox(lhs));
+        define(lir, ins);
+        assignSafepoint(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitCallInstanceOf(MCallInstanceOf* ins)
+{
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+
+    MOZ_ASSERT(lhs->type() == MIRType::Value);
+    MOZ_ASSERT(rhs->type() == MIRType::Object);
+
+    LCallInstanceOf* lir = new(alloc()) LCallInstanceOf(useBoxAtStart(lhs),
+                                                        useRegisterAtStart(rhs));
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitIsCallable(MIsCallable* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+    define(new(alloc()) LIsCallable(useRegister(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitIsConstructor(MIsConstructor* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+    define(new(alloc()) LIsConstructor(useRegister(ins->object())), ins);
+}
+
+static bool
+CanEmitIsObjectAtUses(MInstruction* ins)
+{
+    if (!ins->canEmitAtUses())
+        return false;
+
+    MUseIterator iter(ins->usesBegin());
+    if (iter == ins->usesEnd())
+        return false;
+
+    MNode* node = iter->consumer();
+    if (!node->isDefinition())
+        return false;
+
+    if (!node->toDefinition()->isTest())
+        return false;
+
+    iter++;
+    return iter == ins->usesEnd();
+}
+
+void
+LIRGenerator::visitIsObject(MIsObject* ins)
+{
+    if (CanEmitIsObjectAtUses(ins)) {
+        emitAtUses(ins);
+        return;
+    }
+
+    MDefinition* opd = ins->input();
+    MOZ_ASSERT(opd->type() == MIRType::Value);
+    LIsObject* lir = new(alloc()) LIsObject(useBoxAtStart(opd));
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitHasClass(MHasClass* ins)
+{
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->type() == MIRType::Boolean);
+    define(new(alloc()) LHasClass(useRegister(ins->object())), ins);
+}
+
+void
+LIRGenerator::visitWasmAddOffset(MWasmAddOffset* ins)
+{
+    MOZ_ASSERT(ins->base()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->type() == MIRType::Int32);
+    define(new(alloc()) LWasmAddOffset(useRegisterAtStart(ins->base())), ins);
+}
+
+void
+LIRGenerator::visitWasmBoundsCheck(MWasmBoundsCheck* ins)
+{
+    if (ins->isRedundant()) {
+        if (MOZ_LIKELY(!JitOptions.wasmAlwaysCheckBounds))
+            return;
+    }
+
+    MDefinition* input = ins->input();
+    MOZ_ASSERT(input->type() == MIRType::Int32);
+
+    auto* lir = new(alloc()) LWasmBoundsCheck(useRegisterAtStart(input));
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitWasmLoadGlobalVar(MWasmLoadGlobalVar* ins)
+{
+    if (ins->type() == MIRType::Int64)
+        defineInt64(new(alloc()) LWasmLoadGlobalVarI64, ins);
+    else
+        define(new(alloc()) LWasmLoadGlobalVar, ins);
+}
+
+void
+LIRGenerator::visitWasmStoreGlobalVar(MWasmStoreGlobalVar* ins)
+{
+    MDefinition* value = ins->value();
+    if (value->type() == MIRType::Int64)
+        add(new(alloc()) LWasmStoreGlobalVarI64(useInt64RegisterAtStart(value)), ins);
+    else
+        add(new(alloc()) LWasmStoreGlobalVar(useRegisterAtStart(value)), ins);
+}
+
+void
+LIRGenerator::visitWasmParameter(MWasmParameter* ins)
+{
+    ABIArg abi = ins->abi();
+    if (abi.argInRegister()) {
+#if defined(JS_NUNBOX32)
+        if (abi.isGeneralRegPair()) {
+            defineInt64Fixed(new(alloc()) LWasmParameterI64, ins,
+                LInt64Allocation(LAllocation(AnyRegister(abi.gpr64().high)),
+                                 LAllocation(AnyRegister(abi.gpr64().low))));
+            return;
+        }
+#endif
+        defineFixed(new(alloc()) LWasmParameter, ins, LAllocation(abi.reg()));
+        return;
+    }
+    if (ins->type() == MIRType::Int64) {
+        MOZ_ASSERT(!abi.argInRegister());
+        defineInt64Fixed(new(alloc()) LWasmParameterI64, ins,
+#if defined(JS_NUNBOX32)
+            LInt64Allocation(LArgument(abi.offsetFromArgBase() + INT64HIGH_OFFSET),
+                             LArgument(abi.offsetFromArgBase() + INT64LOW_OFFSET))
+#else
+            LInt64Allocation(LArgument(abi.offsetFromArgBase()))
+#endif
+        );
+    } else {
+        MOZ_ASSERT(IsNumberType(ins->type()) || IsSimdType(ins->type()));
+        defineFixed(new(alloc()) LWasmParameter, ins, LArgument(abi.offsetFromArgBase()));
+    }
+}
+
+void
+LIRGenerator::visitWasmReturn(MWasmReturn* ins)
+{
+    MDefinition* rval = ins->getOperand(0);
+
+    if (rval->type() == MIRType::Int64) {
+        LWasmReturnI64* lir = new(alloc()) LWasmReturnI64(useInt64Fixed(rval, ReturnReg64));
+
+        // Preserve the TLS pointer we were passed in `WasmTlsReg`.
+        MDefinition* tlsPtr = ins->getOperand(1);
+        lir->setOperand(INT64_PIECES, useFixed(tlsPtr, WasmTlsReg));
+
+        add(lir);
+        return;
+    }
+
+    LWasmReturn* lir = new(alloc()) LWasmReturn;
+    if (rval->type() == MIRType::Float32)
+        lir->setOperand(0, useFixed(rval, ReturnFloat32Reg));
+    else if (rval->type() == MIRType::Double)
+        lir->setOperand(0, useFixed(rval, ReturnDoubleReg));
+    else if (IsSimdType(rval->type()))
+        lir->setOperand(0, useFixed(rval, ReturnSimd128Reg));
+    else if (rval->type() == MIRType::Int32)
+        lir->setOperand(0, useFixed(rval, ReturnReg));
+    else
+        MOZ_CRASH("Unexpected wasm return type");
+
+    // Preserve the TLS pointer we were passed in `WasmTlsReg`.
+    MDefinition* tlsPtr = ins->getOperand(1);
+    lir->setOperand(1, useFixed(tlsPtr, WasmTlsReg));
+
+    add(lir);
+}
+
+void
+LIRGenerator::visitWasmReturnVoid(MWasmReturnVoid* ins)
+{
+    auto* lir = new(alloc()) LWasmReturnVoid;
+
+    // Preserve the TLS pointer we were passed in `WasmTlsReg`.
+    MDefinition* tlsPtr = ins->getOperand(0);
+    lir->setOperand(0, useFixed(tlsPtr, WasmTlsReg));
+
+    add(lir);
+}
+
+void
+LIRGenerator::visitWasmStackArg(MWasmStackArg* ins)
+{
+    if (ins->arg()->type() == MIRType::Int64) {
+        add(new(alloc()) LWasmStackArgI64(useInt64RegisterOrConstantAtStart(ins->arg())), ins);
+    } else if (IsFloatingPointType(ins->arg()->type()) || IsSimdType(ins->arg()->type())) {
+        MOZ_ASSERT(!ins->arg()->isEmittedAtUses());
+        add(new(alloc()) LWasmStackArg(useRegisterAtStart(ins->arg())), ins);
+    } else {
+        add(new(alloc()) LWasmStackArg(useRegisterOrConstantAtStart(ins->arg())), ins);
+    }
+}
+
+void
+LIRGenerator::visitWasmCall(MWasmCall* ins)
+{
+    gen->setPerformsCall();
+
+    LAllocation* args = gen->allocate<LAllocation>(ins->numOperands());
+    if (!args) {
+        gen->abort("Couldn't allocate for MWasmCall");
+        return;
+    }
+
+    for (unsigned i = 0; i < ins->numArgs(); i++)
+        args[i] = useFixedAtStart(ins->getOperand(i), ins->registerForArg(i));
+
+    if (ins->callee().isTable())
+        args[ins->numArgs()] = useFixedAtStart(ins->getOperand(ins->numArgs()), WasmTableCallIndexReg);
+
+    LInstruction* lir;
+    if (ins->type() == MIRType::Int64)
+        lir = new(alloc()) LWasmCallI64(args, ins->numOperands());
+    else
+        lir = new(alloc()) LWasmCall(args, ins->numOperands());
+
+    if (ins->type() == MIRType::None)
+        add(lir, ins);
+    else
+        defineReturn(lir, ins);
+}
+
+void
+LIRGenerator::visitSetDOMProperty(MSetDOMProperty* ins)
+{
+    MDefinition* val = ins->value();
+
+    Register cxReg, objReg, privReg, valueReg;
+    GetTempRegForIntArg(0, 0, &cxReg);
+    GetTempRegForIntArg(1, 0, &objReg);
+    GetTempRegForIntArg(2, 0, &privReg);
+    GetTempRegForIntArg(3, 0, &valueReg);
+
+    // Keep using GetTempRegForIntArg, since we want to make sure we
+    // don't clobber registers we're already using.
+    Register tempReg1, tempReg2;
+    GetTempRegForIntArg(4, 0, &tempReg1);
+    mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(5, 0, &tempReg2);
+    MOZ_ASSERT(ok, "How can we not have six temp registers?");
+
+    LSetDOMProperty* lir = new(alloc()) LSetDOMProperty(tempFixed(cxReg),
+                                                        useFixedAtStart(ins->object(), objReg),
+                                                        useBoxFixedAtStart(val, tempReg1, tempReg2),
+                                                        tempFixed(privReg),
+                                                        tempFixed(valueReg));
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGetDOMProperty(MGetDOMProperty* ins)
+{
+    Register cxReg, objReg, privReg, valueReg;
+    GetTempRegForIntArg(0, 0, &cxReg);
+    GetTempRegForIntArg(1, 0, &objReg);
+    GetTempRegForIntArg(2, 0, &privReg);
+    mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &valueReg);
+    MOZ_ASSERT(ok, "How can we not have four temp registers?");
+    LGetDOMProperty* lir = new(alloc()) LGetDOMProperty(tempFixed(cxReg),
+                                                        useFixedAtStart(ins->object(), objReg),
+                                                        tempFixed(privReg),
+                                                        tempFixed(valueReg));
+
+    defineReturn(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGetDOMMember(MGetDOMMember* ins)
+{
+    MOZ_ASSERT(ins->isDomMovable(), "Members had better be movable");
+    // We wish we could assert that ins->domAliasSet() == JSJitInfo::AliasNone,
+    // but some MGetDOMMembers are for [Pure], not [Constant] properties, whose
+    // value can in fact change as a result of DOM setters and method calls.
+    MOZ_ASSERT(ins->domAliasSet() != JSJitInfo::AliasEverything,
+               "Member gets had better not alias the world");
+
+    MDefinition* obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    MIRType type = ins->type();
+
+    if (type == MIRType::Value) {
+        LGetDOMMemberV* lir = new(alloc()) LGetDOMMemberV(useRegisterAtStart(obj));
+        defineBox(lir, ins);
+    } else {
+        LGetDOMMemberT* lir = new(alloc()) LGetDOMMemberT(useRegisterForTypedLoad(obj, type));
+        define(lir, ins);
+    }
+}
+
+void
+LIRGenerator::visitRecompileCheck(MRecompileCheck* ins)
+{
+    LRecompileCheck* lir = new(alloc()) LRecompileCheck(temp());
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitSimdBox(MSimdBox* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->input()->type()));
+    LUse in = useRegister(ins->input());
+    LSimdBox* lir = new(alloc()) LSimdBox(in, temp());
+    define(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitSimdUnbox(MSimdUnbox* ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType::Object);
+    MOZ_ASSERT(IsSimdType(ins->type()));
+    LUse in = useRegister(ins->input());
+    LSimdUnbox* lir = new(alloc()) LSimdUnbox(in, temp());
+    assignSnapshot(lir, Bailout_UnexpectedSimdInput);
+    define(lir, ins);
+}
+
+void
+LIRGenerator::visitSimdConstant(MSimdConstant* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->type()));
+
+    switch (ins->type()) {
+      case MIRType::Int8x16:
+      case MIRType::Int16x8:
+      case MIRType::Int32x4:
+      case MIRType::Bool8x16:
+      case MIRType::Bool16x8:
+      case MIRType::Bool32x4:
+        define(new(alloc()) LSimd128Int(), ins);
+        break;
+      case MIRType::Float32x4:
+        define(new(alloc()) LSimd128Float(), ins);
+        break;
+      default:
+        MOZ_CRASH("Unknown SIMD kind when generating constant");
+    }
+}
+
+void
+LIRGenerator::visitSimdConvert(MSimdConvert* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->type()));
+    MDefinition* input = ins->input();
+    LUse use = useRegister(input);
+    if (ins->type() == MIRType::Int32x4) {
+        MOZ_ASSERT(input->type() == MIRType::Float32x4);
+        switch (ins->signedness()) {
+          case SimdSign::Signed: {
+              LFloat32x4ToInt32x4* lir = new(alloc()) LFloat32x4ToInt32x4(use, temp());
+              if (!gen->compilingWasm())
+                  assignSnapshot(lir, Bailout_BoundsCheck);
+              define(lir, ins);
+              break;
+          }
+          case SimdSign::Unsigned: {
+              LFloat32x4ToUint32x4* lir =
+                new (alloc()) LFloat32x4ToUint32x4(use, temp(), temp(LDefinition::SIMD128INT));
+              if (!gen->compilingWasm())
+                  assignSnapshot(lir, Bailout_BoundsCheck);
+              define(lir, ins);
+              break;
+          }
+          default:
+            MOZ_CRASH("Unexpected SimdConvert sign");
+        }
+    } else if (ins->type() == MIRType::Float32x4) {
+        MOZ_ASSERT(input->type() == MIRType::Int32x4);
+        MOZ_ASSERT(ins->signedness() == SimdSign::Signed, "Unexpected SimdConvert sign");
+        define(new(alloc()) LInt32x4ToFloat32x4(use), ins);
+    } else {
+        MOZ_CRASH("Unknown SIMD kind when generating constant");
+    }
+}
+
+void
+LIRGenerator::visitSimdReinterpretCast(MSimdReinterpretCast* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->type()) && IsSimdType(ins->input()->type()));
+    MDefinition* input = ins->input();
+    LUse use = useRegisterAtStart(input);
+    // :TODO: (Bug 1132894) We have to allocate a different register as redefine
+    // and/or defineReuseInput are not yet capable of reusing the same register
+    // with a different register type.
+    define(new(alloc()) LSimdReinterpretCast(use), ins);
+}
+
+void
+LIRGenerator::visitSimdAllTrue(MSimdAllTrue* ins)
+{
+    MDefinition* input = ins->input();
+    MOZ_ASSERT(IsBooleanSimdType(input->type()));
+
+    LUse use = useRegisterAtStart(input);
+    define(new(alloc()) LSimdAllTrue(use), ins);
+}
+
+void
+LIRGenerator::visitSimdAnyTrue(MSimdAnyTrue* ins)
+{
+    MDefinition* input = ins->input();
+    MOZ_ASSERT(IsBooleanSimdType(input->type()));
+
+    LUse use = useRegisterAtStart(input);
+    define(new(alloc()) LSimdAnyTrue(use), ins);
+}
+
+void
+LIRGenerator::visitSimdUnaryArith(MSimdUnaryArith* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->input()->type()));
+    MOZ_ASSERT(IsSimdType(ins->type()));
+
+    // Cannot be at start, as the ouput is used as a temporary to store values.
+    LUse in = use(ins->input());
+
+    switch (ins->type()) {
+      case MIRType::Int8x16:
+      case MIRType::Bool8x16:
+        define(new (alloc()) LSimdUnaryArithIx16(in), ins);
+        break;
+      case MIRType::Int16x8:
+      case MIRType::Bool16x8:
+        define(new (alloc()) LSimdUnaryArithIx8(in), ins);
+        break;
+      case MIRType::Int32x4:
+      case MIRType::Bool32x4:
+        define(new (alloc()) LSimdUnaryArithIx4(in), ins);
+        break;
+      case MIRType::Float32x4:
+        define(new (alloc()) LSimdUnaryArithFx4(in), ins);
+        break;
+      default:
+        MOZ_CRASH("Unknown SIMD kind for unary operation");
+    }
+}
+
+void
+LIRGenerator::visitSimdBinaryComp(MSimdBinaryComp* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->lhs()->type()));
+    MOZ_ASSERT(IsSimdType(ins->rhs()->type()));
+    MOZ_ASSERT(IsBooleanSimdType(ins->type()));
+
+    if (ShouldReorderCommutative(ins->lhs(), ins->rhs(), ins))
+        ins->reverse();
+
+    switch (ins->specialization()) {
+      case MIRType::Int8x16: {
+          MOZ_ASSERT(ins->signedness() == SimdSign::Signed);
+          LSimdBinaryCompIx16* add = new (alloc()) LSimdBinaryCompIx16();
+          lowerForFPU(add, ins, ins->lhs(), ins->rhs());
+          return;
+      }
+      case MIRType::Int16x8: {
+          MOZ_ASSERT(ins->signedness() == SimdSign::Signed);
+          LSimdBinaryCompIx8* add = new (alloc()) LSimdBinaryCompIx8();
+          lowerForFPU(add, ins, ins->lhs(), ins->rhs());
+          return;
+      }
+      case MIRType::Int32x4: {
+          MOZ_ASSERT(ins->signedness() == SimdSign::Signed);
+          LSimdBinaryCompIx4* add = new (alloc()) LSimdBinaryCompIx4();
+          lowerForCompIx4(add, ins, ins->lhs(), ins->rhs());
+          return;
+      }
+      case MIRType::Float32x4: {
+          MOZ_ASSERT(ins->signedness() == SimdSign::NotApplicable);
+          LSimdBinaryCompFx4* add = new (alloc()) LSimdBinaryCompFx4();
+          lowerForCompFx4(add, ins, ins->lhs(), ins->rhs());
+          return;
+      }
+      default:
+        MOZ_CRASH("Unknown compare type when comparing values");
+    }
+}
+
+void
+LIRGenerator::visitSimdBinaryBitwise(MSimdBinaryBitwise* ins)
+{
+    MOZ_ASSERT(IsSimdType(ins->lhs()->type()));
+    MOZ_ASSERT(IsSimdType(ins->rhs()->type()));
+    MOZ_ASSERT(IsSimdType(ins->type()));
+
+    MDefinition* lhs = ins->lhs();
+    MDefinition* rhs = ins->rhs();
+    ReorderCommutative(&lhs, &rhs, ins);
+    LSimdBinaryBitwise* lir = new(alloc()) LSimdBinaryBitwise;
+    lowerForFPU(lir, ins, lhs, rhs);
+}
+
+void
+LIRGenerator::visitSimdShift(MSimdShift* ins)
+{
+    MOZ_ASSERT(IsIntegerSimdType(ins->type()));
+    MOZ_ASSERT(ins->lhs()->type() == ins->type());
+    MOZ_ASSERT(ins->rhs()->type() == MIRType::Int32);
+
+    LUse vector = useRegisterAtStart(ins->lhs());
+    LAllocation value = useRegisterOrConstant(ins->rhs());
+    // We need a temp register to mask the shift amount, but not if the shift
+    // amount is a constant.
+    LDefinition tempReg = value.isConstant() ? LDefinition::BogusTemp() : temp();
+    LSimdShift* lir = new(alloc()) LSimdShift(vector, value, tempReg);
+    defineReuseInput(lir, ins, 0);
+}
+
+void
+LIRGenerator::visitLexicalCheck(MLexicalCheck* ins)
+{
+    MDefinition* input = ins->input();
+    MOZ_ASSERT(input->type() == MIRType::Value);
+    LLexicalCheck* lir = new(alloc()) LLexicalCheck(useBox(input));
+    assignSnapshot(lir, ins->bailoutKind());
+    add(lir, ins);
+    redefine(ins, input);
+}
+
+void
+LIRGenerator::visitThrowRuntimeLexicalError(MThrowRuntimeLexicalError* ins)
+{
+    LThrowRuntimeLexicalError* lir = new(alloc()) LThrowRuntimeLexicalError();
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitGlobalNameConflictsCheck(MGlobalNameConflictsCheck* ins)
+{
+    LGlobalNameConflictsCheck* lir = new(alloc()) LGlobalNameConflictsCheck();
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDebugger(MDebugger* ins)
+{
+    LDebugger* lir = new(alloc()) LDebugger(tempFixed(CallTempReg0), tempFixed(CallTempReg1));
+    assignSnapshot(lir, Bailout_Debugger);
+    add(lir, ins);
+}
+
+void
+LIRGenerator::visitAtomicIsLockFree(MAtomicIsLockFree* ins)
+{
+    define(new(alloc()) LAtomicIsLockFree(useRegister(ins->input())), ins);
+}
+
+void
+LIRGenerator::visitCheckReturn(MCheckReturn* ins)
+{
+    MDefinition* retVal = ins->returnValue();
+    MDefinition* thisVal = ins->thisValue();
+    MOZ_ASSERT(retVal->type() == MIRType::Value);
+    MOZ_ASSERT(thisVal->type() == MIRType::Value);
+
+    LCheckReturn* lir = new(alloc()) LCheckReturn(useBoxAtStart(retVal), useBoxAtStart(thisVal));
+    assignSnapshot(lir, Bailout_BadDerivedConstructorReturn);
+    add(lir, ins);
+    redefine(ins, retVal);
+}
+
+void
+LIRGenerator::visitCheckIsObj(MCheckIsObj* ins)
+{
+    MDefinition* checkVal = ins->checkValue();
+    MOZ_ASSERT(checkVal->type() == MIRType::Value);
+
+    LCheckIsObj* lir = new(alloc()) LCheckIsObj(useBoxAtStart(checkVal));
+    redefine(ins, checkVal);
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitCheckObjCoercible(MCheckObjCoercible* ins)
+{
+    MDefinition* checkVal = ins->checkValue();
+    MOZ_ASSERT(checkVal->type() == MIRType::Value);
+
+    LCheckObjCoercible* lir = new(alloc()) LCheckObjCoercible(useBoxAtStart(checkVal));
+    redefine(ins, checkVal);
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+void
+LIRGenerator::visitDebugCheckSelfHosted(MDebugCheckSelfHosted* ins)
+{
+    MDefinition* checkVal = ins->checkValue();
+    MOZ_ASSERT(checkVal->type() == MIRType::Value);
+
+    LDebugCheckSelfHosted* lir = new (alloc()) LDebugCheckSelfHosted(useBoxAtStart(checkVal));
+    redefine(ins, checkVal);
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+static void
+SpewResumePoint(MBasicBlock* block, MInstruction* ins, MResumePoint* resumePoint)
+{
+    Fprinter& out = JitSpewPrinter();
+    out.printf("Current resume point %p details:\n", (void*)resumePoint);
+    out.printf("    frame count: %u\n", resumePoint->frameCount());
+
+    if (ins) {
+        out.printf("    taken after: ");
+        ins->printName(out);
+    } else {
+        out.printf("    taken at block %d entry", block->id());
+    }
+    out.printf("\n");
+
+    out.printf("    pc: %p (script: %p, offset: %d)\n",
+            (void*)resumePoint->pc(),
+            (void*)resumePoint->block()->info().script(),
+            int(resumePoint->block()->info().script()->pcToOffset(resumePoint->pc())));
+
+    for (size_t i = 0, e = resumePoint->numOperands(); i < e; i++) {
+        MDefinition* in = resumePoint->getOperand(i);
+        out.printf("    slot%u: ", (unsigned)i);
+        in->printName(out);
+        out.printf("\n");
+    }
+}
+
+bool
+LIRGenerator::visitInstruction(MInstruction* ins)
+{
+    if (ins->isRecoveredOnBailout()) {
+        MOZ_ASSERT(!JitOptions.disableRecoverIns);
+        return true;
+    }
+
+    if (!gen->ensureBallast())
+        return false;
+    ins->accept(this);
+
+    if (ins->possiblyCalls())
+        gen->setPerformsCall();
+
+    if (ins->resumePoint())
+        updateResumeState(ins);
+
+#ifdef DEBUG
+    ins->setInWorklistUnchecked();
+#endif
+
+    // If no safepoint was created, there's no need for an OSI point.
+    if (LOsiPoint* osiPoint = popOsiPoint())
+        add(osiPoint);
+
+    return !gen->errored();
+}
+
+void
+LIRGenerator::definePhis()
+{
+    size_t lirIndex = 0;
+    MBasicBlock* block = current->mir();
+    for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd(); phi++) {
+        if (phi->type() == MIRType::Value) {
+            defineUntypedPhi(*phi, lirIndex);
+            lirIndex += BOX_PIECES;
+        } else if (phi->type() == MIRType::Int64) {
+            defineInt64Phi(*phi, lirIndex);
+            lirIndex += INT64_PIECES;
+        } else {
+            defineTypedPhi(*phi, lirIndex);
+            lirIndex += 1;
+        }
+    }
+}
+
+void
+LIRGenerator::updateResumeState(MInstruction* ins)
+{
+    lastResumePoint_ = ins->resumePoint();
+    if (JitSpewEnabled(JitSpew_IonSnapshots) && lastResumePoint_)
+        SpewResumePoint(nullptr, ins, lastResumePoint_);
+}
+
+void
+LIRGenerator::updateResumeState(MBasicBlock* block)
+{
+    // As Value Numbering phase can remove edges from the entry basic block to a
+    // code paths reachable from the OSR entry point, we have to add fixup
+    // blocks to keep the dominator tree organized the same way. These fixup
+    // blocks are flaged as unreachable, and should only exist iff the graph has
+    // an OSR block.
+    //
+    // Note: RangeAnalysis can flag blocks as unreachable, but they are only
+    // removed iff GVN (including UCE) is enabled.
+    MOZ_ASSERT_IF(!mir()->compilingWasm() && !block->unreachable(), block->entryResumePoint());
+    MOZ_ASSERT_IF(block->unreachable(), block->graph().osrBlock() ||
+                  !mir()->optimizationInfo().gvnEnabled());
+    lastResumePoint_ = block->entryResumePoint();
+    if (JitSpewEnabled(JitSpew_IonSnapshots) && lastResumePoint_)
+        SpewResumePoint(block, nullptr, lastResumePoint_);
+}
+
+bool
+LIRGenerator::visitBlock(MBasicBlock* block)
+{
+    current = block->lir();
+    updateResumeState(block);
+
+    definePhis();
+
+    // See fixup blocks added by Value Numbering, to keep the dominator relation
+    // modified by the presence of the OSR block.
+    MOZ_ASSERT_IF(block->unreachable(), *block->begin() == block->lastIns() ||
+                  !mir()->optimizationInfo().gvnEnabled());
+    MOZ_ASSERT_IF(block->unreachable(), block->graph().osrBlock() ||
+                  !mir()->optimizationInfo().gvnEnabled());
+    for (MInstructionIterator iter = block->begin(); *iter != block->lastIns(); iter++) {
+        if (!visitInstruction(*iter))
+            return false;
+    }
+
+    if (block->successorWithPhis()) {
+        // If we have a successor with phis, lower the phi input now that we
+        // are approaching the join point.
+        MBasicBlock* successor = block->successorWithPhis();
+        uint32_t position = block->positionInPhiSuccessor();
+        size_t lirIndex = 0;
+        for (MPhiIterator phi(successor->phisBegin()); phi != successor->phisEnd(); phi++) {
+            if (!gen->ensureBallast())
+                return false;
+
+            MDefinition* opd = phi->getOperand(position);
+            ensureDefined(opd);
+
+            MOZ_ASSERT(opd->type() == phi->type());
+
+            if (phi->type() == MIRType::Value) {
+                lowerUntypedPhiInput(*phi, position, successor->lir(), lirIndex);
+                lirIndex += BOX_PIECES;
+            } else if (phi->type() == MIRType::Int64) {
+                lowerInt64PhiInput(*phi, position, successor->lir(), lirIndex);
+                lirIndex += INT64_PIECES;
+            } else {
+                lowerTypedPhiInput(*phi, position, successor->lir(), lirIndex);
+                lirIndex += 1;
+            }
+        }
+    }
+
+    // Now emit the last instruction, which is some form of branch.
+    if (!visitInstruction(block->lastIns()))
+        return false;
+
+    return true;
+}
+
+void
+LIRGenerator::visitNaNToZero(MNaNToZero *ins)
+{
+    MDefinition* input = ins->input();
+
+    if (ins->operandIsNeverNaN() && ins->operandIsNeverNegativeZero()) {
+        redefine(ins, input);
+        return;
+    }
+    LNaNToZero* lir = new(alloc()) LNaNToZero(useRegisterAtStart(input), tempDouble());
+    defineReuseInput(lir, ins, 0);
+}
+
+bool
+LIRGenerator::generate()
+{
+    // Create all blocks and prep all phis beforehand.
+    for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
+        if (gen->shouldCancel("Lowering (preparation loop)"))
+            return false;
+
+        if (!lirGraph_.initBlock(*block))
+            return false;
+    }
+
+    for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
+        if (gen->shouldCancel("Lowering (main loop)"))
+            return false;
+
+        if (!visitBlock(*block))
+            return false;
+    }
+
+    lirGraph_.setArgumentSlotCount(maxargslots_);
+    return true;
+}
+
+void
+LIRGenerator::visitPhi(MPhi* phi)
+{
+    // Phi nodes are not lowered because they are only meaningful for the register allocator.
+    MOZ_CRASH("Unexpected Phi node during Lowering.");
+}
+
+void
+LIRGenerator::visitBeta(MBeta* beta)
+{
+    // Beta nodes are supposed to be removed before because they are
+    // only used to carry the range information for Range analysis
+    MOZ_CRASH("Unexpected Beta node during Lowering.");
+}
+
+void
+LIRGenerator::visitObjectState(MObjectState* objState)
+{
+    // ObjectState nodes are always recovered on bailouts
+    MOZ_CRASH("Unexpected ObjectState node during Lowering.");
+}
+
+void
+LIRGenerator::visitArrayState(MArrayState* objState)
+{
+    // ArrayState nodes are always recovered on bailouts
+    MOZ_CRASH("Unexpected ArrayState node during Lowering.");
+}
+
+void
+LIRGenerator::visitUnknownValue(MUnknownValue* ins)
+{
+    MOZ_CRASH("Can not lower unknown value.");
+}