Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 11613 insertions, 0 deletions

diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
new file mode 100644
index 0000000000..2449e3588a
--- /dev/null
+++ b/js/src/jit/MIR.h
@@ -0,0 +1,11613 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * Everything needed to build actual MIR instructions: the actual opcodes and
+ * instructions, the instruction interface, and use chains.
+ */
+
+#ifndef jit_MIR_h
+#define jit_MIR_h
+
+#include "mozilla/Array.h"
+#include "mozilla/HashFunctions.h"
+#ifdef JS_JITSPEW
+#  include "mozilla/Attributes.h"  // MOZ_STACK_CLASS
+#endif
+#include "mozilla/MacroForEach.h"
+#ifdef JS_JITSPEW
+#  include "mozilla/Sprintf.h"
+#  include "mozilla/Vector.h"
+#endif
+
+#include <algorithm>
+#include <initializer_list>
+
+#include "NamespaceImports.h"
+
+#include "jit/AtomicOp.h"
+#include "jit/FixedList.h"
+#include "jit/InlineList.h"
+#include "jit/JitAllocPolicy.h"
+#include "jit/MacroAssembler.h"
+#include "jit/MIROpsGenerated.h"
+#include "jit/ShuffleAnalysis.h"
+#include "jit/TypeData.h"
+#include "jit/TypePolicy.h"
+#include "js/experimental/JitInfo.h"  // JSJit{Getter,Setter}Op, JSJitInfo
+#include "js/HeapAPI.h"
+#include "js/ScalarType.h"  // js::Scalar::Type
+#include "js/Value.h"
+#include "js/Vector.h"
+#include "vm/BigIntType.h"
+#include "vm/EnvironmentObject.h"
+#include "vm/FunctionFlags.h"  // js::FunctionFlags
+#include "vm/JSContext.h"
+#include "vm/RegExpObject.h"
+#include "vm/TypedArrayObject.h"
+#include "wasm/WasmJS.h"  // for WasmInstanceObject
+
+namespace JS {
+struct ExpandoAndGeneration;
+}
+
+namespace js {
+
+namespace wasm {
+class FuncExport;
+extern uint32_t MIRTypeToABIResultSize(jit::MIRType);
+}  // namespace wasm
+
+class JS_PUBLIC_API GenericPrinter;
+class NativeIteratorListHead;
+class StringObject;
+
+enum class UnaryMathFunction : uint8_t;
+
+bool CurrentThreadIsIonCompiling();
+
+namespace jit {
+
+class CallInfo;
+
+#ifdef JS_JITSPEW
+// Helper for debug printing.  Avoids creating a MIR.h <--> MIRGraph.h cycle.
+// Implementation of this needs to see inside `MBasicBlock`; that is possible
+// in MIR.cpp since it also includes MIRGraph.h, whereas this file does not.
+class MBasicBlock;
+uint32_t GetMBasicBlockId(const MBasicBlock* block);
+
+// Helper class for debug printing.  This class allows `::getExtras` methods
+// to add strings to be printed, on a per-MIR-node basis.  The strings are
+// copied into storage owned by this class when `::add` is called, so the
+// `::getExtras` methods do not need to be concerned about storage management.
+class MOZ_STACK_CLASS ExtrasCollector {
+  mozilla::Vector<UniqueChars, 4> strings_;
+
+ public:
+  // Add `str` to the collection.  A copy, owned by this object, is made.  In
+  // case of OOM the call has no effect.
+  void add(const char* str) {
+    UniqueChars dup = DuplicateString(str);
+    if (dup) {
+      (void)strings_.append(std::move(dup));
+    }
+  }
+  size_t count() const { return strings_.length(); }
+  UniqueChars get(size_t ix) { return std::move(strings_[ix]); }
+};
+#endif
+
+// Forward declarations of MIR types.
+#define FORWARD_DECLARE(op) class M##op;
+MIR_OPCODE_LIST(FORWARD_DECLARE)
+#undef FORWARD_DECLARE
+
+// MDefinition visitor which ignores non-overloaded visit functions.
+class MDefinitionVisitorDefaultNoop {
+ public:
+#define VISIT_INS(op) \
+  void visit##op(M##op*) {}
+  MIR_OPCODE_LIST(VISIT_INS)
+#undef VISIT_INS
+};
+
+class BytecodeSite;
+class CompactBufferWriter;
+class Range;
+
+#define MIR_FLAG_LIST(_)                                                       \
+  _(InWorklist)                                                                \
+  _(EmittedAtUses)                                                             \
+  _(Commutative)                                                               \
+  _(Movable) /* Allow passes like LICM to move this instruction */             \
+  _(Lowered) /* (Debug only) has a virtual register */                         \
+  _(Guard)   /* Not removable if uses == 0 */                                  \
+                                                                               \
+  /* Flag an instruction to be considered as a Guard if the instructions       \
+   * bails out on some inputs.                                                 \
+   *                                                                           \
+   * Some optimizations can replace an instruction, and leave its operands     \
+   * unused. When the type information of the operand got used as a            \
+   * predicate of the transformation, then we have to flag the operands as     \
+   * GuardRangeBailouts.                                                       \
+   *                                                                           \
+   * This flag prevents further optimization of instructions, which            \
+   * might remove the run-time checks (bailout conditions) used as a           \
+   * predicate of the previous transformation.                                 \
+   */                                                                          \
+  _(GuardRangeBailouts)                                                        \
+                                                                               \
+  /* Some instructions have uses that aren't directly represented in the       \
+   * graph, and need to be handled specially. As an example, this is used to   \
+   * keep the flagged instruction in resume points, not substituting with an   \
+   * UndefinedValue. This can be used by call inlining when a function         \
+   * argument is not used by the inlined instructions. It is also used         \
+   * to annotate instructions which were used in removed branches.             \
+   */                                                                          \
+  _(ImplicitlyUsed)                                                            \
+                                                                               \
+  /* The instruction has been marked dead for lazy removal from resume         \
+   * points.                                                                   \
+   */                                                                          \
+  _(Unused)                                                                    \
+                                                                               \
+  /* Marks if the current instruction should go to the bailout paths instead   \
+   * of producing code as part of the control flow.  This flag can only be set \
+   * on instructions which are only used by ResumePoint or by other flagged    \
+   * instructions.                                                             \
+   */                                                                          \
+  _(RecoveredOnBailout)                                                        \
+                                                                               \
+  /* Some instructions might represent an object, but the memory of these      \
+   * objects might be incomplete if we have not recovered all the stores which \
+   * were supposed to happen before. This flag is used to annotate             \
+   * instructions which might return a pointer to a memory area which is not   \
+   * yet fully initialized. This flag is used to ensure that stores are        \
+   * executed before returning the value.                                      \
+   */                                                                          \
+  _(IncompleteObject)                                                          \
+                                                                               \
+  /* For WebAssembly, there are functions with multiple results.  Instead of   \
+   * having the results defined by one call instruction, they are instead      \
+   * captured in subsequent result capture instructions, because modelling     \
+   * multi-value results in Ion is too complicated.  However since they        \
+   * capture ambient live registers, it would be an error to move an unrelated \
+   * instruction between the call and the result capture.  This flag is used   \
+   * to prevent code motion from moving instructions in invalid ways.          \
+   */                                                                          \
+  _(CallResultCapture)                                                         \
+                                                                               \
+  /* The current instruction got discarded from the MIR Graph. This is useful  \
+   * when we want to iterate over resume points and instructions, while        \
+   * handling instructions which are discarded without reporting to the        \
+   * iterator.                                                                 \
+   */                                                                          \
+  _(Discarded)
+
+class MDefinition;
+class MInstruction;
+class MBasicBlock;
+class MNode;
+class MUse;
+class MPhi;
+class MIRGraph;
+class MResumePoint;
+class MControlInstruction;
+
+// Represents a use of a node.
+class MUse : public TempObject, public InlineListNode<MUse> {
+  // Grant access to setProducerUnchecked.
+  friend class MDefinition;
+  friend class MPhi;
+
+  MDefinition* producer_;  // MDefinition that is being used.
+  MNode* consumer_;        // The node that is using this operand.
+
+  // Low-level unchecked edit method for replaceAllUsesWith and
+  // MPhi::removeOperand. This doesn't update use lists!
+  // replaceAllUsesWith and MPhi::removeOperand do that manually.
+  void setProducerUnchecked(MDefinition* producer) {
+    MOZ_ASSERT(consumer_);
+    MOZ_ASSERT(producer_);
+    MOZ_ASSERT(producer);
+    producer_ = producer;
+  }
+
+ public:
+  // Default constructor for use in vectors.
+  MUse() : producer_(nullptr), consumer_(nullptr) {}
+
+  // Move constructor for use in vectors. When an MUse is moved, it stays
+  // in its containing use list.
+  MUse(MUse&& other)
+      : InlineListNode<MUse>(std::move(other)),
+        producer_(other.producer_),
+        consumer_(other.consumer_) {}
+
+  // Construct an MUse initialized with |producer| and |consumer|.
+  MUse(MDefinition* producer, MNode* consumer) {
+    initUnchecked(producer, consumer);
+  }
+
+  // Set this use, which was previously clear.
+  inline void init(MDefinition* producer, MNode* consumer);
+  // Like init, but works even when the use contains uninitialized data.
+  inline void initUnchecked(MDefinition* producer, MNode* consumer);
+  // Like initUnchecked, but set the producer to nullptr.
+  inline void initUncheckedWithoutProducer(MNode* consumer);
+  // Set this use, which was not previously clear.
+  inline void replaceProducer(MDefinition* producer);
+  // Clear this use.
+  inline void releaseProducer();
+
+  MDefinition* producer() const {
+    MOZ_ASSERT(producer_ != nullptr);
+    return producer_;
+  }
+  bool hasProducer() const { return producer_ != nullptr; }
+  MNode* consumer() const {
+    MOZ_ASSERT(consumer_ != nullptr);
+    return consumer_;
+  }
+
+#ifdef DEBUG
+  // Return the operand index of this MUse in its consumer. This is DEBUG-only
+  // as normal code should instead call indexOf on the cast consumer directly,
+  // to allow it to be devirtualized and inlined.
+  size_t index() const;
+#endif
+};
+
+using MUseIterator = InlineList<MUse>::iterator;
+
+// A node is an entry in the MIR graph. It has two kinds:
+//   MInstruction: an instruction which appears in the IR stream.
+//   MResumePoint: a list of instructions that correspond to the state of the
+//                 interpreter/Baseline stack.
+//
+// Nodes can hold references to MDefinitions. Each MDefinition has a list of
+// nodes holding such a reference (its use chain).
+class MNode : public TempObject {
+ protected:
+  enum class Kind { Definition = 0, ResumePoint };
+
+ private:
+  static const uintptr_t KindMask = 0x1;
+  uintptr_t blockAndKind_;
+
+  Kind kind() const { return Kind(blockAndKind_ & KindMask); }
+
+ protected:
+  explicit MNode(const MNode& other) : blockAndKind_(other.blockAndKind_) {}
+
+  MNode(MBasicBlock* block, Kind kind) { setBlockAndKind(block, kind); }
+
+  void setBlockAndKind(MBasicBlock* block, Kind kind) {
+    blockAndKind_ = uintptr_t(block) | uintptr_t(kind);
+    MOZ_ASSERT(this->block() == block);
+  }
+
+  MBasicBlock* definitionBlock() const {
+    MOZ_ASSERT(isDefinition());
+    static_assert(unsigned(Kind::Definition) == 0,
+                  "Code below relies on low bit being 0");
+    return reinterpret_cast<MBasicBlock*>(blockAndKind_);
+  }
+  MBasicBlock* resumePointBlock() const {
+    MOZ_ASSERT(isResumePoint());
+    static_assert(unsigned(Kind::ResumePoint) == 1,
+                  "Code below relies on low bit being 1");
+    // Use a subtraction: if the caller does block()->foo, the compiler
+    // will be able to fold it with the load.
+    return reinterpret_cast<MBasicBlock*>(blockAndKind_ - 1);
+  }
+
+ public:
+  // Returns the definition at a given operand.
+  virtual MDefinition* getOperand(size_t index) const = 0;
+  virtual size_t numOperands() const = 0;
+  virtual size_t indexOf(const MUse* u) const = 0;
+
+  bool isDefinition() const { return kind() == Kind::Definition; }
+  bool isResumePoint() const { return kind() == Kind::ResumePoint; }
+  MBasicBlock* block() const {
+    return reinterpret_cast<MBasicBlock*>(blockAndKind_ & ~KindMask);
+  }
+  MBasicBlock* caller() const;
+
+  // Sets an already set operand, updating use information. If you're looking
+  // for setOperand, this is probably what you want.
+  virtual void replaceOperand(size_t index, MDefinition* operand) = 0;
+
+  // Resets the operand to an uninitialized state, breaking the link
+  // with the previous operand's producer.
+  void releaseOperand(size_t index) { getUseFor(index)->releaseProducer(); }
+  bool hasOperand(size_t index) const {
+    return getUseFor(index)->hasProducer();
+  }
+
+  inline MDefinition* toDefinition();
+  inline MResumePoint* toResumePoint();
+
+  [[nodiscard]] virtual bool writeRecoverData(
+      CompactBufferWriter& writer) const;
+
+#ifdef JS_JITSPEW
+  virtual void dump(GenericPrinter& out) const = 0;
+  virtual void dump() const = 0;
+#endif
+
+ protected:
+  // Need visibility on getUseFor to avoid O(n^2) complexity.
+  friend void AssertBasicGraphCoherency(MIRGraph& graph, bool force);
+
+  // Gets the MUse corresponding to given operand.
+  virtual MUse* getUseFor(size_t index) = 0;
+  virtual const MUse* getUseFor(size_t index) const = 0;
+};
+
+class AliasSet {
+ private:
+  uint32_t flags_;
+
+ public:
+  enum Flag {
+    None_ = 0,
+    ObjectFields = 1 << 0,      // shape, class, slots, length etc.
+    Element = 1 << 1,           // A Value member of obj->elements or
+                                // a typed object.
+    UnboxedElement = 1 << 2,    // An unboxed scalar or reference member of
+                                // typed object.
+    DynamicSlot = 1 << 3,       // A Value member of obj->slots.
+    FixedSlot = 1 << 4,         // A Value member of obj->fixedSlots().
+    DOMProperty = 1 << 5,       // A DOM property
+    WasmInstanceData = 1 << 6,  // An asm.js/wasm private global var
+    WasmHeap = 1 << 7,          // An asm.js/wasm heap load
+    WasmHeapMeta = 1 << 8,      // The asm.js/wasm heap base pointer and
+                                // bounds check limit, in Instance.
+    ArrayBufferViewLengthOrOffset =
+        1 << 9,                  // An array buffer view's length or byteOffset
+    WasmGlobalCell = 1 << 10,    // A wasm global cell
+    WasmTableElement = 1 << 11,  // An element of a wasm table
+    WasmTableMeta = 1 << 12,     // A wasm table elements pointer and
+                                 // length field, in instance data.
+    WasmStackResult = 1 << 13,   // A stack result from the current function
+
+    // JSContext's exception state. This is used on instructions like MThrow
+    // or MNewArrayDynamicLength that throw exceptions (other than OOM) but have
+    // no other side effect, to ensure that they get their own up-to-date resume
+    // point. (This resume point will be used when constructing the Baseline
+    // frame during exception bailouts.)
+    ExceptionState = 1 << 14,
+
+    // Used for instructions that load the privateSlot of DOM proxies and
+    // the ExpandoAndGeneration.
+    DOMProxyExpando = 1 << 15,
+
+    // Hash table of a Map or Set object.
+    MapOrSetHashTable = 1 << 16,
+
+    // Internal state of the random number generator
+    RNG = 1 << 17,
+
+    // The pendingException slot on the wasm instance object.
+    WasmPendingException = 1 << 18,
+
+    // The fuzzilliHash slot
+    FuzzilliHash = 1 << 19,
+
+    // The WasmStructObject::inlineData_[..] storage area
+    WasmStructInlineDataArea = 1 << 20,
+
+    // The WasmStructObject::outlineData_ pointer only
+    WasmStructOutlineDataPointer = 1 << 21,
+
+    // The malloc'd block that WasmStructObject::outlineData_ points at
+    WasmStructOutlineDataArea = 1 << 22,
+
+    // The WasmArrayObject::numElements_ field
+    WasmArrayNumElements = 1 << 23,
+
+    // The WasmArrayObject::data_ pointer only
+    WasmArrayDataPointer = 1 << 24,
+
+    // The malloc'd block that WasmArrayObject::data_ points at
+    WasmArrayDataArea = 1 << 25,
+
+    // The generation counter associated with the global object
+    GlobalGenerationCounter = 1 << 26,
+
+    Last = GlobalGenerationCounter,
+
+    Any = Last | (Last - 1),
+    NumCategories = 27,
+
+    // Indicates load or store.
+    Store_ = 1 << 31
+  };
+
+  static_assert((1 << NumCategories) - 1 == Any,
+                "NumCategories must include all flags present in Any");
+
+  explicit AliasSet(uint32_t flags) : flags_(flags) {}
+
+ public:
+  inline bool isNone() const { return flags_ == None_; }
+  uint32_t flags() const { return flags_ & Any; }
+  inline bool isStore() const { return !!(flags_ & Store_); }
+  inline bool isLoad() const { return !isStore() && !isNone(); }
+  inline AliasSet operator|(const AliasSet& other) const {
+    return AliasSet(flags_ | other.flags_);
+  }
+  inline AliasSet operator&(const AliasSet& other) const {
+    return AliasSet(flags_ & other.flags_);
+  }
+  static AliasSet None() { return AliasSet(None_); }
+  static AliasSet Load(uint32_t flags) {
+    MOZ_ASSERT(flags && !(flags & Store_));
+    return AliasSet(flags);
+  }
+  static AliasSet Store(uint32_t flags) {
+    MOZ_ASSERT(flags && !(flags & Store_));
+    return AliasSet(flags | Store_);
+  }
+};
+
+typedef Vector<MDefinition*, 6, JitAllocPolicy> MDefinitionVector;
+typedef Vector<MInstruction*, 6, JitAllocPolicy> MInstructionVector;
+
+// When a floating-point value is used by nodes which would prefer to
+// receive integer inputs, we may be able to help by computing our result
+// into an integer directly.
+//
+// A value can be truncated in 4 differents ways:
+//   1. Ignore Infinities (x / 0 --> 0).
+//   2. Ignore overflow (INT_MIN / -1 == (INT_MAX + 1) --> INT_MIN)
+//   3. Ignore negative zeros. (-0 --> 0)
+//   4. Ignore remainder. (3 / 4 --> 0)
+//
+// Indirect truncation is used to represent that we are interested in the
+// truncated result, but only if it can safely flow into operations which
+// are computed modulo 2^32, such as (2) and (3). Infinities are not safe,
+// as they would have absorbed other math operations. Remainders are not
+// safe, as fractions can be scaled up by multiplication.
+//
+// Division is a particularly interesting node here because it covers all 4
+// cases even when its own operands are integers.
+//
+// Note that these enum values are ordered from least value-modifying to
+// most value-modifying, and code relies on this ordering.
+enum class TruncateKind {
+  // No correction.
+  NoTruncate = 0,
+  // An integer is desired, but we can't skip bailout checks.
+  TruncateAfterBailouts = 1,
+  // The value will be truncated after some arithmetic (see above).
+  IndirectTruncate = 2,
+  // Direct and infallible truncation to int32.
+  Truncate = 3
+};
+
+// An MDefinition is an SSA name.
+class MDefinition : public MNode {
+  friend class MBasicBlock;
+
+ public:
+  enum class Opcode : uint16_t {
+#define DEFINE_OPCODES(op) op,
+    MIR_OPCODE_LIST(DEFINE_OPCODES)
+#undef DEFINE_OPCODES
+  };
+
+ private:
+  InlineList<MUse> uses_;  // Use chain.
+  uint32_t id_;            // Instruction ID, which after block re-ordering
+                           // is sorted within a basic block.
+  Opcode op_;              // Opcode.
+  uint16_t flags_;         // Bit flags.
+  Range* range_;           // Any computed range for this def.
+  union {
+    MDefinition*
+        loadDependency_;  // Implicit dependency (store, call, etc.) of this
+                          // instruction. Used by alias analysis, GVN and LICM.
+    uint32_t virtualRegister_;  // Used by lowering to map definitions to
+                                // virtual registers.
+  };
+
+  // Track bailouts by storing the current pc in MIR instruction. Also used
+  // for profiling and keeping track of what the last known pc was.
+  const BytecodeSite* trackedSite_;
+
+  // If we generate a bailout path for this instruction, this is the
+  // bailout kind that will be encoded in the snapshot. When we bail out,
+  // FinishBailoutToBaseline may take action based on the bailout kind to
+  // prevent bailout loops. (For example, if an instruction bails out after
+  // being hoisted by LICM, we will disable LICM when recompiling the script.)
+  BailoutKind bailoutKind_;
+
+  MIRType resultType_;  // Representation of result type.
+
+ private:
+  enum Flag {
+    None = 0,
+#define DEFINE_FLAG(flag) flag,
+    MIR_FLAG_LIST(DEFINE_FLAG)
+#undef DEFINE_FLAG
+        Total
+  };
+
+  bool hasFlags(uint32_t flags) const { return (flags_ & flags) == flags; }
+  void removeFlags(uint32_t flags) { flags_ &= ~flags; }
+  void setFlags(uint32_t flags) { flags_ |= flags; }
+
+  // Calling isDefinition or isResumePoint on MDefinition is unnecessary.
+  bool isDefinition() const = delete;
+  bool isResumePoint() const = delete;
+
+ protected:
+  void setInstructionBlock(MBasicBlock* block, const BytecodeSite* site) {
+    MOZ_ASSERT(isInstruction());
+    setBlockAndKind(block, Kind::Definition);
+    setTrackedSite(site);
+  }
+
+  void setPhiBlock(MBasicBlock* block) {
+    MOZ_ASSERT(isPhi());
+    setBlockAndKind(block, Kind::Definition);
+  }
+
+  static HashNumber addU32ToHash(HashNumber hash, uint32_t data) {
+    return data + (hash << 6) + (hash << 16) - hash;
+  }
+
+  static HashNumber addU64ToHash(HashNumber hash, uint64_t data) {
+    hash = addU32ToHash(hash, uint32_t(data));
+    hash = addU32ToHash(hash, uint32_t(data >> 32));
+    return hash;
+  }
+
+ public:
+  explicit MDefinition(Opcode op)
+      : MNode(nullptr, Kind::Definition),
+        id_(0),
+        op_(op),
+        flags_(0),
+        range_(nullptr),
+        loadDependency_(nullptr),
+        trackedSite_(nullptr),
+        bailoutKind_(BailoutKind::Unknown),
+        resultType_(MIRType::None) {}
+
+  // Copying a definition leaves the list of uses empty.
+  explicit MDefinition(const MDefinition& other)
+      : MNode(other),
+        id_(0),
+        op_(other.op_),
+        flags_(other.flags_),
+        range_(other.range_),
+        loadDependency_(other.loadDependency_),
+        trackedSite_(other.trackedSite_),
+        bailoutKind_(other.bailoutKind_),
+        resultType_(other.resultType_) {}
+
+  Opcode op() const { return op_; }
+
+#ifdef JS_JITSPEW
+  const char* opName() const;
+  void printName(GenericPrinter& out) const;
+  static void PrintOpcodeName(GenericPrinter& out, Opcode op);
+  virtual void printOpcode(GenericPrinter& out) const;
+  void dump(GenericPrinter& out) const override;
+  void dump() const override;
+  void dumpLocation(GenericPrinter& out) const;
+  void dumpLocation() const;
+  // Dump any other stuff the node wants to have printed in `extras`.  The
+  // added strings are copied, with the `ExtrasCollector` taking ownership of
+  // the copies.
+  virtual void getExtras(ExtrasCollector* extras) {}
+#endif
+
+  // Also for LICM. Test whether this definition is likely to be a call, which
+  // would clobber all or many of the floating-point registers, such that
+  // hoisting floating-point constants out of containing loops isn't likely to
+  // be worthwhile.
+  virtual bool possiblyCalls() const { return false; }
+
+  MBasicBlock* block() const { return definitionBlock(); }
+
+ private:
+#ifdef DEBUG
+  bool trackedSiteMatchesBlock(const BytecodeSite* site) const;
+#endif
+
+  void setTrackedSite(const BytecodeSite* site) {
+    MOZ_ASSERT(site);
+    MOZ_ASSERT(trackedSiteMatchesBlock(site),
+               "tracked bytecode site should match block bytecode site");
+    trackedSite_ = site;
+  }
+
+ public:
+  const BytecodeSite* trackedSite() const {
+    MOZ_ASSERT(trackedSite_,
+               "missing tracked bytecode site; node not assigned to a block?");
+    MOZ_ASSERT(trackedSiteMatchesBlock(trackedSite_),
+               "tracked bytecode site should match block bytecode site");
+    return trackedSite_;
+  }
+
+  BailoutKind bailoutKind() const { return bailoutKind_; }
+  void setBailoutKind(BailoutKind kind) { bailoutKind_ = kind; }
+
+  // Return the range of this value, *before* any bailout checks. Contrast
+  // this with the type() method, and the Range constructor which takes an
+  // MDefinition*, which describe the value *after* any bailout checks.
+  //
+  // Warning: Range analysis is removing the bit-operations such as '| 0' at
+  // the end of the transformations. Using this function to analyse any
+  // operands after the truncate phase of the range analysis will lead to
+  // errors. Instead, one should define the collectRangeInfoPreTrunc() to set
+  // the right set of flags which are dependent on the range of the inputs.
+  Range* range() const {
+    MOZ_ASSERT(type() != MIRType::None);
+    return range_;
+  }
+  void setRange(Range* range) {
+    MOZ_ASSERT(type() != MIRType::None);
+    range_ = range;
+  }
+
+  virtual HashNumber valueHash() const;
+  virtual bool congruentTo(const MDefinition* ins) const { return false; }
+  const MDefinition* skipObjectGuards() const;
+  bool congruentIfOperandsEqual(const MDefinition* ins) const;
+  virtual MDefinition* foldsTo(TempAllocator& alloc);
+  virtual void analyzeEdgeCasesForward();
+  virtual void analyzeEdgeCasesBackward();
+
+  // |canTruncate| reports if this instruction supports truncation. If
+  // |canTruncate| function returns true, then the |truncate| function is
+  // called on the same instruction to mutate the instruction, such as updating
+  // the return type, the range and the specialization of the instruction.
+  virtual bool canTruncate() const;
+  virtual void truncate(TruncateKind kind);
+
+  // Determine what kind of truncate this node prefers for the operand at the
+  // given index.
+  virtual TruncateKind operandTruncateKind(size_t index) const;
+
+  // Compute an absolute or symbolic range for the value of this node.
+  virtual void computeRange(TempAllocator& alloc) {}
+
+  // Collect information from the pre-truncated ranges.
+  virtual void collectRangeInfoPreTrunc() {}
+
+  uint32_t id() const {
+    MOZ_ASSERT(block());
+    return id_;
+  }
+  void setId(uint32_t id) { id_ = id; }
+
+#define FLAG_ACCESSOR(flag)                            \
+  bool is##flag() const {                              \
+    static_assert(Flag::Total <= sizeof(flags_) * 8,   \
+                  "Flags should fit in flags_ field"); \
+    return hasFlags(1 << flag);                        \
+  }                                                    \
+  void set##flag() {                                   \
+    MOZ_ASSERT(!hasFlags(1 << flag));                  \
+    setFlags(1 << flag);                               \
+  }                                                    \
+  void setNot##flag() {                                \
+    MOZ_ASSERT(hasFlags(1 << flag));                   \
+    removeFlags(1 << flag);                            \
+  }                                                    \
+  void set##flag##Unchecked() { setFlags(1 << flag); } \
+  void setNot##flag##Unchecked() { removeFlags(1 << flag); }
+
+  MIR_FLAG_LIST(FLAG_ACCESSOR)
+#undef FLAG_ACCESSOR
+
+  // Return the type of this value. This may be speculative, and enforced
+  // dynamically with the use of bailout checks. If all the bailout checks
+  // pass, the value will have this type.
+  //
+  // Unless this is an MUrsh that has bailouts disabled, which, as a special
+  // case, may return a value in (INT32_MAX,UINT32_MAX] even when its type()
+  // is MIRType::Int32.
+  MIRType type() const { return resultType_; }
+
+  bool mightBeType(MIRType type) const {
+    MOZ_ASSERT(type != MIRType::Value);
+
+    if (type == this->type()) {
+      return true;
+    }
+
+    if (this->type() == MIRType::Value) {
+      return true;
+    }
+
+    return false;
+  }
+
+  bool mightBeMagicType() const;
+
+  // Return true if the result-set types are a subset of the given types.
+  bool definitelyType(std::initializer_list<MIRType> types) const;
+
+  // Float32 specialization operations (see big comment in IonAnalysis before
+  // the Float32 specialization algorithm).
+  virtual bool isFloat32Commutative() const { return false; }
+  virtual bool canProduceFloat32() const { return false; }
+  virtual bool canConsumeFloat32(MUse* use) const { return false; }
+  virtual void trySpecializeFloat32(TempAllocator& alloc) {}
+#ifdef DEBUG
+  // Used during the pass that checks that Float32 flow into valid MDefinitions
+  virtual bool isConsistentFloat32Use(MUse* use) const {
+    return type() == MIRType::Float32 || canConsumeFloat32(use);
+  }
+#endif
+
+  // Returns the beginning of this definition's use chain.
+  MUseIterator usesBegin() const { return uses_.begin(); }
+
+  // Returns the end of this definition's use chain.
+  MUseIterator usesEnd() const { return uses_.end(); }
+
+  bool canEmitAtUses() const { return !isEmittedAtUses(); }
+
+  // Removes a use at the given position
+  void removeUse(MUse* use) { uses_.remove(use); }
+
+#if defined(DEBUG) || defined(JS_JITSPEW)
+  // Number of uses of this instruction. This function is only available
+  // in DEBUG mode since it requires traversing the list. Most users should
+  // use hasUses() or hasOneUse() instead.
+  size_t useCount() const;
+
+  // Number of uses of this instruction (only counting MDefinitions, ignoring
+  // MResumePoints). This function is only available in DEBUG mode since it
+  // requires traversing the list. Most users should use hasUses() or
+  // hasOneUse() instead.
+  size_t defUseCount() const;
+#endif
+
+  // Test whether this MDefinition has exactly one use.
+  bool hasOneUse() const;
+
+  // Test whether this MDefinition has exactly one use.
+  // (only counting MDefinitions, ignoring MResumePoints)
+  bool hasOneDefUse() const;
+
+  // Test whether this MDefinition has at least one use.
+  // (only counting MDefinitions, ignoring MResumePoints)
+  bool hasDefUses() const;
+
+  // Test whether this MDefinition has at least one non-recovered use.
+  // (only counting MDefinitions, ignoring MResumePoints)
+  bool hasLiveDefUses() const;
+
+  bool hasUses() const { return !uses_.empty(); }
+
+  // If this MDefinition has a single use (ignoring MResumePoints), returns that
+  // use's definition. Else returns nullptr.
+  MDefinition* maybeSingleDefUse() const;
+
+  // Returns the most recently added use (ignoring MResumePoints) for this
+  // MDefinition. Returns nullptr if there are no uses. Note that this relies on
+  // addUse adding new uses to the front of the list, and should only be called
+  // during MIR building (before optimization passes make changes to the uses).
+  MDefinition* maybeMostRecentlyAddedDefUse() const;
+
+  void addUse(MUse* use) {
+    MOZ_ASSERT(use->producer() == this);
+    uses_.pushFront(use);
+  }
+  void addUseUnchecked(MUse* use) {
+    MOZ_ASSERT(use->producer() == this);
+    uses_.pushFrontUnchecked(use);
+  }
+  void replaceUse(MUse* old, MUse* now) {
+    MOZ_ASSERT(now->producer() == this);
+    uses_.replace(old, now);
+  }
+
+  // Replace the current instruction by a dominating instruction |dom| in all
+  // uses of the current instruction.
+  void replaceAllUsesWith(MDefinition* dom);
+
+  // Like replaceAllUsesWith, but doesn't set ImplicitlyUsed on |this|'s
+  // operands.
+  void justReplaceAllUsesWith(MDefinition* dom);
+
+  // Replace the current instruction by an optimized-out constant in all uses
+  // of the current instruction. Note, that optimized-out constant should not
+  // be observed, and thus they should not flow in any computation.
+  [[nodiscard]] bool optimizeOutAllUses(TempAllocator& alloc);
+
+  // Replace the current instruction by a dominating instruction |dom| in all
+  // instruction, but keep the current instruction for resume point and
+  // instruction which are recovered on bailouts.
+  void replaceAllLiveUsesWith(MDefinition* dom);
+
+  void setVirtualRegister(uint32_t vreg) {
+    virtualRegister_ = vreg;
+    setLoweredUnchecked();
+  }
+  uint32_t virtualRegister() const {
+    MOZ_ASSERT(isLowered());
+    return virtualRegister_;
+  }
+
+ public:
+  // Opcode testing and casts.
+  template <typename MIRType>
+  bool is() const {
+    return op() == MIRType::classOpcode;
+  }
+  template <typename MIRType>
+  MIRType* to() {
+    MOZ_ASSERT(this->is<MIRType>());
+    return static_cast<MIRType*>(this);
+  }
+  template <typename MIRType>
+  const MIRType* to() const {
+    MOZ_ASSERT(this->is<MIRType>());
+    return static_cast<const MIRType*>(this);
+  }
+#define OPCODE_CASTS(opcode)                                \
+  bool is##opcode() const { return this->is<M##opcode>(); } \
+  M##opcode* to##opcode() { return this->to<M##opcode>(); } \
+  const M##opcode* to##opcode() const { return this->to<M##opcode>(); }
+  MIR_OPCODE_LIST(OPCODE_CASTS)
+#undef OPCODE_CASTS
+
+  inline MConstant* maybeConstantValue();
+
+  inline MInstruction* toInstruction();
+  inline const MInstruction* toInstruction() const;
+  bool isInstruction() const { return !isPhi(); }
+
+  virtual bool isControlInstruction() const { return false; }
+  inline MControlInstruction* toControlInstruction();
+
+  void setResultType(MIRType type) { resultType_ = type; }
+  virtual AliasSet getAliasSet() const {
+    // Instructions are effectful by default.
+    return AliasSet::Store(AliasSet::Any);
+  }
+
+#ifdef DEBUG
+  bool hasDefaultAliasSet() const {
+    AliasSet set = getAliasSet();
+    return set.isStore() && set.flags() == AliasSet::Flag::Any;
+  }
+#endif
+
+  MDefinition* dependency() const {
+    if (getAliasSet().isStore()) {
+      return nullptr;
+    }
+    return loadDependency_;
+  }
+  void setDependency(MDefinition* dependency) {
+    MOZ_ASSERT(!getAliasSet().isStore());
+    loadDependency_ = dependency;
+  }
+  bool isEffectful() const { return getAliasSet().isStore(); }
+
+#ifdef DEBUG
+  bool needsResumePoint() const {
+    // Return whether this instruction should have its own resume point.
+    return isEffectful();
+  }
+#endif
+
+  enum class AliasType : uint32_t { NoAlias = 0, MayAlias = 1, MustAlias = 2 };
+  virtual AliasType mightAlias(const MDefinition* store) const {
+    // Return whether this load may depend on the specified store, given
+    // that the alias sets intersect. This may be refined to exclude
+    // possible aliasing in cases where alias set flags are too imprecise.
+    if (!(getAliasSet().flags() & store->getAliasSet().flags())) {
+      return AliasType::NoAlias;
+    }
+    MOZ_ASSERT(!isEffectful() && store->isEffectful());
+    return AliasType::MayAlias;
+  }
+
+  virtual bool canRecoverOnBailout() const { return false; }
+};
+
+// An MUseDefIterator walks over uses in a definition, skipping any use that is
+// not a definition. Items from the use list must not be deleted during
+// iteration.
+class MUseDefIterator {
+  const MDefinition* def_;
+  MUseIterator current_;
+
+  MUseIterator search(MUseIterator start) {
+    MUseIterator i(start);
+    for (; i != def_->usesEnd(); i++) {
+      if (i->consumer()->isDefinition()) {
+        return i;
+      }
+    }
+    return def_->usesEnd();
+  }
+
+ public:
+  explicit MUseDefIterator(const MDefinition* def)
+      : def_(def), current_(search(def->usesBegin())) {}
+
+  explicit operator bool() const { return current_ != def_->usesEnd(); }
+  MUseDefIterator operator++() {
+    MOZ_ASSERT(current_ != def_->usesEnd());
+    ++current_;
+    current_ = search(current_);
+    return *this;
+  }
+  MUseDefIterator operator++(int) {
+    MUseDefIterator old(*this);
+    operator++();
+    return old;
+  }
+  MUse* use() const { return *current_; }
+  MDefinition* def() const { return current_->consumer()->toDefinition(); }
+};
+
+// Helper class to check that GC pointers embedded in MIR instructions are not
+// in the nursery. Off-thread compilation and nursery GCs can happen in
+// parallel. Nursery pointers are handled with MNurseryObject and the
+// nurseryObjects lists in WarpSnapshot and IonScript.
+//
+// These GC things are rooted through the WarpSnapshot. Compacting GCs cancel
+// off-thread compilations.
+template <typename T>
+class CompilerGCPointer {
+  js::gc::Cell* ptr_;
+
+ public:
+  explicit CompilerGCPointer(T ptr) : ptr_(ptr) {
+    MOZ_ASSERT_IF(ptr, !IsInsideNursery(ptr));
+    MOZ_ASSERT_IF(!CurrentThreadIsIonCompiling(), TlsContext.get()->suppressGC);
+  }
+
+  operator T() const { return static_cast<T>(ptr_); }
+  T operator->() const { return static_cast<T>(ptr_); }
+
+ private:
+  CompilerGCPointer() = delete;
+  CompilerGCPointer(const CompilerGCPointer<T>&) = delete;
+  CompilerGCPointer<T>& operator=(const CompilerGCPointer<T>&) = delete;
+};
+
+using CompilerObject = CompilerGCPointer<JSObject*>;
+using CompilerNativeObject = CompilerGCPointer<NativeObject*>;
+using CompilerFunction = CompilerGCPointer<JSFunction*>;
+using CompilerBaseScript = CompilerGCPointer<BaseScript*>;
+using CompilerPropertyName = CompilerGCPointer<PropertyName*>;
+using CompilerShape = CompilerGCPointer<Shape*>;
+using CompilerGetterSetter = CompilerGCPointer<GetterSetter*>;
+
+// An instruction is an SSA name that is inserted into a basic block's IR
+// stream.
+class MInstruction : public MDefinition, public InlineListNode<MInstruction> {
+  MResumePoint* resumePoint_;
+
+ protected:
+  // All MInstructions are using the "MFoo::New(alloc)" notation instead of
+  // the TempObject new operator. This code redefines the new operator as
+  // protected, and delegates to the TempObject new operator. Thus, the
+  // following code prevents calls to "new(alloc) MFoo" outside the MFoo
+  // members.
+  inline void* operator new(size_t nbytes,
+                            TempAllocator::Fallible view) noexcept(true) {
+    return TempObject::operator new(nbytes, view);
+  }
+  inline void* operator new(size_t nbytes, TempAllocator& alloc) {
+    return TempObject::operator new(nbytes, alloc);
+  }
+  template <class T>
+  inline void* operator new(size_t nbytes, T* pos) {
+    return TempObject::operator new(nbytes, pos);
+  }
+
+ public:
+  explicit MInstruction(Opcode op) : MDefinition(op), resumePoint_(nullptr) {}
+
+  // Copying an instruction leaves the resume point as empty.
+  explicit MInstruction(const MInstruction& other)
+      : MDefinition(other), resumePoint_(nullptr) {}
+
+  // Convenient function used for replacing a load by the value of the store
+  // if the types are match, and boxing the value if they do not match.
+  MDefinition* foldsToStore(TempAllocator& alloc);
+
+  void setResumePoint(MResumePoint* resumePoint);
+  void stealResumePoint(MInstruction* other);
+
+  void moveResumePointAsEntry();
+  void clearResumePoint();
+  MResumePoint* resumePoint() const { return resumePoint_; }
+
+  // For instructions which can be cloned with new inputs, with all other
+  // information being the same. clone() implementations do not need to worry
+  // about cloning generic MInstruction/MDefinition state like flags and
+  // resume points.
+  virtual bool canClone() const { return false; }
+  virtual MInstruction* clone(TempAllocator& alloc,
+                              const MDefinitionVector& inputs) const {
+    MOZ_CRASH();
+  }
+
+  // Instructions needing to hook into type analysis should return a
+  // TypePolicy.
+  virtual const TypePolicy* typePolicy() = 0;
+  virtual MIRType typePolicySpecialization() = 0;
+};
+
+// Note: GenerateOpcodeFiles.py generates MOpcodesGenerated.h based on the
+// INSTRUCTION_HEADER* macros.
+#define INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(opcode) \
+  static const Opcode classOpcode = Opcode::opcode;   \
+  using MThisOpcode = M##opcode;
+
+#define INSTRUCTION_HEADER(opcode)                 \
+  INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(opcode)    \
+  virtual const TypePolicy* typePolicy() override; \
+  virtual MIRType typePolicySpecialization() override;
+
+#define ALLOW_CLONE(typename)                                                \
+  bool canClone() const override { return true; }                            \
+  MInstruction* clone(TempAllocator& alloc, const MDefinitionVector& inputs) \
+      const override {                                                       \
+    MInstruction* res = new (alloc) typename(*this);                         \
+    for (size_t i = 0; i < numOperands(); i++)                               \
+      res->replaceOperand(i, inputs[i]);                                     \
+    return res;                                                              \
+  }
+
+// Adds MFoo::New functions which are mirroring the arguments of the
+// constructors. Opcodes which are using this macro can be called with a
+// TempAllocator, or the fallible version of the TempAllocator.
+#define TRIVIAL_NEW_WRAPPERS                                               \
+  template <typename... Args>                                              \
+  static MThisOpcode* New(TempAllocator& alloc, Args&&... args) {          \
+    return new (alloc) MThisOpcode(std::forward<Args>(args)...);           \
+  }                                                                        \
+  template <typename... Args>                                              \
+  static MThisOpcode* New(TempAllocator::Fallible alloc, Args&&... args) { \
+    return new (alloc) MThisOpcode(std::forward<Args>(args)...);           \
+  }
+
+// These macros are used as a syntactic sugar for writting getOperand
+// accessors. They are meant to be used in the body of MIR Instructions as
+// follows:
+//
+//   public:
+//     INSTRUCTION_HEADER(Foo)
+//     NAMED_OPERANDS((0, lhs), (1, rhs))
+//
+// The above example defines 2 accessors, one named "lhs" accessing the first
+// operand, and a one named "rhs" accessing the second operand.
+#define NAMED_OPERAND_ACCESSOR(Index, Name) \
+  MDefinition* Name() const { return getOperand(Index); }
+#define NAMED_OPERAND_ACCESSOR_APPLY(Args) NAMED_OPERAND_ACCESSOR Args
+#define NAMED_OPERANDS(...) \
+  MOZ_FOR_EACH(NAMED_OPERAND_ACCESSOR_APPLY, (), (__VA_ARGS__))
+
+template <size_t Arity>
+class MAryInstruction : public MInstruction {
+  mozilla::Array<MUse, Arity> operands_;
+
+ protected:
+  MUse* getUseFor(size_t index) final { return &operands_[index]; }
+  const MUse* getUseFor(size_t index) const final { return &operands_[index]; }
+  void initOperand(size_t index, MDefinition* operand) {
+    operands_[index].init(operand, this);
+  }
+
+ public:
+  MDefinition* getOperand(size_t index) const final {
+    return operands_[index].producer();
+  }
+  size_t numOperands() const final { return Arity; }
+#ifdef DEBUG
+  static const size_t staticNumOperands = Arity;
+#endif
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u >= &operands_[0]);
+    MOZ_ASSERT(u <= &operands_[numOperands() - 1]);
+    return u - &operands_[0];
+  }
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    operands_[index].replaceProducer(operand);
+  }
+
+  explicit MAryInstruction(Opcode op) : MInstruction(op) {}
+
+  explicit MAryInstruction(const MAryInstruction<Arity>& other)
+      : MInstruction(other) {
+    for (int i = 0; i < (int)Arity;
+         i++) {  // N.B. use |int| to avoid warnings when Arity == 0
+      operands_[i].init(other.operands_[i].producer(), this);
+    }
+  }
+};
+
+class MNullaryInstruction : public MAryInstruction<0>,
+                            public NoTypePolicy::Data {
+ protected:
+  explicit MNullaryInstruction(Opcode op) : MAryInstruction(op) {}
+
+  HashNumber valueHash() const override;
+};
+
+class MUnaryInstruction : public MAryInstruction<1> {
+ protected:
+  MUnaryInstruction(Opcode op, MDefinition* ins) : MAryInstruction(op) {
+    initOperand(0, ins);
+  }
+
+  HashNumber valueHash() const override;
+
+ public:
+  NAMED_OPERANDS((0, input))
+};
+
+class MBinaryInstruction : public MAryInstruction<2> {
+ protected:
+  MBinaryInstruction(Opcode op, MDefinition* left, MDefinition* right)
+      : MAryInstruction(op) {
+    initOperand(0, left);
+    initOperand(1, right);
+  }
+
+ public:
+  NAMED_OPERANDS((0, lhs), (1, rhs))
+
+ protected:
+  HashNumber valueHash() const override;
+
+  bool binaryCongruentTo(const MDefinition* ins) const {
+    if (op() != ins->op()) {
+      return false;
+    }
+
+    if (type() != ins->type()) {
+      return false;
+    }
+
+    if (isEffectful() || ins->isEffectful()) {
+      return false;
+    }
+
+    const MDefinition* left = getOperand(0);
+    const MDefinition* right = getOperand(1);
+    if (isCommutative() && left->id() > right->id()) {
+      std::swap(left, right);
+    }
+
+    const MBinaryInstruction* bi = static_cast<const MBinaryInstruction*>(ins);
+    const MDefinition* insLeft = bi->getOperand(0);
+    const MDefinition* insRight = bi->getOperand(1);
+    if (bi->isCommutative() && insLeft->id() > insRight->id()) {
+      std::swap(insLeft, insRight);
+    }
+
+    return left == insLeft && right == insRight;
+  }
+
+ public:
+  // Return if the operands to this instruction are both unsigned.
+  static bool unsignedOperands(MDefinition* left, MDefinition* right);
+  bool unsignedOperands();
+
+  // Replace any wrapping operands with the underlying int32 operands
+  // in case of unsigned operands.
+  void replaceWithUnsignedOperands();
+};
+
+class MTernaryInstruction : public MAryInstruction<3> {
+ protected:
+  MTernaryInstruction(Opcode op, MDefinition* first, MDefinition* second,
+                      MDefinition* third)
+      : MAryInstruction(op) {
+    initOperand(0, first);
+    initOperand(1, second);
+    initOperand(2, third);
+  }
+
+  HashNumber valueHash() const override;
+};
+
+class MQuaternaryInstruction : public MAryInstruction<4> {
+ protected:
+  MQuaternaryInstruction(Opcode op, MDefinition* first, MDefinition* second,
+                         MDefinition* third, MDefinition* fourth)
+      : MAryInstruction(op) {
+    initOperand(0, first);
+    initOperand(1, second);
+    initOperand(2, third);
+    initOperand(3, fourth);
+  }
+
+  HashNumber valueHash() const override;
+};
+
+template <class T>
+class MVariadicT : public T {
+  FixedList<MUse> operands_;
+
+ protected:
+  explicit MVariadicT(typename T::Opcode op) : T(op) {}
+  [[nodiscard]] bool init(TempAllocator& alloc, size_t length) {
+    return operands_.init(alloc, length);
+  }
+  void initOperand(size_t index, MDefinition* operand) {
+    // FixedList doesn't initialize its elements, so do an unchecked init.
+    operands_[index].initUnchecked(operand, this);
+  }
+  MUse* getUseFor(size_t index) final { return &operands_[index]; }
+  const MUse* getUseFor(size_t index) const final { return &operands_[index]; }
+
+  // The MWasmCallBase mixin performs initialization for it's subclasses.
+  friend class MWasmCallBase;
+
+ public:
+  // Will assert if called before initialization.
+  MDefinition* getOperand(size_t index) const final {
+    return operands_[index].producer();
+  }
+  size_t numOperands() const final { return operands_.length(); }
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u >= &operands_[0]);
+    MOZ_ASSERT(u <= &operands_[numOperands() - 1]);
+    return u - &operands_[0];
+  }
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    operands_[index].replaceProducer(operand);
+  }
+};
+
+// An instruction with a variable number of operands. Note that the
+// MFoo::New constructor for variadic instructions fallibly
+// initializes the operands_ array and must be checked for OOM.
+using MVariadicInstruction = MVariadicT<MInstruction>;
+
+MIR_OPCODE_CLASS_GENERATED
+
+// Truncation barrier. This is intended for protecting its input against
+// follow-up truncation optimizations.
+class MLimitedTruncate : public MUnaryInstruction,
+                         public ConvertToInt32Policy<0>::Data {
+  TruncateKind truncate_;
+  TruncateKind truncateLimit_;
+
+  MLimitedTruncate(MDefinition* input, TruncateKind limit)
+      : MUnaryInstruction(classOpcode, input),
+        truncate_(TruncateKind::NoTruncate),
+        truncateLimit_(limit) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(LimitedTruncate)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+  TruncateKind truncateKind() const { return truncate_; }
+  void setTruncateKind(TruncateKind kind) { truncate_ = kind; }
+};
+
+// A constant js::Value.
+class MConstant : public MNullaryInstruction {
+  struct Payload {
+    union {
+      bool b;
+      int32_t i32;
+      int64_t i64;
+      intptr_t iptr;
+      float f;
+      double d;
+      JSString* str;
+      JS::Symbol* sym;
+      BigInt* bi;
+      JSObject* obj;
+      Shape* shape;
+      uint64_t asBits;
+    };
+    Payload() : asBits(0) {}
+  };
+
+  Payload payload_;
+
+  static_assert(sizeof(Payload) == sizeof(uint64_t),
+                "asBits must be big enough for all payload bits");
+
+#ifdef DEBUG
+  void assertInitializedPayload() const;
+#else
+  void assertInitializedPayload() const {}
+#endif
+
+  MConstant(TempAllocator& alloc, const Value& v);
+  explicit MConstant(JSObject* obj);
+  explicit MConstant(Shape* shape);
+  explicit MConstant(float f);
+  explicit MConstant(MIRType type, int64_t i);
+
+ public:
+  INSTRUCTION_HEADER(Constant)
+  static MConstant* New(TempAllocator& alloc, const Value& v);
+  static MConstant* New(TempAllocator::Fallible alloc, const Value& v);
+  static MConstant* New(TempAllocator& alloc, const Value& v, MIRType type);
+  static MConstant* NewFloat32(TempAllocator& alloc, double d);
+  static MConstant* NewInt64(TempAllocator& alloc, int64_t i);
+  static MConstant* NewIntPtr(TempAllocator& alloc, intptr_t i);
+  static MConstant* NewObject(TempAllocator& alloc, JSObject* v);
+  static MConstant* NewShape(TempAllocator& alloc, Shape* s);
+  static MConstant* Copy(TempAllocator& alloc, MConstant* src) {
+    return new (alloc) MConstant(*src);
+  }
+
+  // Try to convert this constant to boolean, similar to js::ToBoolean.
+  // Returns false if the type is MIRType::Magic* or MIRType::Object.
+  [[nodiscard]] bool valueToBoolean(bool* res) const;
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+
+  bool canProduceFloat32() const override;
+
+  ALLOW_CLONE(MConstant)
+
+  bool equals(const MConstant* other) const {
+    assertInitializedPayload();
+    return type() == other->type() && payload_.asBits == other->payload_.asBits;
+  }
+
+  bool toBoolean() const {
+    MOZ_ASSERT(type() == MIRType::Boolean);
+    return payload_.b;
+  }
+  int32_t toInt32() const {
+    MOZ_ASSERT(type() == MIRType::Int32);
+    return payload_.i32;
+  }
+  int64_t toInt64() const {
+    MOZ_ASSERT(type() == MIRType::Int64);
+    return payload_.i64;
+  }
+  intptr_t toIntPtr() const {
+    MOZ_ASSERT(type() == MIRType::IntPtr);
+    return payload_.iptr;
+  }
+  bool isInt32(int32_t i) const {
+    return type() == MIRType::Int32 && payload_.i32 == i;
+  }
+  bool isInt64(int64_t i) const {
+    return type() == MIRType::Int64 && payload_.i64 == i;
+  }
+  const double& toDouble() const {
+    MOZ_ASSERT(type() == MIRType::Double);
+    return payload_.d;
+  }
+  const float& toFloat32() const {
+    MOZ_ASSERT(type() == MIRType::Float32);
+    return payload_.f;
+  }
+  JSString* toString() const {
+    MOZ_ASSERT(type() == MIRType::String);
+    return payload_.str;
+  }
+  JS::Symbol* toSymbol() const {
+    MOZ_ASSERT(type() == MIRType::Symbol);
+    return payload_.sym;
+  }
+  BigInt* toBigInt() const {
+    MOZ_ASSERT(type() == MIRType::BigInt);
+    return payload_.bi;
+  }
+  JSObject& toObject() const {
+    MOZ_ASSERT(type() == MIRType::Object);
+    return *payload_.obj;
+  }
+  JSObject* toObjectOrNull() const {
+    if (type() == MIRType::Object) {
+      return payload_.obj;
+    }
+    MOZ_ASSERT(type() == MIRType::Null);
+    return nullptr;
+  }
+  Shape* toShape() const {
+    MOZ_ASSERT(type() == MIRType::Shape);
+    return payload_.shape;
+  }
+
+  bool isTypeRepresentableAsDouble() const {
+    return IsTypeRepresentableAsDouble(type());
+  }
+  double numberToDouble() const {
+    MOZ_ASSERT(isTypeRepresentableAsDouble());
+    if (type() == MIRType::Int32) {
+      return toInt32();
+    }
+    if (type() == MIRType::Double) {
+      return toDouble();
+    }
+    return toFloat32();
+  }
+
+  // Convert this constant to a js::Value. Float32 constants will be stored
+  // as DoubleValue and NaNs are canonicalized. Callers must be careful: not
+  // all constants can be represented by js::Value (wasm supports int64).
+  Value toJSValue() const;
+};
+
+class MWasmNullConstant : public MNullaryInstruction {
+  explicit MWasmNullConstant() : MNullaryInstruction(classOpcode) {
+    setResultType(MIRType::RefOrNull);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmNullConstant)
+  TRIVIAL_NEW_WRAPPERS
+
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->isWasmNullConstant();
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MWasmNullConstant)
+};
+
+// Floating-point value as created by wasm. Just a constant value, used to
+// effectively inhibit all the MIR optimizations. This uses the same LIR nodes
+// as a MConstant of the same type would.
+class MWasmFloatConstant : public MNullaryInstruction {
+  union {
+    float f32_;
+    double f64_;
+#ifdef ENABLE_WASM_SIMD
+    int8_t s128_[16];
+    uint64_t bits_[2];
+#else
+    uint64_t bits_[1];
+#endif
+  } u;
+
+  explicit MWasmFloatConstant(MIRType type) : MNullaryInstruction(classOpcode) {
+    u.bits_[0] = 0;
+#ifdef ENABLE_WASM_SIMD
+    u.bits_[1] = 0;
+#endif
+    setResultType(type);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmFloatConstant)
+
+  static MWasmFloatConstant* NewDouble(TempAllocator& alloc, double d) {
+    auto* ret = new (alloc) MWasmFloatConstant(MIRType::Double);
+    ret->u.f64_ = d;
+    return ret;
+  }
+
+  static MWasmFloatConstant* NewFloat32(TempAllocator& alloc, float f) {
+    auto* ret = new (alloc) MWasmFloatConstant(MIRType::Float32);
+    ret->u.f32_ = f;
+    return ret;
+  }
+
+#ifdef ENABLE_WASM_SIMD
+  static MWasmFloatConstant* NewSimd128(TempAllocator& alloc,
+                                        const SimdConstant& s) {
+    auto* ret = new (alloc) MWasmFloatConstant(MIRType::Simd128);
+    memcpy(ret->u.s128_, s.bytes(), 16);
+    return ret;
+  }
+#endif
+
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  const double& toDouble() const {
+    MOZ_ASSERT(type() == MIRType::Double);
+    return u.f64_;
+  }
+  const float& toFloat32() const {
+    MOZ_ASSERT(type() == MIRType::Float32);
+    return u.f32_;
+  }
+#ifdef ENABLE_WASM_SIMD
+  const SimdConstant toSimd128() const {
+    MOZ_ASSERT(type() == MIRType::Simd128);
+    return SimdConstant::CreateX16(u.s128_);
+  }
+#endif
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    switch (type()) {
+      case MIRType::Float32:
+        SprintfLiteral(buf, "f32{%e}", (double)u.f32_);
+        break;
+      case MIRType::Double:
+        SprintfLiteral(buf, "f64{%e}", u.f64_);
+        break;
+#  ifdef ENABLE_WASM_SIMD
+      case MIRType::Simd128:
+        SprintfLiteral(buf, "v128{[1]=%016llx:[0]=%016llx}",
+                       (unsigned long long int)u.bits_[1],
+                       (unsigned long long int)u.bits_[0]);
+        break;
+#  endif
+      default:
+        SprintfLiteral(buf, "!!getExtras: missing case!!");
+        break;
+    }
+    extras->add(buf);
+  }
+#endif
+};
+
+class MParameter : public MNullaryInstruction {
+  int32_t index_;
+
+  explicit MParameter(int32_t index)
+      : MNullaryInstruction(classOpcode), index_(index) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Parameter)
+  TRIVIAL_NEW_WRAPPERS
+
+  static const int32_t THIS_SLOT = -1;
+  int32_t index() const { return index_; }
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override;
+};
+
+class MControlInstruction : public MInstruction {
+ protected:
+  explicit MControlInstruction(Opcode op) : MInstruction(op) {}
+
+ public:
+  virtual size_t numSuccessors() const = 0;
+  virtual MBasicBlock* getSuccessor(size_t i) const = 0;
+  virtual void replaceSuccessor(size_t i, MBasicBlock* successor) = 0;
+
+  void initSuccessor(size_t i, MBasicBlock* successor) {
+    MOZ_ASSERT(!getSuccessor(i));
+    replaceSuccessor(i, successor);
+  }
+
+  bool isControlInstruction() const override { return true; }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+};
+
+class MTableSwitch final : public MControlInstruction,
+                           public NoFloatPolicy<0>::Data {
+  // The successors of the tableswitch
+  // - First successor = the default case
+  // - Successors 2 and higher = the cases
+  Vector<MBasicBlock*, 0, JitAllocPolicy> successors_;
+  // Index into successors_ sorted on case index
+  Vector<size_t, 0, JitAllocPolicy> cases_;
+
+  MUse operand_;
+  int32_t low_;
+  int32_t high_;
+
+  void initOperand(size_t index, MDefinition* operand) {
+    MOZ_ASSERT(index == 0);
+    operand_.init(operand, this);
+  }
+
+  MTableSwitch(TempAllocator& alloc, MDefinition* ins, int32_t low,
+               int32_t high)
+      : MControlInstruction(classOpcode),
+        successors_(alloc),
+        cases_(alloc),
+        low_(low),
+        high_(high) {
+    initOperand(0, ins);
+  }
+
+ protected:
+  MUse* getUseFor(size_t index) override {
+    MOZ_ASSERT(index == 0);
+    return &operand_;
+  }
+
+  const MUse* getUseFor(size_t index) const override {
+    MOZ_ASSERT(index == 0);
+    return &operand_;
+  }
+
+ public:
+  INSTRUCTION_HEADER(TableSwitch)
+
+  static MTableSwitch* New(TempAllocator& alloc, MDefinition* ins, int32_t low,
+                           int32_t high) {
+    return new (alloc) MTableSwitch(alloc, ins, low, high);
+  }
+
+  size_t numSuccessors() const override { return successors_.length(); }
+
+  [[nodiscard]] bool addSuccessor(MBasicBlock* successor, size_t* index) {
+    MOZ_ASSERT(successors_.length() < (size_t)(high_ - low_ + 2));
+    MOZ_ASSERT(!successors_.empty());
+    *index = successors_.length();
+    return successors_.append(successor);
+  }
+
+  MBasicBlock* getSuccessor(size_t i) const override {
+    MOZ_ASSERT(i < numSuccessors());
+    return successors_[i];
+  }
+
+  void replaceSuccessor(size_t i, MBasicBlock* successor) override {
+    MOZ_ASSERT(i < numSuccessors());
+    successors_[i] = successor;
+  }
+
+  int32_t low() const { return low_; }
+
+  int32_t high() const { return high_; }
+
+  MBasicBlock* getDefault() const { return getSuccessor(0); }
+
+  MBasicBlock* getCase(size_t i) const { return getSuccessor(cases_[i]); }
+
+  [[nodiscard]] bool addDefault(MBasicBlock* block, size_t* index = nullptr) {
+    MOZ_ASSERT(successors_.empty());
+    if (index) {
+      *index = 0;
+    }
+    return successors_.append(block);
+  }
+
+  [[nodiscard]] bool addCase(size_t successorIndex) {
+    return cases_.append(successorIndex);
+  }
+
+  size_t numCases() const { return high() - low() + 1; }
+
+  MDefinition* getOperand(size_t index) const override {
+    MOZ_ASSERT(index == 0);
+    return operand_.producer();
+  }
+
+  size_t numOperands() const override { return 1; }
+
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u == getUseFor(0));
+    return 0;
+  }
+
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    MOZ_ASSERT(index == 0);
+    operand_.replaceProducer(operand);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+template <size_t Arity, size_t Successors>
+class MAryControlInstruction : public MControlInstruction {
+  mozilla::Array<MUse, Arity> operands_;
+  mozilla::Array<MBasicBlock*, Successors> successors_;
+
+ protected:
+  explicit MAryControlInstruction(Opcode op) : MControlInstruction(op) {}
+  void setSuccessor(size_t index, MBasicBlock* successor) {
+    successors_[index] = successor;
+  }
+
+  MUse* getUseFor(size_t index) final { return &operands_[index]; }
+  const MUse* getUseFor(size_t index) const final { return &operands_[index]; }
+  void initOperand(size_t index, MDefinition* operand) {
+    operands_[index].init(operand, this);
+  }
+
+ public:
+  MDefinition* getOperand(size_t index) const final {
+    return operands_[index].producer();
+  }
+  size_t numOperands() const final { return Arity; }
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u >= &operands_[0]);
+    MOZ_ASSERT(u <= &operands_[numOperands() - 1]);
+    return u - &operands_[0];
+  }
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    operands_[index].replaceProducer(operand);
+  }
+  size_t numSuccessors() const final { return Successors; }
+  MBasicBlock* getSuccessor(size_t i) const final { return successors_[i]; }
+  void replaceSuccessor(size_t i, MBasicBlock* succ) final {
+    successors_[i] = succ;
+  }
+};
+
+template <size_t Successors>
+class MVariadicControlInstruction : public MVariadicT<MControlInstruction> {
+  mozilla::Array<MBasicBlock*, Successors> successors_;
+
+ protected:
+  explicit MVariadicControlInstruction(Opcode op)
+      : MVariadicT<MControlInstruction>(op) {}
+  void setSuccessor(size_t index, MBasicBlock* successor) {
+    successors_[index] = successor;
+  }
+
+ public:
+  size_t numSuccessors() const final { return Successors; }
+  MBasicBlock* getSuccessor(size_t i) const final { return successors_[i]; }
+  void replaceSuccessor(size_t i, MBasicBlock* succ) final {
+    successors_[i] = succ;
+  }
+};
+
+// Jump to the start of another basic block.
+class MGoto : public MAryControlInstruction<0, 1>, public NoTypePolicy::Data {
+  explicit MGoto(MBasicBlock* target) : MAryControlInstruction(classOpcode) {
+    setSuccessor(TargetIndex, target);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Goto)
+  static MGoto* New(TempAllocator& alloc, MBasicBlock* target);
+  static MGoto* New(TempAllocator::Fallible alloc, MBasicBlock* target);
+
+  // Variant that may patch the target later.
+  static MGoto* New(TempAllocator& alloc);
+
+  static constexpr size_t TargetIndex = 0;
+
+  MBasicBlock* target() { return getSuccessor(TargetIndex); }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "Block%u", GetMBasicBlockId(target()));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Tests if the input instruction evaluates to true or false, and jumps to the
+// start of a corresponding basic block.
+class MTest : public MAryControlInstruction<1, 2>, public TestPolicy::Data {
+  // It is allowable to specify `trueBranch` or `falseBranch` as nullptr and
+  // patch it in later.
+  MTest(MDefinition* ins, MBasicBlock* trueBranch, MBasicBlock* falseBranch)
+      : MAryControlInstruction(classOpcode) {
+    initOperand(0, ins);
+    setSuccessor(TrueBranchIndex, trueBranch);
+    setSuccessor(FalseBranchIndex, falseBranch);
+  }
+
+  TypeDataList observedTypes_;
+
+ public:
+  INSTRUCTION_HEADER(Test)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, input))
+
+  const TypeDataList& observedTypes() const { return observedTypes_; }
+  void setObservedTypes(const TypeDataList& observed) {
+    observedTypes_ = observed;
+  }
+
+  static constexpr size_t TrueBranchIndex = 0;
+  static constexpr size_t FalseBranchIndex = 1;
+
+  MBasicBlock* ifTrue() const { return getSuccessor(TrueBranchIndex); }
+  MBasicBlock* ifFalse() const { return getSuccessor(FalseBranchIndex); }
+  MBasicBlock* branchSuccessor(BranchDirection dir) const {
+    return (dir == TRUE_BRANCH) ? ifTrue() : ifFalse();
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsDoubleNegation(TempAllocator& alloc);
+  MDefinition* foldsConstant(TempAllocator& alloc);
+  MDefinition* foldsTypes(TempAllocator& alloc);
+  MDefinition* foldsNeedlessControlFlow(TempAllocator& alloc);
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "true->Block%u false->Block%u",
+                   GetMBasicBlockId(ifTrue()), GetMBasicBlockId(ifFalse()));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Returns from this function to the previous caller.
+class MReturn : public MAryControlInstruction<1, 0>,
+                public BoxInputsPolicy::Data {
+  explicit MReturn(MDefinition* ins) : MAryControlInstruction(classOpcode) {
+    initOperand(0, ins);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Return)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, input))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MNewArray : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  // Number of elements to allocate for the array.
+  uint32_t length_;
+
+  // Heap where the array should be allocated.
+  gc::Heap initialHeap_;
+
+  bool vmCall_;
+
+  MNewArray(uint32_t length, MConstant* templateConst, gc::Heap initialHeap,
+            bool vmCall = false);
+
+ public:
+  INSTRUCTION_HEADER(NewArray)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MNewArray* NewVM(TempAllocator& alloc, uint32_t length,
+                          MConstant* templateConst, gc::Heap initialHeap) {
+    return new (alloc) MNewArray(length, templateConst, initialHeap, true);
+  }
+
+  uint32_t length() const { return length_; }
+
+  JSObject* templateObject() const {
+    return getOperand(0)->toConstant()->toObjectOrNull();
+  }
+
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  bool isVMCall() const { return vmCall_; }
+
+  // NewArray is marked as non-effectful because all our allocations are
+  // either lazy when we are using "new Array(length)" or bounded by the
+  // script or the stack size when we are using "new Array(...)" or "[...]"
+  // notations.  So we might have to allocate the array twice if we bail
+  // during the computation of the first element of the square braket
+  // notation.
+  virtual AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    // The template object can safely be used in the recover instruction
+    // because it can never be mutated by any other function execution.
+    return templateObject() != nullptr;
+  }
+};
+
+class MNewTypedArray : public MUnaryInstruction, public NoTypePolicy::Data {
+  gc::Heap initialHeap_;
+
+  MNewTypedArray(MConstant* templateConst, gc::Heap initialHeap)
+      : MUnaryInstruction(classOpcode, templateConst),
+        initialHeap_(initialHeap) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewTypedArray)
+  TRIVIAL_NEW_WRAPPERS
+
+  TypedArrayObject* templateObject() const {
+    return &getOperand(0)->toConstant()->toObject().as<TypedArrayObject>();
+  }
+
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  virtual AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MNewObject : public MUnaryInstruction, public NoTypePolicy::Data {
+ public:
+  enum Mode { ObjectLiteral, ObjectCreate };
+
+ private:
+  gc::Heap initialHeap_;
+  Mode mode_;
+  bool vmCall_;
+
+  MNewObject(MConstant* templateConst, gc::Heap initialHeap, Mode mode,
+             bool vmCall = false)
+      : MUnaryInstruction(classOpcode, templateConst),
+        initialHeap_(initialHeap),
+        mode_(mode),
+        vmCall_(vmCall) {
+    if (mode == ObjectLiteral) {
+      MOZ_ASSERT(!templateObject());
+    } else {
+      MOZ_ASSERT(templateObject());
+    }
+    setResultType(MIRType::Object);
+
+    // The constant is kept separated in a MConstant, this way we can safely
+    // mark it during GC if we recover the object allocation.  Otherwise, by
+    // making it emittedAtUses, we do not produce register allocations for
+    // it and inline its content inside the code produced by the
+    // CodeGenerator.
+    if (templateConst->toConstant()->type() == MIRType::Object) {
+      templateConst->setEmittedAtUses();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MNewObject* NewVM(TempAllocator& alloc, MConstant* templateConst,
+                           gc::Heap initialHeap, Mode mode) {
+    return new (alloc) MNewObject(templateConst, initialHeap, mode, true);
+  }
+
+  Mode mode() const { return mode_; }
+
+  JSObject* templateObject() const {
+    return getOperand(0)->toConstant()->toObjectOrNull();
+  }
+
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  bool isVMCall() const { return vmCall_; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    // The template object can safely be used in the recover instruction
+    // because it can never be mutated by any other function execution.
+    return templateObject() != nullptr;
+  }
+};
+
+class MNewPlainObject : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  uint32_t numFixedSlots_;
+  uint32_t numDynamicSlots_;
+  gc::AllocKind allocKind_;
+  gc::Heap initialHeap_;
+
+  MNewPlainObject(MConstant* shapeConst, uint32_t numFixedSlots,
+                  uint32_t numDynamicSlots, gc::AllocKind allocKind,
+                  gc::Heap initialHeap)
+      : MUnaryInstruction(classOpcode, shapeConst),
+        numFixedSlots_(numFixedSlots),
+        numDynamicSlots_(numDynamicSlots),
+        allocKind_(allocKind),
+        initialHeap_(initialHeap) {
+    setResultType(MIRType::Object);
+
+    // The shape constant is kept separated in a MConstant. This way we can
+    // safely mark it during GC if we recover the object allocation. Otherwise,
+    // by making it emittedAtUses, we do not produce register allocations for it
+    // and inline its content inside the code produced by the CodeGenerator.
+    MOZ_ASSERT(shapeConst->toConstant()->type() == MIRType::Shape);
+    shapeConst->setEmittedAtUses();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewPlainObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  const Shape* shape() const { return getOperand(0)->toConstant()->toShape(); }
+
+  uint32_t numFixedSlots() const { return numFixedSlots_; }
+  uint32_t numDynamicSlots() const { return numDynamicSlots_; }
+  gc::AllocKind allocKind() const { return allocKind_; }
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MNewArrayObject : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  uint32_t length_;
+  gc::Heap initialHeap_;
+
+  MNewArrayObject(TempAllocator& alloc, MConstant* shapeConst, uint32_t length,
+                  gc::Heap initialHeap)
+      : MUnaryInstruction(classOpcode, shapeConst),
+        length_(length),
+        initialHeap_(initialHeap) {
+    setResultType(MIRType::Object);
+    MOZ_ASSERT(shapeConst->toConstant()->type() == MIRType::Shape);
+    shapeConst->setEmittedAtUses();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewArrayObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MNewArrayObject* New(TempAllocator& alloc, MConstant* shapeConst,
+                              uint32_t length, gc::Heap initialHeap) {
+    return new (alloc) MNewArrayObject(alloc, shapeConst, length, initialHeap);
+  }
+
+  const Shape* shape() const { return getOperand(0)->toConstant()->toShape(); }
+
+  // See MNewArray::getAliasSet comment.
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  uint32_t length() const { return length_; }
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MNewIterator : public MUnaryInstruction, public NoTypePolicy::Data {
+ public:
+  enum Type {
+    ArrayIterator,
+    StringIterator,
+    RegExpStringIterator,
+  };
+
+ private:
+  Type type_;
+
+  MNewIterator(MConstant* templateConst, Type type)
+      : MUnaryInstruction(classOpcode, templateConst), type_(type) {
+    setResultType(MIRType::Object);
+    templateConst->setEmittedAtUses();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewIterator)
+  TRIVIAL_NEW_WRAPPERS
+
+  Type type() const { return type_; }
+
+  JSObject* templateObject() {
+    return getOperand(0)->toConstant()->toObjectOrNull();
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+// Represent the content of all slots of an object.  This instruction is not
+// lowered and is not used to generate code.
+class MObjectState : public MVariadicInstruction,
+                     public NoFloatPolicyAfter<1>::Data {
+ private:
+  uint32_t numSlots_;
+  uint32_t numFixedSlots_;
+
+  explicit MObjectState(JSObject* templateObject);
+  explicit MObjectState(const Shape* shape);
+  explicit MObjectState(MObjectState* state);
+
+  [[nodiscard]] bool init(TempAllocator& alloc, MDefinition* obj);
+
+  void initSlot(uint32_t slot, MDefinition* def) { initOperand(slot + 1, def); }
+
+ public:
+  INSTRUCTION_HEADER(ObjectState)
+  NAMED_OPERANDS((0, object))
+
+  // Return the template object of any object creation which can be recovered
+  // on bailout.
+  static JSObject* templateObjectOf(MDefinition* obj);
+
+  static MObjectState* New(TempAllocator& alloc, MDefinition* obj);
+  static MObjectState* Copy(TempAllocator& alloc, MObjectState* state);
+
+  // As we might do read of uninitialized properties, we have to copy the
+  // initial values from the template object.
+  void initFromTemplateObject(TempAllocator& alloc, MDefinition* undefinedVal);
+
+  size_t numFixedSlots() const { return numFixedSlots_; }
+  size_t numSlots() const { return numSlots_; }
+
+  MDefinition* getSlot(uint32_t slot) const { return getOperand(slot + 1); }
+  void setSlot(uint32_t slot, MDefinition* def) {
+    replaceOperand(slot + 1, def);
+  }
+
+  bool hasFixedSlot(uint32_t slot) const {
+    return slot < numSlots() && slot < numFixedSlots();
+  }
+  MDefinition* getFixedSlot(uint32_t slot) const {
+    MOZ_ASSERT(slot < numFixedSlots());
+    return getSlot(slot);
+  }
+  void setFixedSlot(uint32_t slot, MDefinition* def) {
+    MOZ_ASSERT(slot < numFixedSlots());
+    setSlot(slot, def);
+  }
+
+  bool hasDynamicSlot(uint32_t slot) const {
+    return numFixedSlots() < numSlots() && slot < numSlots() - numFixedSlots();
+  }
+  MDefinition* getDynamicSlot(uint32_t slot) const {
+    return getSlot(slot + numFixedSlots());
+  }
+  void setDynamicSlot(uint32_t slot, MDefinition* def) {
+    setSlot(slot + numFixedSlots(), def);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+// Represent the contents of all elements of an array.  This instruction is not
+// lowered and is not used to generate code.
+class MArrayState : public MVariadicInstruction,
+                    public NoFloatPolicyAfter<2>::Data {
+ private:
+  uint32_t numElements_;
+
+  explicit MArrayState(MDefinition* arr);
+
+  [[nodiscard]] bool init(TempAllocator& alloc, MDefinition* obj,
+                          MDefinition* len);
+
+  void initElement(uint32_t index, MDefinition* def) {
+    initOperand(index + 2, def);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ArrayState)
+  NAMED_OPERANDS((0, array), (1, initializedLength))
+
+  static MArrayState* New(TempAllocator& alloc, MDefinition* arr,
+                          MDefinition* initLength);
+  static MArrayState* Copy(TempAllocator& alloc, MArrayState* state);
+
+  void initFromTemplateObject(TempAllocator& alloc, MDefinition* undefinedVal);
+
+  void setInitializedLength(MDefinition* def) { replaceOperand(1, def); }
+
+  size_t numElements() const { return numElements_; }
+
+  MDefinition* getElement(uint32_t index) const {
+    return getOperand(index + 2);
+  }
+  void setElement(uint32_t index, MDefinition* def) {
+    replaceOperand(index + 2, def);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+// WrappedFunction stores information about a function that can safely be used
+// off-thread. In particular, a function's flags can be modified on the main
+// thread as functions are relazified and delazified, so we must be careful not
+// to access these flags off-thread.
+class WrappedFunction : public TempObject {
+  // If this is a native function without a JitEntry, the JSFunction*.
+  CompilerFunction nativeFun_;
+  uint16_t nargs_;
+  js::FunctionFlags flags_;
+
+ public:
+  WrappedFunction(JSFunction* nativeFun, uint16_t nargs, FunctionFlags flags);
+
+  // Note: When adding new accessors be sure to add consistency asserts
+  // to the constructor.
+
+  size_t nargs() const { return nargs_; }
+
+  bool isNativeWithoutJitEntry() const {
+    return flags_.isNativeWithoutJitEntry();
+  }
+  bool hasJitEntry() const { return flags_.hasJitEntry(); }
+  bool isConstructor() const { return flags_.isConstructor(); }
+  bool isClassConstructor() const { return flags_.isClassConstructor(); }
+
+  // These fields never change, they can be accessed off-main thread.
+  JSNative native() const {
+    MOZ_ASSERT(isNativeWithoutJitEntry());
+    return nativeFun_->nativeUnchecked();
+  }
+  bool hasJitInfo() const {
+    return flags_.isBuiltinNative() && nativeFun_->jitInfoUnchecked();
+  }
+  const JSJitInfo* jitInfo() const {
+    MOZ_ASSERT(hasJitInfo());
+    return nativeFun_->jitInfoUnchecked();
+  }
+
+  JSFunction* rawNativeJSFunction() const { return nativeFun_; }
+};
+
+enum class DOMObjectKind : uint8_t { Proxy, Native };
+
+class MCallBase : public MVariadicInstruction, public CallPolicy::Data {
+ protected:
+  // The callee, this, and the actual arguments are all operands of MCall.
+  static const size_t CalleeOperandIndex = 0;
+  static const size_t NumNonArgumentOperands = 1;
+
+  explicit MCallBase(Opcode op) : MVariadicInstruction(op) {}
+
+ public:
+  void initCallee(MDefinition* func) { initOperand(CalleeOperandIndex, func); }
+  MDefinition* getCallee() const { return getOperand(CalleeOperandIndex); }
+
+  void replaceCallee(MInstruction* newfunc) {
+    replaceOperand(CalleeOperandIndex, newfunc);
+  }
+
+  void addArg(size_t argnum, MDefinition* arg);
+
+  MDefinition* getArg(uint32_t index) const {
+    return getOperand(NumNonArgumentOperands + index);
+  }
+
+  // The number of stack arguments is the max between the number of formal
+  // arguments and the number of actual arguments. The number of stack
+  // argument includes the |undefined| padding added in case of underflow.
+  // Includes |this|.
+  uint32_t numStackArgs() const {
+    return numOperands() - NumNonArgumentOperands;
+  }
+  uint32_t paddedNumStackArgs() const {
+    if (JitStackValueAlignment > 1) {
+      return AlignBytes(numStackArgs(), JitStackValueAlignment);
+    }
+    return numStackArgs();
+  }
+
+  static size_t IndexOfThis() { return NumNonArgumentOperands; }
+  static size_t IndexOfArgument(size_t index) {
+    return NumNonArgumentOperands + index + 1;  // +1 to skip |this|.
+  }
+  static size_t IndexOfStackArg(size_t index) {
+    return NumNonArgumentOperands + index;
+  }
+};
+
+class MCall : public MCallBase {
+ protected:
+  // Monomorphic cache for MCalls with a single JSFunction target.
+  WrappedFunction* target_;
+
+  // Original value of argc from the bytecode.
+  uint32_t numActualArgs_;
+
+  // True if the call is for JSOp::New or JSOp::SuperCall.
+  bool construct_ : 1;
+
+  // True if the caller does not use the return value.
+  bool ignoresReturnValue_ : 1;
+
+  bool needsClassCheck_ : 1;
+  bool maybeCrossRealm_ : 1;
+  bool needsThisCheck_ : 1;
+
+  MCall(WrappedFunction* target, uint32_t numActualArgs, bool construct,
+        bool ignoresReturnValue)
+      : MCallBase(classOpcode),
+        target_(target),
+        numActualArgs_(numActualArgs),
+        construct_(construct),
+        ignoresReturnValue_(ignoresReturnValue),
+        needsClassCheck_(true),
+        maybeCrossRealm_(true),
+        needsThisCheck_(false) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Call)
+  static MCall* New(TempAllocator& alloc, WrappedFunction* target,
+                    size_t maxArgc, size_t numActualArgs, bool construct,
+                    bool ignoresReturnValue, bool isDOMCall,
+                    mozilla::Maybe<DOMObjectKind> objectKind);
+
+  bool needsClassCheck() const { return needsClassCheck_; }
+  void disableClassCheck() { needsClassCheck_ = false; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool needsThisCheck() const { return needsThisCheck_; }
+  void setNeedsThisCheck() {
+    MOZ_ASSERT(construct_);
+    needsThisCheck_ = true;
+  }
+
+  // For monomorphic callsites.
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  bool isConstructing() const { return construct_; }
+
+  bool ignoresReturnValue() const { return ignoresReturnValue_; }
+
+  // Does not include |this|.
+  uint32_t numActualArgs() const { return numActualArgs_; }
+
+  bool possiblyCalls() const override { return true; }
+
+  virtual bool isCallDOMNative() const { return false; }
+
+  // A method that can be called to tell the MCall to figure out whether it's
+  // movable or not.  This can't be done in the constructor, because it
+  // depends on the arguments to the call, and those aren't passed to the
+  // constructor but are set up later via addArg.
+  virtual void computeMovable() {}
+};
+
+class MCallDOMNative : public MCall {
+  // A helper class for MCalls for DOM natives.  Note that this is NOT
+  // actually a separate MIR op from MCall, because all sorts of places use
+  // isCall() to check for calls and all we really want is to overload a few
+  // virtual things from MCall.
+
+  DOMObjectKind objectKind_;
+
+  MCallDOMNative(WrappedFunction* target, uint32_t numActualArgs,
+                 DOMObjectKind objectKind)
+      : MCall(target, numActualArgs, false, false), objectKind_(objectKind) {
+    MOZ_ASSERT(getJitInfo()->type() != JSJitInfo::InlinableNative);
+
+    // If our jitinfo is not marked eliminatable, that means that our C++
+    // implementation is fallible or that it never wants to be eliminated or
+    // that we have no hope of ever doing the sort of argument analysis that
+    // would allow us to detemine that we're side-effect-free.  In the
+    // latter case we wouldn't get DCEd no matter what, but for the former
+    // two cases we have to explicitly say that we can't be DCEd.
+    if (!getJitInfo()->isEliminatable) {
+      setGuard();
+    }
+  }
+
+  friend MCall* MCall::New(TempAllocator& alloc, WrappedFunction* target,
+                           size_t maxArgc, size_t numActualArgs, bool construct,
+                           bool ignoresReturnValue, bool isDOMCall,
+                           mozilla::Maybe<DOMObjectKind> objectKind);
+
+  const JSJitInfo* getJitInfo() const;
+
+ public:
+  DOMObjectKind objectKind() const { return objectKind_; }
+
+  virtual AliasSet getAliasSet() const override;
+
+  virtual bool congruentTo(const MDefinition* ins) const override;
+
+  virtual bool isCallDOMNative() const override { return true; }
+
+  virtual void computeMovable() override;
+};
+
+// Used to invoke a JSClass call/construct hook.
+class MCallClassHook : public MCallBase {
+  const JSNative target_;
+  bool constructing_ : 1;
+  bool ignoresReturnValue_ : 1;
+
+  MCallClassHook(JSNative target, bool constructing)
+      : MCallBase(classOpcode),
+        target_(target),
+        constructing_(constructing),
+        ignoresReturnValue_(false) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(CallClassHook)
+  static MCallClassHook* New(TempAllocator& alloc, JSNative target,
+                             uint32_t argc, bool constructing);
+
+  JSNative target() const { return target_; }
+  bool isConstructing() const { return constructing_; }
+
+  uint32_t numActualArgs() const {
+    uint32_t thisAndNewTarget = 1 + constructing_;
+    MOZ_ASSERT(numStackArgs() >= thisAndNewTarget);
+    return numStackArgs() - thisAndNewTarget;
+  }
+
+  bool maybeCrossRealm() const { return true; }
+
+  bool ignoresReturnValue() const { return ignoresReturnValue_; }
+  void setIgnoresReturnValue() { ignoresReturnValue_ = true; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// fun.apply(self, arguments)
+class MApplyArgs : public MTernaryInstruction,
+                   public MixPolicy<ObjectPolicy<0>, UnboxedInt32Policy<1>,
+                                    BoxPolicy<2>>::Data {
+  // Single target from CacheIR, or nullptr
+  WrappedFunction* target_;
+  // Number of extra initial formals to skip.
+  uint32_t numExtraFormals_;
+  bool maybeCrossRealm_ = true;
+  bool ignoresReturnValue_ = false;
+
+  MApplyArgs(WrappedFunction* target, MDefinition* fun, MDefinition* argc,
+             MDefinition* self, uint32_t numExtraFormals = 0)
+      : MTernaryInstruction(classOpcode, fun, argc, self),
+        target_(target),
+        numExtraFormals_(numExtraFormals) {
+    MOZ_ASSERT(argc->type() == MIRType::Int32);
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ApplyArgs)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getFunction), (1, getArgc), (2, getThis))
+
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  uint32_t numExtraFormals() const { return numExtraFormals_; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool ignoresReturnValue() const { return ignoresReturnValue_; }
+  void setIgnoresReturnValue() { ignoresReturnValue_ = true; }
+
+  bool isConstructing() const { return false; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MApplyArgsObj
+    : public MTernaryInstruction,
+      public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1>, BoxPolicy<2>>::Data {
+  WrappedFunction* target_;
+  bool maybeCrossRealm_ = true;
+  bool ignoresReturnValue_ = false;
+
+  MApplyArgsObj(WrappedFunction* target, MDefinition* fun, MDefinition* argsObj,
+                MDefinition* thisArg)
+      : MTernaryInstruction(classOpcode, fun, argsObj, thisArg),
+        target_(target) {
+    MOZ_ASSERT(argsObj->type() == MIRType::Object);
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ApplyArgsObj)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getFunction), (1, getArgsObj), (2, getThis))
+
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool ignoresReturnValue() const { return ignoresReturnValue_; }
+  void setIgnoresReturnValue() { ignoresReturnValue_ = true; }
+
+  bool isConstructing() const { return false; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// fun.apply(fn, array)
+class MApplyArray : public MTernaryInstruction,
+                    public MixPolicy<ObjectPolicy<0>, BoxPolicy<2>>::Data {
+  // Single target from CacheIR, or nullptr
+  WrappedFunction* target_;
+  bool maybeCrossRealm_ = true;
+  bool ignoresReturnValue_ = false;
+
+  MApplyArray(WrappedFunction* target, MDefinition* fun, MDefinition* elements,
+              MDefinition* self)
+      : MTernaryInstruction(classOpcode, fun, elements, self), target_(target) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ApplyArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getFunction), (1, getElements), (2, getThis))
+
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool ignoresReturnValue() const { return ignoresReturnValue_; }
+  void setIgnoresReturnValue() { ignoresReturnValue_ = true; }
+
+  bool isConstructing() const { return false; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// |new F(...arguments)| and |super(...arguments)|.
+class MConstructArgs : public MQuaternaryInstruction,
+                       public MixPolicy<ObjectPolicy<0>, UnboxedInt32Policy<1>,
+                                        BoxPolicy<2>, ObjectPolicy<3>>::Data {
+  // Single target from CacheIR, or nullptr
+  WrappedFunction* target_;
+  // Number of extra initial formals to skip.
+  uint32_t numExtraFormals_;
+  bool maybeCrossRealm_ = true;
+
+  MConstructArgs(WrappedFunction* target, MDefinition* fun, MDefinition* argc,
+                 MDefinition* thisValue, MDefinition* newTarget,
+                 uint32_t numExtraFormals = 0)
+      : MQuaternaryInstruction(classOpcode, fun, argc, thisValue, newTarget),
+        target_(target),
+        numExtraFormals_(numExtraFormals) {
+    MOZ_ASSERT(argc->type() == MIRType::Int32);
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ConstructArgs)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getFunction), (1, getArgc), (2, getThis),
+                 (3, getNewTarget))
+
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  uint32_t numExtraFormals() const { return numExtraFormals_; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool ignoresReturnValue() const { return false; }
+  bool isConstructing() const { return true; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// |new F(...args)| and |super(...args)|.
+class MConstructArray
+    : public MQuaternaryInstruction,
+      public MixPolicy<ObjectPolicy<0>, BoxPolicy<2>, ObjectPolicy<3>>::Data {
+  // Single target from CacheIR, or nullptr
+  WrappedFunction* target_;
+  bool maybeCrossRealm_ = true;
+  bool needsThisCheck_ = false;
+
+  MConstructArray(WrappedFunction* target, MDefinition* fun,
+                  MDefinition* elements, MDefinition* thisValue,
+                  MDefinition* newTarget)
+      : MQuaternaryInstruction(classOpcode, fun, elements, thisValue,
+                               newTarget),
+        target_(target) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ConstructArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getFunction), (1, getElements), (2, getThis),
+                 (3, getNewTarget))
+
+  WrappedFunction* getSingleTarget() const { return target_; }
+
+  bool maybeCrossRealm() const { return maybeCrossRealm_; }
+  void setNotCrossRealm() { maybeCrossRealm_ = false; }
+
+  bool needsThisCheck() const { return needsThisCheck_; }
+  void setNeedsThisCheck() { needsThisCheck_ = true; }
+
+  bool ignoresReturnValue() const { return false; }
+  bool isConstructing() const { return true; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MBail : public MNullaryInstruction {
+  explicit MBail(BailoutKind kind) : MNullaryInstruction(classOpcode) {
+    setBailoutKind(kind);
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Bail)
+
+  static MBail* New(TempAllocator& alloc, BailoutKind kind) {
+    return new (alloc) MBail(kind);
+  }
+  static MBail* New(TempAllocator& alloc) {
+    return new (alloc) MBail(BailoutKind::Inevitable);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MUnreachable : public MAryControlInstruction<0, 0>,
+                     public NoTypePolicy::Data {
+  MUnreachable() : MAryControlInstruction(classOpcode) {}
+
+ public:
+  INSTRUCTION_HEADER(Unreachable)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MAssertRecoveredOnBailout : public MUnaryInstruction,
+                                  public NoTypePolicy::Data {
+  bool mustBeRecovered_;
+
+  MAssertRecoveredOnBailout(MDefinition* ins, bool mustBeRecovered)
+      : MUnaryInstruction(classOpcode, ins), mustBeRecovered_(mustBeRecovered) {
+    setResultType(MIRType::Value);
+    setRecoveredOnBailout();
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(AssertRecoveredOnBailout)
+  TRIVIAL_NEW_WRAPPERS
+
+  // Needed to assert that float32 instructions are correctly recovered.
+  bool canConsumeFloat32(MUse* use) const override { return true; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MAssertFloat32 : public MUnaryInstruction, public NoTypePolicy::Data {
+  bool mustBeFloat32_;
+
+  MAssertFloat32(MDefinition* value, bool mustBeFloat32)
+      : MUnaryInstruction(classOpcode, value), mustBeFloat32_(mustBeFloat32) {}
+
+ public:
+  INSTRUCTION_HEADER(AssertFloat32)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool canConsumeFloat32(MUse* use) const override { return true; }
+
+  bool mustBeFloat32() const { return mustBeFloat32_; }
+};
+
+class MCompare : public MBinaryInstruction, public ComparePolicy::Data {
+ public:
+  enum CompareType {
+
+    // Anything compared to Undefined
+    Compare_Undefined,
+
+    // Anything compared to Null
+    Compare_Null,
+
+    // Int32   compared to Int32
+    // Boolean compared to Boolean
+    Compare_Int32,
+
+    // Int32 compared as unsigneds
+    Compare_UInt32,
+
+    // Int64 compared to Int64.
+    Compare_Int64,
+
+    // Int64 compared as unsigneds.
+    Compare_UInt64,
+
+    // IntPtr compared as unsigneds.
+    Compare_UIntPtr,
+
+    // Double compared to Double
+    Compare_Double,
+
+    // Float compared to Float
+    Compare_Float32,
+
+    // String compared to String
+    Compare_String,
+
+    // Symbol compared to Symbol
+    Compare_Symbol,
+
+    // Object compared to Object
+    Compare_Object,
+
+    // BigInt compared to BigInt
+    Compare_BigInt,
+
+    // BigInt compared to Int32
+    Compare_BigInt_Int32,
+
+    // BigInt compared to Double
+    Compare_BigInt_Double,
+
+    // BigInt compared to String
+    Compare_BigInt_String,
+
+    // Wasm Ref/AnyRef/NullRef compared to Ref/AnyRef/NullRef
+    Compare_RefOrNull,
+  };
+
+ private:
+  CompareType compareType_;
+  JSOp jsop_;
+  bool operandsAreNeverNaN_;
+
+  // When a floating-point comparison is converted to an integer comparison
+  // (when range analysis proves it safe), we need to convert the operands
+  // to integer as well.
+  bool truncateOperands_;
+
+  MCompare(MDefinition* left, MDefinition* right, JSOp jsop,
+           CompareType compareType)
+      : MBinaryInstruction(classOpcode, left, right),
+        compareType_(compareType),
+        jsop_(jsop),
+        operandsAreNeverNaN_(false),
+        truncateOperands_(false) {
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Compare)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MCompare* NewWasm(TempAllocator& alloc, MDefinition* left,
+                           MDefinition* right, JSOp jsop,
+                           CompareType compareType) {
+    MOZ_ASSERT(compareType == Compare_Int32 || compareType == Compare_UInt32 ||
+               compareType == Compare_Int64 || compareType == Compare_UInt64 ||
+               compareType == Compare_Double ||
+               compareType == Compare_Float32 ||
+               compareType == Compare_RefOrNull);
+    auto* ins = MCompare::New(alloc, left, right, jsop, compareType);
+    ins->setResultType(MIRType::Int32);
+    return ins;
+  }
+
+  [[nodiscard]] bool tryFold(bool* result);
+  [[nodiscard]] bool evaluateConstantOperands(TempAllocator& alloc,
+                                              bool* result);
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  CompareType compareType() const { return compareType_; }
+  bool isInt32Comparison() const { return compareType() == Compare_Int32; }
+  bool isDoubleComparison() const { return compareType() == Compare_Double; }
+  bool isFloat32Comparison() const { return compareType() == Compare_Float32; }
+  bool isNumericComparison() const {
+    return isInt32Comparison() || isDoubleComparison() || isFloat32Comparison();
+  }
+  MIRType inputType();
+
+  JSOp jsop() const { return jsop_; }
+  bool operandsAreNeverNaN() const { return operandsAreNeverNaN_; }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+  void collectRangeInfoPreTrunc() override;
+
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+  bool isFloat32Commutative() const override { return true; }
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override {
+    // Both sides of the compare can be Float32
+    return compareType_ == Compare_Float32;
+  }
+#endif
+
+  ALLOW_CLONE(MCompare)
+
+ private:
+  [[nodiscard]] bool tryFoldEqualOperands(bool* result);
+  [[nodiscard]] bool tryFoldTypeOf(bool* result);
+  [[nodiscard]] MDefinition* tryFoldTypeOf(TempAllocator& alloc);
+  [[nodiscard]] MDefinition* tryFoldCharCompare(TempAllocator& alloc);
+  [[nodiscard]] MDefinition* tryFoldStringCompare(TempAllocator& alloc);
+  [[nodiscard]] MDefinition* tryFoldStringSubstring(TempAllocator& alloc);
+  [[nodiscard]] MDefinition* tryFoldStringIndexOf(TempAllocator& alloc);
+
+ public:
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!binaryCongruentTo(ins)) {
+      return false;
+    }
+    return compareType() == ins->toCompare()->compareType() &&
+           jsop() == ins->toCompare()->jsop();
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    switch (compareType_) {
+      case Compare_Undefined:
+      case Compare_Null:
+      case Compare_Int32:
+      case Compare_UInt32:
+      case Compare_Double:
+      case Compare_Float32:
+      case Compare_String:
+      case Compare_Symbol:
+      case Compare_Object:
+      case Compare_BigInt:
+      case Compare_BigInt_Int32:
+      case Compare_BigInt_Double:
+      case Compare_BigInt_String:
+        return true;
+
+      case Compare_Int64:
+      case Compare_UInt64:
+      case Compare_UIntPtr:
+      case Compare_RefOrNull:
+        return false;
+    }
+    MOZ_CRASH("unexpected compare type");
+  }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    const char* ty = nullptr;
+    switch (compareType_) {
+      case Compare_Undefined:
+        ty = "Undefined";
+        break;
+      case Compare_Null:
+        ty = "Null";
+        break;
+      case Compare_Int32:
+        ty = "Int32";
+        break;
+      case Compare_UInt32:
+        ty = "UInt32";
+        break;
+      case Compare_Int64:
+        ty = "Int64";
+        break;
+      case Compare_UInt64:
+        ty = "UInt64";
+        break;
+      case Compare_UIntPtr:
+        ty = "UIntPtr";
+        break;
+      case Compare_Double:
+        ty = "Double";
+        break;
+      case Compare_Float32:
+        ty = "Float32";
+        break;
+      case Compare_String:
+        ty = "String";
+        break;
+      case Compare_Symbol:
+        ty = "Symbol";
+        break;
+      case Compare_Object:
+        ty = "Object";
+        break;
+      case Compare_BigInt:
+        ty = "BigInt";
+        break;
+      case Compare_BigInt_Int32:
+        ty = "BigInt_Int32";
+        break;
+      case Compare_BigInt_Double:
+        ty = "BigInt_Double";
+        break;
+      case Compare_BigInt_String:
+        ty = "BigInt_String";
+        break;
+      case Compare_RefOrNull:
+        ty = "RefOrNull";
+        break;
+      default:
+        ty = "!!unknown!!";
+        break;
+    };
+    char buf[64];
+    SprintfLiteral(buf, "ty=%s jsop=%s", ty, CodeName(jsop()));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Takes a typed value and returns an untyped value.
+class MBox : public MUnaryInstruction, public NoTypePolicy::Data {
+  explicit MBox(MDefinition* ins) : MUnaryInstruction(classOpcode, ins) {
+    // Cannot box a box.
+    MOZ_ASSERT(ins->type() != MIRType::Value);
+
+    setResultType(MIRType::Value);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Box)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MBox)
+};
+
+// Note: the op may have been inverted during lowering (to put constants in a
+// position where they can be immediates), so it is important to use the
+// lir->jsop() instead of the mir->jsop() when it is present.
+static inline Assembler::Condition JSOpToCondition(
+    MCompare::CompareType compareType, JSOp op) {
+  bool isSigned = (compareType != MCompare::Compare_UInt32 &&
+                   compareType != MCompare::Compare_UInt64 &&
+                   compareType != MCompare::Compare_UIntPtr);
+  return JSOpToCondition(op, isSigned);
+}
+
+// Takes a typed value and checks if it is a certain type. If so, the payload
+// is unpacked and returned as that type. Otherwise, it is considered a
+// deoptimization.
+class MUnbox final : public MUnaryInstruction, public BoxInputsPolicy::Data {
+ public:
+  enum Mode {
+    Fallible,    // Check the type, and deoptimize if unexpected.
+    Infallible,  // Type guard is not necessary.
+  };
+
+ private:
+  Mode mode_;
+
+  MUnbox(MDefinition* ins, MIRType type, Mode mode)
+      : MUnaryInstruction(classOpcode, ins), mode_(mode) {
+    // Only allow unboxing a non MIRType::Value when input and output types
+    // don't match. This is often used to force a bailout. Boxing happens
+    // during type analysis.
+    MOZ_ASSERT_IF(ins->type() != MIRType::Value, type != ins->type());
+
+    MOZ_ASSERT(type == MIRType::Boolean || type == MIRType::Int32 ||
+               type == MIRType::Double || type == MIRType::String ||
+               type == MIRType::Symbol || type == MIRType::BigInt ||
+               type == MIRType::Object);
+
+    setResultType(type);
+    setMovable();
+
+    if (mode_ == Fallible) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(Unbox)
+  TRIVIAL_NEW_WRAPPERS
+
+  Mode mode() const { return mode_; }
+  bool fallible() const { return mode() != Infallible; }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isUnbox() || ins->toUnbox()->mode() != mode()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MUnbox)
+};
+
+class MAssertRange : public MUnaryInstruction, public NoTypePolicy::Data {
+  // This is the range checked by the assertion. Don't confuse this with the
+  // range_ member or the range() accessor. Since MAssertRange doesn't return
+  // a value, it doesn't use those.
+  const Range* assertedRange_;
+
+  MAssertRange(MDefinition* ins, const Range* assertedRange)
+      : MUnaryInstruction(classOpcode, ins), assertedRange_(assertedRange) {
+    setGuard();
+    setResultType(MIRType::None);
+  }
+
+ public:
+  INSTRUCTION_HEADER(AssertRange)
+  TRIVIAL_NEW_WRAPPERS
+
+  const Range* assertedRange() const { return assertedRange_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+};
+
+class MAssertClass : public MUnaryInstruction, public NoTypePolicy::Data {
+  const JSClass* class_;
+
+  MAssertClass(MDefinition* obj, const JSClass* clasp)
+      : MUnaryInstruction(classOpcode, obj), class_(clasp) {
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    setGuard();
+    setResultType(MIRType::None);
+  }
+
+ public:
+  INSTRUCTION_HEADER(AssertClass)
+  TRIVIAL_NEW_WRAPPERS
+
+  const JSClass* getClass() const { return class_; }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MAssertShape : public MUnaryInstruction, public NoTypePolicy::Data {
+  CompilerShape shape_;
+
+  MAssertShape(MDefinition* obj, Shape* shape)
+      : MUnaryInstruction(classOpcode, obj), shape_(shape) {
+    MOZ_ASSERT(obj->type() == MIRType::Object);
+
+    setGuard();
+    setResultType(MIRType::None);
+  }
+
+ public:
+  INSTRUCTION_HEADER(AssertShape)
+  TRIVIAL_NEW_WRAPPERS
+
+  const Shape* shape() const { return shape_; }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Eager initialization of arguments object.
+class MCreateArgumentsObject : public MUnaryInstruction,
+                               public ObjectPolicy<0>::Data {
+  CompilerGCPointer<ArgumentsObject*> templateObj_;
+
+  MCreateArgumentsObject(MDefinition* callObj, ArgumentsObject* templateObj)
+      : MUnaryInstruction(classOpcode, callObj), templateObj_(templateObj) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(CreateArgumentsObject)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, getCallObject))
+
+  ArgumentsObject* templateObject() const { return templateObj_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool possiblyCalls() const override { return true; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+// Eager initialization of arguments object for inlined function
+class MCreateInlinedArgumentsObject : public MVariadicInstruction,
+                                      public NoFloatPolicyAfter<0>::Data {
+  CompilerGCPointer<ArgumentsObject*> templateObj_;
+
+  explicit MCreateInlinedArgumentsObject(ArgumentsObject* templateObj)
+      : MVariadicInstruction(classOpcode), templateObj_(templateObj) {
+    setResultType(MIRType::Object);
+  }
+
+  static const size_t NumNonArgumentOperands = 2;
+
+ public:
+  INSTRUCTION_HEADER(CreateInlinedArgumentsObject)
+  static MCreateInlinedArgumentsObject* New(TempAllocator& alloc,
+                                            MDefinition* callObj,
+                                            MDefinition* callee,
+                                            MDefinitionVector& args,
+                                            ArgumentsObject* templateObj);
+  NAMED_OPERANDS((0, getCallObject), (1, getCallee))
+
+  ArgumentsObject* templateObject() const { return templateObj_; }
+
+  MDefinition* getArg(uint32_t idx) const {
+    return getOperand(idx + NumNonArgumentOperands);
+  }
+  uint32_t numActuals() const { return numOperands() - NumNonArgumentOperands; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool possiblyCalls() const override { return true; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MGetInlinedArgument
+    : public MVariadicInstruction,
+      public MixPolicy<UnboxedInt32Policy<0>, NoFloatPolicyAfter<1>>::Data {
+  MGetInlinedArgument() : MVariadicInstruction(classOpcode) {
+    setResultType(MIRType::Value);
+  }
+
+  static const size_t NumNonArgumentOperands = 1;
+
+ public:
+  INSTRUCTION_HEADER(GetInlinedArgument)
+  static MGetInlinedArgument* New(TempAllocator& alloc, MDefinition* index,
+                                  MCreateInlinedArgumentsObject* args);
+  static MGetInlinedArgument* New(TempAllocator& alloc, MDefinition* index,
+                                  const CallInfo& callInfo);
+  NAMED_OPERANDS((0, index))
+
+  MDefinition* getArg(uint32_t idx) const {
+    return getOperand(idx + NumNonArgumentOperands);
+  }
+  uint32_t numActuals() const { return numOperands() - NumNonArgumentOperands; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+class MGetInlinedArgumentHole
+    : public MVariadicInstruction,
+      public MixPolicy<UnboxedInt32Policy<0>, NoFloatPolicyAfter<1>>::Data {
+  MGetInlinedArgumentHole() : MVariadicInstruction(classOpcode) {
+    setGuard();
+    setResultType(MIRType::Value);
+  }
+
+  static const size_t NumNonArgumentOperands = 1;
+
+ public:
+  INSTRUCTION_HEADER(GetInlinedArgumentHole)
+  static MGetInlinedArgumentHole* New(TempAllocator& alloc, MDefinition* index,
+                                      MCreateInlinedArgumentsObject* args);
+  NAMED_OPERANDS((0, index))
+
+  MDefinition* getArg(uint32_t idx) const {
+    return getOperand(idx + NumNonArgumentOperands);
+  }
+  uint32_t numActuals() const { return numOperands() - NumNonArgumentOperands; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+class MInlineArgumentsSlice
+    : public MVariadicInstruction,
+      public MixPolicy<UnboxedInt32Policy<0>, UnboxedInt32Policy<1>,
+                       NoFloatPolicyAfter<2>>::Data {
+  JSObject* templateObj_;
+  gc::Heap initialHeap_;
+
+  MInlineArgumentsSlice(JSObject* templateObj, gc::Heap initialHeap)
+      : MVariadicInstruction(classOpcode),
+        templateObj_(templateObj),
+        initialHeap_(initialHeap) {
+    setResultType(MIRType::Object);
+  }
+
+  static const size_t NumNonArgumentOperands = 2;
+
+ public:
+  INSTRUCTION_HEADER(InlineArgumentsSlice)
+  static MInlineArgumentsSlice* New(TempAllocator& alloc, MDefinition* begin,
+                                    MDefinition* count,
+                                    MCreateInlinedArgumentsObject* args,
+                                    JSObject* templateObj,
+                                    gc::Heap initialHeap);
+  NAMED_OPERANDS((0, begin), (1, count))
+
+  JSObject* templateObj() const { return templateObj_; }
+  gc::Heap initialHeap() const { return initialHeap_; }
+
+  MDefinition* getArg(uint32_t idx) const {
+    return getOperand(idx + NumNonArgumentOperands);
+  }
+  uint32_t numActuals() const { return numOperands() - NumNonArgumentOperands; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// Allocates a new BoundFunctionObject and calls
+// BoundFunctionObject::functionBindImpl. This instruction can have arbitrary
+// side-effects because the GetProperty calls for length/name can call into JS.
+class MBindFunction
+    : public MVariadicInstruction,
+      public MixPolicy<ObjectPolicy<0>, NoFloatPolicyAfter<1>>::Data {
+  CompilerGCPointer<JSObject*> templateObj_;
+
+  explicit MBindFunction(JSObject* templateObj)
+      : MVariadicInstruction(classOpcode), templateObj_(templateObj) {
+    setResultType(MIRType::Object);
+  }
+
+  // The target object is operand 0.
+  static const size_t NumNonArgumentOperands = 1;
+
+ public:
+  INSTRUCTION_HEADER(BindFunction)
+  static MBindFunction* New(TempAllocator& alloc, MDefinition* target,
+                            uint32_t argc, JSObject* templateObj);
+  NAMED_OPERANDS((0, target))
+
+  JSObject* templateObject() const { return templateObj_; }
+
+  MDefinition* getArg(uint32_t idx) const {
+    return getOperand(idx + NumNonArgumentOperands);
+  }
+  void initArg(size_t i, MDefinition* arg) {
+    initOperand(NumNonArgumentOperands + i, arg);
+  }
+  uint32_t numStackArgs() const {
+    return numOperands() - NumNonArgumentOperands;
+  }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MToFPInstruction : public MUnaryInstruction, public ToDoublePolicy::Data {
+ public:
+  // Types of values which can be converted.
+  enum ConversionKind { NonStringPrimitives, NumbersOnly };
+
+ private:
+  ConversionKind conversion_;
+
+ protected:
+  MToFPInstruction(Opcode op, MDefinition* def,
+                   ConversionKind conversion = NonStringPrimitives)
+      : MUnaryInstruction(op, def), conversion_(conversion) {}
+
+ public:
+  ConversionKind conversion() const { return conversion_; }
+};
+
+// Converts a primitive (either typed or untyped) to a double. If the input is
+// not primitive at runtime, a bailout occurs.
+class MToDouble : public MToFPInstruction {
+ private:
+  TruncateKind implicitTruncate_;
+
+  explicit MToDouble(MDefinition* def,
+                     ConversionKind conversion = NonStringPrimitives)
+      : MToFPInstruction(classOpcode, def, conversion),
+        implicitTruncate_(TruncateKind::NoTruncate) {
+    setResultType(MIRType::Double);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (!def->definitelyType({MIRType::Undefined, MIRType::Null,
+                              MIRType::Boolean, MIRType::Int32, MIRType::Double,
+                              MIRType::Float32, MIRType::String})) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToDouble)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isToDouble() || ins->toToDouble()->conversion() != conversion()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+
+  TruncateKind truncateKind() const { return implicitTruncate_; }
+  void setTruncateKind(TruncateKind kind) {
+    implicitTruncate_ = std::max(implicitTruncate_, kind);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    if (input()->type() == MIRType::Value) {
+      return false;
+    }
+    if (input()->type() == MIRType::Symbol) {
+      return false;
+    }
+    if (input()->type() == MIRType::BigInt) {
+      return false;
+    }
+
+    return true;
+  }
+
+  ALLOW_CLONE(MToDouble)
+};
+
+// Converts a primitive (either typed or untyped) to a float32. If the input is
+// not primitive at runtime, a bailout occurs.
+class MToFloat32 : public MToFPInstruction {
+  bool mustPreserveNaN_;
+
+  explicit MToFloat32(MDefinition* def,
+                      ConversionKind conversion = NonStringPrimitives)
+      : MToFPInstruction(classOpcode, def, conversion),
+        mustPreserveNaN_(false) {
+    setResultType(MIRType::Float32);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (!def->definitelyType({MIRType::Undefined, MIRType::Null,
+                              MIRType::Boolean, MIRType::Int32, MIRType::Double,
+                              MIRType::Float32, MIRType::String})) {
+      setGuard();
+    }
+  }
+
+  explicit MToFloat32(MDefinition* def, bool mustPreserveNaN)
+      : MToFloat32(def) {
+    mustPreserveNaN_ = mustPreserveNaN;
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToFloat32)
+  TRIVIAL_NEW_WRAPPERS
+
+  virtual MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!congruentIfOperandsEqual(ins)) {
+      return false;
+    }
+    auto* other = ins->toToFloat32();
+    return other->conversion() == conversion() &&
+           other->mustPreserveNaN_ == mustPreserveNaN_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+
+  bool canConsumeFloat32(MUse* use) const override { return true; }
+  bool canProduceFloat32() const override { return true; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MToFloat32)
+};
+
+// Converts a uint32 to a float32 (coming from wasm).
+class MWasmUnsignedToFloat32 : public MUnaryInstruction,
+                               public NoTypePolicy::Data {
+  explicit MWasmUnsignedToFloat32(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    setResultType(MIRType::Float32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmUnsignedToFloat32)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool canProduceFloat32() const override { return true; }
+};
+
+class MWrapInt64ToInt32 : public MUnaryInstruction, public NoTypePolicy::Data {
+  bool bottomHalf_;
+
+  explicit MWrapInt64ToInt32(MDefinition* def, bool bottomHalf = true)
+      : MUnaryInstruction(classOpcode, def), bottomHalf_(bottomHalf) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WrapInt64ToInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isWrapInt64ToInt32()) {
+      return false;
+    }
+    if (ins->toWrapInt64ToInt32()->bottomHalf() != bottomHalf()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool bottomHalf() const { return bottomHalf_; }
+};
+
+class MExtendInt32ToInt64 : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+  bool isUnsigned_;
+
+  MExtendInt32ToInt64(MDefinition* def, bool isUnsigned)
+      : MUnaryInstruction(classOpcode, def), isUnsigned_(isUnsigned) {
+    setResultType(MIRType::Int64);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(ExtendInt32ToInt64)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return isUnsigned_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isExtendInt32ToInt64()) {
+      return false;
+    }
+    if (ins->toExtendInt32ToInt64()->isUnsigned_ != isUnsigned_) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// The same as MWasmTruncateToInt64 but with the Instance dependency.
+// It used only for arm now because on arm we need to call builtin to truncate
+// to i64.
+class MWasmBuiltinTruncateToInt64 : public MAryInstruction<2>,
+                                    public NoTypePolicy::Data {
+  TruncFlags flags_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmBuiltinTruncateToInt64(MDefinition* def, MDefinition* instance,
+                              TruncFlags flags,
+                              wasm::BytecodeOffset bytecodeOffset)
+      : MAryInstruction(classOpcode),
+        flags_(flags),
+        bytecodeOffset_(bytecodeOffset) {
+    initOperand(0, def);
+    initOperand(1, instance);
+
+    setResultType(MIRType::Int64);
+    setGuard();  // neither removable nor movable because of possible
+                 // side-effects.
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBuiltinTruncateToInt64)
+  NAMED_OPERANDS((0, input), (1, instance));
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return flags_ & TRUNC_UNSIGNED; }
+  bool isSaturating() const { return flags_ & TRUNC_SATURATING; }
+  TruncFlags flags() const { return flags_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmBuiltinTruncateToInt64()->flags() == flags_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MWasmTruncateToInt64 : public MUnaryInstruction,
+                             public NoTypePolicy::Data {
+  TruncFlags flags_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmTruncateToInt64(MDefinition* def, TruncFlags flags,
+                       wasm::BytecodeOffset bytecodeOffset)
+      : MUnaryInstruction(classOpcode, def),
+        flags_(flags),
+        bytecodeOffset_(bytecodeOffset) {
+    setResultType(MIRType::Int64);
+    setGuard();  // neither removable nor movable because of possible
+                 // side-effects.
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmTruncateToInt64)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return flags_ & TRUNC_UNSIGNED; }
+  bool isSaturating() const { return flags_ & TRUNC_SATURATING; }
+  TruncFlags flags() const { return flags_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmTruncateToInt64()->flags() == flags_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Truncate a value to an int32, with wasm semantics: this will trap when the
+// value is out of range.
+class MWasmTruncateToInt32 : public MUnaryInstruction,
+                             public NoTypePolicy::Data {
+  TruncFlags flags_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmTruncateToInt32(MDefinition* def, TruncFlags flags,
+                                wasm::BytecodeOffset bytecodeOffset)
+      : MUnaryInstruction(classOpcode, def),
+        flags_(flags),
+        bytecodeOffset_(bytecodeOffset) {
+    setResultType(MIRType::Int32);
+    setGuard();  // neither removable nor movable because of possible
+                 // side-effects.
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmTruncateToInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return flags_ & TRUNC_UNSIGNED; }
+  bool isSaturating() const { return flags_ & TRUNC_SATURATING; }
+  TruncFlags flags() const { return flags_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmTruncateToInt32()->flags() == flags_;
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Converts an int32 value to intptr by sign-extending it.
+class MInt32ToIntPtr : public MUnaryInstruction,
+                       public UnboxedInt32Policy<0>::Data {
+  bool canBeNegative_ = true;
+
+  explicit MInt32ToIntPtr(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    setResultType(MIRType::IntPtr);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Int32ToIntPtr)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool canBeNegative() const { return canBeNegative_; }
+  void setCanNotBeNegative() { canBeNegative_ = false; }
+
+  void computeRange(TempAllocator& alloc) override;
+  void collectRangeInfoPreTrunc() override;
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Converts an IntPtr value >= 0 to Int32. Bails out if the value > INT32_MAX.
+class MNonNegativeIntPtrToInt32 : public MUnaryInstruction,
+                                  public NoTypePolicy::Data {
+  explicit MNonNegativeIntPtrToInt32(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    MOZ_ASSERT(def->type() == MIRType::IntPtr);
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NonNegativeIntPtrToInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  void computeRange(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Converts an IntPtr value to Double.
+class MIntPtrToDouble : public MUnaryInstruction, public NoTypePolicy::Data {
+  explicit MIntPtrToDouble(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    MOZ_ASSERT(def->type() == MIRType::IntPtr);
+    setResultType(MIRType::Double);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(IntPtrToDouble)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Subtracts (byteSize - 1) from the input value. Bails out if the result is
+// negative. This is used to implement bounds checks for DataView accesses.
+class MAdjustDataViewLength : public MUnaryInstruction,
+                              public NoTypePolicy::Data {
+  const uint32_t byteSize_;
+
+  MAdjustDataViewLength(MDefinition* input, uint32_t byteSize)
+      : MUnaryInstruction(classOpcode, input), byteSize_(byteSize) {
+    MOZ_ASSERT(input->type() == MIRType::IntPtr);
+    MOZ_ASSERT(byteSize > 1);
+    setResultType(MIRType::IntPtr);
+    setMovable();
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(AdjustDataViewLength)
+  TRIVIAL_NEW_WRAPPERS
+
+  uint32_t byteSize() const { return byteSize_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isAdjustDataViewLength()) {
+      return false;
+    }
+    if (ins->toAdjustDataViewLength()->byteSize() != byteSize()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MInt64ToFloatingPoint : public MUnaryInstruction,
+                              public NoTypePolicy::Data {
+  bool isUnsigned_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MInt64ToFloatingPoint(MDefinition* def, MIRType type,
+                        wasm::BytecodeOffset bytecodeOffset, bool isUnsigned)
+      : MUnaryInstruction(classOpcode, def),
+        isUnsigned_(isUnsigned),
+        bytecodeOffset_(bytecodeOffset) {
+    MOZ_ASSERT(IsFloatingPointType(type));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Int64ToFloatingPoint)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return isUnsigned_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isInt64ToFloatingPoint()) {
+      return false;
+    }
+    if (ins->toInt64ToFloatingPoint()->isUnsigned_ != isUnsigned_) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// It used only for arm now because on arm we need to call builtin to convert
+// i64 to float.
+class MBuiltinInt64ToFloatingPoint : public MAryInstruction<2>,
+                                     public NoTypePolicy::Data {
+  bool isUnsigned_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MBuiltinInt64ToFloatingPoint(MDefinition* def, MDefinition* instance,
+                               MIRType type,
+                               wasm::BytecodeOffset bytecodeOffset,
+                               bool isUnsigned)
+      : MAryInstruction(classOpcode),
+        isUnsigned_(isUnsigned),
+        bytecodeOffset_(bytecodeOffset) {
+    MOZ_ASSERT(IsFloatingPointType(type));
+    initOperand(0, def);
+    initOperand(1, instance);
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(BuiltinInt64ToFloatingPoint)
+  NAMED_OPERANDS((0, input), (1, instance));
+  TRIVIAL_NEW_WRAPPERS
+
+  bool isUnsigned() const { return isUnsigned_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isBuiltinInt64ToFloatingPoint()) {
+      return false;
+    }
+    if (ins->toBuiltinInt64ToFloatingPoint()->isUnsigned_ != isUnsigned_) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Applies ECMA's ToNumber on a primitive (either typed or untyped) and expects
+// the result to be precisely representable as an Int32, otherwise bails.
+//
+// If the input is not primitive at runtime, a bailout occurs. If the input
+// cannot be converted to an int32 without loss (i.e. 5.5 or undefined) then a
+// bailout occurs.
+class MToNumberInt32 : public MUnaryInstruction, public ToInt32Policy::Data {
+  bool needsNegativeZeroCheck_;
+  IntConversionInputKind conversion_;
+
+  explicit MToNumberInt32(MDefinition* def, IntConversionInputKind conversion =
+                                                IntConversionInputKind::Any)
+      : MUnaryInstruction(classOpcode, def),
+        needsNegativeZeroCheck_(true),
+        conversion_(conversion) {
+    setResultType(MIRType::Int32);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (!def->definitelyType({MIRType::Undefined, MIRType::Null,
+                              MIRType::Boolean, MIRType::Int32, MIRType::Double,
+                              MIRType::Float32, MIRType::String})) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToNumberInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  // this only has backwards information flow.
+  void analyzeEdgeCasesBackward() override;
+
+  bool needsNegativeZeroCheck() const { return needsNegativeZeroCheck_; }
+  void setNeedsNegativeZeroCheck(bool needsCheck) {
+    needsNegativeZeroCheck_ = needsCheck;
+  }
+
+  IntConversionInputKind conversion() const { return conversion_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isToNumberInt32() ||
+        ins->toToNumberInt32()->conversion() != conversion()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+  void collectRangeInfoPreTrunc() override;
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+
+  ALLOW_CLONE(MToNumberInt32)
+};
+
+// Converts a value or typed input to a truncated int32, for use with bitwise
+// operations. This is an infallible ValueToECMAInt32.
+class MTruncateToInt32 : public MUnaryInstruction, public ToInt32Policy::Data {
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MTruncateToInt32(
+      MDefinition* def,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset())
+      : MUnaryInstruction(classOpcode, def), bytecodeOffset_(bytecodeOffset) {
+    setResultType(MIRType::Int32);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (mightHaveSideEffects(def)) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(TruncateToInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  static bool mightHaveSideEffects(MDefinition* def) {
+    return !def->definitelyType(
+        {MIRType::Undefined, MIRType::Null, MIRType::Boolean, MIRType::Int32,
+         MIRType::Double, MIRType::Float32, MIRType::String});
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    return input()->type() < MIRType::Symbol;
+  }
+
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  ALLOW_CLONE(MTruncateToInt32)
+};
+
+// It is like MTruncateToInt32 but with instance dependency.
+class MWasmBuiltinTruncateToInt32 : public MAryInstruction<2>,
+                                    public ToInt32Policy::Data {
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmBuiltinTruncateToInt32(
+      MDefinition* def, MDefinition* instance,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset())
+      : MAryInstruction(classOpcode), bytecodeOffset_(bytecodeOffset) {
+    initOperand(0, def);
+    initOperand(1, instance);
+    setResultType(MIRType::Int32);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (MTruncateToInt32::mightHaveSideEffects(def)) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBuiltinTruncateToInt32)
+  NAMED_OPERANDS((0, input), (1, instance))
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  ALLOW_CLONE(MWasmBuiltinTruncateToInt32)
+};
+
+// Converts a primitive (either typed or untyped) to a BigInt. If the input is
+// not primitive at runtime, a bailout occurs.
+class MToBigInt : public MUnaryInstruction, public ToBigIntPolicy::Data {
+ private:
+  explicit MToBigInt(MDefinition* def) : MUnaryInstruction(classOpcode, def) {
+    setResultType(MIRType::BigInt);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (!def->definitelyType({MIRType::Boolean, MIRType::BigInt})) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToBigInt)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MToBigInt)
+};
+
+// Takes a Value or typed input and returns a suitable Int64 using the
+// ToBigInt algorithm, possibly calling out to the VM for string, etc inputs.
+class MToInt64 : public MUnaryInstruction, public ToInt64Policy::Data {
+  explicit MToInt64(MDefinition* def) : MUnaryInstruction(classOpcode, def) {
+    setResultType(MIRType::Int64);
+    setMovable();
+
+    // Guard unless the conversion is known to be non-effectful & non-throwing.
+    if (!def->definitelyType(
+            {MIRType::Boolean, MIRType::BigInt, MIRType::Int64})) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToInt64)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MToInt64)
+};
+
+// Takes a BigInt pointer and returns its toInt64 value.
+class MTruncateBigIntToInt64 : public MUnaryInstruction,
+                               public NoTypePolicy::Data {
+  explicit MTruncateBigIntToInt64(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    MOZ_ASSERT(def->type() == MIRType::BigInt);
+    setResultType(MIRType::Int64);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(TruncateBigIntToInt64)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MTruncateBigIntToInt64)
+};
+
+// Takes an Int64 and returns a fresh BigInt pointer.
+class MInt64ToBigInt : public MUnaryInstruction, public NoTypePolicy::Data {
+  explicit MInt64ToBigInt(MDefinition* def)
+      : MUnaryInstruction(classOpcode, def) {
+    MOZ_ASSERT(def->type() == MIRType::Int64);
+    setResultType(MIRType::BigInt);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Int64ToBigInt)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MInt64ToBigInt)
+};
+
+// Converts any type to a string
+class MToString : public MUnaryInstruction, public ToStringPolicy::Data {
+ public:
+  // MToString has two modes for handling of object/symbol arguments: if the
+  // to-string conversion happens as part of another opcode, we have to bail out
+  // to Baseline. If the conversion is for a stand-alone JSOp we can support
+  // side-effects.
+  enum class SideEffectHandling { Bailout, Supported };
+
+ private:
+  SideEffectHandling sideEffects_;
+  bool mightHaveSideEffects_ = false;
+
+  MToString(MDefinition* def, SideEffectHandling sideEffects)
+      : MUnaryInstruction(classOpcode, def), sideEffects_(sideEffects) {
+    setResultType(MIRType::String);
+
+    if (!def->definitelyType({MIRType::Undefined, MIRType::Null,
+                              MIRType::Boolean, MIRType::Int32, MIRType::Double,
+                              MIRType::Float32, MIRType::String,
+                              MIRType::BigInt})) {
+      mightHaveSideEffects_ = true;
+    }
+
+    // If this instruction is not effectful, mark it as movable and set the
+    // Guard flag if needed. If the operation is effectful it won't be
+    // optimized anyway so there's no need to set any flags.
+    if (!isEffectful()) {
+      setMovable();
+      // Objects might override toString; Symbol throws. We bailout in those
+      // cases and run side-effects in baseline instead.
+      if (mightHaveSideEffects_) {
+        setGuard();
+      }
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(ToString)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isToString()) {
+      return false;
+    }
+    if (sideEffects_ != ins->toToString()->sideEffects_) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    if (supportSideEffects() && mightHaveSideEffects_) {
+      return AliasSet::Store(AliasSet::Any);
+    }
+    return AliasSet::None();
+  }
+
+  bool mightHaveSideEffects() const { return mightHaveSideEffects_; }
+
+  bool supportSideEffects() const {
+    return sideEffects_ == SideEffectHandling::Supported;
+  }
+
+  bool needsSnapshot() const {
+    return sideEffects_ == SideEffectHandling::Bailout && mightHaveSideEffects_;
+  }
+
+  ALLOW_CLONE(MToString)
+};
+
+class MBitNot : public MUnaryInstruction, public BitwisePolicy::Data {
+  explicit MBitNot(MDefinition* input) : MUnaryInstruction(classOpcode, input) {
+    setResultType(MIRType::Int32);
+    if (input->type() == MIRType::Int64) {
+      setResultType(MIRType::Int64);
+    }
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(BitNot)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBitNot)
+};
+
+class MTypeOf : public MUnaryInstruction,
+                public BoxExceptPolicy<0, MIRType::Object>::Data {
+  explicit MTypeOf(MDefinition* def) : MUnaryInstruction(classOpcode, def) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+  TypeDataList observed_;
+
+ public:
+  INSTRUCTION_HEADER(TypeOf)
+  TRIVIAL_NEW_WRAPPERS
+
+  void setObservedTypes(const TypeDataList& observed) { observed_ = observed; }
+  bool hasObservedTypes() const { return observed_.count() > 0; }
+  const TypeDataList& observedTypes() const { return observed_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MTypeOfIs : public MUnaryInstruction, public NoTypePolicy::Data {
+  JSOp jsop_;
+  JSType jstype_;
+
+  MTypeOfIs(MDefinition* def, JSOp jsop, JSType jstype)
+      : MUnaryInstruction(classOpcode, def), jsop_(jsop), jstype_(jstype) {
+    MOZ_ASSERT(def->type() == MIRType::Object || def->type() == MIRType::Value);
+
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(TypeOfIs)
+  TRIVIAL_NEW_WRAPPERS
+
+  JSOp jsop() const { return jsop_; }
+  JSType jstype() const { return jstype_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!congruentIfOperandsEqual(ins)) {
+      return false;
+    }
+    return jsop() == ins->toTypeOfIs()->jsop() &&
+           jstype() == ins->toTypeOfIs()->jstype();
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+};
+
+class MBinaryBitwiseInstruction : public MBinaryInstruction,
+                                  public BitwisePolicy::Data {
+ protected:
+  MBinaryBitwiseInstruction(Opcode op, MDefinition* left, MDefinition* right,
+                            MIRType type)
+      : MBinaryInstruction(op, left, right),
+        maskMatchesLeftRange(false),
+        maskMatchesRightRange(false) {
+    MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Int64 ||
+               (isUrsh() && type == MIRType::Double));
+    setResultType(type);
+    setMovable();
+  }
+
+  bool maskMatchesLeftRange;
+  bool maskMatchesRightRange;
+
+ public:
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  MDefinition* foldUnnecessaryBitop();
+  virtual MDefinition* foldIfZero(size_t operand) = 0;
+  virtual MDefinition* foldIfNegOne(size_t operand) = 0;
+  virtual MDefinition* foldIfEqual() = 0;
+  virtual MDefinition* foldIfAllBitsSet(size_t operand) = 0;
+  void collectRangeInfoPreTrunc() override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return binaryCongruentTo(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  TruncateKind operandTruncateKind(size_t index) const override;
+};
+
+class MBitAnd : public MBinaryBitwiseInstruction {
+  MBitAnd(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryBitwiseInstruction(classOpcode, left, right, type) {
+    setCommutative();
+  }
+
+ public:
+  INSTRUCTION_HEADER(BitAnd)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldIfZero(size_t operand) override {
+    return getOperand(operand);  // 0 & x => 0;
+  }
+  MDefinition* foldIfNegOne(size_t operand) override {
+    return getOperand(1 - operand);  // x & -1 => x
+  }
+  MDefinition* foldIfEqual() override {
+    return getOperand(0);  // x & x => x;
+  }
+  MDefinition* foldIfAllBitsSet(size_t operand) override {
+    // e.g. for uint16: x & 0xffff => x;
+    return getOperand(1 - operand);
+  }
+  void computeRange(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBitAnd)
+};
+
+class MBitOr : public MBinaryBitwiseInstruction {
+  MBitOr(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryBitwiseInstruction(classOpcode, left, right, type) {
+    setCommutative();
+  }
+
+ public:
+  INSTRUCTION_HEADER(BitOr)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldIfZero(size_t operand) override {
+    return getOperand(1 -
+                      operand);  // 0 | x => x, so if ith is 0, return (1-i)th
+  }
+  MDefinition* foldIfNegOne(size_t operand) override {
+    return getOperand(operand);  // x | -1 => -1
+  }
+  MDefinition* foldIfEqual() override {
+    return getOperand(0);  // x | x => x
+  }
+  MDefinition* foldIfAllBitsSet(size_t operand) override { return this; }
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBitOr)
+};
+
+class MBitXor : public MBinaryBitwiseInstruction {
+  MBitXor(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryBitwiseInstruction(classOpcode, left, right, type) {
+    setCommutative();
+  }
+
+ public:
+  INSTRUCTION_HEADER(BitXor)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldIfZero(size_t operand) override {
+    return getOperand(1 - operand);  // 0 ^ x => x
+  }
+  MDefinition* foldIfNegOne(size_t operand) override { return this; }
+  MDefinition* foldIfEqual() override { return this; }
+  MDefinition* foldIfAllBitsSet(size_t operand) override { return this; }
+  void computeRange(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBitXor)
+};
+
+class MShiftInstruction : public MBinaryBitwiseInstruction {
+ protected:
+  MShiftInstruction(Opcode op, MDefinition* left, MDefinition* right,
+                    MIRType type)
+      : MBinaryBitwiseInstruction(op, left, right, type) {}
+
+ public:
+  MDefinition* foldIfNegOne(size_t operand) override { return this; }
+  MDefinition* foldIfEqual() override { return this; }
+  MDefinition* foldIfAllBitsSet(size_t operand) override { return this; }
+};
+
+class MLsh : public MShiftInstruction {
+  MLsh(MDefinition* left, MDefinition* right, MIRType type)
+      : MShiftInstruction(classOpcode, left, right, type) {}
+
+ public:
+  INSTRUCTION_HEADER(Lsh)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldIfZero(size_t operand) override {
+    // 0 << x => 0
+    // x << 0 => x
+    return getOperand(0);
+  }
+
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MLsh)
+};
+
+class MRsh : public MShiftInstruction {
+  MRsh(MDefinition* left, MDefinition* right, MIRType type)
+      : MShiftInstruction(classOpcode, left, right, type) {}
+
+ public:
+  INSTRUCTION_HEADER(Rsh)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldIfZero(size_t operand) override {
+    // 0 >> x => 0
+    // x >> 0 => x
+    return getOperand(0);
+  }
+  void computeRange(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MRsh)
+};
+
+class MUrsh : public MShiftInstruction {
+  bool bailoutsDisabled_;
+
+  MUrsh(MDefinition* left, MDefinition* right, MIRType type)
+      : MShiftInstruction(classOpcode, left, right, type),
+        bailoutsDisabled_(false) {}
+
+ public:
+  INSTRUCTION_HEADER(Ursh)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MUrsh* NewWasm(TempAllocator& alloc, MDefinition* left,
+                        MDefinition* right, MIRType type);
+
+  MDefinition* foldIfZero(size_t operand) override {
+    // 0 >>> x => 0
+    if (operand == 0) {
+      return getOperand(0);
+    }
+
+    return this;
+  }
+
+  bool bailoutsDisabled() const { return bailoutsDisabled_; }
+
+  bool fallible() const;
+
+  void computeRange(TempAllocator& alloc) override;
+  void collectRangeInfoPreTrunc() override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MUrsh)
+};
+
+class MSignExtendInt32 : public MUnaryInstruction, public NoTypePolicy::Data {
+ public:
+  enum Mode { Byte, Half };
+
+ private:
+  Mode mode_;
+
+  MSignExtendInt32(MDefinition* op, Mode mode)
+      : MUnaryInstruction(classOpcode, op), mode_(mode) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(SignExtendInt32)
+  TRIVIAL_NEW_WRAPPERS
+
+  Mode mode() const { return mode_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!congruentIfOperandsEqual(ins)) {
+      return false;
+    }
+    return ins->isSignExtendInt32() && ins->toSignExtendInt32()->mode_ == mode_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MSignExtendInt32)
+};
+
+class MSignExtendInt64 : public MUnaryInstruction, public NoTypePolicy::Data {
+ public:
+  enum Mode { Byte, Half, Word };
+
+ private:
+  Mode mode_;
+
+  MSignExtendInt64(MDefinition* op, Mode mode)
+      : MUnaryInstruction(classOpcode, op), mode_(mode) {
+    setResultType(MIRType::Int64);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(SignExtendInt64)
+  TRIVIAL_NEW_WRAPPERS
+
+  Mode mode() const { return mode_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!congruentIfOperandsEqual(ins)) {
+      return false;
+    }
+    return ins->isSignExtendInt64() && ins->toSignExtendInt64()->mode_ == mode_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MSignExtendInt64)
+};
+
+class MBinaryArithInstruction : public MBinaryInstruction,
+                                public ArithPolicy::Data {
+  // Implicit truncate flag is set by the truncate backward range analysis
+  // optimization phase, and by wasm pre-processing. It is used in
+  // NeedNegativeZeroCheck to check if the result of a multiplication needs to
+  // produce -0 double value, and for avoiding overflow checks.
+
+  // This optimization happens when the multiplication cannot be truncated
+  // even if all uses are truncating its result, such as when the range
+  // analysis detect a precision loss in the multiplication.
+  TruncateKind implicitTruncate_;
+
+  // Whether we must preserve NaN semantics, and in particular not fold
+  // (x op id) or (id op x) to x, or replace a division by a multiply of the
+  // exact reciprocal.
+  bool mustPreserveNaN_;
+
+ protected:
+  MBinaryArithInstruction(Opcode op, MDefinition* left, MDefinition* right,
+                          MIRType type)
+      : MBinaryInstruction(op, left, right),
+        implicitTruncate_(TruncateKind::NoTruncate),
+        mustPreserveNaN_(false) {
+    MOZ_ASSERT(IsNumberType(type));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  void setMustPreserveNaN(bool b) { mustPreserveNaN_ = b; }
+  bool mustPreserveNaN() const { return mustPreserveNaN_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  virtual double getIdentity() = 0;
+
+  void setSpecialization(MIRType type) {
+    MOZ_ASSERT(IsNumberType(type));
+    setResultType(type);
+  }
+
+  virtual void trySpecializeFloat32(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!binaryCongruentTo(ins)) {
+      return false;
+    }
+    const auto* other = static_cast<const MBinaryArithInstruction*>(ins);
+    return other->mustPreserveNaN_ == mustPreserveNaN_;
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool isTruncated() const {
+    return implicitTruncate_ == TruncateKind::Truncate;
+  }
+  TruncateKind truncateKind() const { return implicitTruncate_; }
+  void setTruncateKind(TruncateKind kind) {
+    implicitTruncate_ = std::max(implicitTruncate_, kind);
+  }
+};
+
+class MMinMax : public MBinaryInstruction, public ArithPolicy::Data {
+  bool isMax_;
+
+  MMinMax(MDefinition* left, MDefinition* right, MIRType type, bool isMax)
+      : MBinaryInstruction(classOpcode, left, right), isMax_(isMax) {
+    MOZ_ASSERT(IsNumberType(type));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(MinMax)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MMinMax* NewWasm(TempAllocator& alloc, MDefinition* left,
+                          MDefinition* right, MIRType type, bool isMax) {
+    return New(alloc, left, right, type, isMax);
+  }
+
+  bool isMax() const { return isMax_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!congruentIfOperandsEqual(ins)) {
+      return false;
+    }
+    const MMinMax* other = ins->toMinMax();
+    return other->isMax() == isMax();
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MMinMax)
+};
+
+class MMinMaxArray : public MUnaryInstruction, public SingleObjectPolicy::Data {
+  bool isMax_;
+
+  MMinMaxArray(MDefinition* array, MIRType type, bool isMax)
+      : MUnaryInstruction(classOpcode, array), isMax_(isMax) {
+    MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Double);
+    setResultType(type);
+
+    // We can't DCE this, even if the result is unused, in case one of the
+    // elements of the array is an object with a `valueOf` function that
+    // must be called.
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(MinMaxArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, array))
+
+  bool isMax() const { return isMax_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isMinMaxArray() || ins->toMinMaxArray()->isMax() != isMax()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields | AliasSet::Element);
+  }
+};
+
+class MAbs : public MUnaryInstruction, public ArithPolicy::Data {
+  bool implicitTruncate_;
+
+  MAbs(MDefinition* num, MIRType type)
+      : MUnaryInstruction(classOpcode, num), implicitTruncate_(false) {
+    MOZ_ASSERT(IsNumberType(type));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Abs)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MAbs* NewWasm(TempAllocator& alloc, MDefinition* num, MIRType type) {
+    auto* ins = new (alloc) MAbs(num, type);
+    if (type == MIRType::Int32) {
+      ins->implicitTruncate_ = true;
+    }
+    return ins;
+  }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  bool fallible() const;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MAbs)
+};
+
+class MClz : public MUnaryInstruction, public BitwisePolicy::Data {
+  bool operandIsNeverZero_;
+
+  explicit MClz(MDefinition* num, MIRType type)
+      : MUnaryInstruction(classOpcode, num), operandIsNeverZero_(false) {
+    MOZ_ASSERT(IsIntType(type));
+    MOZ_ASSERT(IsNumberType(num->type()));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Clz)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, num))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool operandIsNeverZero() const { return operandIsNeverZero_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void computeRange(TempAllocator& alloc) override;
+  void collectRangeInfoPreTrunc() override;
+};
+
+class MCtz : public MUnaryInstruction, public BitwisePolicy::Data {
+  bool operandIsNeverZero_;
+
+  explicit MCtz(MDefinition* num, MIRType type)
+      : MUnaryInstruction(classOpcode, num), operandIsNeverZero_(false) {
+    MOZ_ASSERT(IsIntType(type));
+    MOZ_ASSERT(IsNumberType(num->type()));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Ctz)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, num))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool operandIsNeverZero() const { return operandIsNeverZero_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void computeRange(TempAllocator& alloc) override;
+  void collectRangeInfoPreTrunc() override;
+};
+
+class MPopcnt : public MUnaryInstruction, public BitwisePolicy::Data {
+  explicit MPopcnt(MDefinition* num, MIRType type)
+      : MUnaryInstruction(classOpcode, num) {
+    MOZ_ASSERT(IsNumberType(num->type()));
+    MOZ_ASSERT(IsIntType(type));
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Popcnt)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, num))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void computeRange(TempAllocator& alloc) override;
+};
+
+// Inline implementation of Math.sqrt().
+class MSqrt : public MUnaryInstruction, public FloatingPointPolicy<0>::Data {
+  MSqrt(MDefinition* num, MIRType type) : MUnaryInstruction(classOpcode, num) {
+    setResultType(type);
+    specialization_ = type;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Sqrt)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MSqrt)
+};
+
+class MCopySign : public MBinaryInstruction, public NoTypePolicy::Data {
+  MCopySign(MDefinition* lhs, MDefinition* rhs, MIRType type)
+      : MBinaryInstruction(classOpcode, lhs, rhs) {
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(CopySign)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MCopySign)
+};
+
+// Inline implementation of Math.hypot().
+class MHypot : public MVariadicInstruction, public AllDoublePolicy::Data {
+  MHypot() : MVariadicInstruction(classOpcode) {
+    setResultType(MIRType::Double);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Hypot)
+  static MHypot* New(TempAllocator& alloc, const MDefinitionVector& vector);
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool possiblyCalls() const override { return true; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  bool canClone() const override { return true; }
+
+  MInstruction* clone(TempAllocator& alloc,
+                      const MDefinitionVector& inputs) const override {
+    return MHypot::New(alloc, inputs);
+  }
+};
+
+// Inline implementation of Math.pow().
+//
+// Supports the following three specializations:
+//
+// 1. MPow(FloatingPoint, FloatingPoint) -> Double
+//   - The most general mode, calls js::ecmaPow.
+//   - Never performs a bailout.
+// 2. MPow(FloatingPoint, Int32) -> Double
+//   - Optimization to call js::powi instead of js::ecmaPow.
+//   - Never performs a bailout.
+// 3. MPow(Int32, Int32) -> Int32
+//   - Performs the complete exponentiation operation in assembly code.
+//   - Bails out if the result doesn't fit in Int32.
+class MPow : public MBinaryInstruction, public PowPolicy::Data {
+  // If true, the result is guaranteed to never be negative zero, as long as the
+  // power is a positive number.
+  bool canBeNegativeZero_;
+
+  MPow(MDefinition* input, MDefinition* power, MIRType specialization)
+      : MBinaryInstruction(classOpcode, input, power) {
+    MOZ_ASSERT(specialization == MIRType::Int32 ||
+               specialization == MIRType::Double);
+    setResultType(specialization);
+    setMovable();
+
+    // The result can't be negative zero if the base is an Int32 value.
+    canBeNegativeZero_ = input->type() != MIRType::Int32;
+  }
+
+  // Helpers for `foldsTo`
+  MDefinition* foldsConstant(TempAllocator& alloc);
+  MDefinition* foldsConstantPower(TempAllocator& alloc);
+
+  bool canBeNegativeZero() const { return canBeNegativeZero_; }
+
+ public:
+  INSTRUCTION_HEADER(Pow)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* input() const { return lhs(); }
+  MDefinition* power() const { return rhs(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool possiblyCalls() const override { return type() != MIRType::Int32; }
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MPow)
+};
+
+// Inline implementation of Math.pow(x, 0.5), which subtly differs from
+// Math.sqrt(x).
+class MPowHalf : public MUnaryInstruction, public DoublePolicy<0>::Data {
+  bool operandIsNeverNegativeInfinity_;
+  bool operandIsNeverNegativeZero_;
+  bool operandIsNeverNaN_;
+
+  explicit MPowHalf(MDefinition* input)
+      : MUnaryInstruction(classOpcode, input),
+        operandIsNeverNegativeInfinity_(false),
+        operandIsNeverNegativeZero_(false),
+        operandIsNeverNaN_(false) {
+    setResultType(MIRType::Double);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(PowHalf)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  bool operandIsNeverNegativeInfinity() const {
+    return operandIsNeverNegativeInfinity_;
+  }
+  bool operandIsNeverNegativeZero() const {
+    return operandIsNeverNegativeZero_;
+  }
+  bool operandIsNeverNaN() const { return operandIsNeverNaN_; }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void collectRangeInfoPreTrunc() override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MPowHalf)
+};
+
+class MSign : public MUnaryInstruction, public SignPolicy::Data {
+ private:
+  MSign(MDefinition* input, MIRType resultType)
+      : MUnaryInstruction(classOpcode, input) {
+    MOZ_ASSERT(IsNumberType(input->type()));
+    MOZ_ASSERT(resultType == MIRType::Int32 || resultType == MIRType::Double);
+    specialization_ = input->type();
+    setResultType(resultType);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Sign)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MSign)
+};
+
+class MMathFunction : public MUnaryInstruction,
+                      public FloatingPointPolicy<0>::Data {
+  UnaryMathFunction function_;
+
+  // A nullptr cache means this function will neither access nor update the
+  // cache.
+  MMathFunction(MDefinition* input, UnaryMathFunction function)
+      : MUnaryInstruction(classOpcode, input), function_(function) {
+    setResultType(MIRType::Double);
+    specialization_ = MIRType::Double;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(MathFunction)
+  TRIVIAL_NEW_WRAPPERS
+
+  UnaryMathFunction function() const { return function_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isMathFunction()) {
+      return false;
+    }
+    if (ins->toMathFunction()->function() != function()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool possiblyCalls() const override { return true; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  static const char* FunctionName(UnaryMathFunction function);
+
+  bool isFloat32Commutative() const override;
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+
+  void computeRange(TempAllocator& alloc) override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MMathFunction)
+};
+
+class MAdd : public MBinaryArithInstruction {
+  MAdd(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryArithInstruction(classOpcode, left, right, type) {
+    setCommutative();
+  }
+
+  MAdd(MDefinition* left, MDefinition* right, TruncateKind truncateKind)
+      : MAdd(left, right, MIRType::Int32) {
+    setTruncateKind(truncateKind);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Add)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MAdd* NewWasm(TempAllocator& alloc, MDefinition* left,
+                       MDefinition* right, MIRType type) {
+    auto* ret = new (alloc) MAdd(left, right, type);
+    if (type == MIRType::Int32) {
+      ret->setTruncateKind(TruncateKind::Truncate);
+    }
+    return ret;
+  }
+
+  bool isFloat32Commutative() const override { return true; }
+
+  double getIdentity() override { return 0; }
+
+  bool fallible() const;
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MAdd)
+};
+
+class MSub : public MBinaryArithInstruction {
+  MSub(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryArithInstruction(classOpcode, left, right, type) {}
+
+ public:
+  INSTRUCTION_HEADER(Sub)
+  TRIVIAL_NEW_WRAPPERS
+
+  static MSub* NewWasm(TempAllocator& alloc, MDefinition* left,
+                       MDefinition* right, MIRType type, bool mustPreserveNaN) {
+    auto* ret = new (alloc) MSub(left, right, type);
+    ret->setMustPreserveNaN(mustPreserveNaN);
+    if (type == MIRType::Int32) {
+      ret->setTruncateKind(TruncateKind::Truncate);
+    }
+    return ret;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  double getIdentity() override { return 0; }
+
+  bool isFloat32Commutative() const override { return true; }
+
+  bool fallible() const;
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MSub)
+};
+
+class MMul : public MBinaryArithInstruction {
+ public:
+  enum Mode { Normal, Integer };
+
+ private:
+  // Annotation the result could be a negative zero
+  // and we need to guard this during execution.
+  bool canBeNegativeZero_;
+
+  Mode mode_;
+
+  MMul(MDefinition* left, MDefinition* right, MIRType type, Mode mode)
+      : MBinaryArithInstruction(classOpcode, left, right, type),
+        canBeNegativeZero_(true),
+        mode_(mode) {
+    setCommutative();
+    if (mode == Integer) {
+      // This implements the required behavior for Math.imul, which
+      // can never fail and always truncates its output to int32.
+      canBeNegativeZero_ = false;
+      setTruncateKind(TruncateKind::Truncate);
+    }
+    MOZ_ASSERT_IF(mode != Integer, mode == Normal);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Mul)
+
+  static MMul* New(TempAllocator& alloc, MDefinition* left, MDefinition* right,
+                   MIRType type, Mode mode = Normal) {
+    return new (alloc) MMul(left, right, type, mode);
+  }
+  static MMul* NewWasm(TempAllocator& alloc, MDefinition* left,
+                       MDefinition* right, MIRType type, Mode mode,
+                       bool mustPreserveNaN) {
+    auto* ret = new (alloc) MMul(left, right, type, mode);
+    ret->setMustPreserveNaN(mustPreserveNaN);
+    return ret;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void analyzeEdgeCasesForward() override;
+  void analyzeEdgeCasesBackward() override;
+  void collectRangeInfoPreTrunc() override;
+
+  double getIdentity() override { return 1; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isMul()) {
+      return false;
+    }
+
+    const MMul* mul = ins->toMul();
+    if (canBeNegativeZero_ != mul->canBeNegativeZero()) {
+      return false;
+    }
+
+    if (mode_ != mul->mode()) {
+      return false;
+    }
+
+    if (mustPreserveNaN() != mul->mustPreserveNaN()) {
+      return false;
+    }
+
+    return binaryCongruentTo(ins);
+  }
+
+  bool canOverflow() const;
+
+  bool canBeNegativeZero() const { return canBeNegativeZero_; }
+  void setCanBeNegativeZero(bool negativeZero) {
+    canBeNegativeZero_ = negativeZero;
+  }
+
+  bool fallible() const { return canBeNegativeZero_ || canOverflow(); }
+
+  bool isFloat32Commutative() const override { return true; }
+
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  Mode mode() const { return mode_; }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MMul)
+};
+
+class MDiv : public MBinaryArithInstruction {
+  bool canBeNegativeZero_;
+  bool canBeNegativeOverflow_;
+  bool canBeDivideByZero_;
+  bool canBeNegativeDividend_;
+  bool unsigned_;  // If false, signedness will be derived from operands
+  bool trapOnError_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MDiv(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryArithInstruction(classOpcode, left, right, type),
+        canBeNegativeZero_(true),
+        canBeNegativeOverflow_(true),
+        canBeDivideByZero_(true),
+        canBeNegativeDividend_(true),
+        unsigned_(false),
+        trapOnError_(false) {}
+
+ public:
+  INSTRUCTION_HEADER(Div)
+
+  static MDiv* New(TempAllocator& alloc, MDefinition* left, MDefinition* right,
+                   MIRType type) {
+    return new (alloc) MDiv(left, right, type);
+  }
+  static MDiv* New(TempAllocator& alloc, MDefinition* left, MDefinition* right,
+                   MIRType type, bool unsignd, bool trapOnError = false,
+                   wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset(),
+                   bool mustPreserveNaN = false) {
+    auto* div = new (alloc) MDiv(left, right, type);
+    div->unsigned_ = unsignd;
+    div->trapOnError_ = trapOnError;
+    div->bytecodeOffset_ = bytecodeOffset;
+    if (trapOnError) {
+      div->setGuard();  // not removable because of possible side-effects.
+      div->setNotMovable();
+    }
+    div->setMustPreserveNaN(mustPreserveNaN);
+    if (type == MIRType::Int32) {
+      div->setTruncateKind(TruncateKind::Truncate);
+    }
+    return div;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  void analyzeEdgeCasesForward() override;
+  void analyzeEdgeCasesBackward() override;
+
+  double getIdentity() override { MOZ_CRASH("not used"); }
+
+  bool canBeNegativeZero() const { return canBeNegativeZero_; }
+  void setCanBeNegativeZero(bool negativeZero) {
+    canBeNegativeZero_ = negativeZero;
+  }
+
+  bool canBeNegativeOverflow() const { return canBeNegativeOverflow_; }
+
+  bool canBeDivideByZero() const { return canBeDivideByZero_; }
+
+  bool canBeNegativeDividend() const {
+    // "Dividend" is an ambiguous concept for unsigned truncated
+    // division, because of the truncation procedure:
+    // ((x>>>0)/2)|0, for example, gets transformed in
+    // MDiv::truncate into a node with lhs representing x (not
+    // x>>>0) and rhs representing the constant 2; in other words,
+    // the MIR node corresponds to "cast operands to unsigned and
+    // divide" operation. In this case, is the dividend x or is it
+    // x>>>0? In order to resolve such ambiguities, we disallow
+    // the usage of this method for unsigned division.
+    MOZ_ASSERT(!unsigned_);
+    return canBeNegativeDividend_;
+  }
+
+  bool isUnsigned() const { return unsigned_; }
+
+  bool isTruncatedIndirectly() const {
+    return truncateKind() >= TruncateKind::IndirectTruncate;
+  }
+
+  bool canTruncateInfinities() const { return isTruncated(); }
+  bool canTruncateRemainder() const { return isTruncated(); }
+  bool canTruncateOverflow() const {
+    return isTruncated() || isTruncatedIndirectly();
+  }
+  bool canTruncateNegativeZero() const {
+    return isTruncated() || isTruncatedIndirectly();
+  }
+
+  bool trapOnError() const { return trapOnError_; }
+  wasm::BytecodeOffset bytecodeOffset() const {
+    MOZ_ASSERT(bytecodeOffset_.isValid());
+    return bytecodeOffset_;
+  }
+
+  bool isFloat32Commutative() const override { return true; }
+
+  void computeRange(TempAllocator& alloc) override;
+  bool fallible() const;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  void collectRangeInfoPreTrunc() override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!MBinaryArithInstruction::congruentTo(ins)) {
+      return false;
+    }
+    const MDiv* other = ins->toDiv();
+    MOZ_ASSERT(other->trapOnError() == trapOnError_);
+    return unsigned_ == other->isUnsigned();
+  }
+
+  ALLOW_CLONE(MDiv)
+};
+
+class MWasmBuiltinDivI64 : public MAryInstruction<3>, public ArithPolicy::Data {
+  bool canBeNegativeZero_;
+  bool canBeNegativeOverflow_;
+  bool canBeDivideByZero_;
+  bool canBeNegativeDividend_;
+  bool unsigned_;  // If false, signedness will be derived from operands
+  bool trapOnError_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmBuiltinDivI64(MDefinition* left, MDefinition* right,
+                     MDefinition* instance)
+      : MAryInstruction(classOpcode),
+        canBeNegativeZero_(true),
+        canBeNegativeOverflow_(true),
+        canBeDivideByZero_(true),
+        canBeNegativeDividend_(true),
+        unsigned_(false),
+        trapOnError_(false) {
+    initOperand(0, left);
+    initOperand(1, right);
+    initOperand(2, instance);
+
+    setResultType(MIRType::Int64);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBuiltinDivI64)
+
+  NAMED_OPERANDS((0, lhs), (1, rhs), (2, instance))
+
+  static MWasmBuiltinDivI64* New(
+      TempAllocator& alloc, MDefinition* left, MDefinition* right,
+      MDefinition* instance, bool unsignd, bool trapOnError = false,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset()) {
+    auto* wasm64Div = new (alloc) MWasmBuiltinDivI64(left, right, instance);
+    wasm64Div->unsigned_ = unsignd;
+    wasm64Div->trapOnError_ = trapOnError;
+    wasm64Div->bytecodeOffset_ = bytecodeOffset;
+    if (trapOnError) {
+      wasm64Div->setGuard();  // not removable because of possible side-effects.
+      wasm64Div->setNotMovable();
+    }
+    return wasm64Div;
+  }
+
+  bool canBeNegativeZero() const { return canBeNegativeZero_; }
+  void setCanBeNegativeZero(bool negativeZero) {
+    canBeNegativeZero_ = negativeZero;
+  }
+
+  bool canBeNegativeOverflow() const { return canBeNegativeOverflow_; }
+
+  bool canBeDivideByZero() const { return canBeDivideByZero_; }
+
+  bool canBeNegativeDividend() const {
+    // "Dividend" is an ambiguous concept for unsigned truncated
+    // division, because of the truncation procedure:
+    // ((x>>>0)/2)|0, for example, gets transformed in
+    // MWasmDiv::truncate into a node with lhs representing x (not
+    // x>>>0) and rhs representing the constant 2; in other words,
+    // the MIR node corresponds to "cast operands to unsigned and
+    // divide" operation. In this case, is the dividend x or is it
+    // x>>>0? In order to resolve such ambiguities, we disallow
+    // the usage of this method for unsigned division.
+    MOZ_ASSERT(!unsigned_);
+    return canBeNegativeDividend_;
+  }
+
+  bool isUnsigned() const { return unsigned_; }
+
+  bool trapOnError() const { return trapOnError_; }
+  wasm::BytecodeOffset bytecodeOffset() const {
+    MOZ_ASSERT(bytecodeOffset_.isValid());
+    return bytecodeOffset_;
+  }
+
+  ALLOW_CLONE(MWasmBuiltinDivI64)
+};
+
+class MMod : public MBinaryArithInstruction {
+  bool unsigned_;  // If false, signedness will be derived from operands
+  bool canBeNegativeDividend_;
+  bool canBePowerOfTwoDivisor_;
+  bool canBeDivideByZero_;
+  bool trapOnError_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MMod(MDefinition* left, MDefinition* right, MIRType type)
+      : MBinaryArithInstruction(classOpcode, left, right, type),
+        unsigned_(false),
+        canBeNegativeDividend_(true),
+        canBePowerOfTwoDivisor_(true),
+        canBeDivideByZero_(true),
+        trapOnError_(false) {}
+
+ public:
+  INSTRUCTION_HEADER(Mod)
+
+  static MMod* New(TempAllocator& alloc, MDefinition* left, MDefinition* right,
+                   MIRType type) {
+    return new (alloc) MMod(left, right, type);
+  }
+  static MMod* New(
+      TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type,
+      bool unsignd, bool trapOnError = false,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset()) {
+    auto* mod = new (alloc) MMod(left, right, type);
+    mod->unsigned_ = unsignd;
+    mod->trapOnError_ = trapOnError;
+    mod->bytecodeOffset_ = bytecodeOffset;
+    if (trapOnError) {
+      mod->setGuard();  // not removable because of possible side-effects.
+      mod->setNotMovable();
+    }
+    if (type == MIRType::Int32) {
+      mod->setTruncateKind(TruncateKind::Truncate);
+    }
+    return mod;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  double getIdentity() override { MOZ_CRASH("not used"); }
+
+  bool canBeNegativeDividend() const {
+    MOZ_ASSERT(type() == MIRType::Int32 || type() == MIRType::Int64);
+    MOZ_ASSERT(!unsigned_);
+    return canBeNegativeDividend_;
+  }
+
+  bool canBeDivideByZero() const {
+    MOZ_ASSERT(type() == MIRType::Int32 || type() == MIRType::Int64);
+    return canBeDivideByZero_;
+  }
+
+  bool canBePowerOfTwoDivisor() const {
+    MOZ_ASSERT(type() == MIRType::Int32);
+    return canBePowerOfTwoDivisor_;
+  }
+
+  void analyzeEdgeCasesForward() override;
+
+  bool isUnsigned() const { return unsigned_; }
+
+  bool trapOnError() const { return trapOnError_; }
+  wasm::BytecodeOffset bytecodeOffset() const {
+    MOZ_ASSERT(bytecodeOffset_.isValid());
+    return bytecodeOffset_;
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  bool fallible() const;
+
+  void computeRange(TempAllocator& alloc) override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+  void collectRangeInfoPreTrunc() override;
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return MBinaryArithInstruction::congruentTo(ins) &&
+           unsigned_ == ins->toMod()->isUnsigned();
+  }
+
+  bool possiblyCalls() const override { return type() == MIRType::Double; }
+
+  ALLOW_CLONE(MMod)
+};
+
+class MWasmBuiltinModD : public MAryInstruction<3>, public ArithPolicy::Data {
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmBuiltinModD(MDefinition* left, MDefinition* right, MDefinition* instance,
+                   MIRType type)
+      : MAryInstruction(classOpcode) {
+    initOperand(0, left);
+    initOperand(1, right);
+    initOperand(2, instance);
+
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBuiltinModD)
+  NAMED_OPERANDS((0, lhs), (1, rhs), (2, instance))
+
+  static MWasmBuiltinModD* New(
+      TempAllocator& alloc, MDefinition* left, MDefinition* right,
+      MDefinition* instance, MIRType type,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset()) {
+    auto* wasmBuiltinModD =
+        new (alloc) MWasmBuiltinModD(left, right, instance, type);
+    wasmBuiltinModD->bytecodeOffset_ = bytecodeOffset;
+    return wasmBuiltinModD;
+  }
+
+  wasm::BytecodeOffset bytecodeOffset() const {
+    MOZ_ASSERT(bytecodeOffset_.isValid());
+    return bytecodeOffset_;
+  }
+
+  ALLOW_CLONE(MWasmBuiltinModD)
+};
+
+class MWasmBuiltinModI64 : public MAryInstruction<3>, public ArithPolicy::Data {
+  bool unsigned_;  // If false, signedness will be derived from operands
+  bool canBeNegativeDividend_;
+  bool canBeDivideByZero_;
+  bool trapOnError_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmBuiltinModI64(MDefinition* left, MDefinition* right,
+                     MDefinition* instance)
+      : MAryInstruction(classOpcode),
+        unsigned_(false),
+        canBeNegativeDividend_(true),
+        canBeDivideByZero_(true),
+        trapOnError_(false) {
+    initOperand(0, left);
+    initOperand(1, right);
+    initOperand(2, instance);
+
+    setResultType(MIRType::Int64);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBuiltinModI64)
+
+  NAMED_OPERANDS((0, lhs), (1, rhs), (2, instance))
+
+  static MWasmBuiltinModI64* New(
+      TempAllocator& alloc, MDefinition* left, MDefinition* right,
+      MDefinition* instance, bool unsignd, bool trapOnError = false,
+      wasm::BytecodeOffset bytecodeOffset = wasm::BytecodeOffset()) {
+    auto* mod = new (alloc) MWasmBuiltinModI64(left, right, instance);
+    mod->unsigned_ = unsignd;
+    mod->trapOnError_ = trapOnError;
+    mod->bytecodeOffset_ = bytecodeOffset;
+    if (trapOnError) {
+      mod->setGuard();  // not removable because of possible side-effects.
+      mod->setNotMovable();
+    }
+    return mod;
+  }
+
+  bool canBeNegativeDividend() const {
+    MOZ_ASSERT(!unsigned_);
+    return canBeNegativeDividend_;
+  }
+
+  bool canBeDivideByZero() const { return canBeDivideByZero_; }
+
+  bool isUnsigned() const { return unsigned_; }
+
+  bool trapOnError() const { return trapOnError_; }
+  wasm::BytecodeOffset bytecodeOffset() const {
+    MOZ_ASSERT(bytecodeOffset_.isValid());
+    return bytecodeOffset_;
+  }
+
+  ALLOW_CLONE(MWasmBuiltinModI64)
+};
+
+class MBigIntBinaryArithInstruction : public MBinaryInstruction,
+                                      public BigIntArithPolicy::Data {
+ protected:
+  MBigIntBinaryArithInstruction(Opcode op, MDefinition* left,
+                                MDefinition* right)
+      : MBinaryInstruction(op, left, right) {
+    setResultType(MIRType::BigInt);
+    setMovable();
+  }
+
+ public:
+  bool congruentTo(const MDefinition* ins) const override {
+    return binaryCongruentTo(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MBigIntAdd : public MBigIntBinaryArithInstruction {
+  MBigIntAdd(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    setCommutative();
+
+    // Don't guard this instruction even though adding two BigInts can throw
+    // JSMSG_BIGINT_TOO_LARGE. This matches the behavior when adding too large
+    // strings in MConcat.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntAdd)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntAdd)
+};
+
+class MBigIntSub : public MBigIntBinaryArithInstruction {
+  MBigIntSub(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntSub)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntSub)
+};
+
+class MBigIntMul : public MBigIntBinaryArithInstruction {
+  MBigIntMul(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    setCommutative();
+
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntMul)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntMul)
+};
+
+class MBigIntDiv : public MBigIntBinaryArithInstruction {
+  bool canBeDivideByZero_;
+
+  MBigIntDiv(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    MOZ_ASSERT(right->type() == MIRType::BigInt);
+    canBeDivideByZero_ =
+        !right->isConstant() || right->toConstant()->toBigInt()->isZero();
+
+    // Throws when the divisor is zero.
+    if (canBeDivideByZero_) {
+      setGuard();
+      setNotMovable();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntDiv)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool canBeDivideByZero() const { return canBeDivideByZero_; }
+
+  AliasSet getAliasSet() const override {
+    if (canBeDivideByZero()) {
+      return AliasSet::Store(AliasSet::ExceptionState);
+    }
+    return AliasSet::None();
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return !canBeDivideByZero(); }
+
+  ALLOW_CLONE(MBigIntDiv)
+};
+
+class MBigIntMod : public MBigIntBinaryArithInstruction {
+  bool canBeDivideByZero_;
+
+  MBigIntMod(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    MOZ_ASSERT(right->type() == MIRType::BigInt);
+    canBeDivideByZero_ =
+        !right->isConstant() || right->toConstant()->toBigInt()->isZero();
+
+    // Throws when the divisor is zero.
+    if (canBeDivideByZero_) {
+      setGuard();
+      setNotMovable();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntMod)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool canBeDivideByZero() const { return canBeDivideByZero_; }
+
+  AliasSet getAliasSet() const override {
+    if (canBeDivideByZero()) {
+      return AliasSet::Store(AliasSet::ExceptionState);
+    }
+    return AliasSet::None();
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return !canBeDivideByZero(); }
+
+  ALLOW_CLONE(MBigIntMod)
+};
+
+class MBigIntPow : public MBigIntBinaryArithInstruction {
+  bool canBeNegativeExponent_;
+
+  MBigIntPow(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    MOZ_ASSERT(right->type() == MIRType::BigInt);
+    canBeNegativeExponent_ =
+        !right->isConstant() || right->toConstant()->toBigInt()->isNegative();
+
+    // Throws when the exponent is negative.
+    if (canBeNegativeExponent_) {
+      setGuard();
+      setNotMovable();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntPow)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool canBeNegativeExponent() const { return canBeNegativeExponent_; }
+
+  AliasSet getAliasSet() const override {
+    if (canBeNegativeExponent()) {
+      return AliasSet::Store(AliasSet::ExceptionState);
+    }
+    return AliasSet::None();
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return !canBeNegativeExponent(); }
+
+  ALLOW_CLONE(MBigIntPow)
+};
+
+class MBigIntBitAnd : public MBigIntBinaryArithInstruction {
+  MBigIntBitAnd(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    setCommutative();
+
+    // We don't need to guard this instruction because it can only fail on OOM.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntBitAnd)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntBitAnd)
+};
+
+class MBigIntBitOr : public MBigIntBinaryArithInstruction {
+  MBigIntBitOr(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    setCommutative();
+
+    // We don't need to guard this instruction because it can only fail on OOM.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntBitOr)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntBitOr)
+};
+
+class MBigIntBitXor : public MBigIntBinaryArithInstruction {
+  MBigIntBitXor(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    setCommutative();
+
+    // We don't need to guard this instruction because it can only fail on OOM.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntBitXor)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntBitXor)
+};
+
+class MBigIntLsh : public MBigIntBinaryArithInstruction {
+  MBigIntLsh(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntLsh)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntLsh)
+};
+
+class MBigIntRsh : public MBigIntBinaryArithInstruction {
+  MBigIntRsh(MDefinition* left, MDefinition* right)
+      : MBigIntBinaryArithInstruction(classOpcode, left, right) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntRsh)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntRsh)
+};
+
+class MBigIntUnaryArithInstruction : public MUnaryInstruction,
+                                     public BigIntArithPolicy::Data {
+ protected:
+  MBigIntUnaryArithInstruction(Opcode op, MDefinition* input)
+      : MUnaryInstruction(op, input) {
+    setResultType(MIRType::BigInt);
+    setMovable();
+  }
+
+ public:
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MBigIntIncrement : public MBigIntUnaryArithInstruction {
+  explicit MBigIntIncrement(MDefinition* input)
+      : MBigIntUnaryArithInstruction(classOpcode, input) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntIncrement)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntIncrement)
+};
+
+class MBigIntDecrement : public MBigIntUnaryArithInstruction {
+  explicit MBigIntDecrement(MDefinition* input)
+      : MBigIntUnaryArithInstruction(classOpcode, input) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntDecrement)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntDecrement)
+};
+
+class MBigIntNegate : public MBigIntUnaryArithInstruction {
+  explicit MBigIntNegate(MDefinition* input)
+      : MBigIntUnaryArithInstruction(classOpcode, input) {
+    // We don't need to guard this instruction because it can only fail on OOM.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntNegate)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntNegate)
+};
+
+class MBigIntBitNot : public MBigIntUnaryArithInstruction {
+  explicit MBigIntBitNot(MDefinition* input)
+      : MBigIntUnaryArithInstruction(classOpcode, input) {
+    // See MBigIntAdd for why we don't guard this instruction.
+  }
+
+ public:
+  INSTRUCTION_HEADER(BigIntBitNot)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MBigIntBitNot)
+};
+
+class MConcat : public MBinaryInstruction,
+                public MixPolicy<ConvertToStringPolicy<0>,
+                                 ConvertToStringPolicy<1>>::Data {
+  MConcat(MDefinition* left, MDefinition* right)
+      : MBinaryInstruction(classOpcode, left, right) {
+    // At least one input should be definitely string
+    MOZ_ASSERT(left->type() == MIRType::String ||
+               right->type() == MIRType::String);
+
+    setMovable();
+    setResultType(MIRType::String);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Concat)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MConcat)
+};
+
+class MStringConvertCase : public MUnaryInstruction,
+                           public StringPolicy<0>::Data {
+ public:
+  enum Mode { LowerCase, UpperCase };
+
+ private:
+  Mode mode_;
+
+  MStringConvertCase(MDefinition* string, Mode mode)
+      : MUnaryInstruction(classOpcode, string), mode_(mode) {
+    setResultType(MIRType::String);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(StringConvertCase)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, string))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toStringConvertCase()->mode() == mode();
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool possiblyCalls() const override { return true; }
+  Mode mode() const { return mode_; }
+};
+
+// This is a 3 state flag used by FlagPhiInputsAsImplicitlyUsed to record and
+// propagate the information about the consumers of a Phi instruction. This is
+// then used to set ImplicitlyUsed flags on the inputs of such Phi instructions.
+enum class PhiUsage : uint8_t { Unknown, Unused, Used };
+
+using PhiVector = Vector<MPhi*, 4, JitAllocPolicy>;
+
+class MPhi final : public MDefinition,
+                   public InlineListNode<MPhi>,
+                   public NoTypePolicy::Data {
+  using InputVector = js::Vector<MUse, 2, JitAllocPolicy>;
+  InputVector inputs_;
+
+  TruncateKind truncateKind_;
+  bool triedToSpecialize_;
+  bool isIterator_;
+  bool canProduceFloat32_;
+  bool canConsumeFloat32_;
+  // Record the state of the data flow before any mutation made to the control
+  // flow, such that removing branches is properly accounted for.
+  PhiUsage usageAnalysis_;
+
+ protected:
+  MUse* getUseFor(size_t index) override {
+    MOZ_ASSERT(index < numOperands());
+    return &inputs_[index];
+  }
+  const MUse* getUseFor(size_t index) const override { return &inputs_[index]; }
+
+ public:
+  INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(Phi)
+  virtual const TypePolicy* typePolicy();
+  virtual MIRType typePolicySpecialization();
+
+  MPhi(TempAllocator& alloc, MIRType resultType)
+      : MDefinition(classOpcode),
+        inputs_(alloc),
+        truncateKind_(TruncateKind::NoTruncate),
+        triedToSpecialize_(false),
+        isIterator_(false),
+        canProduceFloat32_(false),
+        canConsumeFloat32_(false),
+        usageAnalysis_(PhiUsage::Unknown) {
+    setResultType(resultType);
+  }
+
+  static MPhi* New(TempAllocator& alloc, MIRType resultType = MIRType::Value) {
+    return new (alloc) MPhi(alloc, resultType);
+  }
+  static MPhi* New(TempAllocator::Fallible alloc,
+                   MIRType resultType = MIRType::Value) {
+    return new (alloc) MPhi(alloc.alloc, resultType);
+  }
+
+  void removeOperand(size_t index);
+  void removeAllOperands();
+
+  MDefinition* getOperand(size_t index) const override {
+    return inputs_[index].producer();
+  }
+  size_t numOperands() const override { return inputs_.length(); }
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u >= &inputs_[0]);
+    MOZ_ASSERT(u <= &inputs_[numOperands() - 1]);
+    return u - &inputs_[0];
+  }
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    inputs_[index].replaceProducer(operand);
+  }
+  bool triedToSpecialize() const { return triedToSpecialize_; }
+  void specialize(MIRType type) {
+    triedToSpecialize_ = true;
+    setResultType(type);
+  }
+
+#ifdef DEBUG
+  // Assert that this is a phi in a loop header with a unique predecessor and
+  // a unique backedge.
+  void assertLoopPhi() const;
+#else
+  void assertLoopPhi() const {}
+#endif
+
+  // Assuming this phi is in a loop header with a unique loop entry, return
+  // the phi operand along the loop entry.
+  MDefinition* getLoopPredecessorOperand() const;
+
+  // Assuming this phi is in a loop header with a unique loop entry, return
+  // the phi operand along the loop backedge.
+  MDefinition* getLoopBackedgeOperand() const;
+
+  // Whether this phi's type already includes information for def.
+  bool typeIncludes(MDefinition* def);
+
+  // Mark all phis in |iterators|, and the phis they flow into, as having
+  // implicit uses.
+  [[nodiscard]] static bool markIteratorPhis(const PhiVector& iterators);
+
+  // Initializes the operands vector to the given capacity,
+  // permitting use of addInput() instead of addInputSlow().
+  [[nodiscard]] bool reserveLength(size_t length) {
+    return inputs_.reserve(length);
+  }
+
+  // Use only if capacity has been reserved by reserveLength
+  void addInput(MDefinition* ins) {
+    MOZ_ASSERT_IF(type() != MIRType::Value, ins->type() == type());
+    inputs_.infallibleEmplaceBack(ins, this);
+  }
+
+  // Appends a new input to the input vector. May perform reallocation.
+  // Prefer reserveLength() and addInput() instead, where possible.
+  [[nodiscard]] bool addInputSlow(MDefinition* ins) {
+    MOZ_ASSERT_IF(type() != MIRType::Value, ins->type() == type());
+    return inputs_.emplaceBack(ins, this);
+  }
+
+  // Appends a new input to the input vector. Infallible because
+  // we know the inputs fits in the vector's inline storage.
+  void addInlineInput(MDefinition* ins) {
+    MOZ_ASSERT(inputs_.length() < InputVector::InlineLength);
+    MOZ_ALWAYS_TRUE(addInputSlow(ins));
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  MDefinition* foldsTernary(TempAllocator& alloc);
+
+  bool congruentTo(const MDefinition* ins) const override;
+
+  // Mark this phi-node as having replaced all uses of |other|, as during GVN.
+  // For use when GVN eliminates phis which are not equivalent to one another.
+  void updateForReplacement(MPhi* other);
+
+  bool isIterator() const { return isIterator_; }
+  void setIterator() { isIterator_ = true; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+
+  MDefinition* operandIfRedundant();
+
+  bool canProduceFloat32() const override { return canProduceFloat32_; }
+
+  void setCanProduceFloat32(bool can) { canProduceFloat32_ = can; }
+
+  bool canConsumeFloat32(MUse* use) const override {
+    return canConsumeFloat32_;
+  }
+
+  void setCanConsumeFloat32(bool can) { canConsumeFloat32_ = can; }
+
+  TruncateKind operandTruncateKind(size_t index) const override;
+  bool canTruncate() const override;
+  void truncate(TruncateKind kind) override;
+
+  PhiUsage getUsageAnalysis() const { return usageAnalysis_; }
+  void setUsageAnalysis(PhiUsage pu) {
+    MOZ_ASSERT(usageAnalysis_ == PhiUsage::Unknown);
+    usageAnalysis_ = pu;
+    MOZ_ASSERT(usageAnalysis_ != PhiUsage::Unknown);
+  }
+};
+
+// The goal of a Beta node is to split a def at a conditionally taken
+// branch, so that uses dominated by it have a different name.
+class MBeta : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  // This is the range induced by a comparison and branch in a preceding
+  // block. Note that this does not reflect any range constraints from
+  // the input value itself, so this value may differ from the range()
+  // range after it is computed.
+  const Range* comparison_;
+
+  MBeta(MDefinition* val, const Range* comp)
+      : MUnaryInstruction(classOpcode, val), comparison_(comp) {
+    setResultType(val->type());
+  }
+
+ public:
+  INSTRUCTION_HEADER(Beta)
+  TRIVIAL_NEW_WRAPPERS
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+};
+
+// If input evaluates to false (i.e. it's NaN, 0 or -0), 0 is returned, else the
+// input is returned
+class MNaNToZero : public MUnaryInstruction, public DoublePolicy<0>::Data {
+  bool operandIsNeverNaN_;
+  bool operandIsNeverNegativeZero_;
+
+  explicit MNaNToZero(MDefinition* input)
+      : MUnaryInstruction(classOpcode, input),
+        operandIsNeverNaN_(false),
+        operandIsNeverNegativeZero_(false) {
+    setResultType(MIRType::Double);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NaNToZero)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool operandIsNeverNaN() const { return operandIsNeverNaN_; }
+
+  bool operandIsNeverNegativeZero() const {
+    return operandIsNeverNegativeZero_;
+  }
+
+  void collectRangeInfoPreTrunc() override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  void computeRange(TempAllocator& alloc) override;
+
+  bool writeRecoverData(CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MNaNToZero)
+};
+
+// MIR representation of a Value on the OSR BaselineFrame.
+// The Value is indexed off of OsrFrameReg.
+class MOsrValue : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  ptrdiff_t frameOffset_;
+
+  MOsrValue(MOsrEntry* entry, ptrdiff_t frameOffset)
+      : MUnaryInstruction(classOpcode, entry), frameOffset_(frameOffset) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(OsrValue)
+  TRIVIAL_NEW_WRAPPERS
+
+  ptrdiff_t frameOffset() const { return frameOffset_; }
+
+  MOsrEntry* entry() { return getOperand(0)->toOsrEntry(); }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// MIR representation of a JSObject scope chain pointer on the OSR
+// BaselineFrame. The pointer is indexed off of OsrFrameReg.
+class MOsrEnvironmentChain : public MUnaryInstruction,
+                             public NoTypePolicy::Data {
+ private:
+  explicit MOsrEnvironmentChain(MOsrEntry* entry)
+      : MUnaryInstruction(classOpcode, entry) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(OsrEnvironmentChain)
+  TRIVIAL_NEW_WRAPPERS
+
+  MOsrEntry* entry() { return getOperand(0)->toOsrEntry(); }
+};
+
+// MIR representation of a JSObject ArgumentsObject pointer on the OSR
+// BaselineFrame. The pointer is indexed off of OsrFrameReg.
+class MOsrArgumentsObject : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+ private:
+  explicit MOsrArgumentsObject(MOsrEntry* entry)
+      : MUnaryInstruction(classOpcode, entry) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(OsrArgumentsObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  MOsrEntry* entry() { return getOperand(0)->toOsrEntry(); }
+};
+
+// MIR representation of the return value on the OSR BaselineFrame.
+// The Value is indexed off of OsrFrameReg.
+class MOsrReturnValue : public MUnaryInstruction, public NoTypePolicy::Data {
+ private:
+  explicit MOsrReturnValue(MOsrEntry* entry)
+      : MUnaryInstruction(classOpcode, entry) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(OsrReturnValue)
+  TRIVIAL_NEW_WRAPPERS
+
+  MOsrEntry* entry() { return getOperand(0)->toOsrEntry(); }
+};
+
+class MBinaryCache : public MBinaryInstruction,
+                     public MixPolicy<BoxPolicy<0>, BoxPolicy<1>>::Data {
+  explicit MBinaryCache(MDefinition* left, MDefinition* right, MIRType resType)
+      : MBinaryInstruction(classOpcode, left, right) {
+    setResultType(resType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(BinaryCache)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+// Check whether we need to fire the interrupt handler (in wasm code).
+class MWasmInterruptCheck : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmInterruptCheck(MDefinition* instance,
+                      wasm::BytecodeOffset bytecodeOffset)
+      : MUnaryInstruction(classOpcode, instance),
+        bytecodeOffset_(bytecodeOffset) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmInterruptCheck)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+};
+
+// Directly jumps to the indicated trap, leaving Wasm code and reporting a
+// runtime error.
+
+class MWasmTrap : public MAryControlInstruction<0, 0>,
+                  public NoTypePolicy::Data {
+  wasm::Trap trap_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmTrap(wasm::Trap trap, wasm::BytecodeOffset bytecodeOffset)
+      : MAryControlInstruction(classOpcode),
+        trap_(trap),
+        bytecodeOffset_(bytecodeOffset) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmTrap)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  wasm::Trap trap() const { return trap_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+};
+
+// Checks if a value is JS_UNINITIALIZED_LEXICAL, bailout out if so, leaving
+// it to baseline to throw at the correct pc.
+class MLexicalCheck : public MUnaryInstruction, public BoxPolicy<0>::Data {
+  explicit MLexicalCheck(MDefinition* input)
+      : MUnaryInstruction(classOpcode, input) {
+    setResultType(MIRType::Value);
+    setMovable();
+    setGuard();
+
+    // If this instruction bails out, we will set a flag to prevent
+    // lexical checks in this script from being moved.
+    setBailoutKind(BailoutKind::UninitializedLexical);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LexicalCheck)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
+// Unconditionally throw a known error number.
+class MThrowMsg : public MNullaryInstruction {
+  const ThrowMsgKind throwMsgKind_;
+
+  explicit MThrowMsg(ThrowMsgKind throwMsgKind)
+      : MNullaryInstruction(classOpcode), throwMsgKind_(throwMsgKind) {
+    setGuard();
+    setResultType(MIRType::None);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ThrowMsg)
+  TRIVIAL_NEW_WRAPPERS
+
+  ThrowMsgKind throwMsgKind() const { return throwMsgKind_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::ExceptionState);
+  }
+};
+
+class MGetFirstDollarIndex : public MUnaryInstruction,
+                             public StringPolicy<0>::Data {
+  explicit MGetFirstDollarIndex(MDefinition* str)
+      : MUnaryInstruction(classOpcode, str) {
+    setResultType(MIRType::Int32);
+
+    // Codegen assumes string length > 0. Don't allow LICM to move this
+    // before the .length > 1 check in RegExpReplace in RegExp.js.
+    MOZ_ASSERT(!isMovable());
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetFirstDollarIndex)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, str))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+class MStringReplace : public MTernaryInstruction,
+                       public MixPolicy<StringPolicy<0>, StringPolicy<1>,
+                                        StringPolicy<2>>::Data {
+ private:
+  bool isFlatReplacement_;
+
+  MStringReplace(MDefinition* string, MDefinition* pattern,
+                 MDefinition* replacement)
+      : MTernaryInstruction(classOpcode, string, pattern, replacement),
+        isFlatReplacement_(false) {
+    setMovable();
+    setResultType(MIRType::String);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StringReplace)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, string), (1, pattern), (2, replacement))
+
+  void setFlatReplacement() {
+    MOZ_ASSERT(!isFlatReplacement_);
+    isFlatReplacement_ = true;
+  }
+
+  bool isFlatReplacement() const { return isFlatReplacement_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isStringReplace()) {
+      return false;
+    }
+    if (isFlatReplacement_ != ins->toStringReplace()->isFlatReplacement()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override {
+    if (isFlatReplacement_) {
+      MOZ_ASSERT(!pattern()->isRegExp());
+      return true;
+    }
+    return false;
+  }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MLambda : public MBinaryInstruction, public SingleObjectPolicy::Data {
+  MLambda(MDefinition* envChain, MConstant* cst)
+      : MBinaryInstruction(classOpcode, envChain, cst) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Lambda)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, environmentChain))
+
+  MConstant* functionOperand() const { return getOperand(1)->toConstant(); }
+  JSFunction* templateFunction() const {
+    return &functionOperand()->toObject().as<JSFunction>();
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MFunctionWithProto : public MTernaryInstruction,
+                           public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1>,
+                                            ObjectPolicy<2>>::Data {
+  CompilerFunction fun_;
+
+  MFunctionWithProto(MDefinition* envChain, MDefinition* prototype,
+                     MConstant* cst)
+      : MTernaryInstruction(classOpcode, envChain, prototype, cst),
+        fun_(&cst->toObject().as<JSFunction>()) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(FunctionWithProto)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, environmentChain), (1, prototype))
+
+  MConstant* functionOperand() const { return getOperand(2)->toConstant(); }
+  JSFunction* function() const { return fun_; }
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MGetNextEntryForIterator
+    : public MBinaryInstruction,
+      public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1>>::Data {
+ public:
+  enum Mode { Map, Set };
+
+ private:
+  Mode mode_;
+
+  explicit MGetNextEntryForIterator(MDefinition* iter, MDefinition* result,
+                                    Mode mode)
+      : MBinaryInstruction(classOpcode, iter, result), mode_(mode) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetNextEntryForIterator)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, iter), (1, result))
+
+  Mode mode() const { return mode_; }
+};
+
+// Convert a Double into an IntPtr value for accessing a TypedArray or DataView
+// element. If the input is non-finite, not an integer, negative, or outside the
+// IntPtr range, either bails out or produces a value which is known to trigger
+// an out-of-bounds access (this depends on the supportOOB flag).
+class MGuardNumberToIntPtrIndex : public MUnaryInstruction,
+                                  public DoublePolicy<0>::Data {
+  // If true, produce an out-of-bounds index for non-IntPtr doubles instead of
+  // bailing out.
+  const bool supportOOB_;
+
+  MGuardNumberToIntPtrIndex(MDefinition* def, bool supportOOB)
+      : MUnaryInstruction(classOpcode, def), supportOOB_(supportOOB) {
+    MOZ_ASSERT(def->type() == MIRType::Double);
+    setResultType(MIRType::IntPtr);
+    setMovable();
+    if (!supportOOB) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardNumberToIntPtrIndex)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool supportOOB() const { return supportOOB_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardNumberToIntPtrIndex()) {
+      return false;
+    }
+    if (ins->toGuardNumberToIntPtrIndex()->supportOOB() != supportOOB()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  ALLOW_CLONE(MGuardNumberToIntPtrIndex)
+};
+
+// Perform !-operation
+class MNot : public MUnaryInstruction, public TestPolicy::Data {
+  bool operandIsNeverNaN_;
+  TypeDataList observedTypes_;
+
+  explicit MNot(MDefinition* input)
+      : MUnaryInstruction(classOpcode, input), operandIsNeverNaN_(false) {
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  static MNot* NewInt32(TempAllocator& alloc, MDefinition* input) {
+    MOZ_ASSERT(input->type() == MIRType::Int32 ||
+               input->type() == MIRType::Int64);
+    auto* ins = new (alloc) MNot(input);
+    ins->setResultType(MIRType::Int32);
+    return ins;
+  }
+
+  INSTRUCTION_HEADER(Not)
+  TRIVIAL_NEW_WRAPPERS
+
+  void setObservedTypes(const TypeDataList& observed) {
+    observedTypes_ = observed;
+  }
+  const TypeDataList& observedTypes() const { return observedTypes_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool operandIsNeverNaN() const { return operandIsNeverNaN_; }
+
+  virtual AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void collectRangeInfoPreTrunc() override;
+
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+  bool isFloat32Commutative() const override { return true; }
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+// Bailout if index + minimum < 0 or index + maximum >= length. The length used
+// in a bounds check must not be negative, or the wrong result may be computed
+// (unsigned comparisons may be used).
+class MBoundsCheck
+    : public MBinaryInstruction,
+      public MixPolicy<Int32OrIntPtrPolicy<0>, Int32OrIntPtrPolicy<1>>::Data {
+  // Range over which to perform the bounds check, may be modified by GVN.
+  int32_t minimum_;
+  int32_t maximum_;
+  bool fallible_;
+
+  MBoundsCheck(MDefinition* index, MDefinition* length)
+      : MBinaryInstruction(classOpcode, index, length),
+        minimum_(0),
+        maximum_(0),
+        fallible_(true) {
+    setGuard();
+    setMovable();
+    MOZ_ASSERT(index->type() == MIRType::Int32 ||
+               index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(index->type() == length->type());
+
+    // Returns the checked index.
+    setResultType(index->type());
+  }
+
+ public:
+  INSTRUCTION_HEADER(BoundsCheck)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index), (1, length))
+
+  int32_t minimum() const { return minimum_; }
+  void setMinimum(int32_t n) {
+    MOZ_ASSERT(fallible_);
+    minimum_ = n;
+  }
+  int32_t maximum() const { return maximum_; }
+  void setMaximum(int32_t n) {
+    MOZ_ASSERT(fallible_);
+    maximum_ = n;
+  }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isBoundsCheck()) {
+      return false;
+    }
+    const MBoundsCheck* other = ins->toBoundsCheck();
+    if (minimum() != other->minimum() || maximum() != other->maximum()) {
+      return false;
+    }
+    if (fallible() != other->fallible()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+  virtual AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+  bool fallible() const { return fallible_; }
+  void collectRangeInfoPreTrunc() override;
+
+  ALLOW_CLONE(MBoundsCheck)
+};
+
+// Bailout if index < minimum.
+class MBoundsCheckLower : public MUnaryInstruction,
+                          public UnboxedInt32Policy<0>::Data {
+  int32_t minimum_;
+  bool fallible_;
+
+  explicit MBoundsCheckLower(MDefinition* index)
+      : MUnaryInstruction(classOpcode, index), minimum_(0), fallible_(true) {
+    setGuard();
+    setMovable();
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(BoundsCheckLower)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index))
+
+  int32_t minimum() const { return minimum_; }
+  void setMinimum(int32_t n) { minimum_ = n; }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool fallible() const { return fallible_; }
+  void collectRangeInfoPreTrunc() override;
+};
+
+class MSpectreMaskIndex
+    : public MBinaryInstruction,
+      public MixPolicy<Int32OrIntPtrPolicy<0>, Int32OrIntPtrPolicy<1>>::Data {
+  MSpectreMaskIndex(MDefinition* index, MDefinition* length)
+      : MBinaryInstruction(classOpcode, index, length) {
+    // Note: this instruction does not need setGuard(): if there are no uses
+    // it's fine for DCE to eliminate this instruction.
+    setMovable();
+    MOZ_ASSERT(index->type() == MIRType::Int32 ||
+               index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(index->type() == length->type());
+
+    // Returns the masked index.
+    setResultType(index->type());
+  }
+
+ public:
+  INSTRUCTION_HEADER(SpectreMaskIndex)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index), (1, length))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  virtual AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MSpectreMaskIndex)
+};
+
+// Load a value from a dense array's element vector. Bails out if the element is
+// a hole.
+class MLoadElement : public MBinaryInstruction, public NoTypePolicy::Data {
+  MLoadElement(MDefinition* elements, MDefinition* index)
+      : MBinaryInstruction(classOpcode, elements, index) {
+    // Uses may be optimized away based on this instruction's result
+    // type. This means it's invalid to DCE this instruction, as we
+    // have to invalidate when we read a hole.
+    setGuard();
+    setResultType(MIRType::Value);
+    setMovable();
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasType mightAlias(const MDefinition* store) const override;
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::Element);
+  }
+
+  ALLOW_CLONE(MLoadElement)
+};
+
+class MLoadElementAndUnbox : public MBinaryInstruction,
+                             public NoTypePolicy::Data {
+  MUnbox::Mode mode_;
+
+  MLoadElementAndUnbox(MDefinition* elements, MDefinition* index,
+                       MUnbox::Mode mode, MIRType type)
+      : MBinaryInstruction(classOpcode, elements, index), mode_(mode) {
+    setResultType(type);
+    setMovable();
+    if (mode_ == MUnbox::Fallible) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadElementAndUnbox)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index))
+
+  MUnbox::Mode mode() const { return mode_; }
+  bool fallible() const { return mode_ != MUnbox::Infallible; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadElementAndUnbox() ||
+        mode() != ins->toLoadElementAndUnbox()->mode()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::Element);
+  }
+
+  ALLOW_CLONE(MLoadElementAndUnbox);
+};
+
+// Load a value from the elements vector of a native object. If the index is
+// out-of-bounds, or the indexed slot has a hole, undefined is returned instead.
+class MLoadElementHole : public MTernaryInstruction, public NoTypePolicy::Data {
+  bool needsNegativeIntCheck_ = true;
+
+  MLoadElementHole(MDefinition* elements, MDefinition* index,
+                   MDefinition* initLength)
+      : MTernaryInstruction(classOpcode, elements, index, initLength) {
+    setResultType(MIRType::Value);
+    setMovable();
+
+    // Set the guard flag to make sure we bail when we see a negative
+    // index. We can clear this flag (and needsNegativeIntCheck_) in
+    // collectRangeInfoPreTrunc.
+    setGuard();
+
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+    MOZ_ASSERT(initLength->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadElementHole)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, initLength))
+
+  bool needsNegativeIntCheck() const { return needsNegativeIntCheck_; }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadElementHole()) {
+      return false;
+    }
+    const MLoadElementHole* other = ins->toLoadElementHole();
+    if (needsNegativeIntCheck() != other->needsNegativeIntCheck()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::Element);
+  }
+  void collectRangeInfoPreTrunc() override;
+
+  ALLOW_CLONE(MLoadElementHole)
+};
+
+// Store a value to a dense array slots vector.
+class MStoreElement : public MTernaryInstruction,
+                      public NoFloatPolicy<2>::Data {
+  bool needsHoleCheck_;
+  bool needsBarrier_;
+
+  MStoreElement(MDefinition* elements, MDefinition* index, MDefinition* value,
+                bool needsHoleCheck, bool needsBarrier)
+      : MTernaryInstruction(classOpcode, elements, index, value) {
+    needsHoleCheck_ = needsHoleCheck;
+    needsBarrier_ = needsBarrier;
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+    MOZ_ASSERT(value->type() != MIRType::MagicHole);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, value))
+
+  static MStoreElement* NewUnbarriered(TempAllocator& alloc,
+                                       MDefinition* elements,
+                                       MDefinition* index, MDefinition* value,
+                                       bool needsHoleCheck) {
+    return new (alloc)
+        MStoreElement(elements, index, value, needsHoleCheck, false);
+  }
+
+  static MStoreElement* NewBarriered(TempAllocator& alloc,
+                                     MDefinition* elements, MDefinition* index,
+                                     MDefinition* value, bool needsHoleCheck) {
+    return new (alloc)
+        MStoreElement(elements, index, value, needsHoleCheck, true);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::Element);
+  }
+  bool needsBarrier() const { return needsBarrier_; }
+  bool needsHoleCheck() const { return needsHoleCheck_; }
+  bool fallible() const { return needsHoleCheck(); }
+
+  ALLOW_CLONE(MStoreElement)
+};
+
+// Stores MagicValue(JS_ELEMENTS_HOLE) and marks the elements as non-packed.
+class MStoreHoleValueElement : public MBinaryInstruction,
+                               public NoTypePolicy::Data {
+  MStoreHoleValueElement(MDefinition* elements, MDefinition* index)
+      : MBinaryInstruction(classOpcode, elements, index) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreHoleValueElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
+  }
+
+  ALLOW_CLONE(MStoreHoleValueElement)
+};
+
+// Like MStoreElement, but also supports index == initialized length. The
+// downside is that we cannot hoist the elements vector and bounds check, since
+// this instruction may update the (initialized) length and reallocate the
+// elements vector.
+class MStoreElementHole
+    : public MQuaternaryInstruction,
+      public MixPolicy<SingleObjectPolicy, NoFloatPolicy<3>>::Data {
+  MStoreElementHole(MDefinition* object, MDefinition* elements,
+                    MDefinition* index, MDefinition* value)
+      : MQuaternaryInstruction(classOpcode, object, elements, index, value) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+    MOZ_ASSERT(value->type() != MIRType::MagicHole);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreElementHole)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, elements), (2, index), (3, value))
+
+  AliasSet getAliasSet() const override {
+    // StoreElementHole can update the initialized length, the array length
+    // or reallocate obj->elements.
+    return AliasSet::Store(AliasSet::ObjectFields | AliasSet::Element);
+  }
+
+  ALLOW_CLONE(MStoreElementHole)
+};
+
+// Array.prototype.pop or Array.prototype.shift on a dense array.
+class MArrayPopShift : public MUnaryInstruction,
+                       public SingleObjectPolicy::Data {
+ public:
+  enum Mode { Pop, Shift };
+
+ private:
+  Mode mode_;
+
+  MArrayPopShift(MDefinition* object, Mode mode)
+      : MUnaryInstruction(classOpcode, object), mode_(mode) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(ArrayPopShift)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  bool mode() const { return mode_; }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::ObjectFields | AliasSet::Element);
+  }
+
+  ALLOW_CLONE(MArrayPopShift)
+};
+
+// All barriered operations - MCompareExchangeTypedArrayElement,
+// MExchangeTypedArrayElement, and MAtomicTypedArrayElementBinop, as
+// well as MLoadUnboxedScalar and MStoreUnboxedScalar when they are
+// marked as requiring a memory barrer - have the following
+// attributes:
+//
+// - Not movable
+// - Not removable
+// - Not congruent with any other instruction
+// - Effectful (they alias every TypedArray store)
+//
+// The intended effect of those constraints is to prevent all loads
+// and stores preceding the barriered operation from being moved to
+// after the barriered operation, and vice versa, and to prevent the
+// barriered operation from being removed or hoisted.
+
+enum MemoryBarrierRequirement {
+  DoesNotRequireMemoryBarrier,
+  DoesRequireMemoryBarrier
+};
+
+// Also see comments at MMemoryBarrierRequirement, above.
+
+// Load an unboxed scalar value from an array buffer view or other object.
+class MLoadUnboxedScalar : public MBinaryInstruction,
+                           public NoTypePolicy::Data {
+  int32_t offsetAdjustment_ = 0;
+  Scalar::Type storageType_;
+  bool requiresBarrier_;
+
+  MLoadUnboxedScalar(
+      MDefinition* elements, MDefinition* index, Scalar::Type storageType,
+      MemoryBarrierRequirement requiresBarrier = DoesNotRequireMemoryBarrier)
+      : MBinaryInstruction(classOpcode, elements, index),
+        storageType_(storageType),
+        requiresBarrier_(requiresBarrier == DoesRequireMemoryBarrier) {
+    setResultType(MIRType::Value);
+    if (requiresBarrier_) {
+      setGuard();  // Not removable or movable
+    } else {
+      setMovable();
+    }
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadUnboxedScalar)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index))
+
+  Scalar::Type storageType() const { return storageType_; }
+  bool fallible() const {
+    // Bailout if the result does not fit in an int32.
+    return storageType_ == Scalar::Uint32 && type() == MIRType::Int32;
+  }
+  bool requiresMemoryBarrier() const { return requiresBarrier_; }
+  int32_t offsetAdjustment() const { return offsetAdjustment_; }
+  void setOffsetAdjustment(int32_t offsetAdjustment) {
+    offsetAdjustment_ = offsetAdjustment;
+  }
+  AliasSet getAliasSet() const override {
+    // When a barrier is needed make the instruction effectful by
+    // giving it a "store" effect.
+    if (requiresBarrier_) {
+      return AliasSet::Store(AliasSet::UnboxedElement);
+    }
+    return AliasSet::Load(AliasSet::UnboxedElement);
+  }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (requiresBarrier_) {
+      return false;
+    }
+    if (!ins->isLoadUnboxedScalar()) {
+      return false;
+    }
+    const MLoadUnboxedScalar* other = ins->toLoadUnboxedScalar();
+    if (storageType_ != other->storageType_) {
+      return false;
+    }
+    if (offsetAdjustment() != other->offsetAdjustment()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  void computeRange(TempAllocator& alloc) override;
+
+  bool canProduceFloat32() const override {
+    return storageType_ == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MLoadUnboxedScalar)
+};
+
+// Load an unboxed scalar value from a dataview object.
+class MLoadDataViewElement : public MTernaryInstruction,
+                             public NoTypePolicy::Data {
+  Scalar::Type storageType_;
+
+  MLoadDataViewElement(MDefinition* elements, MDefinition* index,
+                       MDefinition* littleEndian, Scalar::Type storageType)
+      : MTernaryInstruction(classOpcode, elements, index, littleEndian),
+        storageType_(storageType) {
+    setResultType(MIRType::Value);
+    setMovable();
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(littleEndian->type() == MIRType::Boolean);
+    MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType);
+    MOZ_ASSERT(Scalar::byteSize(storageType) > 1);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadDataViewElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, littleEndian))
+
+  Scalar::Type storageType() const { return storageType_; }
+  bool fallible() const {
+    // Bailout if the result does not fit in an int32.
+    return storageType_ == Scalar::Uint32 && type() == MIRType::Int32;
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::UnboxedElement);
+  }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadDataViewElement()) {
+      return false;
+    }
+    const MLoadDataViewElement* other = ins->toLoadDataViewElement();
+    if (storageType_ != other->storageType_) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  void computeRange(TempAllocator& alloc) override;
+
+  bool canProduceFloat32() const override {
+    return storageType_ == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MLoadDataViewElement)
+};
+
+// Load a value from a typed array. Out-of-bounds accesses are handled in-line.
+class MLoadTypedArrayElementHole : public MBinaryInstruction,
+                                   public SingleObjectPolicy::Data {
+  Scalar::Type arrayType_;
+  bool forceDouble_;
+
+  MLoadTypedArrayElementHole(MDefinition* object, MDefinition* index,
+                             Scalar::Type arrayType, bool forceDouble)
+      : MBinaryInstruction(classOpcode, object, index),
+        arrayType_(arrayType),
+        forceDouble_(forceDouble) {
+    setResultType(MIRType::Value);
+    setMovable();
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(arrayType >= 0 && arrayType < Scalar::MaxTypedArrayViewType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadTypedArrayElementHole)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, index))
+
+  Scalar::Type arrayType() const { return arrayType_; }
+  bool forceDouble() const { return forceDouble_; }
+  bool fallible() const {
+    return arrayType_ == Scalar::Uint32 && !forceDouble_;
+  }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadTypedArrayElementHole()) {
+      return false;
+    }
+    const MLoadTypedArrayElementHole* other =
+        ins->toLoadTypedArrayElementHole();
+    if (arrayType() != other->arrayType()) {
+      return false;
+    }
+    if (forceDouble() != other->forceDouble()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::UnboxedElement | AliasSet::ObjectFields |
+                          AliasSet::ArrayBufferViewLengthOrOffset);
+  }
+  bool canProduceFloat32() const override {
+    return arrayType_ == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MLoadTypedArrayElementHole)
+};
+
+// Base class for MIR ops that write unboxed scalar values.
+class StoreUnboxedScalarBase {
+  Scalar::Type writeType_;
+
+ protected:
+  explicit StoreUnboxedScalarBase(Scalar::Type writeType)
+      : writeType_(writeType) {
+    MOZ_ASSERT(isIntegerWrite() || isFloatWrite() || isBigIntWrite());
+  }
+
+ public:
+  Scalar::Type writeType() const { return writeType_; }
+  bool isByteWrite() const {
+    return writeType_ == Scalar::Int8 || writeType_ == Scalar::Uint8 ||
+           writeType_ == Scalar::Uint8Clamped;
+  }
+  bool isIntegerWrite() const {
+    return isByteWrite() || writeType_ == Scalar::Int16 ||
+           writeType_ == Scalar::Uint16 || writeType_ == Scalar::Int32 ||
+           writeType_ == Scalar::Uint32;
+  }
+  bool isFloatWrite() const {
+    return writeType_ == Scalar::Float32 || writeType_ == Scalar::Float64;
+  }
+  bool isBigIntWrite() const { return Scalar::isBigIntType(writeType_); }
+};
+
+// Store an unboxed scalar value to an array buffer view or other object.
+class MStoreUnboxedScalar : public MTernaryInstruction,
+                            public StoreUnboxedScalarBase,
+                            public StoreUnboxedScalarPolicy::Data {
+  bool requiresBarrier_;
+
+  MStoreUnboxedScalar(
+      MDefinition* elements, MDefinition* index, MDefinition* value,
+      Scalar::Type storageType,
+      MemoryBarrierRequirement requiresBarrier = DoesNotRequireMemoryBarrier)
+      : MTernaryInstruction(classOpcode, elements, index, value),
+        StoreUnboxedScalarBase(storageType),
+        requiresBarrier_(requiresBarrier == DoesRequireMemoryBarrier) {
+    if (requiresBarrier_) {
+      setGuard();  // Not removable or movable
+    }
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreUnboxedScalar)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, value))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+  bool requiresMemoryBarrier() const { return requiresBarrier_; }
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  bool canConsumeFloat32(MUse* use) const override {
+    return use == getUseFor(2) && writeType() == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MStoreUnboxedScalar)
+};
+
+// Store an unboxed scalar value to a dataview object.
+class MStoreDataViewElement : public MQuaternaryInstruction,
+                              public StoreUnboxedScalarBase,
+                              public StoreDataViewElementPolicy::Data {
+  MStoreDataViewElement(MDefinition* elements, MDefinition* index,
+                        MDefinition* value, MDefinition* littleEndian,
+                        Scalar::Type storageType)
+      : MQuaternaryInstruction(classOpcode, elements, index, value,
+                               littleEndian),
+        StoreUnboxedScalarBase(storageType) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType);
+    MOZ_ASSERT(Scalar::byteSize(storageType) > 1);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreDataViewElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, value), (3, littleEndian))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  bool canConsumeFloat32(MUse* use) const override {
+    return use == getUseFor(2) && writeType() == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MStoreDataViewElement)
+};
+
+class MStoreTypedArrayElementHole : public MQuaternaryInstruction,
+                                    public StoreUnboxedScalarBase,
+                                    public StoreTypedArrayHolePolicy::Data {
+  MStoreTypedArrayElementHole(MDefinition* elements, MDefinition* length,
+                              MDefinition* index, MDefinition* value,
+                              Scalar::Type arrayType)
+      : MQuaternaryInstruction(classOpcode, elements, length, index, value),
+        StoreUnboxedScalarBase(arrayType) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(length->type() == MIRType::IntPtr);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(arrayType >= 0 && arrayType < Scalar::MaxTypedArrayViewType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreTypedArrayElementHole)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, length), (2, index), (3, value))
+
+  Scalar::Type arrayType() const { return writeType(); }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+  TruncateKind operandTruncateKind(size_t index) const override;
+
+  bool canConsumeFloat32(MUse* use) const override {
+    return use == getUseFor(3) && arrayType() == Scalar::Float32;
+  }
+
+  ALLOW_CLONE(MStoreTypedArrayElementHole)
+};
+
+// Compute an "effective address", i.e., a compound computation of the form:
+//   base + index * scale + displacement
+class MEffectiveAddress : public MBinaryInstruction, public NoTypePolicy::Data {
+  MEffectiveAddress(MDefinition* base, MDefinition* index, Scale scale,
+                    int32_t displacement)
+      : MBinaryInstruction(classOpcode, base, index),
+        scale_(scale),
+        displacement_(displacement) {
+    MOZ_ASSERT(base->type() == MIRType::Int32);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+    setMovable();
+    setResultType(MIRType::Int32);
+  }
+
+  Scale scale_;
+  int32_t displacement_;
+
+ public:
+  INSTRUCTION_HEADER(EffectiveAddress)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* base() const { return lhs(); }
+  MDefinition* index() const { return rhs(); }
+  Scale scale() const { return scale_; }
+  int32_t displacement() const { return displacement_; }
+
+  ALLOW_CLONE(MEffectiveAddress)
+};
+
+// Clamp input to range [0, 255] for Uint8ClampedArray.
+class MClampToUint8 : public MUnaryInstruction, public ClampPolicy::Data {
+  explicit MClampToUint8(MDefinition* input)
+      : MUnaryInstruction(classOpcode, input) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(ClampToUint8)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  void computeRange(TempAllocator& alloc) override;
+
+  ALLOW_CLONE(MClampToUint8)
+};
+
+class MLoadFixedSlot : public MUnaryInstruction,
+                       public SingleObjectPolicy::Data {
+  size_t slot_;
+
+ protected:
+  MLoadFixedSlot(MDefinition* obj, size_t slot)
+      : MUnaryInstruction(classOpcode, obj), slot_(slot) {
+    setResultType(MIRType::Value);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadFixedSlot)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  size_t slot() const { return slot_; }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadFixedSlot()) {
+      return false;
+    }
+    if (slot() != ins->toLoadFixedSlot()->slot()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::FixedSlot);
+  }
+
+  AliasType mightAlias(const MDefinition* store) const override;
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MLoadFixedSlot)
+};
+
+class MLoadFixedSlotAndUnbox : public MUnaryInstruction,
+                               public SingleObjectPolicy::Data {
+  size_t slot_;
+  MUnbox::Mode mode_;
+
+  MLoadFixedSlotAndUnbox(MDefinition* obj, size_t slot, MUnbox::Mode mode,
+                         MIRType type)
+      : MUnaryInstruction(classOpcode, obj), slot_(slot), mode_(mode) {
+    setResultType(type);
+    setMovable();
+    if (mode_ == MUnbox::Fallible) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadFixedSlotAndUnbox)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  size_t slot() const { return slot_; }
+  MUnbox::Mode mode() const { return mode_; }
+  bool fallible() const { return mode_ != MUnbox::Infallible; }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadFixedSlotAndUnbox() ||
+        slot() != ins->toLoadFixedSlotAndUnbox()->slot() ||
+        mode() != ins->toLoadFixedSlotAndUnbox()->mode()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::FixedSlot);
+  }
+
+  AliasType mightAlias(const MDefinition* store) const override;
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MLoadFixedSlotAndUnbox);
+};
+
+class MLoadDynamicSlotAndUnbox : public MUnaryInstruction,
+                                 public NoTypePolicy::Data {
+  size_t slot_;
+  MUnbox::Mode mode_;
+
+  MLoadDynamicSlotAndUnbox(MDefinition* slots, size_t slot, MUnbox::Mode mode,
+                           MIRType type)
+      : MUnaryInstruction(classOpcode, slots), slot_(slot), mode_(mode) {
+    setResultType(type);
+    setMovable();
+    if (mode_ == MUnbox::Fallible) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadDynamicSlotAndUnbox)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, slots))
+
+  size_t slot() const { return slot_; }
+  MUnbox::Mode mode() const { return mode_; }
+  bool fallible() const { return mode_ != MUnbox::Infallible; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadDynamicSlotAndUnbox() ||
+        slot() != ins->toLoadDynamicSlotAndUnbox()->slot() ||
+        mode() != ins->toLoadDynamicSlotAndUnbox()->mode()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::DynamicSlot);
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MLoadDynamicSlotAndUnbox);
+};
+
+class MStoreFixedSlot
+    : public MBinaryInstruction,
+      public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1>>::Data {
+  bool needsBarrier_;
+  size_t slot_;
+
+  MStoreFixedSlot(MDefinition* obj, MDefinition* rval, size_t slot,
+                  bool barrier)
+      : MBinaryInstruction(classOpcode, obj, rval),
+        needsBarrier_(barrier),
+        slot_(slot) {}
+
+ public:
+  INSTRUCTION_HEADER(StoreFixedSlot)
+  NAMED_OPERANDS((0, object), (1, value))
+
+  static MStoreFixedSlot* NewUnbarriered(TempAllocator& alloc, MDefinition* obj,
+                                         size_t slot, MDefinition* rval) {
+    return new (alloc) MStoreFixedSlot(obj, rval, slot, false);
+  }
+  static MStoreFixedSlot* NewBarriered(TempAllocator& alloc, MDefinition* obj,
+                                       size_t slot, MDefinition* rval) {
+    return new (alloc) MStoreFixedSlot(obj, rval, slot, true);
+  }
+
+  size_t slot() const { return slot_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::FixedSlot);
+  }
+  bool needsBarrier() const { return needsBarrier_; }
+  void setNeedsBarrier(bool needsBarrier = true) {
+    needsBarrier_ = needsBarrier;
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MStoreFixedSlot)
+};
+
+class MGetPropertyCache : public MBinaryInstruction,
+                          public MixPolicy<BoxExceptPolicy<0, MIRType::Object>,
+                                           CacheIdPolicy<1>>::Data {
+  MGetPropertyCache(MDefinition* obj, MDefinition* id)
+      : MBinaryInstruction(classOpcode, obj, id) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetPropertyCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, idval))
+};
+
+class MGetPropSuperCache
+    : public MTernaryInstruction,
+      public MixPolicy<ObjectPolicy<0>, BoxExceptPolicy<1, MIRType::Object>,
+                       CacheIdPolicy<2>>::Data {
+  MGetPropSuperCache(MDefinition* obj, MDefinition* receiver, MDefinition* id)
+      : MTernaryInstruction(classOpcode, obj, receiver, id) {
+    setResultType(MIRType::Value);
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetPropSuperCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, receiver), (2, idval))
+};
+
+// Guard the object's proto is |expected|.
+class MGuardProto : public MBinaryInstruction, public SingleObjectPolicy::Data {
+  MGuardProto(MDefinition* obj, MDefinition* expected)
+      : MBinaryInstruction(classOpcode, obj, expected) {
+    MOZ_ASSERT(expected->isConstant() || expected->isNurseryObject());
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardProto)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, expected))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields);
+  }
+  AliasType mightAlias(const MDefinition* def) const override {
+    // These instructions never modify the [[Prototype]].
+    if (def->isAddAndStoreSlot() || def->isAllocateAndStoreSlot()) {
+      return AliasType::NoAlias;
+    }
+    return AliasType::MayAlias;
+  }
+};
+
+// Guard the object has no proto.
+class MGuardNullProto : public MUnaryInstruction,
+                        public SingleObjectPolicy::Data {
+  explicit MGuardNullProto(MDefinition* obj)
+      : MUnaryInstruction(classOpcode, obj) {
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardNullProto)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields);
+  }
+  AliasType mightAlias(const MDefinition* def) const override {
+    // These instructions never modify the [[Prototype]].
+    if (def->isAddAndStoreSlot() || def->isAllocateAndStoreSlot()) {
+      return AliasType::NoAlias;
+    }
+    return AliasType::MayAlias;
+  }
+};
+
+// Guard on a specific Value.
+class MGuardValue : public MUnaryInstruction, public BoxInputsPolicy::Data {
+  Value expected_;
+
+  MGuardValue(MDefinition* val, const Value& expected)
+      : MUnaryInstruction(classOpcode, val), expected_(expected) {
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardValue)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value))
+
+  Value expected() const { return expected_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardValue()) {
+      return false;
+    }
+    if (expected() != ins->toGuardValue()->expected()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Guard on function flags
+class MGuardFunctionFlags : public MUnaryInstruction,
+                            public SingleObjectPolicy::Data {
+  // At least one of the expected flags must be set, but not necessarily all
+  // expected flags.
+  uint16_t expectedFlags_;
+
+  // None of the unexpected flags must be set.
+  uint16_t unexpectedFlags_;
+
+  explicit MGuardFunctionFlags(MDefinition* fun, uint16_t expectedFlags,
+                               uint16_t unexpectedFlags)
+      : MUnaryInstruction(classOpcode, fun),
+        expectedFlags_(expectedFlags),
+        unexpectedFlags_(unexpectedFlags) {
+    MOZ_ASSERT((expectedFlags & unexpectedFlags) == 0,
+               "Can't guard inconsistent flags");
+    MOZ_ASSERT((expectedFlags | unexpectedFlags) != 0,
+               "Can't guard zero flags");
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardFunctionFlags)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, function))
+
+  uint16_t expectedFlags() const { return expectedFlags_; };
+  uint16_t unexpectedFlags() const { return unexpectedFlags_; };
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardFunctionFlags()) {
+      return false;
+    }
+    if (expectedFlags() != ins->toGuardFunctionFlags()->expectedFlags()) {
+      return false;
+    }
+    if (unexpectedFlags() != ins->toGuardFunctionFlags()->unexpectedFlags()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields);
+  }
+};
+
+// Guard on an object's identity, inclusively or exclusively.
+class MGuardObjectIdentity : public MBinaryInstruction,
+                             public SingleObjectPolicy::Data {
+  bool bailOnEquality_;
+
+  MGuardObjectIdentity(MDefinition* obj, MDefinition* expected,
+                       bool bailOnEquality)
+      : MBinaryInstruction(classOpcode, obj, expected),
+        bailOnEquality_(bailOnEquality) {
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardObjectIdentity)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, expected))
+
+  bool bailOnEquality() const { return bailOnEquality_; }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardObjectIdentity()) {
+      return false;
+    }
+    if (bailOnEquality() != ins->toGuardObjectIdentity()->bailOnEquality()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+// Guard on a specific JSFunction. Used instead of MGuardObjectIdentity,
+// so we can store some metadata related to the expected function.
+class MGuardSpecificFunction : public MBinaryInstruction,
+                               public SingleObjectPolicy::Data {
+  uint16_t nargs_;
+  FunctionFlags flags_;
+
+  MGuardSpecificFunction(MDefinition* obj, MDefinition* expected,
+                         uint16_t nargs, FunctionFlags flags)
+      : MBinaryInstruction(classOpcode, obj, expected),
+        nargs_(nargs),
+        flags_(flags) {
+    MOZ_ASSERT(expected->isConstant() || expected->isNurseryObject());
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardSpecificFunction)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, function), (1, expected))
+
+  uint16_t nargs() const { return nargs_; }
+  FunctionFlags flags() const { return flags_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardSpecificFunction()) {
+      return false;
+    }
+
+    auto* other = ins->toGuardSpecificFunction();
+    if (nargs() != other->nargs() ||
+        flags().toRaw() != other->flags().toRaw()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MGuardSpecificSymbol : public MUnaryInstruction,
+                             public SymbolPolicy<0>::Data {
+  CompilerGCPointer<JS::Symbol*> expected_;
+
+  MGuardSpecificSymbol(MDefinition* symbol, JS::Symbol* expected)
+      : MUnaryInstruction(classOpcode, symbol), expected_(expected) {
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Symbol);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardSpecificSymbol)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, symbol))
+
+  JS::Symbol* expected() const { return expected_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardSpecificSymbol()) {
+      return false;
+    }
+    if (expected() != ins->toGuardSpecificSymbol()->expected()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MGuardTagNotEqual
+    : public MBinaryInstruction,
+      public MixPolicy<UnboxedInt32Policy<0>, UnboxedInt32Policy<1>>::Data {
+  MGuardTagNotEqual(MDefinition* left, MDefinition* right)
+      : MBinaryInstruction(classOpcode, left, right) {
+    setGuard();
+    setMovable();
+    setCommutative();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardTagNotEqual)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return binaryCongruentTo(ins);
+  }
+};
+
+// Load from vp[slot] (slots that are not inline in an object).
+class MLoadDynamicSlot : public MUnaryInstruction, public NoTypePolicy::Data {
+  uint32_t slot_;
+
+  MLoadDynamicSlot(MDefinition* slots, uint32_t slot)
+      : MUnaryInstruction(classOpcode, slots), slot_(slot) {
+    setResultType(MIRType::Value);
+    setMovable();
+    MOZ_ASSERT(slots->type() == MIRType::Slots);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadDynamicSlot)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, slots))
+
+  uint32_t slot() const { return slot_; }
+
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadDynamicSlot()) {
+      return false;
+    }
+    if (slot() != ins->toLoadDynamicSlot()->slot()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override {
+    MOZ_ASSERT(slots()->type() == MIRType::Slots);
+    return AliasSet::Load(AliasSet::DynamicSlot);
+  }
+  AliasType mightAlias(const MDefinition* store) const override;
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MLoadDynamicSlot)
+};
+
+class MAddAndStoreSlot
+    : public MBinaryInstruction,
+      public MixPolicy<SingleObjectPolicy, BoxPolicy<1>>::Data {
+ public:
+  enum class Kind {
+    FixedSlot,
+    DynamicSlot,
+  };
+
+ private:
+  Kind kind_;
+  uint32_t slotOffset_;
+  CompilerShape shape_;
+
+  MAddAndStoreSlot(MDefinition* obj, MDefinition* value, Kind kind,
+                   uint32_t slotOffset, Shape* shape)
+      : MBinaryInstruction(classOpcode, obj, value),
+        kind_(kind),
+        slotOffset_(slotOffset),
+        shape_(shape) {}
+
+ public:
+  INSTRUCTION_HEADER(AddAndStoreSlot)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, value))
+
+  Kind kind() const { return kind_; }
+  uint32_t slotOffset() const { return slotOffset_; }
+  Shape* shape() const { return shape_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::ObjectFields |
+                           (kind() == Kind::FixedSlot ? AliasSet::FixedSlot
+                                                      : AliasSet::DynamicSlot));
+  }
+};
+
+// Store to vp[slot] (slots that are not inline in an object).
+class MStoreDynamicSlot : public MBinaryInstruction,
+                          public NoFloatPolicy<1>::Data {
+  uint32_t slot_;
+  bool needsBarrier_;
+
+  MStoreDynamicSlot(MDefinition* slots, uint32_t slot, MDefinition* value,
+                    bool barrier)
+      : MBinaryInstruction(classOpcode, slots, value),
+        slot_(slot),
+        needsBarrier_(barrier) {
+    MOZ_ASSERT(slots->type() == MIRType::Slots);
+  }
+
+ public:
+  INSTRUCTION_HEADER(StoreDynamicSlot)
+  NAMED_OPERANDS((0, slots), (1, value))
+
+  static MStoreDynamicSlot* NewUnbarriered(TempAllocator& alloc,
+                                           MDefinition* slots, uint32_t slot,
+                                           MDefinition* value) {
+    return new (alloc) MStoreDynamicSlot(slots, slot, value, false);
+  }
+  static MStoreDynamicSlot* NewBarriered(TempAllocator& alloc,
+                                         MDefinition* slots, uint32_t slot,
+                                         MDefinition* value) {
+    return new (alloc) MStoreDynamicSlot(slots, slot, value, true);
+  }
+
+  uint32_t slot() const { return slot_; }
+  bool needsBarrier() const { return needsBarrier_; }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::DynamicSlot);
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  ALLOW_CLONE(MStoreDynamicSlot)
+};
+
+class MSetPropertyCache : public MTernaryInstruction,
+                          public MixPolicy<SingleObjectPolicy, CacheIdPolicy<1>,
+                                           NoFloatPolicy<2>>::Data {
+  bool strict_ : 1;
+
+  MSetPropertyCache(MDefinition* obj, MDefinition* id, MDefinition* value,
+                    bool strict)
+      : MTernaryInstruction(classOpcode, obj, id, value), strict_(strict) {}
+
+ public:
+  INSTRUCTION_HEADER(SetPropertyCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, idval), (2, value))
+
+  bool strict() const { return strict_; }
+};
+
+class MMegamorphicSetElement : public MTernaryInstruction,
+                               public MegamorphicSetElementPolicy::Data {
+  bool strict_;
+
+  MMegamorphicSetElement(MDefinition* object, MDefinition* index,
+                         MDefinition* value, bool strict)
+      : MTernaryInstruction(classOpcode, object, index, value),
+        strict_(strict) {}
+
+ public:
+  INSTRUCTION_HEADER(MegamorphicSetElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, index), (2, value))
+
+  bool strict() const { return strict_; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MSetDOMProperty : public MBinaryInstruction,
+                        public MixPolicy<ObjectPolicy<0>, BoxPolicy<1>>::Data {
+  const JSJitSetterOp func_;
+  Realm* setterRealm_;
+  DOMObjectKind objectKind_;
+
+  MSetDOMProperty(const JSJitSetterOp func, DOMObjectKind objectKind,
+                  Realm* setterRealm, MDefinition* obj, MDefinition* val)
+      : MBinaryInstruction(classOpcode, obj, val),
+        func_(func),
+        setterRealm_(setterRealm),
+        objectKind_(objectKind) {}
+
+ public:
+  INSTRUCTION_HEADER(SetDOMProperty)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, value))
+
+  JSJitSetterOp fun() const { return func_; }
+  Realm* setterRealm() const { return setterRealm_; }
+  DOMObjectKind objectKind() const { return objectKind_; }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MGetDOMPropertyBase : public MVariadicInstruction,
+                            public ObjectPolicy<0>::Data {
+  const JSJitInfo* info_;
+
+ protected:
+  MGetDOMPropertyBase(Opcode op, const JSJitInfo* jitinfo)
+      : MVariadicInstruction(op), info_(jitinfo) {
+    MOZ_ASSERT(jitinfo);
+    MOZ_ASSERT(jitinfo->type() == JSJitInfo::Getter);
+
+    // We are movable iff the jitinfo says we can be.
+    if (isDomMovable()) {
+      MOZ_ASSERT(jitinfo->aliasSet() != JSJitInfo::AliasEverything);
+      setMovable();
+    } else {
+      // If we're not movable, that means we shouldn't be DCEd either,
+      // because we might throw an exception when called, and getting rid
+      // of that is observable.
+      setGuard();
+    }
+
+    setResultType(MIRType::Value);
+  }
+
+  const JSJitInfo* info() const { return info_; }
+
+  [[nodiscard]] bool init(TempAllocator& alloc, MDefinition* obj,
+                          MDefinition* guard, MDefinition* globalGuard) {
+    MOZ_ASSERT(obj);
+    // guard can be null.
+    // globalGuard can be null.
+    size_t operandCount = 1;
+    if (guard) {
+      ++operandCount;
+    }
+    if (globalGuard) {
+      ++operandCount;
+    }
+    if (!MVariadicInstruction::init(alloc, operandCount)) {
+      return false;
+    }
+    initOperand(0, obj);
+
+    size_t operandIndex = 1;
+    // Pin the guard, if we have one as an operand if we want to hoist later.
+    if (guard) {
+      initOperand(operandIndex++, guard);
+    }
+
+    // And the same for the global guard, if we have one.
+    if (globalGuard) {
+      initOperand(operandIndex, globalGuard);
+    }
+
+    return true;
+  }
+
+ public:
+  NAMED_OPERANDS((0, object))
+
+  JSJitGetterOp fun() const { return info_->getter; }
+  bool isInfallible() const { return info_->isInfallible; }
+  bool isDomMovable() const { return info_->isMovable; }
+  JSJitInfo::AliasSet domAliasSet() const { return info_->aliasSet(); }
+  size_t domMemberSlotIndex() const {
+    MOZ_ASSERT(info_->isAlwaysInSlot || info_->isLazilyCachedInSlot);
+    return info_->slotIndex;
+  }
+  bool valueMayBeInSlot() const { return info_->isLazilyCachedInSlot; }
+
+  bool baseCongruentTo(const MGetDOMPropertyBase* ins) const {
+    if (!isDomMovable()) {
+      return false;
+    }
+
+    // Checking the jitinfo is the same as checking the constant function
+    if (!(info() == ins->info())) {
+      return false;
+    }
+
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    JSJitInfo::AliasSet aliasSet = domAliasSet();
+    if (aliasSet == JSJitInfo::AliasNone) {
+      return AliasSet::None();
+    }
+    if (aliasSet == JSJitInfo::AliasDOMSets) {
+      return AliasSet::Load(AliasSet::DOMProperty);
+    }
+    MOZ_ASSERT(aliasSet == JSJitInfo::AliasEverything);
+    return AliasSet::Store(AliasSet::Any);
+  }
+};
+
+class MGetDOMProperty : public MGetDOMPropertyBase {
+  Realm* getterRealm_;
+  DOMObjectKind objectKind_;
+
+  MGetDOMProperty(const JSJitInfo* jitinfo, DOMObjectKind objectKind,
+                  Realm* getterRealm)
+      : MGetDOMPropertyBase(classOpcode, jitinfo),
+        getterRealm_(getterRealm),
+        objectKind_(objectKind) {}
+
+ public:
+  INSTRUCTION_HEADER(GetDOMProperty)
+
+  static MGetDOMProperty* New(TempAllocator& alloc, const JSJitInfo* info,
+                              DOMObjectKind objectKind, Realm* getterRealm,
+                              MDefinition* obj, MDefinition* guard,
+                              MDefinition* globalGuard) {
+    auto* res = new (alloc) MGetDOMProperty(info, objectKind, getterRealm);
+    if (!res || !res->init(alloc, obj, guard, globalGuard)) {
+      return nullptr;
+    }
+    return res;
+  }
+
+  Realm* getterRealm() const { return getterRealm_; }
+  DOMObjectKind objectKind() const { return objectKind_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGetDOMProperty()) {
+      return false;
+    }
+
+    if (ins->toGetDOMProperty()->getterRealm() != getterRealm()) {
+      return false;
+    }
+
+    return baseCongruentTo(ins->toGetDOMProperty());
+  }
+
+  bool possiblyCalls() const override { return true; }
+};
+
+class MGetDOMMember : public MGetDOMPropertyBase {
+  explicit MGetDOMMember(const JSJitInfo* jitinfo)
+      : MGetDOMPropertyBase(classOpcode, jitinfo) {
+    setResultType(MIRTypeFromValueType(jitinfo->returnType()));
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetDOMMember)
+
+  static MGetDOMMember* New(TempAllocator& alloc, const JSJitInfo* info,
+                            MDefinition* obj, MDefinition* guard,
+                            MDefinition* globalGuard) {
+    auto* res = new (alloc) MGetDOMMember(info);
+    if (!res || !res->init(alloc, obj, guard, globalGuard)) {
+      return nullptr;
+    }
+    return res;
+  }
+
+  bool possiblyCalls() const override { return false; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGetDOMMember()) {
+      return false;
+    }
+
+    return baseCongruentTo(ins->toGetDOMMember());
+  }
+};
+
+class MLoadDOMExpandoValueGuardGeneration : public MUnaryInstruction,
+                                            public SingleObjectPolicy::Data {
+  JS::ExpandoAndGeneration* expandoAndGeneration_;
+  uint64_t generation_;
+
+  MLoadDOMExpandoValueGuardGeneration(
+      MDefinition* proxy, JS::ExpandoAndGeneration* expandoAndGeneration,
+      uint64_t generation)
+      : MUnaryInstruction(classOpcode, proxy),
+        expandoAndGeneration_(expandoAndGeneration),
+        generation_(generation) {
+    setGuard();
+    setMovable();
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(LoadDOMExpandoValueGuardGeneration)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, proxy))
+
+  JS::ExpandoAndGeneration* expandoAndGeneration() const {
+    return expandoAndGeneration_;
+  }
+  uint64_t generation() const { return generation_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isLoadDOMExpandoValueGuardGeneration()) {
+      return false;
+    }
+    const auto* other = ins->toLoadDOMExpandoValueGuardGeneration();
+    if (expandoAndGeneration() != other->expandoAndGeneration() ||
+        generation() != other->generation()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::DOMProxyExpando);
+  }
+};
+
+// Inlined assembly for Math.floor(double | float32) -> int32.
+class MFloor : public MUnaryInstruction, public FloatingPointPolicy<0>::Data {
+  explicit MFloor(MDefinition* num) : MUnaryInstruction(classOpcode, num) {
+    setResultType(MIRType::Int32);
+    specialization_ = MIRType::Double;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Floor)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MFloor)
+};
+
+// Inlined assembly version for Math.ceil(double | float32) -> int32.
+class MCeil : public MUnaryInstruction, public FloatingPointPolicy<0>::Data {
+  explicit MCeil(MDefinition* num) : MUnaryInstruction(classOpcode, num) {
+    setResultType(MIRType::Int32);
+    specialization_ = MIRType::Double;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Ceil)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  void computeRange(TempAllocator& alloc) override;
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MCeil)
+};
+
+// Inlined version of Math.round(double | float32) -> int32.
+class MRound : public MUnaryInstruction, public FloatingPointPolicy<0>::Data {
+  explicit MRound(MDefinition* num) : MUnaryInstruction(classOpcode, num) {
+    setResultType(MIRType::Int32);
+    specialization_ = MIRType::Double;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Round)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MRound)
+};
+
+// Inlined version of Math.trunc(double | float32) -> int32.
+class MTrunc : public MUnaryInstruction, public FloatingPointPolicy<0>::Data {
+  explicit MTrunc(MDefinition* num) : MUnaryInstruction(classOpcode, num) {
+    setResultType(MIRType::Int32);
+    specialization_ = MIRType::Double;
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Trunc)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MTrunc)
+};
+
+// NearbyInt rounds the floating-point input to the nearest integer, according
+// to the RoundingMode.
+class MNearbyInt : public MUnaryInstruction,
+                   public FloatingPointPolicy<0>::Data {
+  RoundingMode roundingMode_;
+
+  explicit MNearbyInt(MDefinition* num, MIRType resultType,
+                      RoundingMode roundingMode)
+      : MUnaryInstruction(classOpcode, num), roundingMode_(roundingMode) {
+    MOZ_ASSERT(HasAssemblerSupport(roundingMode));
+
+    MOZ_ASSERT(IsFloatingPointType(resultType));
+    setResultType(resultType);
+    specialization_ = resultType;
+
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(NearbyInt)
+  TRIVIAL_NEW_WRAPPERS
+
+  static bool HasAssemblerSupport(RoundingMode mode) {
+    return Assembler::HasRoundInstruction(mode);
+  }
+
+  RoundingMode roundingMode() const { return roundingMode_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool isFloat32Commutative() const override { return true; }
+  void trySpecializeFloat32(TempAllocator& alloc) override;
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#endif
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toNearbyInt()->roundingMode() == roundingMode_;
+  }
+
+#ifdef JS_JITSPEW
+  void printOpcode(GenericPrinter& out) const override;
+#endif
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+
+  bool canRecoverOnBailout() const override {
+    switch (roundingMode_) {
+      case RoundingMode::Up:
+      case RoundingMode::Down:
+      case RoundingMode::TowardsZero:
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  ALLOW_CLONE(MNearbyInt)
+};
+
+class MGetIteratorCache : public MUnaryInstruction,
+                          public BoxExceptPolicy<0, MIRType::Object>::Data {
+  explicit MGetIteratorCache(MDefinition* val)
+      : MUnaryInstruction(classOpcode, val) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GetIteratorCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value))
+};
+
+// Implementation for 'in' operator using instruction cache
+class MInCache : public MBinaryInstruction,
+                 public MixPolicy<CacheIdPolicy<0>, ObjectPolicy<1>>::Data {
+  MInCache(MDefinition* key, MDefinition* obj)
+      : MBinaryInstruction(classOpcode, key, obj) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(InCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, key), (1, object))
+};
+
+// Test whether the index is in the array bounds or a hole.
+class MInArray : public MQuaternaryInstruction, public ObjectPolicy<3>::Data {
+  bool needsNegativeIntCheck_;
+
+  MInArray(MDefinition* elements, MDefinition* index, MDefinition* initLength,
+           MDefinition* object)
+      : MQuaternaryInstruction(classOpcode, elements, index, initLength,
+                               object),
+        needsNegativeIntCheck_(true) {
+    setResultType(MIRType::Boolean);
+    setMovable();
+
+    // Set the guard flag to make sure we bail when we see a negative index.
+    // We can clear this flag (and needsNegativeIntCheck_) in
+    // collectRangeInfoPreTrunc.
+    setGuard();
+
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+    MOZ_ASSERT(initLength->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(InArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, initLength), (3, object))
+
+  bool needsNegativeIntCheck() const { return needsNegativeIntCheck_; }
+  void collectRangeInfoPreTrunc() override;
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::Element);
+  }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isInArray()) {
+      return false;
+    }
+    const MInArray* other = ins->toInArray();
+    if (needsNegativeIntCheck() != other->needsNegativeIntCheck()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(other);
+  }
+};
+
+// Bail when the element is a hole.
+class MGuardElementNotHole : public MBinaryInstruction,
+                             public NoTypePolicy::Data {
+  MGuardElementNotHole(MDefinition* elements, MDefinition* index)
+      : MBinaryInstruction(classOpcode, elements, index) {
+    setMovable();
+    setGuard();
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::Int32);
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardElementNotHole)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::Element);
+  }
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
+class MCheckPrivateFieldCache
+    : public MBinaryInstruction,
+      public MixPolicy<BoxExceptPolicy<0, MIRType::Object>,
+                       CacheIdPolicy<1>>::Data {
+  MCheckPrivateFieldCache(MDefinition* obj, MDefinition* id)
+      : MBinaryInstruction(classOpcode, obj, id) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(CheckPrivateFieldCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, idval))
+};
+
+class MHasOwnCache : public MBinaryInstruction,
+                     public MixPolicy<BoxExceptPolicy<0, MIRType::Object>,
+                                      CacheIdPolicy<1>>::Data {
+  MHasOwnCache(MDefinition* obj, MDefinition* id)
+      : MBinaryInstruction(classOpcode, obj, id) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(HasOwnCache)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, idval))
+};
+
+// Implementation for instanceof operator with specific rhs.
+class MInstanceOf : public MBinaryInstruction,
+                    public MixPolicy<BoxExceptPolicy<0, MIRType::Object>,
+                                     ObjectPolicy<1>>::Data {
+  MInstanceOf(MDefinition* obj, MDefinition* proto)
+      : MBinaryInstruction(classOpcode, obj, proto) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(InstanceOf)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+// Given a value being written to another object, update the generational store
+// buffer if the value is in the nursery and object is in the tenured heap.
+class MPostWriteBarrier : public MBinaryInstruction,
+                          public ObjectPolicy<0>::Data {
+  MPostWriteBarrier(MDefinition* obj, MDefinition* value)
+      : MBinaryInstruction(classOpcode, obj, value) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(PostWriteBarrier)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, value))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override {
+    // During lowering, values that neither have object nor value MIR type
+    // are ignored, thus Float32 can show up at this point without any issue.
+    return use == getUseFor(1);
+  }
+#endif
+
+  ALLOW_CLONE(MPostWriteBarrier)
+};
+
+// Given a value being written to another object's elements at the specified
+// index, update the generational store buffer if the value is in the nursery
+// and object is in the tenured heap.
+class MPostWriteElementBarrier
+    : public MTernaryInstruction,
+      public MixPolicy<ObjectPolicy<0>, UnboxedInt32Policy<2>>::Data {
+  MPostWriteElementBarrier(MDefinition* obj, MDefinition* value,
+                           MDefinition* index)
+      : MTernaryInstruction(classOpcode, obj, value, index) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(PostWriteElementBarrier)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, value), (2, index))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override {
+    // During lowering, values that neither have object nor value MIR type
+    // are ignored, thus Float32 can show up at this point without any issue.
+    return use == getUseFor(1);
+  }
+#endif
+
+  ALLOW_CLONE(MPostWriteElementBarrier)
+};
+
+class MNewCallObject : public MUnaryInstruction,
+                       public SingleObjectPolicy::Data {
+ public:
+  INSTRUCTION_HEADER(NewCallObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  explicit MNewCallObject(MConstant* templateObj)
+      : MUnaryInstruction(classOpcode, templateObj) {
+    setResultType(MIRType::Object);
+  }
+
+  CallObject* templateObject() const {
+    return &getOperand(0)->toConstant()->toObject().as<CallObject>();
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+};
+
+class MNewStringObject : public MUnaryInstruction,
+                         public ConvertToStringPolicy<0>::Data {
+  CompilerObject templateObj_;
+
+  MNewStringObject(MDefinition* input, JSObject* templateObj)
+      : MUnaryInstruction(classOpcode, input), templateObj_(templateObj) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  INSTRUCTION_HEADER(NewStringObject)
+  TRIVIAL_NEW_WRAPPERS
+
+  StringObject* templateObj() const;
+};
+
+// This is an alias for MLoadFixedSlot.
+class MEnclosingEnvironment : public MLoadFixedSlot {
+  explicit MEnclosingEnvironment(MDefinition* obj)
+      : MLoadFixedSlot(obj, EnvironmentObject::enclosingEnvironmentSlot()) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  static MEnclosingEnvironment* New(TempAllocator& alloc, MDefinition* obj) {
+    return new (alloc) MEnclosingEnvironment(obj);
+  }
+
+  AliasSet getAliasSet() const override {
+    // EnvironmentObject reserved slots are immutable.
+    return AliasSet::None();
+  }
+};
+
+// This is an element of a spaghetti stack which is used to represent the memory
+// context which has to be restored in case of a bailout.
+struct MStoreToRecover : public TempObject,
+                         public InlineSpaghettiStackNode<MStoreToRecover> {
+  MDefinition* operand;
+
+  explicit MStoreToRecover(MDefinition* operand) : operand(operand) {}
+};
+
+using MStoresToRecoverList = InlineSpaghettiStack<MStoreToRecover>;
+
+// A resume point contains the information needed to reconstruct the Baseline
+// Interpreter state from a position in Warp JIT code. A resume point is a
+// mapping of stack slots to MDefinitions.
+//
+// We capture stack state at critical points:
+//   * (1) At the beginning of every basic block.
+//   * (2) After every effectful operation.
+//
+// As long as these two properties are maintained, instructions can be moved,
+// hoisted, or, eliminated without problems, and ops without side effects do not
+// need to worry about capturing state at precisely the right point in time.
+//
+// Effectful instructions, of course, need to capture state after completion,
+// where the interpreter will not attempt to repeat the operation. For this,
+// ResumeAfter must be used. The state is attached directly to the effectful
+// instruction to ensure that no intermediate instructions could be injected
+// in between by a future analysis pass.
+//
+// During LIR construction, if an instruction can bail back to the interpreter,
+// we create an LSnapshot, which uses the last known resume point to request
+// register/stack assignments for every live value.
+class MResumePoint final : public MNode
+#ifdef DEBUG
+    ,
+                           public InlineForwardListNode<MResumePoint>
+#endif
+{
+ private:
+  friend class MBasicBlock;
+  friend void AssertBasicGraphCoherency(MIRGraph& graph, bool force);
+
+  // List of stack slots needed to reconstruct the BaselineFrame.
+  FixedList<MUse> operands_;
+
+  // List of stores needed to reconstruct the content of objects which are
+  // emulated by EmulateStateOf variants.
+  MStoresToRecoverList stores_;
+
+  jsbytecode* pc_;
+  MInstruction* instruction_;
+  ResumeMode mode_;
+  bool isDiscarded_ = false;
+
+  MResumePoint(MBasicBlock* block, jsbytecode* pc, ResumeMode mode);
+  void inherit(MBasicBlock* state);
+
+  // Calling isDefinition or isResumePoint on MResumePoint is unnecessary.
+  bool isDefinition() const = delete;
+  bool isResumePoint() const = delete;
+
+  void setBlock(MBasicBlock* block) {
+    setBlockAndKind(block, Kind::ResumePoint);
+  }
+
+ protected:
+  // Initializes operands_ to an empty array of a fixed length.
+  // The array may then be filled in by inherit().
+  [[nodiscard]] bool init(TempAllocator& alloc);
+
+  void clearOperand(size_t index) {
+    // FixedList doesn't initialize its elements, so do an unchecked init.
+    operands_[index].initUncheckedWithoutProducer(this);
+  }
+
+  MUse* getUseFor(size_t index) override { return &operands_[index]; }
+  const MUse* getUseFor(size_t index) const override {
+    return &operands_[index];
+  }
+
+ public:
+  static MResumePoint* New(TempAllocator& alloc, MBasicBlock* block,
+                           jsbytecode* pc, ResumeMode mode);
+
+  MBasicBlock* block() const { return resumePointBlock(); }
+
+  size_t numAllocatedOperands() const { return operands_.length(); }
+  uint32_t stackDepth() const { return numAllocatedOperands(); }
+  size_t numOperands() const override { return numAllocatedOperands(); }
+  size_t indexOf(const MUse* u) const final {
+    MOZ_ASSERT(u >= &operands_[0]);
+    MOZ_ASSERT(u <= &operands_[numOperands() - 1]);
+    return u - &operands_[0];
+  }
+  void initOperand(size_t index, MDefinition* operand) {
+    // FixedList doesn't initialize its elements, so do an unchecked init.
+    operands_[index].initUnchecked(operand, this);
+  }
+  void replaceOperand(size_t index, MDefinition* operand) final {
+    operands_[index].replaceProducer(operand);
+  }
+
+  bool isObservableOperand(MUse* u) const;
+  bool isObservableOperand(size_t index) const;
+  bool isRecoverableOperand(MUse* u) const;
+
+  MDefinition* getOperand(size_t index) const override {
+    return operands_[index].producer();
+  }
+  jsbytecode* pc() const { return pc_; }
+  MResumePoint* caller() const;
+  uint32_t frameCount() const {
+    uint32_t count = 1;
+    for (MResumePoint* it = caller(); it; it = it->caller()) {
+      count++;
+    }
+    return count;
+  }
+  MInstruction* instruction() { return instruction_; }
+  void setInstruction(MInstruction* ins) {
+    MOZ_ASSERT(!instruction_);
+    instruction_ = ins;
+  }
+  void resetInstruction() {
+    MOZ_ASSERT(instruction_);
+    instruction_ = nullptr;
+  }
+  ResumeMode mode() const { return mode_; }
+
+  void releaseUses() {
+    for (size_t i = 0, e = numOperands(); i < e; i++) {
+      if (operands_[i].hasProducer()) {
+        operands_[i].releaseProducer();
+      }
+    }
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+
+  // Register a store instruction on the current resume point. This
+  // instruction would be recovered when we are bailing out. The |cache|
+  // argument can be any resume point, it is used to share memory if we are
+  // doing the same modification.
+  void addStore(TempAllocator& alloc, MDefinition* store,
+                const MResumePoint* cache = nullptr);
+
+  MStoresToRecoverList::iterator storesBegin() const { return stores_.begin(); }
+  MStoresToRecoverList::iterator storesEnd() const { return stores_.end(); }
+
+  void setDiscarded() { isDiscarded_ = true; }
+  bool isDiscarded() const { return isDiscarded_; }
+
+#ifdef JS_JITSPEW
+  virtual void dump(GenericPrinter& out) const override;
+  virtual void dump() const override;
+#endif
+};
+
+class MIsCallable : public MUnaryInstruction,
+                    public BoxExceptPolicy<0, MIRType::Object>::Data {
+  explicit MIsCallable(MDefinition* object)
+      : MUnaryInstruction(classOpcode, object) {
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(IsCallable)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MHasClass : public MUnaryInstruction, public SingleObjectPolicy::Data {
+  const JSClass* class_;
+
+  MHasClass(MDefinition* object, const JSClass* clasp)
+      : MUnaryInstruction(classOpcode, object), class_(clasp) {
+    MOZ_ASSERT(object->type() == MIRType::Object);
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(HasClass)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  const JSClass* getClass() const { return class_; }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isHasClass()) {
+      return false;
+    }
+    if (getClass() != ins->toHasClass()->getClass()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
+class MGuardToClass : public MUnaryInstruction,
+                      public SingleObjectPolicy::Data {
+  const JSClass* class_;
+
+  MGuardToClass(MDefinition* object, const JSClass* clasp)
+      : MUnaryInstruction(classOpcode, object), class_(clasp) {
+    MOZ_ASSERT(object->type() == MIRType::Object);
+    MOZ_ASSERT(!clasp->isJSFunction(), "Use MGuardToFunction instead");
+    setResultType(MIRType::Object);
+    setMovable();
+
+    // We will bail out if the class type is incorrect, so we need to ensure we
+    // don't eliminate this instruction
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardToClass)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  const JSClass* getClass() const { return class_; }
+  bool isArgumentsObjectClass() const {
+    return class_ == &MappedArgumentsObject::class_ ||
+           class_ == &UnmappedArgumentsObject::class_;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardToClass()) {
+      return false;
+    }
+    if (getClass() != ins->toGuardToClass()->getClass()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
+class MGuardToFunction : public MUnaryInstruction,
+                         public SingleObjectPolicy::Data {
+  explicit MGuardToFunction(MDefinition* object)
+      : MUnaryInstruction(classOpcode, object) {
+    MOZ_ASSERT(object->type() == MIRType::Object);
+    setResultType(MIRType::Object);
+    setMovable();
+
+    // We will bail out if the class type is incorrect, so we need to ensure we
+    // don't eliminate this instruction
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardToFunction)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    if (!ins->isGuardToFunction()) {
+      return false;
+    }
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
+// Note: we might call a proxy trap, so this instruction is effectful.
+class MIsArray : public MUnaryInstruction,
+                 public BoxExceptPolicy<0, MIRType::Object>::Data {
+  explicit MIsArray(MDefinition* value)
+      : MUnaryInstruction(classOpcode, value) {
+    setResultType(MIRType::Boolean);
+  }
+
+ public:
+  INSTRUCTION_HEADER(IsArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value))
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+class MIsTypedArray : public MUnaryInstruction,
+                      public SingleObjectPolicy::Data {
+  bool possiblyWrapped_;
+
+  explicit MIsTypedArray(MDefinition* value, bool possiblyWrapped)
+      : MUnaryInstruction(classOpcode, value),
+        possiblyWrapped_(possiblyWrapped) {
+    setResultType(MIRType::Boolean);
+
+    if (possiblyWrapped) {
+      // Proxy checks may throw, so we're neither removable nor movable.
+      setGuard();
+    } else {
+      setMovable();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(IsTypedArray)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value))
+
+  bool isPossiblyWrapped() const { return possiblyWrapped_; }
+  AliasSet getAliasSet() const override {
+    if (isPossiblyWrapped()) {
+      return AliasSet::Store(AliasSet::Any);
+    }
+    return AliasSet::None();
+  }
+};
+
+// Allocate the generator object for a frame.
+class MGenerator : public MTernaryInstruction,
+                   public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1>>::Data {
+  explicit MGenerator(MDefinition* callee, MDefinition* environmentChain,
+                      MDefinition* argsObject)
+      : MTernaryInstruction(classOpcode, callee, environmentChain, argsObject) {
+    setResultType(MIRType::Object);
+  };
+
+ public:
+  INSTRUCTION_HEADER(Generator)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, callee), (1, environmentChain), (2, argsObject))
+};
+
+class MMaybeExtractAwaitValue : public MBinaryInstruction,
+                                public BoxPolicy<0>::Data {
+  explicit MMaybeExtractAwaitValue(MDefinition* value, MDefinition* canSkip)
+      : MBinaryInstruction(classOpcode, value, canSkip) {
+    setResultType(MIRType::Value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(MaybeExtractAwaitValue)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, canSkip))
+};
+
+class MAtomicIsLockFree : public MUnaryInstruction,
+                          public ConvertToInt32Policy<0>::Data {
+  explicit MAtomicIsLockFree(MDefinition* value)
+      : MUnaryInstruction(classOpcode, value) {
+    setResultType(MIRType::Boolean);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(AtomicIsLockFree)
+  TRIVIAL_NEW_WRAPPERS
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  [[nodiscard]] bool writeRecoverData(
+      CompactBufferWriter& writer) const override;
+  bool canRecoverOnBailout() const override { return true; }
+
+  ALLOW_CLONE(MAtomicIsLockFree)
+};
+
+class MCompareExchangeTypedArrayElement
+    : public MQuaternaryInstruction,
+      public MixPolicy<TruncateToInt32OrToBigIntPolicy<2>,
+                       TruncateToInt32OrToBigIntPolicy<3>>::Data {
+  Scalar::Type arrayType_;
+
+  explicit MCompareExchangeTypedArrayElement(MDefinition* elements,
+                                             MDefinition* index,
+                                             Scalar::Type arrayType,
+                                             MDefinition* oldval,
+                                             MDefinition* newval)
+      : MQuaternaryInstruction(classOpcode, elements, index, oldval, newval),
+        arrayType_(arrayType) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    setGuard();  // Not removable
+  }
+
+ public:
+  INSTRUCTION_HEADER(CompareExchangeTypedArrayElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, oldval), (3, newval))
+
+  bool isByteArray() const {
+    return (arrayType_ == Scalar::Int8 || arrayType_ == Scalar::Uint8);
+  }
+  Scalar::Type arrayType() const { return arrayType_; }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+};
+
+class MAtomicExchangeTypedArrayElement
+    : public MTernaryInstruction,
+      public TruncateToInt32OrToBigIntPolicy<2>::Data {
+  Scalar::Type arrayType_;
+
+  MAtomicExchangeTypedArrayElement(MDefinition* elements, MDefinition* index,
+                                   MDefinition* value, Scalar::Type arrayType)
+      : MTernaryInstruction(classOpcode, elements, index, value),
+        arrayType_(arrayType) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(arrayType <= Scalar::Uint32 || Scalar::isBigIntType(arrayType));
+    setGuard();  // Not removable
+  }
+
+ public:
+  INSTRUCTION_HEADER(AtomicExchangeTypedArrayElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, value))
+
+  bool isByteArray() const {
+    return (arrayType_ == Scalar::Int8 || arrayType_ == Scalar::Uint8);
+  }
+  Scalar::Type arrayType() const { return arrayType_; }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+};
+
+class MAtomicTypedArrayElementBinop
+    : public MTernaryInstruction,
+      public TruncateToInt32OrToBigIntPolicy<2>::Data {
+ private:
+  AtomicOp op_;
+  Scalar::Type arrayType_;
+  bool forEffect_;
+
+  explicit MAtomicTypedArrayElementBinop(AtomicOp op, MDefinition* elements,
+                                         MDefinition* index,
+                                         Scalar::Type arrayType,
+                                         MDefinition* value, bool forEffect)
+      : MTernaryInstruction(classOpcode, elements, index, value),
+        op_(op),
+        arrayType_(arrayType),
+        forEffect_(forEffect) {
+    MOZ_ASSERT(elements->type() == MIRType::Elements);
+    MOZ_ASSERT(index->type() == MIRType::IntPtr);
+    MOZ_ASSERT(arrayType <= Scalar::Uint32 || Scalar::isBigIntType(arrayType));
+    setGuard();  // Not removable
+  }
+
+ public:
+  INSTRUCTION_HEADER(AtomicTypedArrayElementBinop)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements), (1, index), (2, value))
+
+  bool isByteArray() const {
+    return (arrayType_ == Scalar::Int8 || arrayType_ == Scalar::Uint8);
+  }
+  AtomicOp operation() const { return op_; }
+  Scalar::Type arrayType() const { return arrayType_; }
+  bool isForEffect() const { return forEffect_; }
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::UnboxedElement);
+  }
+};
+
+class MDebugger : public MNullaryInstruction {
+  MDebugger() : MNullaryInstruction(classOpcode) {
+    setBailoutKind(BailoutKind::Debugger);
+  }
+
+ public:
+  INSTRUCTION_HEADER(Debugger)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+// Used to load the prototype of an object known to have
+// a static prototype.
+class MObjectStaticProto : public MUnaryInstruction,
+                           public SingleObjectPolicy::Data {
+  explicit MObjectStaticProto(MDefinition* object)
+      : MUnaryInstruction(classOpcode, object) {
+    setResultType(MIRType::Object);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(ObjectStaticProto)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields);
+  }
+  AliasType mightAlias(const MDefinition* def) const override {
+    // These instructions never modify the [[Prototype]].
+    if (def->isAddAndStoreSlot() || def->isAllocateAndStoreSlot() ||
+        def->isStoreElementHole() || def->isArrayPush()) {
+      return AliasType::NoAlias;
+    }
+    return AliasType::MayAlias;
+  }
+};
+
+class MConstantProto : public MUnaryInstruction,
+                       public SingleObjectPolicy::Data {
+  // NOTE: we're not going to actually use the underlying receiver object for
+  // anything. This is just here for giving extra information to MGuardShape
+  // to MGuardShape::mightAlias. Accordingly, we don't take it as an operand,
+  // but instead just keep a pointer to it. This means we need to ensure it's
+  // not discarded before we try to access it. If this is discarded, we
+  // basically just become an MConstant for the object's proto, which is fine.
+  const MDefinition* receiverObject_;
+
+  explicit MConstantProto(MDefinition* protoObject,
+                          const MDefinition* receiverObject)
+      : MUnaryInstruction(classOpcode, protoObject),
+        receiverObject_(receiverObject) {
+    MOZ_ASSERT(protoObject->isConstant());
+    setResultType(MIRType::Object);
+    setMovable();
+  }
+
+  ALLOW_CLONE(MConstantProto)
+
+ public:
+  INSTRUCTION_HEADER(ConstantProto)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, protoObject))
+
+  HashNumber valueHash() const override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    if (this == ins) {
+      return true;
+    }
+    const MDefinition* receiverObject = getReceiverObject();
+    return congruentIfOperandsEqual(ins) && receiverObject &&
+           receiverObject == ins->toConstantProto()->getReceiverObject();
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  const MDefinition* getReceiverObject() const {
+    if (receiverObject_->isDiscarded()) {
+      return nullptr;
+    }
+    return receiverObject_;
+  }
+};
+
+class MObjectToIterator : public MUnaryInstruction,
+                          public ObjectPolicy<0>::Data {
+  NativeIteratorListHead* enumeratorsAddr_;
+  bool wantsIndices_ = false;
+
+  explicit MObjectToIterator(MDefinition* object,
+                             NativeIteratorListHead* enumeratorsAddr)
+      : MUnaryInstruction(classOpcode, object),
+        enumeratorsAddr_(enumeratorsAddr) {
+    setResultType(MIRType::Object);
+  }
+
+ public:
+  NativeIteratorListHead* enumeratorsAddr() const { return enumeratorsAddr_; }
+  INSTRUCTION_HEADER(ObjectToIterator)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  bool wantsIndices() const { return wantsIndices_; }
+  void setWantsIndices(bool value) { wantsIndices_ = value; }
+};
+
+// Flips the input's sign bit, independently of the rest of the number's
+// payload. Note this is different from multiplying by minus-one, which has
+// side-effects for e.g. NaNs.
+class MWasmNeg : public MUnaryInstruction, public NoTypePolicy::Data {
+  MWasmNeg(MDefinition* op, MIRType type) : MUnaryInstruction(classOpcode, op) {
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmNeg)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+// Machine-level bitwise AND/OR/XOR, avoiding all JS-level complexity embodied
+// in MBinaryBitwiseInstruction.
+class MWasmBinaryBitwise : public MBinaryInstruction,
+                           public NoTypePolicy::Data {
+ public:
+  enum class SubOpcode { And, Or, Xor };
+
+ protected:
+  MWasmBinaryBitwise(MDefinition* left, MDefinition* right, MIRType type,
+                     SubOpcode subOpcode)
+      : MBinaryInstruction(classOpcode, left, right), subOpcode_(subOpcode) {
+    MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Int64);
+    setResultType(type);
+    setMovable();
+    setCommutative();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBinaryBitwise)
+  TRIVIAL_NEW_WRAPPERS
+
+  SubOpcode subOpcode() const { return subOpcode_; }
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->isWasmBinaryBitwise() &&
+           ins->toWasmBinaryBitwise()->subOpcode() == subOpcode() &&
+           binaryCongruentTo(ins);
+  }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    const char* what = "!!unknown!!";
+    switch (subOpcode()) {
+      case SubOpcode::And:
+        what = "And";
+        break;
+      case SubOpcode::Or:
+        what = "Or";
+        break;
+      case SubOpcode::Xor:
+        what = "Xor";
+        break;
+    }
+    extras->add(what);
+  }
+#endif
+
+ private:
+  SubOpcode subOpcode_;
+
+  ALLOW_CLONE(MWasmBinaryBitwise)
+};
+
+class MWasmLoadInstance : public MUnaryInstruction, public NoTypePolicy::Data {
+  uint32_t offset_;
+  AliasSet aliases_;
+
+  explicit MWasmLoadInstance(MDefinition* instance, uint32_t offset,
+                             MIRType type, AliasSet aliases)
+      : MUnaryInstruction(classOpcode, instance),
+        offset_(offset),
+        aliases_(aliases) {
+    // Different instance data have different alias classes and only those
+    // classes are allowed.
+    MOZ_ASSERT(
+        aliases_.flags() == AliasSet::Load(AliasSet::WasmHeapMeta).flags() ||
+        aliases_.flags() == AliasSet::Load(AliasSet::WasmTableMeta).flags() ||
+        aliases_.flags() ==
+            AliasSet::Load(AliasSet::WasmPendingException).flags() ||
+        aliases_.flags() == AliasSet::None().flags());
+
+    // The only types supported at the moment.
+    MOZ_ASSERT(type == MIRType::Pointer || type == MIRType::Int32 ||
+               type == MIRType::Int64 || type == MIRType::RefOrNull);
+
+    setMovable();
+    setResultType(type);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadInstance)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance))
+
+  uint32_t offset() const { return offset_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return op() == ins->op() &&
+           offset() == ins->toWasmLoadInstance()->offset() &&
+           type() == ins->type();
+  }
+
+  HashNumber valueHash() const override {
+    return addU32ToHash(HashNumber(op()), offset());
+  }
+
+  AliasSet getAliasSet() const override { return aliases_; }
+};
+
+class MWasmStoreInstance : public MBinaryInstruction,
+                           public NoTypePolicy::Data {
+  uint32_t offset_;
+  AliasSet aliases_;
+
+  explicit MWasmStoreInstance(MDefinition* instance, MDefinition* value,
+                              uint32_t offset, MIRType type, AliasSet aliases)
+      : MBinaryInstruction(classOpcode, instance, value),
+        offset_(offset),
+        aliases_(aliases) {
+    // Different instance data have different alias classes and only those
+    // classes are allowed.
+    MOZ_ASSERT(aliases_.flags() ==
+               AliasSet::Store(AliasSet::WasmPendingException).flags());
+
+    // The only types supported at the moment.
+    MOZ_ASSERT(type == MIRType::Pointer || type == MIRType::Int32 ||
+               type == MIRType::Int64 || type == MIRType::RefOrNull);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreInstance)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance), (1, value))
+
+  uint32_t offset() const { return offset_; }
+
+  AliasSet getAliasSet() const override { return aliases_; }
+};
+
+class MWasmHeapBase : public MUnaryInstruction, public NoTypePolicy::Data {
+  AliasSet aliases_;
+
+  explicit MWasmHeapBase(MDefinition* instance, AliasSet aliases)
+      : MUnaryInstruction(classOpcode, instance), aliases_(aliases) {
+    setMovable();
+    setResultType(MIRType::Pointer);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmHeapBase)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance))
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->isWasmHeapBase();
+  }
+
+  AliasSet getAliasSet() const override { return aliases_; }
+};
+
+// For memory32, bounds check nodes are of type Int32 on 32-bit systems for both
+// wasm and asm.js code, as well as on 64-bit systems for asm.js code and for
+// wasm code that is known to have a bounds check limit that fits into 32 bits.
+// They are of type Int64 only on 64-bit systems for wasm code with 4GB heaps.
+// There is no way for nodes of both types to be present in the same function.
+// Should this change, then BCE must be updated to take type into account.
+//
+// For memory64, bounds check nodes are always of type Int64.
+
+class MWasmBoundsCheck : public MBinaryInstruction, public NoTypePolicy::Data {
+ public:
+  enum Target {
+    // Linear memory at index zero, which is the only memory allowed so far.
+    Memory0,
+    // Everything else.  Currently comprises tables, and arrays in the GC
+    // proposal.
+    Unknown
+  };
+
+ private:
+  wasm::BytecodeOffset bytecodeOffset_;
+  Target target_;
+
+  explicit MWasmBoundsCheck(MDefinition* index, MDefinition* boundsCheckLimit,
+                            wasm::BytecodeOffset bytecodeOffset, Target target)
+      : MBinaryInstruction(classOpcode, index, boundsCheckLimit),
+        bytecodeOffset_(bytecodeOffset),
+        target_(target) {
+    MOZ_ASSERT(index->type() == boundsCheckLimit->type());
+
+    // Bounds check is effectful: it throws for OOB.
+    setGuard();
+
+    if (JitOptions.spectreIndexMasking) {
+      setResultType(index->type());
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBoundsCheck)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index), (1, boundsCheckLimit))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool isMemory() const { return target_ == MWasmBoundsCheck::Memory0; }
+
+  bool isRedundant() const { return !isGuard(); }
+
+  void setRedundant() { setNotGuard(); }
+
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+};
+
+class MWasmAddOffset : public MUnaryInstruction, public NoTypePolicy::Data {
+  uint64_t offset_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  MWasmAddOffset(MDefinition* base, uint64_t offset,
+                 wasm::BytecodeOffset bytecodeOffset)
+      : MUnaryInstruction(classOpcode, base),
+        offset_(offset),
+        bytecodeOffset_(bytecodeOffset) {
+    setGuard();
+    MOZ_ASSERT(base->type() == MIRType::Int32 ||
+               base->type() == MIRType::Int64);
+    setResultType(base->type());
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmAddOffset)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, base))
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  uint64_t offset() const { return offset_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+};
+
+class MWasmAlignmentCheck : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+  uint32_t byteSize_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmAlignmentCheck(MDefinition* index, uint32_t byteSize,
+                               wasm::BytecodeOffset bytecodeOffset)
+      : MUnaryInstruction(classOpcode, index),
+        byteSize_(byteSize),
+        bytecodeOffset_(bytecodeOffset) {
+    MOZ_ASSERT(mozilla::IsPowerOfTwo(byteSize));
+    // Alignment check is effectful: it throws for unaligned.
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmAlignmentCheck)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index))
+
+  bool congruentTo(const MDefinition* ins) const override;
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  uint32_t byteSize() const { return byteSize_; }
+
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+};
+
+class MWasmLoad
+    : public MVariadicInstruction,  // memoryBase is nullptr on some platforms
+      public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+
+  explicit MWasmLoad(const wasm::MemoryAccessDesc& access, MIRType resultType)
+      : MVariadicInstruction(classOpcode), access_(access) {
+    setGuard();
+    setResultType(resultType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoad)
+  NAMED_OPERANDS((0, base), (1, memoryBase));
+
+  static MWasmLoad* New(TempAllocator& alloc, MDefinition* memoryBase,
+                        MDefinition* base, const wasm::MemoryAccessDesc& access,
+                        MIRType resultType) {
+    MWasmLoad* load = new (alloc) MWasmLoad(access, resultType);
+    if (!load->init(alloc, 1 + !!memoryBase)) {
+      return nullptr;
+    }
+
+    load->initOperand(0, base);
+    if (memoryBase) {
+      load->initOperand(1, memoryBase);
+    }
+
+    return load;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+
+  AliasSet getAliasSet() const override {
+    // When a barrier is needed, make the instruction effectful by giving
+    // it a "store" effect.
+    if (access_.isAtomic()) {
+      return AliasSet::Store(AliasSet::WasmHeap);
+    }
+    return AliasSet::Load(AliasSet::WasmHeap);
+  }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "(offs=%lld)", (long long int)access().offset64());
+    extras->add(buf);
+  }
+#endif
+};
+
+class MWasmStore : public MVariadicInstruction, public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+
+  explicit MWasmStore(const wasm::MemoryAccessDesc& access)
+      : MVariadicInstruction(classOpcode), access_(access) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStore)
+  NAMED_OPERANDS((0, base), (1, value), (2, memoryBase))
+
+  static MWasmStore* New(TempAllocator& alloc, MDefinition* memoryBase,
+                         MDefinition* base,
+                         const wasm::MemoryAccessDesc& access,
+                         MDefinition* value) {
+    MWasmStore* store = new (alloc) MWasmStore(access);
+    if (!store->init(alloc, 2 + !!memoryBase)) {
+      return nullptr;
+    }
+
+    store->initOperand(0, base);
+    store->initOperand(1, value);
+    if (memoryBase) {
+      store->initOperand(2, memoryBase);
+    }
+
+    return store;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "(offs=%lld)", (long long int)access().offset64());
+    extras->add(buf);
+  }
+#endif
+};
+
+class MAsmJSMemoryAccess {
+  Scalar::Type accessType_;
+  bool needsBoundsCheck_;
+
+ public:
+  explicit MAsmJSMemoryAccess(Scalar::Type accessType)
+      : accessType_(accessType), needsBoundsCheck_(true) {
+    MOZ_ASSERT(accessType != Scalar::Uint8Clamped);
+  }
+
+  Scalar::Type accessType() const { return accessType_; }
+  unsigned byteSize() const { return TypedArrayElemSize(accessType()); }
+  bool needsBoundsCheck() const { return needsBoundsCheck_; }
+
+  wasm::MemoryAccessDesc access() const {
+    return wasm::MemoryAccessDesc(accessType_, Scalar::byteSize(accessType_), 0,
+                                  wasm::BytecodeOffset());
+  }
+
+  void removeBoundsCheck() { needsBoundsCheck_ = false; }
+};
+
+class MAsmJSLoadHeap
+    : public MVariadicInstruction,  // 1 plus optional memoryBase and
+                                    // boundsCheckLimit
+      public MAsmJSMemoryAccess,
+      public NoTypePolicy::Data {
+  uint32_t memoryBaseIndex_;
+
+  explicit MAsmJSLoadHeap(uint32_t memoryBaseIndex, Scalar::Type accessType)
+      : MVariadicInstruction(classOpcode),
+        MAsmJSMemoryAccess(accessType),
+        memoryBaseIndex_(memoryBaseIndex) {
+    setResultType(ScalarTypeToMIRType(accessType));
+  }
+
+ public:
+  INSTRUCTION_HEADER(AsmJSLoadHeap)
+  NAMED_OPERANDS((0, base), (1, boundsCheckLimit))
+
+  static MAsmJSLoadHeap* New(TempAllocator& alloc, MDefinition* memoryBase,
+                             MDefinition* base, MDefinition* boundsCheckLimit,
+                             Scalar::Type accessType) {
+    uint32_t nextIndex = 2;
+    uint32_t memoryBaseIndex = memoryBase ? nextIndex++ : UINT32_MAX;
+
+    MAsmJSLoadHeap* load =
+        new (alloc) MAsmJSLoadHeap(memoryBaseIndex, accessType);
+    if (!load->init(alloc, nextIndex)) {
+      return nullptr;
+    }
+
+    load->initOperand(0, base);
+    load->initOperand(1, boundsCheckLimit);
+    if (memoryBase) {
+      load->initOperand(memoryBaseIndex, memoryBase);
+    }
+
+    return load;
+  }
+
+  bool hasMemoryBase() const { return memoryBaseIndex_ != UINT32_MAX; }
+  MDefinition* memoryBase() const {
+    MOZ_ASSERT(hasMemoryBase());
+    return getOperand(memoryBaseIndex_);
+  }
+
+  bool congruentTo(const MDefinition* ins) const override;
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::WasmHeap);
+  }
+  AliasType mightAlias(const MDefinition* def) const override;
+};
+
+class MAsmJSStoreHeap
+    : public MVariadicInstruction,  // 2 plus optional memoryBase and
+                                    // boundsCheckLimit
+      public MAsmJSMemoryAccess,
+      public NoTypePolicy::Data {
+  uint32_t memoryBaseIndex_;
+
+  explicit MAsmJSStoreHeap(uint32_t memoryBaseIndex, Scalar::Type accessType)
+      : MVariadicInstruction(classOpcode),
+        MAsmJSMemoryAccess(accessType),
+        memoryBaseIndex_(memoryBaseIndex) {}
+
+ public:
+  INSTRUCTION_HEADER(AsmJSStoreHeap)
+  NAMED_OPERANDS((0, base), (1, value), (2, boundsCheckLimit))
+
+  static MAsmJSStoreHeap* New(TempAllocator& alloc, MDefinition* memoryBase,
+                              MDefinition* base, MDefinition* boundsCheckLimit,
+                              Scalar::Type accessType, MDefinition* v) {
+    uint32_t nextIndex = 3;
+    uint32_t memoryBaseIndex = memoryBase ? nextIndex++ : UINT32_MAX;
+
+    MAsmJSStoreHeap* store =
+        new (alloc) MAsmJSStoreHeap(memoryBaseIndex, accessType);
+    if (!store->init(alloc, nextIndex)) {
+      return nullptr;
+    }
+
+    store->initOperand(0, base);
+    store->initOperand(1, v);
+    store->initOperand(2, boundsCheckLimit);
+    if (memoryBase) {
+      store->initOperand(memoryBaseIndex, memoryBase);
+    }
+
+    return store;
+  }
+
+  bool hasMemoryBase() const { return memoryBaseIndex_ != UINT32_MAX; }
+  MDefinition* memoryBase() const {
+    MOZ_ASSERT(hasMemoryBase());
+    return getOperand(memoryBaseIndex_);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+};
+
+class MWasmCompareExchangeHeap : public MVariadicInstruction,
+                                 public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmCompareExchangeHeap(const wasm::MemoryAccessDesc& access,
+                                    wasm::BytecodeOffset bytecodeOffset)
+      : MVariadicInstruction(classOpcode),
+        access_(access),
+        bytecodeOffset_(bytecodeOffset) {
+    setGuard();  // Not removable
+    setResultType(ScalarTypeToMIRType(access.type()));
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmCompareExchangeHeap)
+  NAMED_OPERANDS((0, base), (1, oldValue), (2, newValue), (3, instance),
+                 (4, memoryBase))
+
+  static MWasmCompareExchangeHeap* New(TempAllocator& alloc,
+                                       wasm::BytecodeOffset bytecodeOffset,
+                                       MDefinition* memoryBase,
+                                       MDefinition* base,
+                                       const wasm::MemoryAccessDesc& access,
+                                       MDefinition* oldv, MDefinition* newv,
+                                       MDefinition* instance) {
+    MWasmCompareExchangeHeap* cas =
+        new (alloc) MWasmCompareExchangeHeap(access, bytecodeOffset);
+    if (!cas->init(alloc, 4 + !!memoryBase)) {
+      return nullptr;
+    }
+    cas->initOperand(0, base);
+    cas->initOperand(1, oldv);
+    cas->initOperand(2, newv);
+    cas->initOperand(3, instance);
+    if (memoryBase) {
+      cas->initOperand(4, memoryBase);
+    }
+    return cas;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+};
+
+class MWasmAtomicExchangeHeap : public MVariadicInstruction,
+                                public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmAtomicExchangeHeap(const wasm::MemoryAccessDesc& access,
+                                   wasm::BytecodeOffset bytecodeOffset)
+      : MVariadicInstruction(classOpcode),
+        access_(access),
+        bytecodeOffset_(bytecodeOffset) {
+    setGuard();  // Not removable
+    setResultType(ScalarTypeToMIRType(access.type()));
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmAtomicExchangeHeap)
+  NAMED_OPERANDS((0, base), (1, value), (2, instance), (3, memoryBase))
+
+  static MWasmAtomicExchangeHeap* New(TempAllocator& alloc,
+                                      wasm::BytecodeOffset bytecodeOffset,
+                                      MDefinition* memoryBase,
+                                      MDefinition* base,
+                                      const wasm::MemoryAccessDesc& access,
+                                      MDefinition* value,
+                                      MDefinition* instance) {
+    MWasmAtomicExchangeHeap* xchg =
+        new (alloc) MWasmAtomicExchangeHeap(access, bytecodeOffset);
+    if (!xchg->init(alloc, 3 + !!memoryBase)) {
+      return nullptr;
+    }
+
+    xchg->initOperand(0, base);
+    xchg->initOperand(1, value);
+    xchg->initOperand(2, instance);
+    if (memoryBase) {
+      xchg->initOperand(3, memoryBase);
+    }
+
+    return xchg;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+};
+
+class MWasmAtomicBinopHeap : public MVariadicInstruction,
+                             public NoTypePolicy::Data {
+  AtomicOp op_;
+  wasm::MemoryAccessDesc access_;
+  wasm::BytecodeOffset bytecodeOffset_;
+
+  explicit MWasmAtomicBinopHeap(AtomicOp op,
+                                const wasm::MemoryAccessDesc& access,
+                                wasm::BytecodeOffset bytecodeOffset)
+      : MVariadicInstruction(classOpcode),
+        op_(op),
+        access_(access),
+        bytecodeOffset_(bytecodeOffset) {
+    setGuard();  // Not removable
+    setResultType(ScalarTypeToMIRType(access.type()));
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmAtomicBinopHeap)
+  NAMED_OPERANDS((0, base), (1, value), (2, instance), (3, memoryBase))
+
+  static MWasmAtomicBinopHeap* New(TempAllocator& alloc,
+                                   wasm::BytecodeOffset bytecodeOffset,
+                                   AtomicOp op, MDefinition* memoryBase,
+                                   MDefinition* base,
+                                   const wasm::MemoryAccessDesc& access,
+                                   MDefinition* v, MDefinition* instance) {
+    MWasmAtomicBinopHeap* binop =
+        new (alloc) MWasmAtomicBinopHeap(op, access, bytecodeOffset);
+    if (!binop->init(alloc, 3 + !!memoryBase)) {
+      return nullptr;
+    }
+
+    binop->initOperand(0, base);
+    binop->initOperand(1, v);
+    binop->initOperand(2, instance);
+    if (memoryBase) {
+      binop->initOperand(3, memoryBase);
+    }
+
+    return binop;
+  }
+
+  AtomicOp operation() const { return op_; }
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+  wasm::BytecodeOffset bytecodeOffset() const { return bytecodeOffset_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+};
+
+class MWasmLoadInstanceDataField : public MUnaryInstruction,
+                                   public NoTypePolicy::Data {
+  MWasmLoadInstanceDataField(MIRType type, unsigned instanceDataOffset,
+                             bool isConstant, MDefinition* instance)
+      : MUnaryInstruction(classOpcode, instance),
+        instanceDataOffset_(instanceDataOffset),
+        isConstant_(isConstant) {
+    MOZ_ASSERT(IsNumberType(type) || type == MIRType::Simd128 ||
+               type == MIRType::Pointer || type == MIRType::RefOrNull);
+    setResultType(type);
+    setMovable();
+  }
+
+  unsigned instanceDataOffset_;
+  bool isConstant_;
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadInstanceDataField)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance))
+
+  unsigned instanceDataOffset() const { return instanceDataOffset_; }
+
+  HashNumber valueHash() const override;
+  bool congruentTo(const MDefinition* ins) const override;
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  AliasSet getAliasSet() const override {
+    return isConstant_ ? AliasSet::None()
+                       : AliasSet::Load(AliasSet::WasmInstanceData);
+  }
+
+  AliasType mightAlias(const MDefinition* def) const override;
+};
+
+class MWasmLoadGlobalCell : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+  MWasmLoadGlobalCell(MIRType type, MDefinition* cellPtr)
+      : MUnaryInstruction(classOpcode, cellPtr) {
+    setResultType(type);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadGlobalCell)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, cellPtr))
+
+  // The default valueHash is good enough, because there are no non-operand
+  // fields.
+  bool congruentTo(const MDefinition* ins) const override;
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::WasmGlobalCell);
+  }
+
+  AliasType mightAlias(const MDefinition* def) const override;
+};
+
+class MWasmLoadTableElement : public MBinaryInstruction,
+                              public NoTypePolicy::Data {
+  MWasmLoadTableElement(MDefinition* elements, MDefinition* index)
+      : MBinaryInstruction(classOpcode, elements, index) {
+    setResultType(MIRType::RefOrNull);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadTableElement)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, elements))
+  NAMED_OPERANDS((1, index))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::WasmTableElement);
+  }
+};
+
+class MWasmStoreInstanceDataField : public MBinaryInstruction,
+                                    public NoTypePolicy::Data {
+  MWasmStoreInstanceDataField(unsigned instanceDataOffset, MDefinition* value,
+                              MDefinition* instance)
+      : MBinaryInstruction(classOpcode, value, instance),
+        instanceDataOffset_(instanceDataOffset) {}
+
+  unsigned instanceDataOffset_;
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreInstanceDataField)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, instance))
+
+  unsigned instanceDataOffset() const { return instanceDataOffset_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmInstanceData);
+  }
+};
+
+class MWasmStoreGlobalCell : public MBinaryInstruction,
+                             public NoTypePolicy::Data {
+  MWasmStoreGlobalCell(MDefinition* value, MDefinition* cellPtr)
+      : MBinaryInstruction(classOpcode, value, cellPtr) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreGlobalCell)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, value), (1, cellPtr))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmGlobalCell);
+  }
+};
+
+class MWasmStoreStackResult : public MBinaryInstruction,
+                              public NoTypePolicy::Data {
+  MWasmStoreStackResult(MDefinition* stackResultArea, uint32_t offset,
+                        MDefinition* value)
+      : MBinaryInstruction(classOpcode, stackResultArea, value),
+        offset_(offset) {}
+
+  uint32_t offset_;
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreStackResult)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, stackResultArea), (1, value))
+
+  uint32_t offset() const { return offset_; }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmStackResult);
+  }
+};
+
+// Represents a known-good derived pointer into an object or memory region (in
+// the most general sense) that will not move while the derived pointer is live.
+// The `offset` *must* be a valid offset into the object represented by `base`;
+// hence overflow in the address calculation will never be an issue.  `offset`
+// must be representable as a 31-bit unsigned integer.
+//
+// DO NOT use this with a base value of any JS-heap-resident object type.
+// Such a value would need to be adjusted during GC, yet we have no mechanism
+// to do that.  See bug 1810090.
+
+class MWasmDerivedPointer : public MUnaryInstruction,
+                            public NoTypePolicy::Data {
+  MWasmDerivedPointer(MDefinition* base, size_t offset)
+      : MUnaryInstruction(classOpcode, base), offset_(uint32_t(offset)) {
+    MOZ_ASSERT(offset <= INT32_MAX);
+    // Do not change this to allow `base` to be a GC-heap allocated type.
+    MOZ_ASSERT(base->type() == MIRType::Pointer ||
+               base->type() == TargetWordMIRType());
+    setResultType(MIRType::Pointer);
+    setMovable();
+  }
+
+  uint32_t offset_;
+
+ public:
+  INSTRUCTION_HEADER(WasmDerivedPointer)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, base))
+
+  uint32_t offset() const { return offset_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmDerivedPointer()->offset() == offset();
+  }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "(offs=%lld)", (long long int)offset_);
+    extras->add(buf);
+  }
+#endif
+
+  ALLOW_CLONE(MWasmDerivedPointer)
+};
+
+// As with MWasmDerivedPointer, DO NOT use this with a base value of any
+// JS-heap-resident object type.
+class MWasmDerivedIndexPointer : public MBinaryInstruction,
+                                 public NoTypePolicy::Data {
+  MWasmDerivedIndexPointer(MDefinition* base, MDefinition* index, Scale scale)
+      : MBinaryInstruction(classOpcode, base, index), scale_(scale) {
+    // Do not change this to allow `base` to be a GC-heap allocated type.
+    MOZ_ASSERT(base->type() == MIRType::Pointer);
+    setResultType(MIRType::Pointer);
+    setMovable();
+  }
+
+  Scale scale_;
+
+ public:
+  INSTRUCTION_HEADER(WasmDerivedIndexPointer)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, base))
+  NAMED_OPERANDS((1, index))
+
+  Scale scale() const { return scale_; }
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toWasmDerivedIndexPointer()->scale() == scale();
+  }
+
+  ALLOW_CLONE(MWasmDerivedIndexPointer)
+};
+
+// Whether to perform a pre-write barrier for a wasm store reference.
+enum class WasmPreBarrierKind : uint8_t { None, Normal };
+
+// Stores a reference to an address. This performs a pre-barrier on the address,
+// but not a post-barrier. A post-barrier must be performed separately, if it's
+// required.  The accessed location is `valueBase + valueOffset`.  The latter
+// must be be representable as a 31-bit unsigned integer.
+
+class MWasmStoreRef : public MAryInstruction<3>, public NoTypePolicy::Data {
+  uint32_t offset_;
+  AliasSet::Flag aliasSet_;
+  WasmPreBarrierKind preBarrierKind_;
+
+  MWasmStoreRef(MDefinition* instance, MDefinition* valueBase,
+                size_t valueOffset, MDefinition* value, AliasSet::Flag aliasSet,
+                WasmPreBarrierKind preBarrierKind)
+      : MAryInstruction<3>(classOpcode),
+        offset_(uint32_t(valueOffset)),
+        aliasSet_(aliasSet),
+        preBarrierKind_(preBarrierKind) {
+    MOZ_ASSERT(valueOffset <= INT32_MAX);
+    MOZ_ASSERT(valueBase->type() == MIRType::Pointer ||
+               valueBase->type() == MIRType::StackResults);
+    MOZ_ASSERT(value->type() == MIRType::RefOrNull);
+    initOperand(0, instance);
+    initOperand(1, valueBase);
+    initOperand(2, value);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreRef)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance), (1, valueBase), (2, value))
+
+  uint32_t offset() const { return offset_; }
+  AliasSet getAliasSet() const override { return AliasSet::Store(aliasSet_); }
+  WasmPreBarrierKind preBarrierKind() const { return preBarrierKind_; }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "(offs=%lld)", (long long int)offset_);
+    extras->add(buf);
+  }
+#endif
+};
+
+// Given a value being written to another object, update the generational store
+// buffer if the value is in the nursery and object is in the tenured heap.
+class MWasmPostWriteBarrier : public MQuaternaryInstruction,
+                              public NoTypePolicy::Data {
+  uint32_t valueOffset_;
+
+  MWasmPostWriteBarrier(MDefinition* instance, MDefinition* object,
+                        MDefinition* valueBase, uint32_t valueOffset,
+                        MDefinition* value)
+      : MQuaternaryInstruction(classOpcode, instance, object, valueBase, value),
+        valueOffset_(valueOffset) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmPostWriteBarrier)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance), (1, object), (2, valueBase), (3, value))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  uint32_t valueOffset() const { return valueOffset_; }
+
+  ALLOW_CLONE(MWasmPostWriteBarrier)
+};
+
+class MWasmParameter : public MNullaryInstruction {
+  ABIArg abi_;
+
+  MWasmParameter(ABIArg abi, MIRType mirType)
+      : MNullaryInstruction(classOpcode), abi_(abi) {
+    setResultType(mirType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmParameter)
+  TRIVIAL_NEW_WRAPPERS
+
+  ABIArg abi() const { return abi_; }
+};
+
+class MWasmReturn : public MAryControlInstruction<2, 0>,
+                    public NoTypePolicy::Data {
+  MWasmReturn(MDefinition* ins, MDefinition* instance)
+      : MAryControlInstruction(classOpcode) {
+    initOperand(0, ins);
+    initOperand(1, instance);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmReturn)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MWasmReturnVoid : public MAryControlInstruction<1, 0>,
+                        public NoTypePolicy::Data {
+  explicit MWasmReturnVoid(MDefinition* instance)
+      : MAryControlInstruction(classOpcode) {
+    initOperand(0, instance);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmReturnVoid)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MWasmStackArg : public MUnaryInstruction, public NoTypePolicy::Data {
+  MWasmStackArg(uint32_t spOffset, MDefinition* ins)
+      : MUnaryInstruction(classOpcode, ins), spOffset_(spOffset) {}
+
+  uint32_t spOffset_;
+
+ public:
+  INSTRUCTION_HEADER(WasmStackArg)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, arg))
+
+  uint32_t spOffset() const { return spOffset_; }
+  void incrementOffset(uint32_t inc) { spOffset_ += inc; }
+};
+
+template <typename Location>
+class MWasmResultBase : public MNullaryInstruction {
+  Location loc_;
+
+ protected:
+  MWasmResultBase(Opcode op, MIRType type, Location loc)
+      : MNullaryInstruction(op), loc_(loc) {
+    setResultType(type);
+    setCallResultCapture();
+  }
+
+ public:
+  Location loc() { return loc_; }
+};
+
+class MWasmRegisterResult : public MWasmResultBase<Register> {
+  MWasmRegisterResult(MIRType type, Register reg)
+      : MWasmResultBase(classOpcode, type, reg) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmRegisterResult)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+class MWasmFloatRegisterResult : public MWasmResultBase<FloatRegister> {
+  MWasmFloatRegisterResult(MIRType type, FloatRegister reg)
+      : MWasmResultBase(classOpcode, type, reg) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmFloatRegisterResult)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+class MWasmRegister64Result : public MWasmResultBase<Register64> {
+  explicit MWasmRegister64Result(Register64 reg)
+      : MWasmResultBase(classOpcode, MIRType::Int64, reg) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmRegister64Result)
+  TRIVIAL_NEW_WRAPPERS
+};
+
+class MWasmStackResultArea : public MNullaryInstruction {
+ public:
+  class StackResult {
+    // Offset in bytes from lowest address of stack result area.
+    uint32_t offset_;
+    MIRType type_;
+
+   public:
+    StackResult() : type_(MIRType::Undefined) {}
+    StackResult(uint32_t offset, MIRType type) : offset_(offset), type_(type) {}
+
+    bool initialized() const { return type_ != MIRType::Undefined; }
+    uint32_t offset() const {
+      MOZ_ASSERT(initialized());
+      return offset_;
+    }
+    MIRType type() const {
+      MOZ_ASSERT(initialized());
+      return type_;
+    }
+    uint32_t endOffset() const {
+      return offset() + wasm::MIRTypeToABIResultSize(type());
+    }
+  };
+
+ private:
+  FixedList<StackResult> results_;
+  uint32_t base_;
+
+  explicit MWasmStackResultArea()
+      : MNullaryInstruction(classOpcode), base_(UINT32_MAX) {
+    setResultType(MIRType::StackResults);
+  }
+
+  void assertInitialized() const {
+    MOZ_ASSERT(results_.length() != 0);
+#ifdef DEBUG
+    for (size_t i = 0; i < results_.length(); i++) {
+      MOZ_ASSERT(results_[i].initialized());
+    }
+#endif
+  }
+
+  bool baseInitialized() const { return base_ != UINT32_MAX; }
+
+ public:
+  INSTRUCTION_HEADER(WasmStackResultArea)
+  TRIVIAL_NEW_WRAPPERS
+
+  [[nodiscard]] bool init(TempAllocator& alloc, size_t stackResultCount) {
+    MOZ_ASSERT(results_.length() == 0);
+    MOZ_ASSERT(stackResultCount > 0);
+    if (!results_.init(alloc, stackResultCount)) {
+      return false;
+    }
+    for (size_t n = 0; n < stackResultCount; n++) {
+      results_[n] = StackResult();
+    }
+    return true;
+  }
+
+  size_t resultCount() const { return results_.length(); }
+  const StackResult& result(size_t n) const {
+    MOZ_ASSERT(results_[n].initialized());
+    return results_[n];
+  }
+  void initResult(size_t n, const StackResult& loc) {
+    MOZ_ASSERT(!results_[n].initialized());
+    MOZ_ASSERT((n == 0) == (loc.offset() == 0));
+    MOZ_ASSERT_IF(n > 0, loc.offset() >= result(n - 1).endOffset());
+    results_[n] = loc;
+  }
+
+  uint32_t byteSize() const {
+    assertInitialized();
+    return result(resultCount() - 1).endOffset();
+  }
+
+  // Stack index indicating base of stack area.
+  uint32_t base() const {
+    MOZ_ASSERT(baseInitialized());
+    return base_;
+  }
+  void setBase(uint32_t base) {
+    MOZ_ASSERT(!baseInitialized());
+    base_ = base;
+    MOZ_ASSERT(baseInitialized());
+  }
+};
+
+class MWasmStackResult : public MUnaryInstruction, public NoTypePolicy::Data {
+  uint32_t resultIdx_;
+
+  MWasmStackResult(MWasmStackResultArea* resultArea, size_t idx)
+      : MUnaryInstruction(classOpcode, resultArea), resultIdx_(idx) {
+    setResultType(result().type());
+    setCallResultCapture();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStackResult)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, resultArea))
+
+  const MWasmStackResultArea::StackResult& result() const {
+    return resultArea()->toWasmStackResultArea()->result(resultIdx_);
+  }
+};
+
+// Arguments for constructing a catchable wasm call inside of a try block.
+struct MWasmCallTryDesc {
+  bool inTry;
+  uint32_t relativeTryDepth;
+  size_t tryNoteIndex;
+  MBasicBlock* fallthroughBlock;
+  MBasicBlock* prePadBlock;
+
+  MWasmCallTryDesc()
+      : inTry(false),
+        relativeTryDepth(0),
+        tryNoteIndex(0),
+        fallthroughBlock(nullptr),
+        prePadBlock(nullptr) {}
+};
+
+// Mixin class for wasm calls that may or may not be catchable.
+class MWasmCallBase {
+ public:
+  struct Arg {
+    AnyRegister reg;
+    MDefinition* def;
+    Arg(AnyRegister reg, MDefinition* def) : reg(reg), def(def) {}
+  };
+  typedef Vector<Arg, 8, SystemAllocPolicy> Args;
+
+ protected:
+  wasm::CallSiteDesc desc_;
+  wasm::CalleeDesc callee_;
+  wasm::FailureMode builtinMethodFailureMode_;
+  FixedList<AnyRegister> argRegs_;
+  uint32_t stackArgAreaSizeUnaligned_;
+  ABIArg instanceArg_;
+  bool inTry_;
+  size_t tryNoteIndex_;
+
+  MWasmCallBase(const wasm::CallSiteDesc& desc, const wasm::CalleeDesc& callee,
+                uint32_t stackArgAreaSizeUnaligned, bool inTry,
+                size_t tryNoteIndex)
+      : desc_(desc),
+        callee_(callee),
+        builtinMethodFailureMode_(wasm::FailureMode::Infallible),
+        stackArgAreaSizeUnaligned_(stackArgAreaSizeUnaligned),
+        inTry_(inTry),
+        tryNoteIndex_(tryNoteIndex) {}
+
+  template <class MVariadicT>
+  [[nodiscard]] bool initWithArgs(TempAllocator& alloc, MVariadicT* ins,
+                                  const Args& args,
+                                  MDefinition* tableIndexOrRef) {
+    if (!argRegs_.init(alloc, args.length())) {
+      return false;
+    }
+    for (size_t i = 0; i < argRegs_.length(); i++) {
+      argRegs_[i] = args[i].reg;
+    }
+
+    if (!ins->init(alloc, argRegs_.length() + (tableIndexOrRef ? 1 : 0))) {
+      return false;
+    }
+    // FixedList doesn't initialize its elements, so do an unchecked init.
+    for (size_t i = 0; i < argRegs_.length(); i++) {
+      ins->initOperand(i, args[i].def);
+    }
+    if (tableIndexOrRef) {
+      ins->initOperand(argRegs_.length(), tableIndexOrRef);
+    }
+    return true;
+  }
+
+ public:
+  static bool IsWasmCall(MDefinition* def) {
+    return def->isWasmCallCatchable() || def->isWasmCallUncatchable();
+  }
+
+  size_t numArgs() const { return argRegs_.length(); }
+  AnyRegister registerForArg(size_t index) const {
+    MOZ_ASSERT(index < numArgs());
+    return argRegs_[index];
+  }
+  const wasm::CallSiteDesc& desc() const { return desc_; }
+  const wasm::CalleeDesc& callee() const { return callee_; }
+  wasm::FailureMode builtinMethodFailureMode() const {
+    MOZ_ASSERT(callee_.which() == wasm::CalleeDesc::BuiltinInstanceMethod);
+    return builtinMethodFailureMode_;
+  }
+  uint32_t stackArgAreaSizeUnaligned() const {
+    return stackArgAreaSizeUnaligned_;
+  }
+
+  const ABIArg& instanceArg() const { return instanceArg_; }
+
+  bool inTry() const { return inTry_; }
+  size_t tryNoteIndex() const { return tryNoteIndex_; }
+};
+
+// A wasm call that is catchable. This instruction is a control instruction,
+// and terminates the block it is on. A normal return will proceed in a the
+// fallthrough block. An exceptional return will unwind into the landing pad
+// block for this call. The landing pad block must begin with an
+// MWasmCallLandingPrePad.
+class MWasmCallCatchable final : public MVariadicControlInstruction<2>,
+                                 public MWasmCallBase,
+                                 public NoTypePolicy::Data {
+  MWasmCallCatchable(const wasm::CallSiteDesc& desc,
+                     const wasm::CalleeDesc& callee,
+                     uint32_t stackArgAreaSizeUnaligned, size_t tryNoteIndex)
+      : MVariadicControlInstruction(classOpcode),
+        MWasmCallBase(desc, callee, stackArgAreaSizeUnaligned, true,
+                      tryNoteIndex) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmCallCatchable)
+
+  static MWasmCallCatchable* New(TempAllocator& alloc,
+                                 const wasm::CallSiteDesc& desc,
+                                 const wasm::CalleeDesc& callee,
+                                 const Args& args,
+                                 uint32_t stackArgAreaSizeUnaligned,
+                                 const MWasmCallTryDesc& tryDesc,
+                                 MDefinition* tableIndexOrRef = nullptr);
+
+  bool possiblyCalls() const override { return true; }
+
+  static const size_t FallthroughBranchIndex = 0;
+  static const size_t PrePadBranchIndex = 1;
+};
+
+// A wasm call that is not catchable. This instruction is not a control
+// instruction, and therefore is not a block terminator.
+class MWasmCallUncatchable final : public MVariadicInstruction,
+                                   public MWasmCallBase,
+                                   public NoTypePolicy::Data {
+  MWasmCallUncatchable(const wasm::CallSiteDesc& desc,
+                       const wasm::CalleeDesc& callee,
+                       uint32_t stackArgAreaSizeUnaligned)
+      : MVariadicInstruction(classOpcode),
+        MWasmCallBase(desc, callee, stackArgAreaSizeUnaligned, false, 0) {}
+
+ public:
+  INSTRUCTION_HEADER(WasmCallUncatchable)
+
+  static MWasmCallUncatchable* New(TempAllocator& alloc,
+                                   const wasm::CallSiteDesc& desc,
+                                   const wasm::CalleeDesc& callee,
+                                   const Args& args,
+                                   uint32_t stackArgAreaSizeUnaligned,
+                                   MDefinition* tableIndexOrRef = nullptr);
+
+  static MWasmCallUncatchable* NewBuiltinInstanceMethodCall(
+      TempAllocator& alloc, const wasm::CallSiteDesc& desc,
+      const wasm::SymbolicAddress builtin, wasm::FailureMode failureMode,
+      const ABIArg& instanceArg, const Args& args,
+      uint32_t stackArgAreaSizeUnaligned);
+
+  bool possiblyCalls() const override { return true; }
+};
+
+// A marker instruction for a block which is the landing pad for a catchable
+// wasm call. This instruction does not emit any code, only filling in
+// metadata. This instruction must be the first instruction added to the
+// landing pad block.
+class MWasmCallLandingPrePad : public MNullaryInstruction {
+  // The block of the call that may unwind to this landing pad.
+  MBasicBlock* callBlock_;
+  // The index of the try note to initialize a landing pad for.
+  size_t tryNoteIndex_;
+
+  explicit MWasmCallLandingPrePad(MBasicBlock* callBlock, size_t tryNoteIndex)
+      : MNullaryInstruction(classOpcode),
+        callBlock_(callBlock),
+        tryNoteIndex_(tryNoteIndex) {
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmCallLandingPrePad)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  size_t tryNoteIndex() { return tryNoteIndex_; }
+  MBasicBlock* callBlock() { return callBlock_; }
+};
+
+class MWasmSelect : public MTernaryInstruction, public NoTypePolicy::Data {
+  MWasmSelect(MDefinition* trueExpr, MDefinition* falseExpr,
+              MDefinition* condExpr)
+      : MTernaryInstruction(classOpcode, trueExpr, falseExpr, condExpr) {
+    MOZ_ASSERT(condExpr->type() == MIRType::Int32);
+    MOZ_ASSERT(trueExpr->type() == falseExpr->type());
+    setResultType(trueExpr->type());
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmSelect)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, trueExpr), (1, falseExpr), (2, condExpr))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  ALLOW_CLONE(MWasmSelect)
+};
+
+class MWasmReinterpret : public MUnaryInstruction, public NoTypePolicy::Data {
+  MWasmReinterpret(MDefinition* val, MIRType toType)
+      : MUnaryInstruction(classOpcode, val) {
+    switch (val->type()) {
+      case MIRType::Int32:
+        MOZ_ASSERT(toType == MIRType::Float32);
+        break;
+      case MIRType::Float32:
+        MOZ_ASSERT(toType == MIRType::Int32);
+        break;
+      case MIRType::Double:
+        MOZ_ASSERT(toType == MIRType::Int64);
+        break;
+      case MIRType::Int64:
+        MOZ_ASSERT(toType == MIRType::Double);
+        break;
+      default:
+        MOZ_CRASH("unexpected reinterpret conversion");
+    }
+    setMovable();
+    setResultType(toType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmReinterpret)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  ALLOW_CLONE(MWasmReinterpret)
+};
+
+class MRotate : public MBinaryInstruction, public NoTypePolicy::Data {
+  bool isLeftRotate_;
+
+  MRotate(MDefinition* input, MDefinition* count, MIRType type,
+          bool isLeftRotate)
+      : MBinaryInstruction(classOpcode, input, count),
+        isLeftRotate_(isLeftRotate) {
+    setMovable();
+    setResultType(type);
+    // Prevent reordering.  Although there's no problem eliding call result
+    // definitions, there's also no need, as they cause no codegen.
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(Rotate)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, input), (1, count))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           ins->toRotate()->isLeftRotate() == isLeftRotate_;
+  }
+
+  bool isLeftRotate() const { return isLeftRotate_; }
+
+  ALLOW_CLONE(MRotate)
+};
+
+// Wasm SIMD.
+//
+// See comment in WasmIonCompile.cpp for a justification for these nodes.
+
+// (v128, v128, v128) -> v128 effect-free operation.
+class MWasmTernarySimd128 : public MTernaryInstruction,
+                            public NoTypePolicy::Data {
+  wasm::SimdOp simdOp_;
+
+  MWasmTernarySimd128(MDefinition* v0, MDefinition* v1, MDefinition* v2,
+                      wasm::SimdOp simdOp)
+      : MTernaryInstruction(classOpcode, v0, v1, v2), simdOp_(simdOp) {
+    setMovable();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmTernarySimd128)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, v0), (1, v1), (2, v2))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+#ifdef ENABLE_WASM_SIMD
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  // If the control mask of a bitselect allows the operation to be specialized
+  // as a shuffle and it is profitable to specialize it on this platform, return
+  // true and the appropriate shuffle mask.
+  bool specializeBitselectConstantMaskAsShuffle(int8_t shuffle[16]);
+  // Checks if more relaxed version of lane select can be used. It returns true
+  // if a bit mask input expected to be all 0s or 1s for entire 8-bit lanes,
+  // false otherwise.
+  bool canRelaxBitselect();
+#endif
+
+  wasm::SimdOp simdOp() const { return simdOp_; }
+
+  ALLOW_CLONE(MWasmTernarySimd128)
+};
+
+// (v128, v128) -> v128 effect-free operations.
+class MWasmBinarySimd128 : public MBinaryInstruction,
+                           public NoTypePolicy::Data {
+  wasm::SimdOp simdOp_;
+
+  MWasmBinarySimd128(MDefinition* lhs, MDefinition* rhs, bool commutative,
+                     wasm::SimdOp simdOp)
+      : MBinaryInstruction(classOpcode, lhs, rhs), simdOp_(simdOp) {
+    setMovable();
+    setResultType(MIRType::Simd128);
+    if (commutative) {
+      setCommutative();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBinarySimd128)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->toWasmBinarySimd128()->simdOp() == simdOp_ &&
+           congruentIfOperandsEqual(ins);
+  }
+#ifdef ENABLE_WASM_SIMD
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+
+  // Checks if pmaddubsw operation is supported.
+  bool canPmaddubsw();
+#endif
+
+  wasm::SimdOp simdOp() const { return simdOp_; }
+
+  // Platform-dependent specialization.
+  bool specializeForConstantRhs();
+
+  ALLOW_CLONE(MWasmBinarySimd128)
+};
+
+// (v128, const) -> v128 effect-free operations.
+class MWasmBinarySimd128WithConstant : public MUnaryInstruction,
+                                       public NoTypePolicy::Data {
+  SimdConstant rhs_;
+  wasm::SimdOp simdOp_;
+
+  MWasmBinarySimd128WithConstant(MDefinition* lhs, const SimdConstant& rhs,
+                                 wasm::SimdOp simdOp)
+      : MUnaryInstruction(classOpcode, lhs), rhs_(rhs), simdOp_(simdOp) {
+    setMovable();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmBinarySimd128WithConstant)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->toWasmBinarySimd128WithConstant()->simdOp() == simdOp_ &&
+           congruentIfOperandsEqual(ins) &&
+           rhs_.bitwiseEqual(ins->toWasmBinarySimd128WithConstant()->rhs());
+  }
+
+  wasm::SimdOp simdOp() const { return simdOp_; }
+  MDefinition* lhs() const { return input(); }
+  const SimdConstant& rhs() const { return rhs_; }
+
+  ALLOW_CLONE(MWasmBinarySimd128WithConstant)
+};
+
+// (v128, scalar, imm) -> v128 effect-free operations.
+class MWasmReplaceLaneSimd128 : public MBinaryInstruction,
+                                public NoTypePolicy::Data {
+  uint32_t laneIndex_;
+  wasm::SimdOp simdOp_;
+
+  MWasmReplaceLaneSimd128(MDefinition* lhs, MDefinition* rhs,
+                          uint32_t laneIndex, wasm::SimdOp simdOp)
+      : MBinaryInstruction(classOpcode, lhs, rhs),
+        laneIndex_(laneIndex),
+        simdOp_(simdOp) {
+    setMovable();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmReplaceLaneSimd128)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->toWasmReplaceLaneSimd128()->simdOp() == simdOp_ &&
+           ins->toWasmReplaceLaneSimd128()->laneIndex() == laneIndex_ &&
+           congruentIfOperandsEqual(ins);
+  }
+
+  uint32_t laneIndex() const { return laneIndex_; }
+  wasm::SimdOp simdOp() const { return simdOp_; }
+
+  ALLOW_CLONE(MWasmReplaceLaneSimd128)
+};
+
+// (scalar) -> v128 effect-free operations.
+class MWasmScalarToSimd128 : public MUnaryInstruction,
+                             public NoTypePolicy::Data {
+  wasm::SimdOp simdOp_;
+
+  MWasmScalarToSimd128(MDefinition* src, wasm::SimdOp simdOp)
+      : MUnaryInstruction(classOpcode, src), simdOp_(simdOp) {
+    setMovable();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmScalarToSimd128)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->toWasmScalarToSimd128()->simdOp() == simdOp_ &&
+           congruentIfOperandsEqual(ins);
+  }
+#ifdef ENABLE_WASM_SIMD
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+#endif
+
+  wasm::SimdOp simdOp() const { return simdOp_; }
+
+  ALLOW_CLONE(MWasmScalarToSimd128)
+};
+
+// (v128, imm) -> scalar effect-free operations.
+class MWasmReduceSimd128 : public MUnaryInstruction, public NoTypePolicy::Data {
+  wasm::SimdOp simdOp_;
+  uint32_t imm_;
+
+  MWasmReduceSimd128(MDefinition* src, wasm::SimdOp simdOp, MIRType outType,
+                     uint32_t imm)
+      : MUnaryInstruction(classOpcode, src), simdOp_(simdOp), imm_(imm) {
+    setMovable();
+    setResultType(outType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmReduceSimd128)
+  TRIVIAL_NEW_WRAPPERS
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+  bool congruentTo(const MDefinition* ins) const override {
+    return ins->toWasmReduceSimd128()->simdOp() == simdOp_ &&
+           ins->toWasmReduceSimd128()->imm() == imm_ &&
+           congruentIfOperandsEqual(ins);
+  }
+#ifdef ENABLE_WASM_SIMD
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+#endif
+
+  uint32_t imm() const { return imm_; }
+  wasm::SimdOp simdOp() const { return simdOp_; }
+
+  ALLOW_CLONE(MWasmReduceSimd128)
+};
+
+class MWasmLoadLaneSimd128
+    : public MVariadicInstruction,  // memoryBase is nullptr on some platforms
+      public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+  uint32_t laneSize_;
+  uint32_t laneIndex_;
+  uint32_t memoryBaseIndex_;
+
+  MWasmLoadLaneSimd128(const wasm::MemoryAccessDesc& access, uint32_t laneSize,
+                       uint32_t laneIndex, uint32_t memoryBaseIndex)
+      : MVariadicInstruction(classOpcode),
+        access_(access),
+        laneSize_(laneSize),
+        laneIndex_(laneIndex),
+        memoryBaseIndex_(memoryBaseIndex) {
+    MOZ_ASSERT(!access_.isAtomic());
+    setGuard();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadLaneSimd128)
+  NAMED_OPERANDS((0, base), (1, value));
+
+  static MWasmLoadLaneSimd128* New(TempAllocator& alloc,
+                                   MDefinition* memoryBase, MDefinition* base,
+                                   const wasm::MemoryAccessDesc& access,
+                                   uint32_t laneSize, uint32_t laneIndex,
+                                   MDefinition* value) {
+    uint32_t nextIndex = 2;
+    uint32_t memoryBaseIndex = memoryBase ? nextIndex++ : UINT32_MAX;
+
+    MWasmLoadLaneSimd128* load = new (alloc)
+        MWasmLoadLaneSimd128(access, laneSize, laneIndex, memoryBaseIndex);
+    if (!load->init(alloc, nextIndex)) {
+      return nullptr;
+    }
+
+    load->initOperand(0, base);
+    load->initOperand(1, value);
+    if (memoryBase) {
+      load->initOperand(memoryBaseIndex, memoryBase);
+    }
+
+    return load;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+  uint32_t laneSize() const { return laneSize_; }
+  uint32_t laneIndex() const { return laneIndex_; }
+  bool hasMemoryBase() const { return memoryBaseIndex_ != UINT32_MAX; }
+  MDefinition* memoryBase() const {
+    MOZ_ASSERT(hasMemoryBase());
+    return getOperand(memoryBaseIndex_);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::WasmHeap);
+  }
+};
+
+class MWasmStoreLaneSimd128 : public MVariadicInstruction,
+                              public NoTypePolicy::Data {
+  wasm::MemoryAccessDesc access_;
+  uint32_t laneSize_;
+  uint32_t laneIndex_;
+  uint32_t memoryBaseIndex_;
+
+  explicit MWasmStoreLaneSimd128(const wasm::MemoryAccessDesc& access,
+                                 uint32_t laneSize, uint32_t laneIndex,
+                                 uint32_t memoryBaseIndex)
+      : MVariadicInstruction(classOpcode),
+        access_(access),
+        laneSize_(laneSize),
+        laneIndex_(laneIndex),
+        memoryBaseIndex_(memoryBaseIndex) {
+    MOZ_ASSERT(!access_.isAtomic());
+    setGuard();
+    setResultType(MIRType::Simd128);
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreLaneSimd128)
+  NAMED_OPERANDS((0, base), (1, value))
+
+  static MWasmStoreLaneSimd128* New(TempAllocator& alloc,
+                                    MDefinition* memoryBase, MDefinition* base,
+                                    const wasm::MemoryAccessDesc& access,
+                                    uint32_t laneSize, uint32_t laneIndex,
+                                    MDefinition* value) {
+    uint32_t nextIndex = 2;
+    uint32_t memoryBaseIndex = memoryBase ? nextIndex++ : UINT32_MAX;
+
+    MWasmStoreLaneSimd128* store = new (alloc)
+        MWasmStoreLaneSimd128(access, laneSize, laneIndex, memoryBaseIndex);
+    if (!store->init(alloc, nextIndex)) {
+      return nullptr;
+    }
+
+    store->initOperand(0, base);
+    store->initOperand(1, value);
+    if (memoryBase) {
+      store->initOperand(memoryBaseIndex, memoryBase);
+    }
+
+    return store;
+  }
+
+  const wasm::MemoryAccessDesc& access() const { return access_; }
+  uint32_t laneSize() const { return laneSize_; }
+  uint32_t laneIndex() const { return laneIndex_; }
+  bool hasMemoryBase() const { return memoryBaseIndex_ != UINT32_MAX; }
+  MDefinition* memoryBase() const {
+    MOZ_ASSERT(hasMemoryBase());
+    return getOperand(memoryBaseIndex_);
+  }
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::WasmHeap);
+  }
+};
+
+// End Wasm SIMD
+
+// Used by MIR building to represent the bytecode result of an operation for
+// which an MBail was generated, to balance the basic block's MDefinition stack.
+class MUnreachableResult : public MNullaryInstruction {
+  explicit MUnreachableResult(MIRType type) : MNullaryInstruction(classOpcode) {
+    MOZ_ASSERT(type != MIRType::None);
+    setResultType(type);
+  }
+
+ public:
+  INSTRUCTION_HEADER(UnreachableResult)
+  TRIVIAL_NEW_WRAPPERS
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+};
+
+class MIonToWasmCall final : public MVariadicInstruction,
+                             public NoTypePolicy::Data {
+  CompilerGCPointer<WasmInstanceObject*> instanceObj_;
+  const wasm::FuncExport& funcExport_;
+
+  MIonToWasmCall(WasmInstanceObject* instanceObj, MIRType resultType,
+                 const wasm::FuncExport& funcExport)
+      : MVariadicInstruction(classOpcode),
+        instanceObj_(instanceObj),
+        funcExport_(funcExport) {
+    setResultType(resultType);
+  }
+
+ public:
+  INSTRUCTION_HEADER(IonToWasmCall);
+
+  static MIonToWasmCall* New(TempAllocator& alloc,
+                             WasmInstanceObject* instanceObj,
+                             const wasm::FuncExport& funcExport);
+
+  void initArg(size_t i, MDefinition* arg) { initOperand(i, arg); }
+
+  WasmInstanceObject* instanceObject() const { return instanceObj_; }
+  wasm::Instance* instance() const { return &instanceObj_->instance(); }
+  const wasm::FuncExport& funcExport() const { return funcExport_; }
+  bool possiblyCalls() const override { return true; }
+#ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override;
+#endif
+};
+
+// For accesses to wasm object fields, we need to be able to describe 8- and
+// 16-bit accesses.  But MIRType can't represent those.  Hence these two
+// supplemental enums, used for reading and writing fields respectively.
+
+// Indicates how to widen an 8- or 16-bit value (when it is read from memory).
+enum class MWideningOp : uint8_t { None, FromU16, FromS16, FromU8, FromS8 };
+
+#ifdef JS_JITSPEW
+static inline const char* StringFromMWideningOp(MWideningOp op) {
+  switch (op) {
+    case MWideningOp::None:
+      return "None";
+    case MWideningOp::FromU16:
+      return "FromU16";
+    case MWideningOp::FromS16:
+      return "FromS16";
+    case MWideningOp::FromU8:
+      return "FromU8";
+    case MWideningOp::FromS8:
+      return "FromS8";
+    default:
+      break;
+  }
+  MOZ_CRASH("Unknown MWideningOp");
+}
+#endif
+
+// Indicates how to narrow a 32-bit value (when it is written to memory).  The
+// operation is a simple truncate.
+enum class MNarrowingOp : uint8_t { None, To16, To8 };
+
+#ifdef JS_JITSPEW
+static inline const char* StringFromMNarrowingOp(MNarrowingOp op) {
+  switch (op) {
+    case MNarrowingOp::None:
+      return "None";
+    case MNarrowingOp::To16:
+      return "To16";
+    case MNarrowingOp::To8:
+      return "To8";
+    default:
+      break;
+  }
+  MOZ_CRASH("Unknown MNarrowingOp");
+}
+#endif
+
+// Provide information about potential trap at the instruction machine code,
+// e.g. null pointer dereference.
+struct TrapSiteInfo {
+  wasm::BytecodeOffset offset;
+  explicit TrapSiteInfo(wasm::BytecodeOffset offset_) : offset(offset_) {}
+};
+
+typedef mozilla::Maybe<TrapSiteInfo> MaybeTrapSiteInfo;
+
+// Load an object field stored at a fixed offset from a base pointer.  This
+// field may be any value type, including references.  No barriers are
+// performed.  The offset must be representable as a 31-bit unsigned integer.
+class MWasmLoadField : public MUnaryInstruction, public NoTypePolicy::Data {
+  uint32_t offset_;
+  MWideningOp wideningOp_;
+  AliasSet aliases_;
+  MaybeTrapSiteInfo maybeTrap_;
+
+  MWasmLoadField(MDefinition* obj, uint32_t offset, MIRType type,
+                 MWideningOp wideningOp, AliasSet aliases,
+                 MaybeTrapSiteInfo maybeTrap = mozilla::Nothing())
+      : MUnaryInstruction(classOpcode, obj),
+        offset_(uint32_t(offset)),
+        wideningOp_(wideningOp),
+        aliases_(aliases),
+        maybeTrap_(maybeTrap) {
+    MOZ_ASSERT(offset <= INT32_MAX);
+    // "if you want to widen the value when it is loaded, the destination type
+    // must be Int32".
+    MOZ_ASSERT_IF(wideningOp != MWideningOp::None, type == MIRType::Int32);
+    MOZ_ASSERT(
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmStructOutlineDataPointer).flags() ||
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmArrayNumElements).flags() ||
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmArrayDataPointer).flags() ||
+        aliases.flags() == AliasSet::Load(AliasSet::Any).flags());
+    setResultType(type);
+    if (maybeTrap_) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadField)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, obj))
+
+  uint32_t offset() const { return offset_; }
+  MWideningOp wideningOp() const { return wideningOp_; }
+  AliasSet getAliasSet() const override { return aliases_; }
+  MaybeTrapSiteInfo maybeTrap() const { return maybeTrap_; }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    // In the limited case where this insn is used to read
+    // WasmStructObject::outlineData_ (the field itself, not what it points
+    // at), we allow commoning up to happen.  This is OK because
+    // WasmStructObject::outlineData_ is readonly for the life of the
+    // WasmStructObject.
+    if (!ins->isWasmLoadField()) {
+      return false;
+    }
+    const MWasmLoadField* other = ins->toWasmLoadField();
+    return ins->isWasmLoadField() && congruentIfOperandsEqual(ins) &&
+           offset() == other->offset() && wideningOp() == other->wideningOp() &&
+           getAliasSet().flags() == other->getAliasSet().flags() &&
+           getAliasSet().flags() ==
+               AliasSet::Load(AliasSet::WasmStructOutlineDataPointer).flags();
+  }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[96];
+    SprintfLiteral(buf, "(offs=%lld, wideningOp=%s)", (long long int)offset_,
+                   StringFromMWideningOp(wideningOp_));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Loads a value from a location, denoted as a fixed offset from a base
+// pointer, which (it is assumed) is within a wasm object.  This field may be
+// any value type, including references.  No barriers are performed.
+//
+// This instruction takes a pointer to a second object `ka`, which it is
+// necessary to keep alive.  It is expected that `ka` holds a reference to
+// `obj`, but this is not enforced and no code is generated to access `ka`.
+// This instruction extends the lifetime of `ka` so that it, and hence `obj`,
+// cannot be collected while `obj` is live.  This is necessary if `obj` does
+// not point to a GC-managed object.  `offset` must be representable as a
+// 31-bit unsigned integer.
+class MWasmLoadFieldKA : public MBinaryInstruction, public NoTypePolicy::Data {
+  uint32_t offset_;
+  MWideningOp wideningOp_;
+  AliasSet aliases_;
+  MaybeTrapSiteInfo maybeTrap_;
+
+  MWasmLoadFieldKA(MDefinition* ka, MDefinition* obj, size_t offset,
+                   MIRType type, MWideningOp wideningOp, AliasSet aliases,
+                   MaybeTrapSiteInfo maybeTrap = mozilla::Nothing())
+      : MBinaryInstruction(classOpcode, ka, obj),
+        offset_(uint32_t(offset)),
+        wideningOp_(wideningOp),
+        aliases_(aliases),
+        maybeTrap_(maybeTrap) {
+    MOZ_ASSERT(offset <= INT32_MAX);
+    MOZ_ASSERT_IF(wideningOp != MWideningOp::None, type == MIRType::Int32);
+    MOZ_ASSERT(
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmStructInlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmStructOutlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Load(AliasSet::WasmArrayDataArea).flags() ||
+        aliases.flags() == AliasSet::Load(AliasSet::Any).flags());
+    setResultType(type);
+    if (maybeTrap_) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmLoadFieldKA)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, ka), (1, obj))
+
+  uint32_t offset() const { return offset_; }
+  MWideningOp wideningOp() const { return wideningOp_; }
+  AliasSet getAliasSet() const override { return aliases_; }
+  MaybeTrapSiteInfo maybeTrap() const { return maybeTrap_; }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[96];
+    SprintfLiteral(buf, "(offs=%lld, wideningOp=%s)", (long long int)offset_,
+                   StringFromMWideningOp(wideningOp_));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Stores a non-reference value to anlocation, denoted as a fixed offset from
+// a base pointer, which (it is assumed) is within a wasm object.  This field
+// may be any value type, _excluding_ references.  References _must_ use the
+// 'Ref' variant of this instruction.  The offset must be representable as a
+// 31-bit unsigned integer.
+//
+// This instruction takes a second object `ka` that must be kept alive, as
+// described for MWasmLoadFieldKA above.
+class MWasmStoreFieldKA : public MTernaryInstruction,
+                          public NoTypePolicy::Data {
+  uint32_t offset_;
+  MNarrowingOp narrowingOp_;
+  AliasSet aliases_;
+  MaybeTrapSiteInfo maybeTrap_;
+
+  MWasmStoreFieldKA(MDefinition* ka, MDefinition* obj, size_t offset,
+                    MDefinition* value, MNarrowingOp narrowingOp,
+                    AliasSet aliases,
+                    MaybeTrapSiteInfo maybeTrap = mozilla::Nothing())
+      : MTernaryInstruction(classOpcode, ka, obj, value),
+        offset_(uint32_t(offset)),
+        narrowingOp_(narrowingOp),
+        aliases_(aliases),
+        maybeTrap_(maybeTrap) {
+    MOZ_ASSERT(offset <= INT32_MAX);
+    MOZ_ASSERT(value->type() != MIRType::RefOrNull);
+    // "if you want to narrow the value when it is stored, the source type
+    // must be Int32".
+    MOZ_ASSERT_IF(narrowingOp != MNarrowingOp::None,
+                  value->type() == MIRType::Int32);
+    MOZ_ASSERT(
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmStructInlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmStructOutlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmArrayDataArea).flags() ||
+        aliases.flags() == AliasSet::Store(AliasSet::Any).flags());
+    if (maybeTrap_) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreFieldKA)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, ka), (1, obj), (2, value))
+
+  uint32_t offset() const { return offset_; }
+  MNarrowingOp narrowingOp() const { return narrowingOp_; }
+  AliasSet getAliasSet() const override { return aliases_; }
+  MaybeTrapSiteInfo maybeTrap() const { return maybeTrap_; }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[96];
+    SprintfLiteral(buf, "(offs=%lld, narrowingOp=%s)", (long long int)offset_,
+                   StringFromMNarrowingOp(narrowingOp_));
+    extras->add(buf);
+  }
+#endif
+};
+
+// Stores a reference value to a location, denoted as a fixed offset from a
+// base pointer, which (it is assumed) is within a wasm object.  This
+// instruction emits a pre-barrier.  A post barrier _must_ be performed
+// separately.  The offset must be representable as a 31-bit unsigned integer.
+//
+// This instruction takes a second object `ka` that must be kept alive, as
+// described for MWasmLoadFieldKA above.
+class MWasmStoreFieldRefKA : public MAryInstruction<4>,
+                             public NoTypePolicy::Data {
+  uint32_t offset_;
+  AliasSet aliases_;
+  MaybeTrapSiteInfo maybeTrap_;
+  WasmPreBarrierKind preBarrierKind_;
+
+  MWasmStoreFieldRefKA(MDefinition* instance, MDefinition* ka, MDefinition* obj,
+                       size_t offset, MDefinition* value, AliasSet aliases,
+                       MaybeTrapSiteInfo maybeTrap,
+                       WasmPreBarrierKind preBarrierKind)
+      : MAryInstruction<4>(classOpcode),
+        offset_(uint32_t(offset)),
+        aliases_(aliases),
+        maybeTrap_(maybeTrap),
+        preBarrierKind_(preBarrierKind) {
+    MOZ_ASSERT(obj->type() == TargetWordMIRType() ||
+               obj->type() == MIRType::Pointer ||
+               obj->type() == MIRType::RefOrNull);
+    MOZ_ASSERT(offset <= INT32_MAX);
+    MOZ_ASSERT(value->type() == MIRType::RefOrNull);
+    MOZ_ASSERT(
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmStructInlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmStructOutlineDataArea).flags() ||
+        aliases.flags() ==
+            AliasSet::Store(AliasSet::WasmArrayDataArea).flags() ||
+        aliases.flags() == AliasSet::Store(AliasSet::Any).flags());
+    initOperand(0, instance);
+    initOperand(1, ka);
+    initOperand(2, obj);
+    initOperand(3, value);
+    if (maybeTrap_) {
+      setGuard();
+    }
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmStoreFieldRefKA)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, instance), (1, ka), (2, obj), (3, value))
+
+  uint32_t offset() const { return offset_; }
+  AliasSet getAliasSet() const override { return aliases_; }
+  MaybeTrapSiteInfo maybeTrap() const { return maybeTrap_; }
+  WasmPreBarrierKind preBarrierKind() const { return preBarrierKind_; }
+
+#ifdef JS_JITSPEW
+  void getExtras(ExtrasCollector* extras) override {
+    char buf[64];
+    SprintfLiteral(buf, "(offs=%lld)", (long long int)offset_);
+    extras->add(buf);
+  }
+#endif
+};
+
+class MWasmGcObjectIsSubtypeOfAbstract : public MUnaryInstruction,
+                                         public NoTypePolicy::Data {
+  wasm::RefType sourceType_;
+  wasm::RefType destType_;
+
+  MWasmGcObjectIsSubtypeOfAbstract(MDefinition* object,
+                                   wasm::RefType sourceType,
+                                   wasm::RefType destType)
+      : MUnaryInstruction(classOpcode, object),
+        sourceType_(sourceType),
+        destType_(destType) {
+    MOZ_ASSERT(!destType.isTypeRef());
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmGcObjectIsSubtypeOfAbstract)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  wasm::RefType sourceType() const { return sourceType_; };
+  wasm::RefType destType() const { return destType_; };
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           sourceType() ==
+               ins->toWasmGcObjectIsSubtypeOfAbstract()->sourceType() &&
+           destType() == ins->toWasmGcObjectIsSubtypeOfAbstract()->destType();
+  }
+
+  HashNumber valueHash() const override {
+    HashNumber hn = MUnaryInstruction::valueHash();
+    hn = addU64ToHash(hn, sourceType().packed().bits());
+    hn = addU64ToHash(hn, destType().packed().bits());
+    return hn;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+// Tests if the WasmGcObject, `object`, is a subtype of `superSuperTypeVector`.
+// The actual super type definition must be known at compile time, so that the
+// subtyping depth of super type depth can be used.
+class MWasmGcObjectIsSubtypeOfConcrete : public MBinaryInstruction,
+                                         public NoTypePolicy::Data {
+  wasm::RefType sourceType_;
+  wasm::RefType destType_;
+
+  MWasmGcObjectIsSubtypeOfConcrete(MDefinition* object,
+                                   MDefinition* superSuperTypeVector,
+                                   wasm::RefType sourceType,
+                                   wasm::RefType destType)
+      : MBinaryInstruction(classOpcode, object, superSuperTypeVector),
+        sourceType_(sourceType),
+        destType_(destType) {
+    MOZ_ASSERT(destType.isTypeRef());
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(WasmGcObjectIsSubtypeOfConcrete)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object), (1, superSuperTypeVector))
+
+  wasm::RefType sourceType() const { return sourceType_; };
+  wasm::RefType destType() const { return destType_; };
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins) &&
+           sourceType() ==
+               ins->toWasmGcObjectIsSubtypeOfConcrete()->sourceType() &&
+           destType() == ins->toWasmGcObjectIsSubtypeOfConcrete()->destType();
+  }
+
+  HashNumber valueHash() const override {
+    HashNumber hn = MBinaryInstruction::valueHash();
+    hn = addU64ToHash(hn, sourceType().packed().bits());
+    hn = addU64ToHash(hn, destType().packed().bits());
+    return hn;
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
+#ifdef FUZZING_JS_FUZZILLI
+class MFuzzilliHash : public MUnaryInstruction, public NoTypePolicy::Data {
+  explicit MFuzzilliHash(MDefinition* obj)
+      : MUnaryInstruction(classOpcode, obj) {
+    setResultType(MIRType::Int32);
+    setMovable();
+  }
+
+ public:
+  INSTRUCTION_HEADER(FuzzilliHash);
+  TRIVIAL_NEW_WRAPPERS
+  ALLOW_CLONE(MFuzzilliHash)
+
+#  ifdef DEBUG
+  bool isConsistentFloat32Use(MUse* use) const override { return true; }
+#  endif
+
+  AliasSet getAliasSet() const override {
+    MDefinition* obj = getOperand(0);
+    if (obj->type() == MIRType::Object || obj->type() == MIRType::Value) {
+      return AliasSet::Load(AliasSet::ObjectFields | AliasSet::FixedSlot |
+                            AliasSet::DynamicSlot | AliasSet::Element |
+                            AliasSet::UnboxedElement);
+    }
+    return AliasSet::None();
+  }
+};
+
+class MFuzzilliHashStore : public MUnaryInstruction, public NoTypePolicy::Data {
+  explicit MFuzzilliHashStore(MDefinition* obj)
+      : MUnaryInstruction(classOpcode, obj) {
+    MOZ_ASSERT(obj->type() == MIRType::Int32);
+
+    setResultType(MIRType::None);
+  }
+
+ public:
+  INSTRUCTION_HEADER(FuzzilliHashStore);
+  TRIVIAL_NEW_WRAPPERS
+  ALLOW_CLONE(MFuzzilliHashStore)
+
+  // this is a store and hence effectful, however no other load can
+  // alias with the store
+  AliasSet getAliasSet() const override {
+    return AliasSet::Store(AliasSet::FuzzilliHash);
+  }
+};
+#endif
+
+#undef INSTRUCTION_HEADER
+
+void MUse::init(MDefinition* producer, MNode* consumer) {
+  MOZ_ASSERT(!consumer_, "Initializing MUse that already has a consumer");
+  MOZ_ASSERT(!producer_, "Initializing MUse that already has a producer");
+  initUnchecked(producer, consumer);
+}
+
+void MUse::initUnchecked(MDefinition* producer, MNode* consumer) {
+  MOZ_ASSERT(consumer, "Initializing to null consumer");
+  consumer_ = consumer;
+  producer_ = producer;
+  producer_->addUseUnchecked(this);
+}
+
+void MUse::initUncheckedWithoutProducer(MNode* consumer) {
+  MOZ_ASSERT(consumer, "Initializing to null consumer");
+  consumer_ = consumer;
+  producer_ = nullptr;
+}
+
+void MUse::replaceProducer(MDefinition* producer) {
+  MOZ_ASSERT(consumer_, "Resetting MUse without a consumer");
+  producer_->removeUse(this);
+  producer_ = producer;
+  producer_->addUse(this);
+}
+
+void MUse::releaseProducer() {
+  MOZ_ASSERT(consumer_, "Clearing MUse without a consumer");
+  producer_->removeUse(this);
+  producer_ = nullptr;
+}
+
+// Implement cast functions now that the compiler can see the inheritance.
+
+MDefinition* MNode::toDefinition() {
+  MOZ_ASSERT(isDefinition());
+  return (MDefinition*)this;
+}
+
+MResumePoint* MNode::toResumePoint() {
+  MOZ_ASSERT(isResumePoint());
+  return (MResumePoint*)this;
+}
+
+MInstruction* MDefinition::toInstruction() {
+  MOZ_ASSERT(!isPhi());
+  return (MInstruction*)this;
+}
+
+const MInstruction* MDefinition::toInstruction() const {
+  MOZ_ASSERT(!isPhi());
+  return (const MInstruction*)this;
+}
+
+MControlInstruction* MDefinition::toControlInstruction() {
+  MOZ_ASSERT(isControlInstruction());
+  return (MControlInstruction*)this;
+}
+
+MConstant* MDefinition::maybeConstantValue() {
+  MDefinition* op = this;
+  if (op->isBox()) {
+    op = op->toBox()->input();
+  }
+  if (op->isConstant()) {
+    return op->toConstant();
+  }
+  return nullptr;
+}
+
+#ifdef ENABLE_WASM_SIMD
+MWasmShuffleSimd128* BuildWasmShuffleSimd128(TempAllocator& alloc,
+                                             const int8_t* control,
+                                             MDefinition* lhs,
+                                             MDefinition* rhs);
+#endif  // ENABLE_WASM_SIMD
+
+}  // namespace jit
+}  // namespace js
+
+#endif /* jit_MIR_h */