--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -3608,18 +3608,16 @@ static bool ArraySliceDenseKernel(JSCont
   MOZ_ASSERT(count >= result->length());
   result->setLength(cx, count);
 
   return true;
 }
 
 JSObject* js::ArraySliceDense(JSContext* cx, HandleObject obj, int32_t begin,
                               int32_t end, HandleObject result) {
-  MOZ_ASSERT_IF(jit::JitOptions.warpBuilder, IsPackedArray(obj));
-
   if (result && IsArraySpecies(cx, obj)) {
     if (!ArraySliceDenseKernel(cx, &obj->as<ArrayObject>(), begin, end,
                                &result->as<ArrayObject>())) {
       return nullptr;
     }
     return result;
   }
 

--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -2028,17 +2028,16 @@ bool jit::FinishBailoutToBaseline(Baseli
     case BailoutKind::SpecificSymbolGuard:
     case BailoutKind::NonInt32ArrayLength:
     case BailoutKind::ProtoGuard:
     case BailoutKind::ProxyGuard:
     case BailoutKind::NotProxyGuard:
     case BailoutKind::NotDOMProxyGuard:
     case BailoutKind::NotArrayBufferMaybeSharedGuard:
     case BailoutKind::ArrayPopShift:
-    case BailoutKind::ArraySlice:
     case BailoutKind::TagNotEqualGuard:
       // Do nothing.
       break;
 
     case BailoutKind::FirstExecution:
       // Do not return directly, as this was not frequent in the first place,
       // thus rely on the check for frequent bailouts to recompile the current
       // script.

--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -1459,60 +1459,16 @@ bool BaselineCacheIRCompiler::emitArrayP
 
   // Return value is new length.
   masm.add32(Imm32(1), scratchLength);
   masm.tagValue(JSVAL_TYPE_INT32, scratchLength, val);
 
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-
-  AutoOutputRegister output(*this);
-  AutoScratchRegisterMaybeOutput scratch1(allocator, masm, output);
-  AutoScratchRegisterMaybeOutputType scratch2(allocator, masm, output);
-
-  Register array = allocator.useRegister(masm, arrayId);
-  Register begin = allocator.useRegister(masm, beginId);
-  Register end = allocator.useRegister(masm, endId);
-
-  FailurePath* failure = nullptr;
-  if (!addFailurePath(&failure)) {
-    return false;
-  }
-
-  allocator.discardStack(masm);
-
-  masm.branchArrayIsNotPacked(array, scratch1, scratch2, failure->label());
-
-  AutoStubFrame stubFrame(*this);
-  stubFrame.enter(masm, scratch2);
-
-  // Don't attempt to pre-allocate the object, instead always use the slow
-  // path.
-  ImmPtr result(nullptr);
-
-  masm.Push(result);
-  masm.Push(end);
-  masm.Push(begin);
-  masm.Push(array);
-
-  using Fn =
-      JSObject* (*)(JSContext*, HandleObject, int32_t, int32_t, HandleObject);
-  callVM<Fn, ArraySliceDense>(masm);
-
-  stubFrame.leave(masm);
-
-  masm.tagValue(JSVAL_TYPE_OBJECT, ReturnReg, output.valueReg());
-  return true;
-}
-
 bool BaselineCacheIRCompiler::emitIsArrayResult(ValOperandId inputId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
 
   AutoOutputRegister output(*this);
   AutoScratchRegister scratch1(allocator, masm);
   AutoScratchRegisterMaybeOutput scratch2(allocator, masm, output);
 
   ValueOperand val = allocator.useValueRegister(masm, inputId);

--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5019,26 +5019,26 @@ void CallIRGenerator::emitNativeCalleeGu
 
 AttachDecision CallIRGenerator::tryAttachArrayPush(HandleFunction callee) {
   // Only optimize on obj.push(val);
   if (argc_ != 1 || !thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  JSObject* thisobj = &thisval_.toObject();
+  RootedObject thisobj(cx_, &thisval_.toObject());
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
   if (thisobj->hasLazyGroup()) {
     return AttachDecision::NoAction;
   }
 
-  auto* thisarray = &thisobj->as<ArrayObject>();
+  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
   // Check for other indexed properties or class hooks.
   if (!CanAttachAddElement(thisarray, /* isInit = */ false)) {
     return AttachDecision::NoAction;
   }
 
   // Can't add new elements to arrays with non-writable length.
   if (!thisarray->lengthIsWritable()) {
@@ -5161,22 +5161,22 @@ AttachDecision CallIRGenerator::tryAttac
   }
 
   // Only optimize on obj.join(...);
   if (!thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  JSObject* thisobj = &thisval_.toObject();
+  RootedObject thisobj(cx_, &thisval_.toObject());
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
-  auto* thisarray = &thisobj->as<ArrayObject>();
+  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
   // And the array is of length 0 or 1.
   if (thisarray->length() > 1) {
     return AttachDecision::NoAction;
   }
 
   // And the array is packed.
   if (thisarray->getDenseInitializedLength() != thisarray->length()) {
@@ -5223,94 +5223,16 @@ AttachDecision CallIRGenerator::tryAttac
 
   // Set the stub kind to Regular
   cacheIRStubKind_ = BaselineCacheIRStubKind::Regular;
 
   trackAttached("ArrayJoin");
   return AttachDecision::Attach;
 }
 
-AttachDecision CallIRGenerator::tryAttachArraySlice(HandleFunction callee) {
-  // Only handle argc <= 2.
-  if (argc_ > 2) {
-    return AttachDecision::NoAction;
-  }
-
-  // Only optimize if |this| is a packed array.
-  if (!thisval_.isObject() || !IsPackedArray(&thisval_.toObject())) {
-    return AttachDecision::NoAction;
-  }
-
-  // Arguments for the sliced region must be integers.
-  if (argc_ > 0 && !args_[0].isInt32()) {
-    return AttachDecision::NoAction;
-  }
-  if (argc_ > 1 && !args_[1].isInt32()) {
-    return AttachDecision::NoAction;
-  }
-
-  RootedArrayObject arr(cx_, &thisval_.toObject().as<ArrayObject>());
-
-  // The group of the result will be dynamically fixed up to match the input
-  // object, allowing us to handle 'this' objects that might have more than one
-  // group. Make sure that no singletons can be sliced here.
-  if (arr->isSingleton()) {
-    return AttachDecision::NoAction;
-  }
-
-  JSObject* templateObj =
-      NewFullyAllocatedArrayTryReuseGroup(cx_, arr, 0, TenuredObject);
-  if (!templateObj) {
-    cx_->recoverFromOutOfMemory();
-    return AttachDecision::NoAction;
-  }
-
-  // Initialize the input operand.
-  Int32OperandId argcId(writer.setInputOperandId(0));
-
-  // Guard callee is the 'slice' native function.
-  emitNativeCalleeGuard(callee);
-
-  ValOperandId thisValId =
-      writer.loadArgumentFixedSlot(ArgumentKind::This, argc_);
-  ObjOperandId objId = writer.guardToObject(thisValId);
-  writer.guardClass(objId, GuardClassKind::Array);
-
-  Int32OperandId int32BeginId;
-  if (argc_ > 0) {
-    ValOperandId beginId =
-        writer.loadArgumentFixedSlot(ArgumentKind::Arg0, argc_);
-    int32BeginId = writer.guardToInt32(beginId);
-  } else {
-    int32BeginId = writer.loadInt32Constant(0);
-  }
-
-  Int32OperandId int32EndId;
-  if (argc_ > 1) {
-    ValOperandId endId =
-        writer.loadArgumentFixedSlot(ArgumentKind::Arg1, argc_);
-    int32EndId = writer.guardToInt32(endId);
-  } else {
-    int32EndId = writer.loadInt32ArrayLength(objId);
-  }
-
-  writer.packedArraySliceResult(templateObj, objId, int32BeginId, int32EndId);
-
-  if (!JitOptions.warpBuilder) {
-    // Store the template object for BaselineInspector.
-    writer.metaNativeTemplateObject(callee, templateObj);
-  }
-
-  writer.typeMonitorResult();
-  cacheIRStubKind_ = BaselineCacheIRStubKind::Monitored;
-
-  trackAttached("ArraySlice");
-  return AttachDecision::Attach;
-}
-
 AttachDecision CallIRGenerator::tryAttachArrayIsArray(HandleFunction callee) {
   // Need a single argument.
   if (argc_ != 1) {
     return AttachDecision::NoAction;
   }
 
   // Initialize the input operand.
   Int32OperandId argcId(writer.setInputOperandId(0));
@@ -8186,17 +8108,17 @@ AttachDecision CallIRGenerator::tryAttac
 
   if (argc_ != 2) {
     return AttachDecision::NoAction;
   }
 
   if (!thisval_.isObject() || !thisval_.toObject().is<JSFunction>()) {
     return AttachDecision::NoAction;
   }
-  auto* target = &thisval_.toObject().as<JSFunction>();
+  RootedFunction target(cx_, &thisval_.toObject().as<JSFunction>());
 
   bool isScripted = target->hasJitEntry();
   MOZ_ASSERT_IF(!isScripted, target->isNativeWithoutJitEntry());
 
   if (target->isClassConstructor()) {
     return AttachDecision::NoAction;
   }
 
@@ -8300,18 +8222,16 @@ AttachDecision CallIRGenerator::tryAttac
       return tryAttachArrayConstructor(callee);
     case InlinableNative::ArrayPush:
       return tryAttachArrayPush(callee);
     case InlinableNative::ArrayPop:
     case InlinableNative::ArrayShift:
       return tryAttachArrayPopShift(callee, native);
     case InlinableNative::ArrayJoin:
       return tryAttachArrayJoin(callee);
-    case InlinableNative::ArraySlice:
-      return tryAttachArraySlice(callee);
     case InlinableNative::ArrayIsArray:
       return tryAttachArrayIsArray(callee);
 
     // DataView natives.
     case InlinableNative::DataViewGetInt8:
       return tryAttachDataViewGet(callee, Scalar::Int8);
     case InlinableNative::DataViewGetUint8:
       return tryAttachDataViewGet(callee, Scalar::Uint8);
@@ -8804,18 +8724,16 @@ bool CallIRGenerator::getTemplateObjectF
     return true;
   }
 
   if (!calleeFunc->hasJitInfo() ||
       calleeFunc->jitInfo()->type() != JSJitInfo::InlinableNative) {
     return true;
   }
 
-  bool isConstructing = IsConstructOp(op_);
-
   // Check for natives to which template objects can be attached. This is
   // done to provide templates to Ion for inlining these natives later on.
   switch (calleeFunc->jitInfo()->inlinableNative) {
     case InlinableNative::Array: {
       // Note: the template array won't be used if its length is inaccurately
       // computed here.  (We allocate here because compilation may occur on a
       // separate thread where allocation is impossible.)
 
@@ -8841,36 +8759,21 @@ bool CallIRGenerator::getTemplateObjectF
         return true;
       }
 
       RootedObject obj(cx_, &thisval_.toObject());
       if (obj->isSingleton()) {
         return true;
       }
 
-      if (IsPackedArray(obj)) {
-        // This case is handled by tryAttachArraySlice.
-        return true;
-      }
-
-      // TODO(Warp): Support non-packed arrays in tryAttachArraySlice if they're
-      // common in user code.
-      if (JitOptions.warpBuilder) {
-        return true;
-      }
-
       res.set(NewFullyAllocatedArrayTryReuseGroup(cx_, obj, 0, TenuredObject));
       return !!res;
     }
 
     case InlinableNative::String: {
-      if (!isConstructing) {
-        return true;
-      }
-
       RootedString emptyString(cx_, cx_->runtime()->emptyString);
       res.set(StringObject::create(cx_, emptyString, /* proto = */ nullptr,
                                    TenuredObject));
       return !!res;
     }
 
     default:
       return true;
@@ -9014,17 +8917,17 @@ AttachDecision CallIRGenerator::tryAttac
     return AttachDecision::NoAction;
   }
 
   RootedObject calleeObj(cx_, &callee_.toObject());
   if (!calleeObj->is<JSFunction>()) {
     return tryAttachCallHook(calleeObj);
   }
 
-  HandleFunction calleeFunc = calleeObj.as<JSFunction>();
+  RootedFunction calleeFunc(cx_, &calleeObj->as<JSFunction>());
 
   // Check for scripted optimizations.
   if (calleeFunc->hasJitEntry()) {
     return tryAttachCallScripted(calleeFunc);
   }
 
   // Check for native-function optimizations.
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
@@ -10726,18 +10629,18 @@ AttachDecision NewObjectIRGenerator::try
 
   trackAttached("NewObjectWithTemplate");
   return AttachDecision::Attach;
 }
 
 #ifdef JS_SIMULATOR
 bool js::jit::CallAnyNative(JSContext* cx, unsigned argc, Value* vp) {
   CallArgs args = CallArgsFromVp(argc, vp);
-  JSObject* calleeObj = &args.callee();
+  RootedObject calleeObj(cx, &args.callee());
 
   MOZ_ASSERT(calleeObj->is<JSFunction>());
-  auto* calleeFunc = &calleeObj->as<JSFunction>();
+  RootedFunction calleeFunc(cx, &calleeObj->as<JSFunction>());
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
 
   JSNative native = calleeFunc->native();
   return native(cx, args.length(), args.base());
 }
 #endif

--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -1631,17 +1631,16 @@ class MOZ_RAII CallIRGenerator : public 
 
   AtomicsReadWriteModifyOperands emitAtomicsReadWriteModifyOperands(
       HandleFunction callee);
 
   AttachDecision tryAttachArrayPush(HandleFunction callee);
   AttachDecision tryAttachArrayPopShift(HandleFunction callee,
                                         InlinableNative native);
   AttachDecision tryAttachArrayJoin(HandleFunction callee);
-  AttachDecision tryAttachArraySlice(HandleFunction callee);
   AttachDecision tryAttachArrayIsArray(HandleFunction callee);
   AttachDecision tryAttachDataViewGet(HandleFunction callee, Scalar::Type type);
   AttachDecision tryAttachDataViewSet(HandleFunction callee, Scalar::Type type);
   AttachDecision tryAttachUnsafeGetReservedSlot(HandleFunction callee,
                                                 InlinableNative native);
   AttachDecision tryAttachUnsafeSetReservedSlot(HandleFunction callee);
   AttachDecision tryAttachIsSuspendedGenerator(HandleFunction callee);
   AttachDecision tryAttachToObject(HandleFunction callee,

--- a/js/src/jit/CacheIRCompiler.cpp
+++ b/js/src/jit/CacheIRCompiler.cpp
@@ -2474,35 +2474,16 @@ bool CacheIRCompiler::emitLoadInt32Array
   masm.load32(Address(scratch, ObjectElements::offsetOfLength()), scratch);
 
   // Guard length fits in an int32.
   masm.branchTest32(Assembler::Signed, scratch, scratch, failure->label());
   EmitStoreResult(masm, scratch, JSVAL_TYPE_INT32, output);
   return true;
 }
 
-bool CacheIRCompiler::emitLoadInt32ArrayLength(ObjOperandId objId,
-                                               Int32OperandId resultId) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-  Register obj = allocator.useRegister(masm, objId);
-  Register res = allocator.defineRegister(masm, resultId);
-
-  FailurePath* failure;
-  if (!addFailurePath(&failure)) {
-    return false;
-  }
-
-  masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), res);
-  masm.load32(Address(res, ObjectElements::offsetOfLength()), res);
-
-  // Guard length fits in an int32.
-  masm.branchTest32(Assembler::Signed, res, res, failure->label());
-  return true;
-}
-
 bool CacheIRCompiler::emitDoubleAddResult(NumberOperandId lhsId,
                                           NumberOperandId rhsId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   AutoOutputRegister output(*this);
 
   // Float register must be preserved. The BinaryArith ICs use
   // the fact that baseline has them available, as well as fixed temps on
   // LBinaryCache.
@@ -8043,20 +8024,16 @@ template <>
 struct ReturnTypeToJSValueType<JSString*> {
   static constexpr JSValueType result = JSVAL_TYPE_STRING;
 };
 template <>
 struct ReturnTypeToJSValueType<BigInt*> {
   static constexpr JSValueType result = JSVAL_TYPE_BIGINT;
 };
 template <>
-struct ReturnTypeToJSValueType<JSObject*> {
-  static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
-};
-template <>
 struct ReturnTypeToJSValueType<ArrayIteratorObject*> {
   static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
 };
 template <>
 struct ReturnTypeToJSValueType<StringIteratorObject*> {
   static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
 };
 template <>

--- a/js/src/jit/CacheIROps.yaml
+++ b/js/src/jit/CacheIROps.yaml
@@ -917,26 +917,16 @@
 
 - name: PackedArrayShiftResult
   shared: true
   transpile: true
   cost_estimate: 4
   args:
     array: ObjId
 
-- name: PackedArraySliceResult
-  shared: false
-  transpile: true
-  cost_estimate: 5
-  args:
-    templateObject: ObjectField
-    array: ObjId
-    begin: Int32Id
-    end: Int32Id
-
 - name: IsArrayResult
   shared: false
   transpile: true
   cost_estimate: 5
   args:
     input: ValId
 
 - name: StoreFixedSlotUndefinedResult
@@ -1667,24 +1657,16 @@
 
 - name: LoadInt32ArrayLengthResult
   shared: true
   transpile: true
   cost_estimate: 1
   args:
     obj: ObjId
 
-- name: LoadInt32ArrayLength
-  shared: true
-  transpile: true
-  cost_estimate: 1
-  args:
-    obj: ObjId
-    result: Int32Id
-
 - name: LoadArgumentsObjectArgResult
   shared: true
   transpile: false
   cost_estimate: 2
   args:
     obj: ObjId
     index: Int32Id
 

--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -10529,23 +10529,16 @@ void CodeGenerator::visitArraySlice(LArr
   Register object = ToRegister(lir->object());
   Register begin = ToRegister(lir->begin());
   Register end = ToRegister(lir->end());
   Register temp1 = ToRegister(lir->temp1());
   Register temp2 = ToRegister(lir->temp2());
 
   Label call, fail;
 
-  if (JitOptions.warpBuilder) {
-    Label bail;
-    masm.branchArrayIsNotPacked(object, temp1, temp2, &bail);
-
-    bailoutFrom(&bail, lir->snapshot());
-  }
-
   // Try to allocate an object.
   TemplateObject templateObject(lir->mir()->templateObj());
   masm.createGCObject(temp1, temp2, templateObject, lir->mir()->initialHeap(),
                       &fail);
 
   // Fixup the group of the result in case it doesn't match the template object.
   masm.copyObjGroupNoPreBarrier(object, temp1, temp2);
 

--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -1861,16 +1861,21 @@ bool IonCacheIRCompiler::emitStoreDenseE
   masm.bind(&doStore);
   EmitStoreDenseElement(masm, val, scratch1, element);
   if (needsPostBarrier()) {
     emitPostBarrierElement(obj, val, scratch1, index);
   }
   return true;
 }
 
+bool IonCacheIRCompiler::emitArrayPush(ObjOperandId objId, ValOperandId rhsId) {
+  MOZ_ASSERT_UNREACHABLE("emitArrayPush not supported for IonCaches.");
+  return false;
+}
+
 bool IonCacheIRCompiler::emitCallNativeSetter(ObjOperandId objId,
                                               uint32_t setterOffset,
                                               ValOperandId rhsId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   AutoSaveLiveRegisters save(*this);
 
   Register obj = allocator.useRegister(masm, objId);
   JSFunction* target = &objectStubField(setterOffset)->as<JSFunction>();
@@ -2429,26 +2434,16 @@ bool IonCacheIRCompiler::emitLoadArgumen
   MOZ_CRASH("Call ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitGuardFunApply(Int32OperandId argcId,
                                            CallFlags flags) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
-bool IonCacheIRCompiler::emitArrayPush(ObjOperandId objId, ValOperandId rhsId) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
-bool IonCacheIRCompiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
 bool IonCacheIRCompiler::emitIsArrayResult(ValOperandId inputId) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitIsTypedArrayResult(ObjOperandId objId,
                                                 bool isPossiblyWrapped) {
   MOZ_CRASH("Call ICs not used in ion");
 }

--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -180,19 +180,16 @@ enum class BailoutKind : uint8_t {
   NotDOMProxyGuard,
 
   // Bailout triggered by MGuardIsNotArrayBufferMaybeShared.
   NotArrayBufferMaybeSharedGuard,
 
   // Bailout triggered by MArrayPopShift.
   ArrayPopShift,
 
-  // Bailout triggered by MArraySlice.
-  ArraySlice,
-
   // Bailout triggered by MGuardValue.
   ValueGuard,
 
   // Bailout triggered by MGuardNotOptimizedArguments.
   NotOptimizedArgumentsGuard,
 
   // Bailout triggered by MGuardNullOrUndefined.
   NullOrUndefinedGuard,
@@ -285,18 +282,16 @@ inline const char* BailoutKindString(Bai
     case BailoutKind::NotProxyGuard:
       return "BailoutKind::NotProxyGuard";
     case BailoutKind::NotDOMProxyGuard:
       return "BailoutKind::NotDOMProxyGuard";
     case BailoutKind::NotArrayBufferMaybeSharedGuard:
       return "BailoutKind::NotArrayBufferMaybeSharedGuard";
     case BailoutKind::ArrayPopShift:
       return "BailoutKind::ArrayPopShift";
-    case BailoutKind::ArraySlice:
-      return "BailoutKind::ArraySlice";
     case BailoutKind::ValueGuard:
       return "BailoutKind::ValueGuard";
     case BailoutKind::NotOptimizedArgumentsGuard:
       return "BailoutKind::NotOptimizedArgumentsGuard";
     case BailoutKind::NullOrUndefinedGuard:
       return "BailoutKind::NullOrUndefinedGuard";
     case BailoutKind::TagNotEqualGuard:
       return "BailoutKind::TagNotEqualGuard";

--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3531,19 +3531,16 @@ void LIRGenerator::visitArraySlice(MArra
   MOZ_ASSERT(ins->begin()->type() == MIRType::Int32);
   MOZ_ASSERT(ins->end()->type() == MIRType::Int32);
 
   LArraySlice* lir = new (alloc())
       LArraySlice(useFixedAtStart(ins->object(), CallTempReg0),
                   useFixedAtStart(ins->begin(), CallTempReg1),
                   useFixedAtStart(ins->end(), CallTempReg2),
                   tempFixed(CallTempReg3), tempFixed(CallTempReg4));
-  if (JitOptions.warpBuilder) {
-    assignSnapshot(lir, BailoutKind::ArraySlice);
-  }
   defineReturn(lir, ins);
   assignSafepoint(lir, ins);
 }
 
 void LIRGenerator::visitArrayJoin(MArrayJoin* ins) {
   MOZ_ASSERT(ins->type() == MIRType::String);
   MOZ_ASSERT(ins->array()->type() == MIRType::Object);
   MOZ_ASSERT(ins->sep()->type() == MIRType::String);

--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -3913,42 +3913,36 @@ void MacroAssembler::debugAssertObjHasFi
   branchTest32(Assembler::NonZero,
                Address(scratch, Shape::offsetOfImmutableFlags()),
                Imm32(Shape::fixedSlotsMask()), &hasFixedSlots);
   assumeUnreachable("Expected a fixed slot");
   bind(&hasFixedSlots);
 #endif
 }
 
-void MacroAssembler::branchArrayIsNotPacked(Register array, Register temp1,
-                                            Register temp2, Label* label) {
-  loadPtr(Address(array, NativeObject::offsetOfElements()), temp1);
-
-  // Test length == initializedLength.
-  Label done;
-  Address initLength(temp1, ObjectElements::offsetOfInitializedLength());
-  load32(Address(temp1, ObjectElements::offsetOfLength()), temp2);
-  branch32(Assembler::NotEqual, initLength, temp2, label);
-
-  // Test the NON_PACKED flag.
-  Address flags(temp1, ObjectElements::offsetOfFlags());
-  branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::NON_PACKED),
-               label);
-}
-
 void MacroAssembler::setIsPackedArray(Register obj, Register output,
                                       Register temp) {
   // Ensure it's an ArrayObject.
   Label notPackedArray;
   branchTestObjClass(Assembler::NotEqual, obj, &ArrayObject::class_, temp, obj,
                      &notPackedArray);
 
-  branchArrayIsNotPacked(obj, temp, output, &notPackedArray);
-
+  loadPtr(Address(obj, NativeObject::offsetOfElements()), temp);
+
+  // Test length == initializedLength.
   Label done;
+  Address initLength(temp, ObjectElements::offsetOfInitializedLength());
+  load32(Address(temp, ObjectElements::offsetOfLength()), output);
+  branch32(Assembler::NotEqual, initLength, output, &notPackedArray);
+
+  // Test the NON_PACKED flag.
+  Address flags(temp, ObjectElements::offsetOfFlags());
+  branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::NON_PACKED),
+               &notPackedArray);
+
   move32(Imm32(1), output);
   jump(&done);
 
   bind(&notPackedArray);
   move32(Imm32(0), output);
 
   bind(&done);
 }

--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -3608,19 +3608,16 @@ class MacroAssembler : public MacroAssem
                                const Address& dest);
 
   void memoryBarrierBefore(const Synchronization& sync);
   void memoryBarrierAfter(const Synchronization& sync);
 
   void debugAssertIsObject(const ValueOperand& val);
   void debugAssertObjHasFixedSlots(Register obj, Register scratch);
 
-  void branchArrayIsNotPacked(Register array, Register temp1, Register temp2,
-                              Label* label);
-
   void setIsPackedArray(Register obj, Register output, Register temp);
 
   void packedArrayPop(Register array, ValueOperand output, Register temp1,
                       Register temp2, Label* fail);
   void packedArrayShift(Register array, ValueOperand output, Register temp1,
                         Register temp2, LiveRegisterSet volatileRegs,
                         Label* fail);
 

--- a/js/src/jit/WarpCacheIRTranspiler.cpp
+++ b/js/src/jit/WarpCacheIRTranspiler.cpp
@@ -971,29 +971,16 @@ bool WarpCacheIRTranspiler::emitLoadInt3
 
   auto* length = MArrayLength::New(alloc(), elements);
   add(length);
 
   pushResult(length);
   return true;
 }
 
-bool WarpCacheIRTranspiler::emitLoadInt32ArrayLength(ObjOperandId objId,
-                                                     Int32OperandId resultId) {
-  MDefinition* obj = getOperand(objId);
-
-  auto* elements = MElements::New(alloc(), obj);
-  add(elements);
-
-  auto* length = MArrayLength::New(alloc(), elements);
-  add(length);
-
-  return defineOperand(resultId, length);
-}
-
 bool WarpCacheIRTranspiler::emitLoadTypedArrayLengthResult(
     ObjOperandId objId, uint32_t getterOffset) {
   MDefinition* obj = getOperand(objId);
 
   auto* length = MArrayBufferViewLength::New(alloc(), obj);
   add(length);
 
   pushResult(length);
@@ -1989,35 +1976,16 @@ bool WarpCacheIRTranspiler::emitPackedAr
   auto* ins = MArrayPopShift::New(alloc(), array, MArrayPopShift::Shift,
                                   needsHoleCheck, maybeUndefined);
   addEffectful(ins);
 
   pushResult(ins);
   return resumeAfter(ins);
 }
 
-bool WarpCacheIRTranspiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  JSObject* templateObj = tenuredObjectStubField(templateObjectOffset);
-
-  MDefinition* array = getOperand(arrayId);
-  MDefinition* begin = getOperand(beginId);
-  MDefinition* end = getOperand(endId);
-
-  // TODO: support pre-tenuring.
-  gc::InitialHeap heap = gc::DefaultHeap;
-
-  auto* ins = MArraySlice::New(alloc(), array, begin, end, templateObj, heap);
-  addEffectful(ins);
-
-  pushResult(ins);
-  return resumeAfter(ins);
-}
-
 bool WarpCacheIRTranspiler::emitHasClassResult(ObjOperandId objId,
                                                uint32_t claspOffset) {
   MDefinition* obj = getOperand(objId);
   const JSClass* clasp = classStubField(claspOffset);
 
   auto* hasClass = MHasClass::New(alloc(), obj, clasp);
   add(hasClass);