--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3459,49 +3459,56 @@ AbortReasonOr<Ok> IonBuilder::binaryBitO
   if (!SimpleBitOpOperand(left) || !SimpleBitOpOperand(right)) {
     return Ok();
   }
 
   MBinaryBitwiseInstruction* ins;
   switch (op) {
     case JSOp::BitAnd:
       ins = MBitAnd::New(alloc(), left, right);
+      ins->setInt32Specialization();
+      ins->setCommutative();
       break;
 
     case JSOp::BitOr:
       ins = MBitOr::New(alloc(), left, right);
+      ins->setInt32Specialization();
+      ins->setCommutative();
       break;
 
     case JSOp::BitXor:
       ins = MBitXor::New(alloc(), left, right);
+      ins->setInt32Specialization();
+      ins->setCommutative();
       break;
 
     case JSOp::Lsh:
       ins = MLsh::New(alloc(), left, right);
+      ins->setInt32Specialization();
       break;
 
     case JSOp::Rsh:
       ins = MRsh::New(alloc(), left, right);
+      ins->setInt32Specialization();
       break;
 
     case JSOp::Ursh:
       ins = MUrsh::New(alloc(), left, right);
+      if (inspector->hasSeenDoubleResult(pc)) {
+        ins->toUrsh()->setDoubleSpecialization();
+      } else {
+        ins->setInt32Specialization();
+      }
       break;
 
     default:
       MOZ_CRASH("unexpected bitop");
   }
 
   current->add(ins);
-  ins->infer(inspector, pc);
-
-  // The expected specialization should match the inferred specialization.
-  MOZ_ASSERT(ins->specialization() == MIRType::Int32 ||
-             (op == JSOp::Ursh && ins->specialization() == MIRType::Double));
-
   current->push(ins);
   if (ins->isEffectful()) {
     MOZ_TRY(resumeAfter(ins));
   }
 
   *emitted = true;
   return Ok();
 }

--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -2815,17 +2815,18 @@ IonBuilder::InliningResult IonBuilder::i
     } else {
       const JSClass* remaining[] = {clasp2, clasp3, clasp4};
       MDefinition* last = hasClass1;
       for (size_t i = 0; i < ArrayLength(remaining); i++) {
         MHasClass* hasClass =
             MHasClass::New(alloc(), callInfo.getArg(0), remaining[i]);
         current->add(hasClass);
         MBitOr* either = MBitOr::New(alloc(), last, hasClass);
-        either->infer(inspector, pc);
+        either->setInt32Specialization();
+        either->setCommutative();
         current->add(either);
         last = either;
       }
 
       MDefinition* result = convertToBoolean(last);
       current->push(result);
     }
   }

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2527,79 +2527,28 @@ MDefinition* MBinaryBitwiseInstruction::
     MOZ_ASSERT(rhs->isConstant());
     MOZ_ASSERT(rhs->type() == MIRType::Int32);
     return foldIfAllBitsSet(1);
   }
 
   return this;
 }
 
-void MBinaryBitwiseInstruction::infer(BaselineInspector*, jsbytecode*) {
-  if (getOperand(0)->mightBeType(MIRType::Object) ||
-      getOperand(0)->mightBeType(MIRType::Symbol) ||
-      getOperand(0)->mightBeType(MIRType::BigInt) ||
-      getOperand(1)->mightBeType(MIRType::Object) ||
-      getOperand(1)->mightBeType(MIRType::Symbol) ||
-      getOperand(1)->mightBeType(MIRType::BigInt)) {
-    specialization_ = MIRType::None;
-    setResultType(MIRType::Value);
-  } else {
-    specializeAs(MIRType::Int32);
-  }
-}
-
 void MBinaryBitwiseInstruction::specializeAs(MIRType type) {
   MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Int64);
   MOZ_ASSERT(this->type() == MIRType::Value || this->type() == type);
 
   specialization_ = type;
   setResultType(type);
 
   if (isBitOr() || isBitAnd() || isBitXor()) {
     setCommutative();
   }
 }
 
-void MShiftInstruction::infer(BaselineInspector*, jsbytecode*) {
-  if (getOperand(0)->mightBeType(MIRType::Object) ||
-      getOperand(1)->mightBeType(MIRType::Object) ||
-      getOperand(0)->mightBeType(MIRType::Symbol) ||
-      getOperand(1)->mightBeType(MIRType::Symbol) ||
-      getOperand(0)->mightBeType(MIRType::BigInt) ||
-      getOperand(1)->mightBeType(MIRType::BigInt)) {
-    specialization_ = MIRType::None;
-    setResultType(MIRType::Value);
-  } else {
-    specialization_ = MIRType::Int32;
-    setResultType(MIRType::Int32);
-  }
-}
-
-void MUrsh::infer(BaselineInspector* inspector, jsbytecode* pc) {
-  if (getOperand(0)->mightBeType(MIRType::Object) ||
-      getOperand(1)->mightBeType(MIRType::Object) ||
-      getOperand(0)->mightBeType(MIRType::Symbol) ||
-      getOperand(1)->mightBeType(MIRType::Symbol) ||
-      getOperand(0)->mightBeType(MIRType::BigInt) ||
-      getOperand(1)->mightBeType(MIRType::BigInt)) {
-    specialization_ = MIRType::None;
-    setResultType(MIRType::Value);
-    return;
-  }
-
-  if (inspector->hasSeenDoubleResult(pc)) {
-    specialization_ = MIRType::Double;
-    setResultType(MIRType::Double);
-    return;
-  }
-
-  specialization_ = MIRType::Int32;
-  setResultType(MIRType::Int32);
-}
-
 static inline bool CanProduceNegativeZero(MDefinition* def) {
   // Test if this instruction can produce negative zero even when bailing out
   // and changing types.
   switch (def->op()) {
     case MDefinition::Opcode::Constant:
       if (def->type() == MIRType::Double &&
           def->toConstant()->toDouble() == -0.0) {
         return true;

--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4466,17 +4466,16 @@ class MBinaryBitwiseInstruction : public
 
  public:
   MDefinition* foldsTo(TempAllocator& alloc) override;
   MDefinition* foldUnnecessaryBitop();
   virtual MDefinition* foldIfZero(size_t operand) = 0;
   virtual MDefinition* foldIfNegOne(size_t operand) = 0;
   virtual MDefinition* foldIfEqual() = 0;
   virtual MDefinition* foldIfAllBitsSet(size_t operand) = 0;
-  virtual void infer(BaselineInspector* inspector, jsbytecode* pc);
   void collectRangeInfoPreTrunc() override;
 
   void setInt32Specialization() {
     specialization_ = MIRType::Int32;
     setResultType(MIRType::Int32);
   }
 
   bool congruentTo(const MDefinition* ins) const override {
@@ -4592,17 +4591,16 @@ class MShiftInstruction : public MBinary
   MShiftInstruction(Opcode op, MDefinition* left, MDefinition* right,
                     MIRType type)
       : MBinaryBitwiseInstruction(op, left, right, type) {}
 
  public:
   MDefinition* foldIfNegOne(size_t operand) override { return this; }
   MDefinition* foldIfEqual() override { return this; }
   MDefinition* foldIfAllBitsSet(size_t operand) override { return this; }
-  virtual void infer(BaselineInspector* inspector, jsbytecode* pc) override;
 };
 
 class MLsh : public MShiftInstruction {
   MLsh(MDefinition* left, MDefinition* right, MIRType type)
       : MShiftInstruction(classOpcode, left, right, type) {}
 
  public:
   INSTRUCTION_HEADER(Lsh)
@@ -4672,22 +4670,25 @@ class MUrsh : public MShiftInstruction {
     // 0 >>> x => 0
     if (operand == 0) {
       return getOperand(0);
     }
 
     return this;
   }
 
-  void infer(BaselineInspector* inspector, jsbytecode* pc) override;
-
   bool bailoutsDisabled() const { return bailoutsDisabled_; }
 
   bool fallible() const;
 
+  void setDoubleSpecialization() {
+    specialization_ = MIRType::Double;
+    setResultType(MIRType::Double);
+  }
+
   void computeRange(TempAllocator& alloc) override;
   void collectRangeInfoPreTrunc() override;
 
   MOZ_MUST_USE bool writeRecoverData(
       CompactBufferWriter& writer) const override;
   bool canRecoverOnBailout() const override {
     return specialization_ < MIRType::Object;
   }