--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -4215,22 +4215,22 @@ CodeGenerator::visitNewArrayCallVM(LNewA
     MOZ_ASSERT(!lir->isCall());
     saveLive(lir);
 
     JSObject* templateObject = lir->mir()->templateObject();
 
     if (templateObject) {
         pushArg(Imm32(lir->mir()->convertDoubleElements()));
         pushArg(ImmGCPtr(templateObject->group()));
-        pushArg(Imm32(lir->mir()->length()));
+        pushArg(Imm32(lir->mir()->count()));
 
         callVM(NewArrayWithGroupInfo, lir);
     } else {
         pushArg(Imm32(GenericObject));
-        pushArg(Imm32(lir->mir()->length()));
+        pushArg(Imm32(lir->mir()->count()));
         pushArg(ImmPtr(lir->mir()->pc()));
         pushArg(ImmGCPtr(lir->mir()->block()->info().script()));
 
         callVM(NewArrayOperationInfo, lir);
     }
 
     if (ReturnReg != objReg)
         masm.movePtr(ReturnReg, objReg);
@@ -4296,19 +4296,19 @@ CodeGenerator::visitHypot(LHypot* lir)
 }
 
 void
 CodeGenerator::visitNewArray(LNewArray* lir)
 {
     Register objReg = ToRegister(lir->output());
     Register tempReg = ToRegister(lir->temp());
     JSObject* templateObject = lir->mir()->templateObject();
-    DebugOnly<uint32_t> length = lir->mir()->length();
-
-    MOZ_ASSERT(length < NativeObject::NELEMENTS_LIMIT);
+    DebugOnly<uint32_t> count = lir->mir()->count();
+
+    MOZ_ASSERT(count < NativeObject::NELEMENTS_LIMIT);
 
     if (lir->mir()->shouldUseVM()) {
         visitNewArrayCallVM(lir);
         return;
     }
 
     OutOfLineNewArray* ool = new(alloc()) OutOfLineNewArray(lir);
     addOutOfLineCode(ool, lir->mir());

--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6917,32 +6917,32 @@ IonBuilder::compareTrySharedStub(bool* e
     current->add(unbox);
     current->push(unbox);
 
     *emitted = true;
     return true;
 }
 
 bool
-IonBuilder::jsop_newarray(uint32_t length)
+IonBuilder::jsop_newarray(uint32_t count)
 {
     JSObject* templateObject = inspector->getTemplateObject(pc);
     gc::InitialHeap heap;
     MConstant* templateConst;
 
     if (templateObject) {
         heap = templateObject->group()->initialHeap(constraints());
         templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject);
     } else {
         heap = gc::DefaultHeap;
         templateConst = MConstant::New(alloc(), NullValue());
     }
     current->add(templateConst);
 
-    MNewArray* ins = MNewArray::New(alloc(), constraints(), length, templateConst, heap, pc);
+    MNewArray* ins = MNewArray::New(alloc(), constraints(), count, templateConst, heap, pc);
     current->add(ins);
     current->push(ins);
 
     ObjectGroup* templateGroup = inspector->getTemplateObjectGroup(pc);
     if (templateGroup) {
         TemporaryTypeSet* types = MakeSingletonTypeSet(constraints(), templateGroup);
         ins->setResultTypeSet(types);
     }

--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -691,17 +691,17 @@ class IonBuilder
     bool jsop_arguments_getelem();
     bool jsop_runonce();
     bool jsop_rest();
     bool jsop_not();
     bool jsop_getprop(PropertyName* name);
     bool jsop_setprop(PropertyName* name);
     bool jsop_delprop(PropertyName* name);
     bool jsop_delelem();
-    bool jsop_newarray(uint32_t length);
+    bool jsop_newarray(uint32_t count);
     bool jsop_newarray_copyonwrite();
     bool jsop_newobject();
     bool jsop_initelem();
     bool jsop_initelem_array();
     bool jsop_initelem_getter_setter();
     bool jsop_mutateproto();
     bool jsop_initprop(PropertyName* name);
     bool jsop_initprop_getter_setter(PropertyName* name);

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4042,17 +4042,17 @@ MObjectState::Copy(TempAllocator& alloc,
     return res;
 }
 
 MArrayState::MArrayState(MDefinition* arr)
 {
     // This instruction is only used as a summary for bailout paths.
     setResultType(MIRType_Object);
     setRecoveredOnBailout();
-    numElements_ = arr->toNewArray()->length();
+    numElements_ = arr->toNewArray()->count();
 }
 
 bool
 MArrayState::init(TempAllocator& alloc, MDefinition* obj, MDefinition* len)
 {
     if (!MVariadicInstruction::init(alloc, numElements() + 2))
         return false;
     // +1, for the Array object.
@@ -4082,20 +4082,20 @@ MArrayState::Copy(TempAllocator& alloc, 
     MArrayState* res = new(alloc) MArrayState(arr);
     if (!res || !res->init(alloc, arr, len))
         return nullptr;
     for (size_t i = 0; i < res->numElements(); i++)
         res->initElement(i, state->getElement(i));
     return res;
 }
 
-MNewArray::MNewArray(CompilerConstraintList* constraints, uint32_t length, MConstant* templateConst,
+MNewArray::MNewArray(CompilerConstraintList* constraints, uint32_t count, MConstant* templateConst,
                      gc::InitialHeap initialHeap, jsbytecode* pc)
   : MUnaryInstruction(templateConst),
-    length_(length),
+    count_(count),
     initialHeap_(initialHeap),
     convertDoubleElements_(false),
     pc_(pc)
 {
     setResultType(MIRType_Object);
     if (templateObject()) {
         if (TemporaryTypeSet* types = MakeSingletonTypeSet(constraints, templateObject())) {
             setResultTypeSet(types);
@@ -4107,26 +4107,26 @@ MNewArray::MNewArray(CompilerConstraintL
 
 bool
 MNewArray::shouldUseVM() const
 {
     if (!templateObject())
         return true;
 
     if (templateObject()->is<UnboxedArrayObject>()) {
-        MOZ_ASSERT(templateObject()->as<UnboxedArrayObject>().capacity() >= length());
+        MOZ_ASSERT(templateObject()->as<UnboxedArrayObject>().capacity() >= count());
         return !templateObject()->as<UnboxedArrayObject>().hasInlineElements();
     }
 
-    MOZ_ASSERT(length() < NativeObject::NELEMENTS_LIMIT);
+    MOZ_ASSERT(count() < NativeObject::NELEMENTS_LIMIT);
 
     size_t arraySlots =
         gc::GetGCKindSlots(templateObject()->asTenured().getAllocKind()) - ObjectElements::VALUES_PER_HEADER;
 
-    return length() > arraySlots;
+    return count() > arraySlots;
 }
 
 bool
 MLoadFixedSlot::mightAlias(const MDefinition* store) const
 {
     if (store->isStoreFixedSlot() && store->toStoreFixedSlot()->slot() != slot())
         return false;
     return true;

--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2900,42 +2900,42 @@ typedef CompilerGCPointer<PropertyName*>
 typedef CompilerGCPointer<Shape*> CompilerShape;
 typedef CompilerGCPointer<ObjectGroup*> CompilerObjectGroup;
 
 class MNewArray
   : public MUnaryInstruction,
     public NoTypePolicy::Data
 {
   private:
-    // Number of elements to allocate for the array.
-    uint32_t length_;
+    // Number of space to allocate for the array.
+    uint32_t count_;
 
     // Heap where the array should be allocated.
     gc::InitialHeap initialHeap_;
 
     // Whether values written to this array should be converted to double first.
     bool convertDoubleElements_;
 
     jsbytecode* pc_;
 
-    MNewArray(CompilerConstraintList* constraints, uint32_t length, MConstant* templateConst,
+    MNewArray(CompilerConstraintList* constraints, uint32_t count, MConstant* templateConst,
               gc::InitialHeap initialHeap, jsbytecode* pc);
 
   public:
     INSTRUCTION_HEADER(NewArray)
 
     static MNewArray* New(TempAllocator& alloc, CompilerConstraintList* constraints,
-                          uint32_t length, MConstant* templateConst,
+                          uint32_t count, MConstant* templateConst,
                           gc::InitialHeap initialHeap, jsbytecode* pc)
     {
-        return new(alloc) MNewArray(constraints, length, templateConst, initialHeap, pc);
-    }
-
-    uint32_t length() const {
-        return length_;
+        return new(alloc) MNewArray(constraints, count, templateConst, initialHeap, pc);
+    }
+
+    uint32_t count() const {
+        return count_;
     }
 
     JSObject* templateObject() const {
         return getOperand(0)->toConstant()->value().toObjectOrNull();
     }
 
     gc::InitialHeap initialHeap() const {
         return initialHeap_;

--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -1202,17 +1202,17 @@ RNewObject::recover(JSContext* cx, Snaps
     return true;
 }
 
 bool
 MNewArray::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     writer.writeUnsigned(uint32_t(RInstruction::Recover_NewArray));
-    writer.writeUnsigned(length());
+    writer.writeUnsigned(count());
     return true;
 }
 
 RNewArray::RNewArray(CompactBufferReader& reader)
 {
     count_ = reader.readUnsigned();
 }
 

--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -890,33 +890,33 @@ IsElementEscaped(MElements* def, uint32_
 //
 // For the moment, this code is dumb as it only supports arrays which are not
 // changing length, with only access with known constants.
 static bool
 IsArrayEscaped(MInstruction* ins)
 {
     MOZ_ASSERT(ins->type() == MIRType_Object);
     MOZ_ASSERT(ins->isNewArray());
-    uint32_t length = ins->toNewArray()->length();
+    uint32_t count = ins->toNewArray()->count();
 
     JitSpewDef(JitSpew_Escape, "Check array\n", ins);
     JitSpewIndent spewIndent(JitSpew_Escape);
 
     JSObject* obj = ins->toNewArray()->templateObject();
     if (!obj) {
         JitSpew(JitSpew_Escape, "No template object defined.");
         return true;
     }
 
     if (obj->is<UnboxedArrayObject>()) {
         JitSpew(JitSpew_Escape, "Template object is an unboxed plain object.");
         return true;
     }
 
-    if (length >= 16) {
+    if (count >= 16) {
         JitSpew(JitSpew_Escape, "Array has too many elements");
         return true;
     }
 
     // Check if the object is escaped. If the object is not the first argument
     // of either a known Store / Load, then we consider it as escaped. This is a
     // cheap and conservative escape analysis.
     for (MUseIterator i(ins->usesBegin()); i != ins->usesEnd(); i++) {
@@ -930,17 +930,17 @@ IsArrayEscaped(MInstruction* ins)
             continue;
         }
 
         MDefinition* def = consumer->toDefinition();
         switch (def->op()) {
           case MDefinition::Op_Elements: {
             MElements *elem = def->toElements();
             MOZ_ASSERT(elem->object() == ins);
-            if (IsElementEscaped(elem, length)) {
+            if (IsElementEscaped(elem, count)) {
                 JitSpewDef(JitSpew_Escape, "is indirectly escaped by\n", elem);
                 return true;
             }
 
             break;
           }
 
           // This instruction is a no-op used to verify that scalar replacement