--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -720,19 +720,19 @@ void ICStub::trace(JSTracer* trc) {
     default:
       break;
   }
 }
 
 // This helper handles ICState updates/transitions while attaching CacheIR
 // stubs.
 template <typename IRGenerator, typename... Args>
-static void TryAttachStub(const char* name, JSContext* cx, BaselineFrame* frame,
-                          ICFallbackStub* stub, BaselineCacheIRStubKind kind,
-                          Args&&... args) {
+static void TryAttachStubOld(const char* name, JSContext* cx,
+                             BaselineFrame* frame, ICFallbackStub* stub,
+                             BaselineCacheIRStubKind kind, Args&&... args) {
   if (stub->state().maybeTransition()) {
     stub->discardStubs(cx);
   }
 
   if (stub->state().canAttachStub()) {
     RootedScript script(cx, frame->script());
     jsbytecode* pc = stub->icEntry()->pc(script);
 
@@ -748,16 +748,55 @@ static void TryAttachStub(const char* na
       }
     }
     if (!attached) {
       stub->state().trackNotAttached();
     }
   }
 }
 
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename... Args>
+static void TryAttachStub(const char* name, JSContext* cx, BaselineFrame* frame,
+                          ICFallbackStub* stub, BaselineCacheIRStubKind kind,
+                          Args&&... args) {
+  if (stub->state().maybeTransition()) {
+    stub->discardStubs(cx);
+  }
+
+  if (stub->state().canAttachStub()) {
+    RootedScript script(cx, frame->script());
+    jsbytecode* pc = stub->icEntry()->pc(script);
+
+    bool attached = false;
+    IRGenerator gen(cx, script, pc, stub->state().mode(),
+                    std::forward<Args>(args)...);
+    switch (gen.tryAttachStub()) {
+      case AttachDecision::Attach: {
+        ICStub* newStub =
+            AttachBaselineCacheIRStub(cx, gen.writerRef(), gen.cacheKind(),
+                                      kind, script, stub, &attached);
+        if (newStub) {
+          JitSpew(JitSpew_BaselineIC, "  Attached %s CacheIR stub", name);
+        }
+      } break;
+      case AttachDecision::NoAction:
+        break;
+      case AttachDecision::TemporarilyUnoptimizable:
+      case AttachDecision::Deferred:
+        MOZ_ASSERT_UNREACHABLE("Not expected in generic TryAttachStub");
+        break;
+    }
+    if (!attached) {
+      stub->state().trackNotAttached();
+    }
+  }
+}
+
 //
 // WarmUpCounter_Fallback
 //
 
 /* clang-format off */
 // The following data is kept in a temporary heap-allocated buffer, stored in
 // JitRuntime (high memory addresses at top, low at bottom):
 //
@@ -1979,18 +2018,18 @@ bool ICTypeUpdate_AnyValue::Compiler::ge
 bool DoToBoolFallback(JSContext* cx, BaselineFrame* frame,
                       ICToBool_Fallback* stub, HandleValue arg,
                       MutableHandleValue ret) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "ToBool");
 
   MOZ_ASSERT(!arg.isBoolean());
 
-  TryAttachStub<ToBoolIRGenerator>("ToBool", cx, frame, stub,
-                                   BaselineCacheIRStubKind::Regular, arg);
+  TryAttachStubOld<ToBoolIRGenerator>("ToBool", cx, frame, stub,
+                                      BaselineCacheIRStubKind::Regular, arg);
 
   bool cond = ToBoolean(arg);
   ret.setBoolean(cond);
 
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_ToBool() {
@@ -2558,19 +2597,19 @@ bool DoInFallback(JSContext* cx, Baselin
 
   FallbackICSpew(cx, stub, "In");
 
   if (!objValue.isObject()) {
     ReportInNotObjectError(cx, key, -2, objValue, -1);
     return false;
   }
 
-  TryAttachStub<HasPropIRGenerator>("In", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular,
-                                    CacheKind::In, key, objValue);
+  TryAttachStubOld<HasPropIRGenerator>("In", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular,
+                                       CacheKind::In, key, objValue);
 
   RootedObject obj(cx, &objValue.toObject());
   bool cond = false;
   if (!OperatorIn(cx, key, obj, &cond)) {
     return false;
   }
   res.setBoolean(cond);
 
@@ -2601,19 +2640,19 @@ bool FallbackICCodeCompiler::emit_In() {
 
 bool DoHasOwnFallback(JSContext* cx, BaselineFrame* frame,
                       ICHasOwn_Fallback* stub, HandleValue keyValue,
                       HandleValue objValue, MutableHandleValue res) {
   stub->incrementEnteredCount();
 
   FallbackICSpew(cx, stub, "HasOwn");
 
-  TryAttachStub<HasPropIRGenerator>("HasOwn", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular,
-                                    CacheKind::HasOwn, keyValue, objValue);
+  TryAttachStubOld<HasPropIRGenerator>("HasOwn", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular,
+                                       CacheKind::HasOwn, keyValue, objValue);
 
   bool found;
   if (!HasOwnProperty(cx, objValue, keyValue, &found)) {
     return false;
   }
 
   res.setBoolean(found);
   return true;
@@ -2650,19 +2689,19 @@ bool DoGetNameFallback(JSContext* cx, Ba
   jsbytecode* pc = stub->icEntry()->pc(script);
   mozilla::DebugOnly<JSOp> op = JSOp(*pc);
   FallbackICSpew(cx, stub, "GetName(%s)", CodeName[JSOp(*pc)]);
 
   MOZ_ASSERT(op == JSOP_GETNAME || op == JSOP_GETGNAME);
 
   RootedPropertyName name(cx, script->getName(pc));
 
-  TryAttachStub<GetNameIRGenerator>("GetName", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Monitored,
-                                    envChain, name);
+  TryAttachStubOld<GetNameIRGenerator>("GetName", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Monitored,
+                                       envChain, name);
 
   static_assert(JSOP_GETGNAME_LENGTH == JSOP_GETNAME_LENGTH,
                 "Otherwise our check for JSOP_TYPEOF isn't ok");
   if (JSOp(pc[JSOP_GETGNAME_LENGTH]) == JSOP_TYPEOF) {
     if (!GetEnvironmentName<GetNameMode::TypeOf>(cx, envChain, name, res)) {
       return false;
     }
   } else {
@@ -2708,19 +2747,19 @@ bool DoBindNameFallback(JSContext* cx, B
   jsbytecode* pc = stub->icEntry()->pc(frame->script());
   mozilla::DebugOnly<JSOp> op = JSOp(*pc);
   FallbackICSpew(cx, stub, "BindName(%s)", CodeName[JSOp(*pc)]);
 
   MOZ_ASSERT(op == JSOP_BINDNAME || op == JSOP_BINDGNAME);
 
   RootedPropertyName name(cx, frame->script()->getName(pc));
 
-  TryAttachStub<BindNameIRGenerator>("BindName", cx, frame, stub,
-                                     BaselineCacheIRStubKind::Regular, envChain,
-                                     name);
+  TryAttachStubOld<BindNameIRGenerator>("BindName", cx, frame, stub,
+                                        BaselineCacheIRStubKind::Regular,
+                                        envChain, name);
 
   RootedObject scope(cx);
   if (!LookupNameUnqualified(cx, name, envChain, &scope)) {
     return false;
   }
 
   res.setObject(*scope);
   return true;
@@ -2761,18 +2800,18 @@ bool DoGetIntrinsicFallback(JSContext* c
   }
 
   // An intrinsic operation will always produce the same result, so only
   // needs to be monitored once. Attach a stub to load the resulting constant
   // directly.
 
   TypeScript::Monitor(cx, script, pc, res);
 
-  TryAttachStub<GetIntrinsicIRGenerator>("GetIntrinsic", cx, frame, stub,
-                                         BaselineCacheIRStubKind::Regular, res);
+  TryAttachStubOld<GetIntrinsicIRGenerator>(
+      "GetIntrinsic", cx, frame, stub, BaselineCacheIRStubKind::Regular, res);
 
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_GetIntrinsic() {
   EmitRestoreTailCallReg(masm);
 
   masm.push(ICStubReg);
@@ -5440,17 +5479,17 @@ bool ICCall_ScriptedFunCall::Compiler::g
 //
 
 bool DoGetIteratorFallback(JSContext* cx, BaselineFrame* frame,
                            ICGetIterator_Fallback* stub, HandleValue value,
                            MutableHandleValue res) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "GetIterator");
 
-  TryAttachStub<GetIteratorIRGenerator>(
+  TryAttachStubOld<GetIteratorIRGenerator>(
       "GetIterator", cx, frame, stub, BaselineCacheIRStubKind::Regular, value);
 
   JSObject* iterobj = ValueToIterator(cx, value);
   if (!iterobj) {
     return false;
   }
 
   res.setObject(*iterobj);
@@ -5504,19 +5543,19 @@ bool DoInstanceOfFallback(JSContext* cx,
     }
     return true;
   }
 
   // For functions, keep track of the |prototype| property in type information,
   // for use during Ion compilation.
   EnsureTrackPropertyTypes(cx, obj, NameToId(cx->names().prototype));
 
-  TryAttachStub<InstanceOfIRGenerator>("InstanceOf", cx, frame, stub,
-                                       BaselineCacheIRStubKind::Regular, lhs,
-                                       obj);
+  TryAttachStubOld<InstanceOfIRGenerator>("InstanceOf", cx, frame, stub,
+                                          BaselineCacheIRStubKind::Regular, lhs,
+                                          obj);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_InstanceOf() {
   EmitRestoreTailCallReg(masm);
 
   // Sync stack for the decompiler.
   masm.pushValue(R0);
@@ -5537,18 +5576,18 @@ bool FallbackICCodeCompiler::emit_Instan
 //
 
 bool DoTypeOfFallback(JSContext* cx, BaselineFrame* frame,
                       ICTypeOf_Fallback* stub, HandleValue val,
                       MutableHandleValue res) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "TypeOf");
 
-  TryAttachStub<TypeOfIRGenerator>("TypeOf", cx, frame, stub,
-                                   BaselineCacheIRStubKind::Regular, val);
+  TryAttachStubOld<TypeOfIRGenerator>("TypeOf", cx, frame, stub,
+                                      BaselineCacheIRStubKind::Regular, val);
 
   JSType type = js::TypeOfValue(val);
   RootedString string(cx, TypeName(type, cx->names()));
   res.setString(string);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_TypeOf() {
@@ -5696,19 +5735,19 @@ bool DoUnaryArithFallback(JSContext* cx,
     default:
       MOZ_CRASH("Unexpected op");
   }
 
   if (res.isDouble()) {
     stub->setSawDoubleResult();
   }
 
-  TryAttachStub<UnaryArithIRGenerator>("UniaryArith", cx, frame, stub,
-                                       BaselineCacheIRStubKind::Regular, op,
-                                       val, res);
+  TryAttachStubOld<UnaryArithIRGenerator>("UniaryArith", cx, frame, stub,
+                                          BaselineCacheIRStubKind::Regular, op,
+                                          val, res);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_UnaryArith() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -5820,19 +5859,19 @@ bool DoBinaryArithFallback(JSContext* cx
     default:
       MOZ_CRASH("Unhandled baseline arith op");
   }
 
   if (ret.isDouble()) {
     stub->setSawDoubleResult();
   }
 
-  TryAttachStub<BinaryArithIRGenerator>("BinaryArith", cx, frame, stub,
-                                        BaselineCacheIRStubKind::Regular, op,
-                                        lhs, rhs, ret);
+  TryAttachStubOld<BinaryArithIRGenerator>("BinaryArith", cx, frame, stub,
+                                           BaselineCacheIRStubKind::Regular, op,
+                                           lhs, rhs, ret);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_BinaryArith() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -5917,19 +5956,19 @@ bool DoCompareFallback(JSContext* cx, Ba
       break;
     default:
       MOZ_ASSERT_UNREACHABLE("Unhandled baseline compare op");
       return false;
   }
 
   ret.setBoolean(out);
 
-  TryAttachStub<CompareIRGenerator>("Compare", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular, op, lhs,
-                                    rhs);
+  TryAttachStubOld<CompareIRGenerator>("Compare", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular, op,
+                                       lhs, rhs);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_Compare() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -6023,19 +6062,19 @@ bool DoNewObjectFallback(JSContext* cx, 
 
     if (obj && !obj->isSingleton() &&
         !obj->group()->maybePreliminaryObjectsDontCheckGeneration()) {
       templateObject = NewObjectOperation(cx, script, pc, TenuredObject);
       if (!templateObject) {
         return false;
       }
 
-      TryAttachStub<NewObjectIRGenerator>("NewObject", cx, frame, stub,
-                                          BaselineCacheIRStubKind::Regular,
-                                          JSOp(*pc), templateObject);
+      TryAttachStubOld<NewObjectIRGenerator>("NewObject", cx, frame, stub,
+                                             BaselineCacheIRStubKind::Regular,
+                                             JSOp(*pc), templateObject);
 
       stub->setTemplateObject(templateObject);
     }
   }
 
   if (!obj) {
     return false;
   }

--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5371,20 +5371,17 @@ AttachDecision CallIRGenerator::tryAttac
   CallFlags flags(isConstructing, isSpread, isSameRealm);
 
   if (isConstructing && !calleeFunc->isConstructor()) {
     return AttachDecision::NoAction;
   }
 
   // Check for specific native-function optimizations.
   if (isSpecialized) {
-    AttachDecision decision = tryAttachSpecialCaseCallNative(calleeFunc);
-    if (decision != AttachDecision::NoAction) {
-      return decision;
-    }
+    TRY_ATTACH(tryAttachSpecialCaseCallNative(calleeFunc));
   }
   if (JitOptions.disableCacheIRCalls) {
     return AttachDecision::NoAction;
   }
 
   RootedObject templateObj(cx_);
   if (isConstructing && isSpecialized &&
       !getTemplateObjectForNative(calleeFunc, &templateObj)) {

--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -506,22 +506,47 @@ class CallFlags {
   static const uint8_t IsConstructing = 1 << 5;
   static const uint8_t IsSameRealm = 1 << 6;
 
   friend class CacheIRReader;
   friend class CacheIRWriter;
 };
 
 enum class AttachDecision {
+  // We cannot attach a stub.
   NoAction,
+
+  // We can attach a stub.
   Attach,
+
+  // We cannot currently attach a stub, but we expect to be able to do so in the
+  // future. In this case, we do not call trackNotAttached().
   TemporarilyUnoptimizable,
+
+  // We want to attach a stub, but the result of the operation is
+  // needed to generate that stub. For example, AddSlot needs to know
+  // the resulting shape. Note: the attached stub will inspect the
+  // inputs to the operation, so most input checks should be done
+  // before the actual operation, with only minimal checks remaining
+  // for the deferred portion. This prevents arbitrary scripted code
+  // run by the operation from interfering with the conditions being
+  // checked.
   Deferred
 };
 
+// If the input expression evaluates to an AttachDecision other than NoAction,
+// return that AttachDecision. If it is NoAction, do nothing.
+#define TRY_ATTACH(expr)                      \
+  do {                                        \
+    AttachDecision result = expr;             \
+    if (result != AttachDecision::NoAction) { \
+      return result;                          \
+    }                                         \
+  } while (0)
+
 // Set of arguments supported by GetIndexOfArgument.
 // Support for Arg2 and up can be added easily, but is currently unneeded.
 enum class ArgumentKind : uint8_t { Callee, This, NewTarget, Arg0, Arg1 };
 
 // This function calculates the index of an argument based on the call flags.
 // addArgc is an out-parameter, indicating whether the value of argc should
 // be added to the return value to find the actual index.
 inline int32_t GetIndexOfArgument(ArgumentKind kind, CallFlags flags,

--- a/js/src/jit/IonIC.cpp
+++ b/js/src/jit/IonIC.cpp
@@ -110,16 +110,74 @@ void IonIC::trace(JSTracer* trc) {
     TraceCacheIRStub(trc, stub, stub->stubInfo());
 
     nextCodeRaw = stub->nextCodeRaw();
   }
 
   MOZ_ASSERT(nextCodeRaw == fallbackLabel_.raw());
 }
 
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename IC, typename... Args>
+static void TryAttachIonStubOld(JSContext* cx, IC* ic, IonScript* ionScript,
+                                Args&&... args) {
+  if (ic->state().maybeTransition()) {
+    ic->discardStubs(cx->zone());
+  }
+
+  if (ic->state().canAttachStub()) {
+    RootedScript script(cx, ic->script());
+    bool attached = false;
+    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
+                    std::forward<Args>(args)...);
+    if (gen.tryAttachStub()) {
+      ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
+                            &attached);
+    }
+    if (!attached) {
+      ic->state().trackNotAttached();
+    }
+  }
+}
+
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename IC, typename... Args>
+static void TryAttachIonStub(JSContext* cx, IC* ic, IonScript* ionScript,
+                             Args&&... args) {
+  if (ic->state().maybeTransition()) {
+    ic->discardStubs(cx->zone());
+  }
+
+  if (ic->state().canAttachStub()) {
+    RootedScript script(cx, ic->script());
+    bool attached = false;
+    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
+                    std::forward<Args>(args)...);
+    switch (gen.tryAttachStub()) {
+      case AttachDecision::Attach:
+        ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
+                              &attached);
+        break;
+      case AttachDecision::NoAction:
+        break;
+      case AttachDecision::TemporarilyUnoptimizable:
+        attached = true;
+        break;
+      case AttachDecision::Deferred:
+        MOZ_ASSERT_UNREACHABLE("Not expected in generic TryAttachIonStub");
+        break;
+    }
+    if (!attached) {
+      ic->state().trackNotAttached();
+    }
+  }
+}
+
 /* static */
 bool IonGetPropertyIC::update(JSContext* cx, HandleScript outerScript,
                               IonGetPropertyIC* ic, HandleValue val,
                               HandleValue idVal, MutableHandleValue res) {
   // Override the return value if we are invalidated (bug 728188).
   IonScript* ionScript = outerScript->ionScript();
   AutoDetectInvalidation adi(cx, res, ionScript);
 
@@ -347,50 +405,26 @@ bool IonSetPropertyIC::update(JSContext*
     if (!attached && !isTemporarilyUnoptimizable) {
       ic->state().trackNotAttached();
     }
   }
 
   return true;
 }
 
-// This helper handles ICState updates/transitions while attaching CacheIR
-// stubs.
-template <typename IRGenerator, typename IC, typename... Args>
-static void TryAttachIonStub(JSContext* cx, IC* ic, IonScript* ionScript,
-                             Args&&... args) {
-  if (ic->state().maybeTransition()) {
-    ic->discardStubs(cx->zone());
-  }
-
-  if (ic->state().canAttachStub()) {
-    RootedScript script(cx, ic->script());
-    bool attached = false;
-    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
-                    std::forward<Args>(args)...);
-    if (gen.tryAttachStub()) {
-      ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
-                            &attached);
-    }
-    if (!attached) {
-      ic->state().trackNotAttached();
-    }
-  }
-}
-
 /* static */
 bool IonGetNameIC::update(JSContext* cx, HandleScript outerScript,
                           IonGetNameIC* ic, HandleObject envChain,
                           MutableHandleValue res) {
   IonScript* ionScript = outerScript->ionScript();
   jsbytecode* pc = ic->pc();
   RootedPropertyName name(cx, ic->script()->getName(pc));
 
-  TryAttachIonStub<GetNameIRGenerator, IonGetNameIC>(cx, ic, ionScript,
-                                                     envChain, name);
+  TryAttachIonStubOld<GetNameIRGenerator, IonGetNameIC>(cx, ic, ionScript,
+                                                        envChain, name);
 
   RootedObject obj(cx);
   RootedObject holder(cx);
   Rooted<PropertyResult> prop(cx);
   if (!LookupName(cx, name, envChain, &obj, &holder, &prop)) {
     return false;
   }
 
@@ -412,45 +446,45 @@ bool IonGetNameIC::update(JSContext* cx,
 
 /* static */
 JSObject* IonBindNameIC::update(JSContext* cx, HandleScript outerScript,
                                 IonBindNameIC* ic, HandleObject envChain) {
   IonScript* ionScript = outerScript->ionScript();
   jsbytecode* pc = ic->pc();
   RootedPropertyName name(cx, ic->script()->getName(pc));
 
-  TryAttachIonStub<BindNameIRGenerator, IonBindNameIC>(cx, ic, ionScript,
-                                                       envChain, name);
+  TryAttachIonStubOld<BindNameIRGenerator, IonBindNameIC>(cx, ic, ionScript,
+                                                          envChain, name);
 
   RootedObject holder(cx);
   if (!LookupNameUnqualified(cx, name, envChain, &holder)) {
     return nullptr;
   }
 
   return holder;
 }
 
 /* static */
 JSObject* IonGetIteratorIC::update(JSContext* cx, HandleScript outerScript,
                                    IonGetIteratorIC* ic, HandleValue value) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<GetIteratorIRGenerator, IonGetIteratorIC>(cx, ic, ionScript,
-                                                             value);
+  TryAttachIonStubOld<GetIteratorIRGenerator, IonGetIteratorIC>(
+      cx, ic, ionScript, value);
 
   return ValueToIterator(cx, value);
 }
 
 /* static */
 bool IonHasOwnIC::update(JSContext* cx, HandleScript outerScript,
                          IonHasOwnIC* ic, HandleValue val, HandleValue idVal,
                          int32_t* res) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<HasPropIRGenerator, IonHasOwnIC>(
+  TryAttachIonStubOld<HasPropIRGenerator, IonHasOwnIC>(
       cx, ic, ionScript, CacheKind::HasOwn, idVal, val);
 
   bool found;
   if (!HasOwnProperty(cx, val, idVal, &found)) {
     return false;
   }
 
   *res = found;
@@ -458,29 +492,29 @@ bool IonHasOwnIC::update(JSContext* cx, 
 }
 
 /* static */
 bool IonInIC::update(JSContext* cx, HandleScript outerScript, IonInIC* ic,
                      HandleValue key, HandleObject obj, bool* res) {
   IonScript* ionScript = outerScript->ionScript();
   RootedValue objV(cx, ObjectValue(*obj));
 
-  TryAttachIonStub<HasPropIRGenerator, IonInIC>(cx, ic, ionScript,
-                                                CacheKind::In, key, objV);
+  TryAttachIonStubOld<HasPropIRGenerator, IonInIC>(cx, ic, ionScript,
+                                                   CacheKind::In, key, objV);
 
   return OperatorIn(cx, key, obj, res);
 }
 /* static */
 bool IonInstanceOfIC::update(JSContext* cx, HandleScript outerScript,
                              IonInstanceOfIC* ic, HandleValue lhs,
                              HandleObject rhs, bool* res) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<InstanceOfIRGenerator, IonInstanceOfIC>(cx, ic, ionScript,
-                                                           lhs, rhs);
+  TryAttachIonStubOld<InstanceOfIRGenerator, IonInstanceOfIC>(cx, ic, ionScript,
+                                                              lhs, rhs);
 
   return HasInstance(cx, rhs, lhs, res);
 }
 
 /*  static */
 bool IonUnaryArithIC::update(JSContext* cx, HandleScript outerScript,
                              IonUnaryArithIC* ic, HandleValue val,
                              MutableHandleValue res) {
@@ -516,18 +550,18 @@ bool IonUnaryArithIC::update(JSContext* 
         return false;
       }
       break;
     }
     default:
       MOZ_CRASH("Unexpected op");
   }
 
-  TryAttachIonStub<UnaryArithIRGenerator, IonUnaryArithIC>(cx, ic, ionScript,
-                                                           op, val, res);
+  TryAttachIonStubOld<UnaryArithIRGenerator, IonUnaryArithIC>(cx, ic, ionScript,
+                                                              op, val, res);
 
   return true;
 }
 
 /* static */
 bool IonBinaryArithIC::update(JSContext* cx, HandleScript outerScript,
                               IonBinaryArithIC* ic, HandleValue lhs,
                               HandleValue rhs, MutableHandleValue ret) {
@@ -586,18 +620,18 @@ bool IonBinaryArithIC::update(JSContext*
         return false;
       }
       break;
     }
     default:
       MOZ_CRASH("Unhandled binary arith op");
   }
 
-  TryAttachIonStub<BinaryArithIRGenerator, IonBinaryArithIC>(cx, ic, ionScript,
-                                                             op, lhs, rhs, ret);
+  TryAttachIonStubOld<BinaryArithIRGenerator, IonBinaryArithIC>(
+      cx, ic, ionScript, op, lhs, rhs, ret);
 
   return true;
 }
 
 /* static */
 bool IonCompareIC::update(JSContext* cx, HandleScript outerScript,
                           IonCompareIC* ic, HandleValue lhs, HandleValue rhs,
                           bool* res) {
@@ -653,18 +687,18 @@ bool IonCompareIC::update(JSContext* cx,
         return false;
       }
       break;
     default:
       MOZ_ASSERT_UNREACHABLE("Unhandled ion compare op");
       return false;
   }
 
-  TryAttachIonStub<CompareIRGenerator, IonCompareIC>(cx, ic, ionScript, op, lhs,
-                                                     rhs);
+  TryAttachIonStubOld<CompareIRGenerator, IonCompareIC>(cx, ic, ionScript, op,
+                                                        lhs, rhs);
 
   return true;
 }
 
 uint8_t* IonICStub::stubDataStart() {
   return reinterpret_cast<uint8_t*>(this) + stubInfo_->stubDataOffset();
 }