--- a/js/src/ion/shared/Assembler-x86-shared.h
+++ b/js/src/ion/shared/Assembler-x86-shared.h
@@ -311,19 +311,16 @@ class AssemblerX86Shared
     }
 
     // The below cmpl methods switch the lhs and rhs when it invokes the
     // macroassembler to conform with intel standard.  When calling this
     // function put the left operand on the left as you would expect.
     void cmpl(const Register &lhs, const Register &rhs) {
         masm.cmpl_rr(rhs.code(), lhs.code());
     }
-    void cmpl(Imm32 imm, const Register &reg) {
-        masm.cmpl_ir(imm.value, reg.code());
-    }
     void cmpl(const Register &lhs, const Operand &rhs) {
         switch (rhs.kind()) {
           case Operand::REG:
             masm.cmpl_rr(rhs.reg(), lhs.code());
             break;
           case Operand::REG_DISP:
             masm.cmpl_mr(rhs.disp(), rhs.base(), lhs.code());
             break;

--- a/js/src/ion/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/ion/shared/CodeGenerator-x86-shared.cpp
@@ -266,17 +266,17 @@ CodeGeneratorX86Shared::visitMulI(LMulI 
     const LAllocation *rhs = ins->getOperand(1);
     MMul *mul = ins->mir();
 
     if (rhs->isConstant()) {
         // Bailout on -0.0
         int32 constant = ToInt32(rhs);
         if (mul->canBeNegativeZero() && constant <= 0) {
             Assembler::Condition bailoutCond = (constant == 0) ? Assembler::LessThan : Assembler::Equal;
-            masm.cmpl(Imm32(0), ToRegister(lhs));
+            masm.cmpl(ToOperand(lhs), Imm32(0));
             if (bailoutIf(bailoutCond, ins->snapshot()))
                     return false;
         }
 
         switch (constant) {
           case -1:
             masm.negl(ToOperand(lhs));
             break;
@@ -308,18 +308,18 @@ CodeGeneratorX86Shared::visitMulI(LMulI 
         masm.imull(ToOperand(rhs), ToRegister(lhs));
 
         // Bailout on overflow
         if (mul->canOverflow() && !bailoutIf(Assembler::Overflow, ins->snapshot()))
             return false;
 
         // Bailout on 0 (could be -0.0)
         if (mul->canBeNegativeZero()) {
-            masm.cmpl(Imm32(0), ToRegister(lhs));
-            if (!bailoutIf(Assembler::Zero, ins->snapshot()))
+            masm.cmpl(ToOperand(lhs), Imm32(0));
+            if (!bailoutIf(Assembler::Equal, ins->snapshot()))
                 return false;
         }
     }
 
     return true;
 }
 
 bool
@@ -433,17 +433,17 @@ CodeGeneratorX86Shared::visitTableSwitch
 
     // Lower value with low value
     if (mir->low() != 0)
         masm.subl(Imm32(mir->low()), ToOperand(index));
 
     // Jump to default case if input is out of range
     LBlock *defaultcase = mir->getDefault()->lir();
     int32 cases = mir->numCases();
-    masm.cmpl(Imm32(cases), ToRegister(index));
+    masm.cmpl(ToOperand(index), Imm32(cases));
     masm.j(AssemblerX86Shared::AboveOrEqual, defaultcase->label());
  
     // Create a label pointing to the jumptable
     // This gets patched after linking
     CodeLabel *label = new CodeLabel();
     if (!masm.addCodeLabel(label))
         return false;
   

--- a/js/src/ion/x64/MacroAssembler-x64.h
+++ b/js/src/ion/x64/MacroAssembler-x64.h
@@ -120,17 +120,17 @@ class MacroAssemblerX64 : public MacroAs
         breakpoint();
         bind(&good);
 #endif
     }
 
     void cmpTag(const ValueOperand &operand, ImmTag tag) {
         movq(operand.value(), ScratchReg);
         shrq(Imm32(JSVAL_TAG_SHIFT), ScratchReg);
-        cmpl(tag, ScratchReg);
+        cmpl(Operand(ScratchReg), tag);
     }
 
     // Type-testing instructions on x64 will clobber ScratchReg.
     Condition testInt32(Condition cond, const ValueOperand &src) {
         JS_ASSERT(cond == Equal || cond == NotEqual);
         cmpTag(src, ImmTag(JSVAL_TAG_INT32));
         return cond;
     }

--- a/js/src/ion/x86/Assembler-x86.h
+++ b/js/src/ion/x86/Assembler-x86.h
@@ -171,19 +171,25 @@ class ValueOperand
     Register type_;
     Register payload_;
 
   public:
     ValueOperand(Register type, Register payload)
       : type_(type), payload_(payload)
     { }
 
+    Operand type() const {
+        return Operand(type_);
+    }
     Register typeReg() const {
         return type_;
     }
+    Operand payload() const {
+        return Operand(payload_);
+    }
     Register payloadReg() const {
         return payload_;
     }
 };
 
 class Assembler : public AssemblerX86Shared
 {
     void writeRelocation(JmpSrc src) {

--- a/js/src/ion/x86/MacroAssembler-x86.h
+++ b/js/src/ion/x86/MacroAssembler-x86.h
@@ -99,40 +99,40 @@ class MacroAssemblerX86 : public MacroAs
         j(Equal, &good);
         breakpoint();
         bind(&good);
 #endif
     }
 
     Condition testInt32(Condition cond, const ValueOperand &value) {
         JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
-        cmpl(ImmType(JSVAL_TYPE_INT32), value.typeReg());
+        cmpl(value.type(), ImmType(JSVAL_TYPE_INT32));
         return cond;
     }
     Condition testBoolean(Condition cond, const ValueOperand &value) {
         JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
-        cmpl(ImmType(JSVAL_TYPE_BOOLEAN), value.typeReg());
+        cmpl(value.type(), ImmType(JSVAL_TYPE_BOOLEAN));
         return cond;
     }
     Condition testDouble(Condition cond, const ValueOperand &value) {
         JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
         Condition actual = (cond == Assembler::Equal)
                            ? Assembler::Below
                            : Assembler::AboveOrEqual;
-        cmpl(ImmTag(JSVAL_TAG_CLEAR), value.typeReg());
+        cmpl(value.type(), ImmTag(JSVAL_TAG_CLEAR));
         return actual;
     }
     Condition testNull(Condition cond, const ValueOperand &value) {
         JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
-        cmpl(ImmType(JSVAL_TYPE_NULL), value.typeReg());
+        cmpl(value.type(), ImmType(JSVAL_TYPE_NULL));
         return cond;
     }
     Condition testUndefined(Condition cond, const ValueOperand &value) {
         JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
-        cmpl(ImmType(JSVAL_TYPE_UNDEFINED), value.typeReg());
+        cmpl(value.type(), ImmType(JSVAL_TYPE_UNDEFINED));
         return cond;
     }
 
     void unboxInt32(const ValueOperand &operand, const Register &dest) {
         movl(operand.payloadReg(), dest);
     }
     void unboxBoolean(const ValueOperand &operand, const Register &dest) {
         movl(operand.payloadReg(), dest);