Bug 937540 part 9 - Use placement new for LIR instructions, OOL code. r=luke
authorJan de Mooij <jdemooij@mozilla.com>
Thu, 05 Dec 2013 22:04:27 +0100
changeset 159073 280cf89fa30ea416a0588d105e81c8ef408ba66c
parent 159072 837a6f6f4c2f2a4fcb9152ce8ae941b8eee2bef5
child 159074 53f77d87a3ab7b98688702be79e27aeda1069ef1
push id25771
push usercbook@mozilla.com
push dateFri, 06 Dec 2013 12:30:11 +0000
treeherdermozilla-central@9a92e42151dc [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs937540
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 937540 part 9 - Use placement new for LIR instructions, OOL code. r=luke
js/src/jit/BaselineCompiler.cpp
js/src/jit/BaselineFrameInfo.cpp
js/src/jit/BaselineFrameInfo.h
js/src/jit/CodeGenerator.cpp
js/src/jit/FixedList.h
js/src/jit/IonBuilder.cpp
js/src/jit/LIR-Common.h
js/src/jit/LIR.cpp
js/src/jit/LIR.h
js/src/jit/Lowering.cpp
js/src/jit/MIR.cpp
js/src/jit/MIR.h
js/src/jit/MIRGraph.cpp
js/src/jit/RegisterAllocator.cpp
js/src/jit/StupidAllocator.cpp
js/src/jit/arm/CodeGenerator-arm.cpp
js/src/jit/arm/Lowering-arm.cpp
js/src/jit/shared/CodeGenerator-shared.cpp
js/src/jit/shared/CodeGenerator-shared.h
js/src/jit/shared/CodeGenerator-x86-shared.cpp
js/src/jit/shared/Lowering-shared-inl.h
js/src/jit/shared/Lowering-shared.cpp
js/src/jit/shared/Lowering-x86-shared.cpp
js/src/jit/x64/Lowering-x64.cpp
js/src/jit/x86/CodeGenerator-x86.cpp
js/src/jit/x86/Lowering-x86.cpp
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -31,23 +31,23 @@ BaselineCompiler::BaselineCompiler(JSCon
 }
 
 bool
 BaselineCompiler::init()
 {
     if (!analysis_.init(alloc_, cx->runtime()->gsnCache))
         return false;
 
-    if (!labels_.init(script->length()))
+    if (!labels_.init(alloc_, script->length()))
         return false;
 
     for (size_t i = 0; i < script->length(); i++)
         new (&labels_[i]) Label();
 
-    if (!frame.init())
+    if (!frame.init(alloc_))
         return false;
 
     return true;
 }
 
 bool
 BaselineCompiler::addPCMappingEntry(bool addIndexEntry)
 {
--- a/js/src/jit/BaselineFrameInfo.cpp
+++ b/js/src/jit/BaselineFrameInfo.cpp
@@ -9,20 +9,21 @@
 #ifdef DEBUG
 # include "jit/BytecodeAnalysis.h"
 #endif
 
 using namespace js;
 using namespace js::jit;
 
 bool
-FrameInfo::init() {
+FrameInfo::init(TempAllocator &alloc)
+{
     // One slot is always needed for this/arguments type checks.
     size_t nstack = Max(script->nslots - script->nfixed, 1);
-    if (!stack.init(nstack))
+    if (!stack.init(alloc, nstack))
         return false;
 
     return true;
 }
 
 void
 FrameInfo::sync(StackValue *val)
 {
--- a/js/src/jit/BaselineFrameInfo.h
+++ b/js/src/jit/BaselineFrameInfo.h
@@ -171,17 +171,17 @@ class FrameInfo
   public:
     FrameInfo(JSContext *cx, HandleScript script, MacroAssembler &masm)
       : script(cx, script),
         masm(masm),
         stack(),
         spIndex(0)
     { }
 
-    bool init();
+    bool init(TempAllocator &alloc);
 
     uint32_t nlocals() const {
         return script->nfixed;
     }
     uint32_t nargs() const {
         return script->function()->nargs;
     }
 
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -105,17 +105,17 @@ CodeGeneratorShared::addCache(LInstructi
     DataPtr<IonCache> cache(this, cacheIndex);
     MInstruction *mir = lir->mirRaw()->toInstruction();
     if (mir->resumePoint())
         cache->setScriptedLocation(mir->block()->info().script(),
                                    mir->resumePoint()->pc());
     else
         cache->setIdempotent();
 
-    OutOfLineUpdateCache *ool = new OutOfLineUpdateCache(lir, cacheIndex);
+    OutOfLineUpdateCache *ool = new(alloc()) OutOfLineUpdateCache(lir, cacheIndex);
     if (!addOutOfLineCode(ool))
         return false;
 
     // OOL-specific state depends on the type of cache.
     cache->initializeAddCacheState(lir, &ool->state());
 
     cache->emitInitialJump(masm, ool->state());
     masm.bind(ool->rejoin());
@@ -589,17 +589,17 @@ CodeGenerator::getJumpLabelForBranch(MBa
 }
 
 bool
 CodeGenerator::visitTestOAndBranch(LTestOAndBranch *lir)
 {
     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
                "Objects which can't emulate undefined should have been constant-folded");
 
-    OutOfLineTestObject *ool = new OutOfLineTestObject();
+    OutOfLineTestObject *ool = new(alloc()) OutOfLineTestObject();
     if (!addOutOfLineCode(ool))
         return false;
 
     Label *truthy = getJumpLabelForBranch(lir->ifTruthy());
     Label *falsy = getJumpLabelForBranch(lir->ifFalsy());
 
     testObjectEmulatesUndefined(ToRegister(lir->input()), falsy, truthy,
                                 ToRegister(lir->temp()), ool);
@@ -607,17 +607,17 @@ CodeGenerator::visitTestOAndBranch(LTest
 
 }
 
 bool
 CodeGenerator::visitTestVAndBranch(LTestVAndBranch *lir)
 {
     OutOfLineTestObject *ool = nullptr;
     if (lir->mir()->operandMightEmulateUndefined()) {
-        ool = new OutOfLineTestObject();
+        ool = new(alloc()) OutOfLineTestObject();
         if (!addOutOfLineCode(ool))
             return false;
     }
 
     Label *truthy = getJumpLabelForBranch(lir->ifTruthy());
     Label *falsy = getJumpLabelForBranch(lir->ifFalsy());
 
     testValueTruthy(ToValue(lir, LTestVAndBranch::Input),
@@ -956,17 +956,17 @@ CodeGenerator::visitOutOfLineInterruptCh
     masm.jump(ool->rejoin());
 
     return true;
 }
 
 bool
 CodeGenerator::visitInterruptCheckImplicit(LInterruptCheckImplicit *lir)
 {
-    OutOfLineInterruptCheckImplicit *ool = new OutOfLineInterruptCheckImplicit(current, lir);
+    OutOfLineInterruptCheckImplicit *ool = new(alloc()) OutOfLineInterruptCheckImplicit(current, lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     lir->setOolEntry(ool->entry());
     masm.bind(ool->rejoin());
     return true;
 }
 
@@ -1573,17 +1573,17 @@ CodeGenerator::visitOutOfLineCallPostWri
     return true;
 }
 #endif
 
 bool
 CodeGenerator::visitPostWriteBarrierO(LPostWriteBarrierO *lir)
 {
 #ifdef JSGC_GENERATIONAL
-    OutOfLineCallPostWriteBarrier *ool = new OutOfLineCallPostWriteBarrier(lir, lir->object());
+    OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
     if (!addOutOfLineCode(ool))
         return false;
 
     const Nursery &nursery = GetIonContext()->runtime->gcNursery();
 
     if (lir->object()->isConstant()) {
         JS_ASSERT(!nursery.isInside(&lir->object()->toConstant()->toObject()));
     } else {
@@ -1602,17 +1602,17 @@ CodeGenerator::visitPostWriteBarrierO(LP
 #endif
     return true;
 }
 
 bool
 CodeGenerator::visitPostWriteBarrierV(LPostWriteBarrierV *lir)
 {
 #ifdef JSGC_GENERATIONAL
-    OutOfLineCallPostWriteBarrier *ool = new OutOfLineCallPostWriteBarrier(lir, lir->object());
+    OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
     if (!addOutOfLineCode(ool))
         return false;
 
     ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
     masm.branchTestObject(Assembler::NotEqual, value, ool->rejoin());
 
     const Nursery &nursery = GetIonContext()->runtime->gcNursery();
 
@@ -1634,17 +1634,17 @@ CodeGenerator::visitPostWriteBarrierV(LP
 #endif
     return true;
 }
 
 bool
 CodeGenerator::visitPostWriteBarrierAllSlots(LPostWriteBarrierAllSlots *lir)
 {
 #ifdef JSGC_GENERATIONAL
-    OutOfLineCallPostWriteBarrier *ool = new OutOfLineCallPostWriteBarrier(lir, lir->object());
+    OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
     if (!addOutOfLineCode(ool))
         return false;
 
     const Nursery &nursery = GetIonContext()->runtime->gcNursery();
 
     if (lir->object()->isConstant()) {
         JS_ASSERT(!nursery.isInside(&lir->object()->toConstant()->toObject()));
         return true;
@@ -2496,17 +2496,17 @@ CodeGenerator::visitCheckOverRecursed(LC
     // It must always be possible to trespass past the stack limit.
     // Ion may legally place frames very close to the limit. Calling additional
     // C functions may then violate the limit without any checking.
 
     // Since Ion frames exist on the C stack, the stack limit may be
     // dynamically set by JS_SetThreadStackLimit() and JS_SetNativeStackQuota().
     const void *limitAddr = GetIonContext()->runtime->addressOfIonStackLimit();
 
-    CheckOverRecursedFailure *ool = new CheckOverRecursedFailure(lir);
+    CheckOverRecursedFailure *ool = new(alloc()) CheckOverRecursedFailure(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     // Conditional forward (unlikely) branch to failure.
     masm.branchPtr(Assembler::AboveOrEqual, AbsoluteAddress(limitAddr), StackPointer, ool->entry());
     masm.bind(ool->rejoin());
 
     return true;
@@ -2600,17 +2600,17 @@ CodeGenerator::visitCheckOverRecursedPar
 
     Register sliceReg = ToRegister(lir->forkJoinSlice());
     Register tempReg = ToRegister(lir->getTempReg());
 
     masm.loadPtr(Address(sliceReg, offsetof(ForkJoinSlice, perThreadData)), tempReg);
     masm.loadPtr(Address(tempReg, offsetof(PerThreadData, ionStackLimit)), tempReg);
 
     // Conditional forward (unlikely) branch to failure.
-    CheckOverRecursedFailurePar *ool = new CheckOverRecursedFailurePar(lir);
+    CheckOverRecursedFailurePar *ool = new(alloc()) CheckOverRecursedFailurePar(lir);
     if (!addOutOfLineCode(ool))
         return false;
     masm.branchPtr(Assembler::BelowOrEqual, StackPointer, tempReg, ool->entry());
     masm.checkInterruptFlagsPar(tempReg, ool->entry());
     masm.bind(ool->rejoin());
 
     return true;
 }
@@ -2657,17 +2657,17 @@ class OutOfLineCheckInterruptPar : publi
         return codegen->visitOutOfLineCheckInterruptPar(this);
     }
 };
 
 bool
 CodeGenerator::visitCheckInterruptPar(LCheckInterruptPar *lir)
 {
     // First check for slice->shared->interrupt_.
-    OutOfLineCheckInterruptPar *ool = new OutOfLineCheckInterruptPar(lir);
+    OutOfLineCheckInterruptPar *ool = new(alloc()) OutOfLineCheckInterruptPar(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     // We must check two flags:
     // - runtime->interrupt
     // - runtime->parallelAbort
     // See vm/ForkJoin.h for discussion on why we use this design.
 
@@ -3061,17 +3061,17 @@ bool CodeGenerator::visitHypot(LHypot *l
 }
 
 bool
 CodeGenerator::visitNewParallelArray(LNewParallelArray *lir)
 {
     Register objReg = ToRegister(lir->output());
     JSObject *templateObject = lir->mir()->templateObject();
 
-    OutOfLineNewParallelArray *ool = new OutOfLineNewParallelArray(lir);
+    OutOfLineNewParallelArray *ool = new(alloc()) OutOfLineNewParallelArray(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.newGCThing(objReg, templateObject, ool->entry(), gc::DefaultHeap);
     masm.initGCThing(objReg, templateObject);
 
     masm.bind(ool->rejoin());
     return true;
@@ -3094,17 +3094,17 @@ CodeGenerator::visitNewArray(LNewArray *
     JSObject *templateObject = lir->mir()->templateObject();
     DebugOnly<uint32_t> count = lir->mir()->count();
 
     JS_ASSERT(count < JSObject::NELEMENTS_LIMIT);
 
     if (lir->mir()->shouldUseVM())
         return visitNewArrayCallVM(lir);
 
-    OutOfLineNewArray *ool = new OutOfLineNewArray(lir);
+    OutOfLineNewArray *ool = new(alloc()) OutOfLineNewArray(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.newGCThing(objReg, templateObject, ool->entry(), lir->mir()->initialHeap());
     masm.initGCThing(objReg, templateObject);
 
     masm.bind(ool->rejoin());
     return true;
@@ -3180,17 +3180,17 @@ CodeGenerator::visitNewObject(LNewObject
 {
     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
     Register objReg = ToRegister(lir->output());
     JSObject *templateObject = lir->mir()->templateObject();
 
     if (lir->mir()->shouldUseVM())
         return visitNewObjectVMCall(lir);
 
-    OutOfLineNewObject *ool = new OutOfLineNewObject(lir);
+    OutOfLineNewObject *ool = new(alloc()) OutOfLineNewObject(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.newGCThing(objReg, templateObject, ool->entry(), lir->mir()->initialHeap());
     masm.initGCThing(objReg, templateObject);
 
     masm.bind(ool->rejoin());
     return true;
@@ -3398,17 +3398,17 @@ public:
 };
 
 bool
 CodeGenerator::emitAllocateGCThingPar(LInstruction *lir, const Register &objReg,
                                       const Register &sliceReg, const Register &tempReg1,
                                       const Register &tempReg2, JSObject *templateObj)
 {
     gc::AllocKind allocKind = templateObj->tenuredGetAllocKind();
-    OutOfLineNewGCThingPar *ool = new OutOfLineNewGCThingPar(lir, allocKind, objReg, sliceReg);
+    OutOfLineNewGCThingPar *ool = new(alloc()) OutOfLineNewGCThingPar(lir, allocKind, objReg, sliceReg);
     if (!ool || !addOutOfLineCode(ool))
         return false;
 
     masm.newGCThingPar(objReg, sliceReg, tempReg1, tempReg2, templateObj, ool->entry());
     masm.bind(ool->rejoin());
     masm.initGCThing(objReg, templateObj);
     return true;
 }
@@ -4201,17 +4201,17 @@ CodeGenerator::visitIsNullOrLikeUndefine
                    lir->mir()->operandMightEmulateUndefined(),
                    "Operands which can't emulate undefined should have been folded");
 
         OutOfLineTestObjectWithLabels *ool = nullptr;
         Maybe<Label> label1, label2;
         Label *nullOrLikeUndefined;
         Label *notNullOrLikeUndefined;
         if (lir->mir()->operandMightEmulateUndefined()) {
-            ool = new OutOfLineTestObjectWithLabels();
+            ool = new(alloc()) OutOfLineTestObjectWithLabels();
             if (!addOutOfLineCode(ool))
                 return false;
             nullOrLikeUndefined = ool->label1();
             notNullOrLikeUndefined = ool->label2();
         } else {
             label1.construct();
             label2.construct();
             nullOrLikeUndefined = label1.addr();
@@ -4286,17 +4286,17 @@ CodeGenerator::visitIsNullOrLikeUndefine
         }
 
         MOZ_ASSERT(lir->mir()->lhs()->type() != MIRType_Object ||
                    lir->mir()->operandMightEmulateUndefined(),
                    "Operands which can't emulate undefined should have been folded");
 
         OutOfLineTestObject *ool = nullptr;
         if (lir->mir()->operandMightEmulateUndefined()) {
-            ool = new OutOfLineTestObject();
+            ool = new(alloc()) OutOfLineTestObject();
             if (!addOutOfLineCode(ool))
                 return false;
         }
 
         Register tag = masm.splitTagForTest(value);
 
         Label *ifTrueLabel = getJumpLabelForBranch(ifTrue);
         Label *ifFalseLabel = getJumpLabelForBranch(ifFalse);
@@ -4336,17 +4336,17 @@ CodeGenerator::visitEmulatesUndefined(LE
                lir->mir()->compareType() == MCompare::Compare_Null);
     MOZ_ASSERT(lir->mir()->lhs()->type() == MIRType_Object);
     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
                "If the object couldn't emulate undefined, this should have been folded.");
 
     JSOp op = lir->mir()->jsop();
     MOZ_ASSERT(op == JSOP_EQ || op == JSOP_NE, "Strict equality should have been folded");
 
-    OutOfLineTestObjectWithLabels *ool = new OutOfLineTestObjectWithLabels();
+    OutOfLineTestObjectWithLabels *ool = new(alloc()) OutOfLineTestObjectWithLabels();
     if (!addOutOfLineCode(ool))
         return false;
 
     Label *emulatesUndefined = ool->label1();
     Label *doesntEmulateUndefined = ool->label2();
 
     Register objreg = ToRegister(lir->input());
     Register output = ToRegister(lir->output());
@@ -4370,17 +4370,17 @@ CodeGenerator::visitEmulatesUndefinedAnd
     MOZ_ASSERT(lir->mir()->compareType() == MCompare::Compare_Undefined ||
                lir->mir()->compareType() == MCompare::Compare_Null);
     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
                "Operands which can't emulate undefined should have been folded");
 
     JSOp op = lir->mir()->jsop();
     MOZ_ASSERT(op == JSOP_EQ || op == JSOP_NE, "Strict equality should have been folded");
 
-    OutOfLineTestObject *ool = new OutOfLineTestObject();
+    OutOfLineTestObject *ool = new(alloc()) OutOfLineTestObject();
     if (!addOutOfLineCode(ool))
         return false;
 
     Label *equal;
     Label *unequal;
 
     {
         MBasicBlock *ifTrue;
@@ -4733,17 +4733,17 @@ CodeGenerator::visitSetInitializedLength
 }
 
 bool
 CodeGenerator::visitNotO(LNotO *lir)
 {
     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
                "This should be constant-folded if the object can't emulate undefined.");
 
-    OutOfLineTestObjectWithLabels *ool = new OutOfLineTestObjectWithLabels();
+    OutOfLineTestObjectWithLabels *ool = new(alloc()) OutOfLineTestObjectWithLabels();
     if (!addOutOfLineCode(ool))
         return false;
 
     Label *ifEmulatesUndefined = ool->label1();
     Label *ifDoesntEmulateUndefined = ool->label2();
 
     Register objreg = ToRegister(lir->input());
     Register output = ToRegister(lir->output());
@@ -4767,17 +4767,17 @@ bool
 CodeGenerator::visitNotV(LNotV *lir)
 {
     Maybe<Label> ifTruthyLabel, ifFalsyLabel;
     Label *ifTruthy;
     Label *ifFalsy;
 
     OutOfLineTestObjectWithLabels *ool = nullptr;
     if (lir->mir()->operandMightEmulateUndefined()) {
-        ool = new OutOfLineTestObjectWithLabels();
+        ool = new(alloc()) OutOfLineTestObjectWithLabels();
         if (!addOutOfLineCode(ool))
             return false;
         ifTruthy = ool->label1();
         ifFalsy = ool->label2();
     } else {
         ifTruthyLabel.construct();
         ifFalsyLabel.construct();
         ifTruthy = ifTruthyLabel.addr();
@@ -4960,17 +4960,17 @@ CodeGenerator::visitStoreElementV(LStore
     else
         masm.storeValue(value, BaseIndex(elements, ToRegister(lir->index()), TimesEight));
     return true;
 }
 
 bool
 CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT *lir)
 {
-    OutOfLineStoreElementHole *ool = new OutOfLineStoreElementHole(lir);
+    OutOfLineStoreElementHole *ool = new(alloc()) OutOfLineStoreElementHole(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     Register elements = ToRegister(lir->elements());
     const LAllocation *index = lir->index();
 
     // OOL path if index >= initializedLength.
     Address initLength(elements, ObjectElements::offsetOfInitializedLength());
@@ -4985,17 +4985,17 @@ CodeGenerator::visitStoreElementHoleT(LS
 
     masm.bind(ool->rejoin());
     return true;
 }
 
 bool
 CodeGenerator::visitStoreElementHoleV(LStoreElementHoleV *lir)
 {
-    OutOfLineStoreElementHole *ool = new OutOfLineStoreElementHole(lir);
+    OutOfLineStoreElementHole *ool = new(alloc()) OutOfLineStoreElementHole(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     Register elements = ToRegister(lir->elements());
     const LAllocation *index = lir->index();
     const ValueOperand value = ToValue(lir, LStoreElementHoleV::Value);
 
     // OOL path if index >= initializedLength.
@@ -5972,17 +5972,17 @@ class OutOfLineUnboxFloatingPoint : publ
 bool
 CodeGenerator::visitUnboxFloatingPoint(LUnboxFloatingPoint *lir)
 {
     const ValueOperand box = ToValue(lir, LUnboxFloatingPoint::Input);
     const LDefinition *result = lir->output();
 
     // Out-of-line path to convert int32 to double or bailout
     // if this instruction is fallible.
-    OutOfLineUnboxFloatingPoint *ool = new OutOfLineUnboxFloatingPoint(lir);
+    OutOfLineUnboxFloatingPoint *ool = new(alloc()) OutOfLineUnboxFloatingPoint(lir);
     if (!addOutOfLineCode(ool))
         return false;
 
     FloatRegister resultReg = ToFloatRegister(result);
     masm.branchTestDouble(Assembler::NotEqual, box, ool->entry());
     masm.unboxDouble(box, resultReg);
     if (lir->type() == MIRType_Float32)
         masm.convertDoubleToFloat(resultReg, resultReg);
@@ -6736,17 +6736,17 @@ CodeGenerator::visitTypeOfV(LTypeOfV *li
 
     const JSAtomState &names = GetIonContext()->runtime->names();
     Label done;
 
     OutOfLineTypeOfV *ool = nullptr;
     if (lir->mir()->inputMaybeCallableOrEmulatesUndefined()) {
         // The input may be a callable object (result is "function") or may
         // emulate undefined (result is "undefined"). Use an OOL path.
-        ool = new OutOfLineTypeOfV(lir);
+        ool = new(alloc()) OutOfLineTypeOfV(lir);
         if (!addOutOfLineCode(ool))
             return false;
 
         masm.branchTestObject(Assembler::Equal, tag, ool->entry());
     } else {
         // Input is not callable and does not emulate undefined, so if
         // it's an object the result is always "object".
         Label notObject;
--- a/js/src/jit/FixedList.h
+++ b/js/src/jit/FixedList.h
@@ -27,36 +27,36 @@ class FixedList
     void operator= (const FixedList*); // no assignment definition.
 
   public:
     FixedList()
       : length_(0)
     { }
 
     // Dynamic memory allocation requires the ability to report failure.
-    bool init(size_t length) {
+    bool init(TempAllocator &alloc, size_t length) {
         length_ = length;
         if (length == 0)
             return true;
 
-        list_ = (T *)GetIonContext()->temp->allocate(length * sizeof(T));
+        list_ = (T *)alloc.allocate(length * sizeof(T));
         return list_ != nullptr;
     }
 
     size_t length() const {
         return length_;
     }
 
     void shrink(size_t num) {
         JS_ASSERT(num < length_);
         length_ -= num;
     }
 
-    bool growBy(size_t num) {
-        T *list = (T *)GetIonContext()->temp->allocate((length_ + num) * sizeof(T));
+    bool growBy(TempAllocator &alloc, size_t num) {
+        T *list = (T *)alloc.allocate((length_ + num) * sizeof(T));
         if (!list)
             return false;
 
         for (size_t i = 0; i < length_; i++)
             list[i] = list_[i];
 
         length_ += num;
         list_ = list;
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3051,17 +3051,17 @@ IonBuilder::jsop_condswitch()
     // The current case now be the default case which jump to the body of the
     // default case, which might be behind the last target.
     JS_ASSERT(JSOp(*curCase) == JSOP_DEFAULT);
     jsbytecode *defaultTarget = GetJumpOffset(curCase) + curCase;
     JS_ASSERT(curCase < defaultTarget && defaultTarget <= exitpc);
 
     // Allocate the current graph state.
     CFGState state = CFGState::CondSwitch(this, exitpc, defaultTarget);
-    if (!state.condswitch.bodies || !state.condswitch.bodies->init(nbBodies))
+    if (!state.condswitch.bodies || !state.condswitch.bodies->init(alloc(), nbBodies))
         return ControlStatus_Error;
 
     // We loop on case conditions with processCondSwitchCase.
     JS_ASSERT(JSOp(*firstCase) == JSOP_CASE);
     state.stopAt = firstCase;
     state.state = CFGState::COND_SWITCH_CASE;
 
     return cfgStack_.append(state);
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -91,23 +91,27 @@ class LMove
         return to_;
     }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
 {
     js::Vector<LMove, 2, IonAllocPolicy> moves_;
 
-  public:
-    LIR_HEADER(MoveGroup)
-
     LMoveGroup(TempAllocator &alloc)
       : moves_(alloc)
     { }
 
+  public:
+    LIR_HEADER(MoveGroup)
+
+    static LMoveGroup *New(TempAllocator &alloc) {
+        return new(alloc) LMoveGroup(alloc);
+    }
+
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
     bool add(LAllocation *from, LAllocation *to);
 
     // Add a move which takes place after existing moves in the group.
     bool addAfter(LAllocation *from, LAllocation *to);
 
@@ -455,27 +459,29 @@ class LNewCallObjectPar : public LInstru
         setOperand(1, slots);
         setTemp(0, temp1);
         setTemp(1, temp2);
     }
 
 public:
     LIR_HEADER(NewCallObjectPar);
 
-    static LNewCallObjectPar *NewWithSlots(const LAllocation &slice, const LAllocation &slots,
+    static LNewCallObjectPar *NewWithSlots(TempAllocator &alloc,
+                                           const LAllocation &slice, const LAllocation &slots,
                                            const LDefinition &temp1, const LDefinition &temp2)
     {
-        return new LNewCallObjectPar(slice, slots, temp1, temp2);
-    }
-
-    static LNewCallObjectPar *NewSansSlots(const LAllocation &slice,
+        return new(alloc) LNewCallObjectPar(slice, slots, temp1, temp2);
+    }
+
+    static LNewCallObjectPar *NewSansSlots(TempAllocator &alloc,
+                                           const LAllocation &slice,
                                            const LDefinition &temp1, const LDefinition &temp2)
     {
         LAllocation slots = LConstantIndex::Bogus();
-        return new LNewCallObjectPar(slice, slots, temp1, temp2);
+        return new(alloc) LNewCallObjectPar(slice, slots, temp1, temp2);
     }
 
     const LAllocation *forkJoinSlice() {
         return getOperand(0);
     }
 
     const LAllocation *slots() {
         return getOperand(1);
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -78,30 +78,30 @@ LBlock::lastId()
     return last->id();
 }
 
 LMoveGroup *
 LBlock::getEntryMoveGroup(TempAllocator &alloc)
 {
     if (entryMoveGroup_)
         return entryMoveGroup_;
-    entryMoveGroup_ = new LMoveGroup(alloc);
+    entryMoveGroup_ = LMoveGroup::New(alloc);
     if (begin()->isLabel())
         insertAfter(*begin(), entryMoveGroup_);
     else
         insertBefore(*begin(), entryMoveGroup_);
     return entryMoveGroup_;
 }
 
 LMoveGroup *
 LBlock::getExitMoveGroup(TempAllocator &alloc)
 {
     if (exitMoveGroup_)
         return exitMoveGroup_;
-    exitMoveGroup_ = new LMoveGroup(alloc);
+    exitMoveGroup_ = LMoveGroup::New(alloc);
     insertBefore(*rbegin(), exitMoveGroup_);
     return exitMoveGroup_;
 }
 
 static size_t
 TotalOperandCount(MResumePoint *mir)
 {
     size_t accum = mir->numOperands();
@@ -160,17 +160,17 @@ LPhi::init(MIRGenerator *gen)
 LPhi::LPhi(MPhi *mir)
   : numInputs_(mir->numOperands())
 {
 }
 
 LPhi *
 LPhi::New(MIRGenerator *gen, MPhi *ins)
 {
-    LPhi *phi = new LPhi(ins);
+    LPhi *phi = new(gen->alloc()) LPhi(ins);
     if (!phi->init(gen))
         return nullptr;
     return phi;
 }
 
 void
 LInstruction::printName(FILE *fp, Opcode op)
 {
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -564,17 +564,17 @@ class LDefinition
     LIR_OPCODE_LIST(LIROP)
 #undef LIROP
 
 class LSnapshot;
 class LSafepoint;
 class LInstructionVisitor;
 
 class LInstruction
-  : public OldTempObject,
+  : public TempObject,
     public InlineListNode<LInstruction>
 {
     uint32_t id_;
 
     // This snapshot could be set after a ResumePoint.  It is used to restart
     // from the resume point pc.
     LSnapshot *snapshot_;
 
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -30,17 +30,17 @@ bool
 LIRGenerator::visitParameter(MParameter *param)
 {
     ptrdiff_t offset;
     if (param->index() == MParameter::THIS_SLOT)
         offset = THIS_FRAME_SLOT;
     else
         offset = 1 + param->index();
 
-    LParameter *ins = new LParameter;
+    LParameter *ins = new(alloc()) LParameter;
     if (!defineBox(ins, param, LDefinition::PRESET))
         return false;
 
     offset *= sizeof(Value);
 #if defined(JS_NUNBOX32)
 # if defined(IS_BIG_ENDIAN)
     ins->getDef(0)->setOutput(LArgument(LAllocation::INT_ARGUMENT, offset));
     ins->getDef(1)->setOutput(LArgument(LAllocation::INT_ARGUMENT, offset + 4));
@@ -53,48 +53,48 @@ LIRGenerator::visitParameter(MParameter 
 #endif
 
     return true;
 }
 
 bool
 LIRGenerator::visitCallee(MCallee *ins)
 {
-    return define(new LCallee(), ins);
+    return define(new(alloc()) LCallee(), ins);
 }
 
 bool
 LIRGenerator::visitGoto(MGoto *ins)
 {
-    return add(new LGoto(ins->target()));
+    return add(new(alloc()) LGoto(ins->target()));
 }
 
 bool
 LIRGenerator::visitTableSwitch(MTableSwitch *tableswitch)
 {
     MDefinition *opd = tableswitch->getOperand(0);
 
     // There should be at least 1 successor. The default case!
     JS_ASSERT(tableswitch->numSuccessors() > 0);
 
     // If there are no cases, the default case is always taken.
     if (tableswitch->numSuccessors() == 1)
-        return add(new LGoto(tableswitch->getDefault()));
+        return add(new(alloc()) LGoto(tableswitch->getDefault()));
 
     // If we don't know the type.
     if (opd->type() == MIRType_Value) {
         LTableSwitchV *lir = newLTableSwitchV(tableswitch);
         if (!useBox(lir, LTableSwitchV::InputValue, opd))
             return false;
         return add(lir);
     }
 
     // Case indices are numeric, so other types will always go to the default case.
     if (opd->type() != MIRType_Int32 && opd->type() != MIRType_Double)
-        return add(new LGoto(tableswitch->getDefault()));
+        return add(new(alloc()) LGoto(tableswitch->getDefault()));
 
     // Return an LTableSwitch, capable of handling either an integer or
     // floating-point index.
     LAllocation index;
     LDefinition tempInt;
     if (opd->type() == MIRType_Int32) {
         index = useRegisterAtStart(opd);
         tempInt = tempCopy(opd, 0);
@@ -103,197 +103,199 @@ LIRGenerator::visitTableSwitch(MTableSwi
         tempInt = temp(LDefinition::GENERAL);
     }
     return add(newLTableSwitch(index, tempInt, tableswitch));
 }
 
 bool
 LIRGenerator::visitCheckOverRecursed(MCheckOverRecursed *ins)
 {
-    LCheckOverRecursed *lir = new LCheckOverRecursed();
+    LCheckOverRecursed *lir = new(alloc()) LCheckOverRecursed();
 
     if (!add(lir))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
 
     return true;
 }
 
 bool
 LIRGenerator::visitCheckOverRecursedPar(MCheckOverRecursedPar *ins)
 {
     LCheckOverRecursedPar *lir =
-        new LCheckOverRecursedPar(useRegister(ins->forkJoinSlice()), temp());
+        new(alloc()) LCheckOverRecursedPar(useRegister(ins->forkJoinSlice()), temp());
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 
 bool
 LIRGenerator::visitDefVar(MDefVar *ins)
 {
-    LDefVar *lir = new LDefVar(useRegisterAtStart(ins->scopeChain()));
+    LDefVar *lir = new(alloc()) LDefVar(useRegisterAtStart(ins->scopeChain()));
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
 
     return true;
 }
 
 bool
 LIRGenerator::visitDefFun(MDefFun *ins)
 {
-    LDefFun *lir = new LDefFun(useRegisterAtStart(ins->scopeChain()));
+    LDefFun *lir = new(alloc()) LDefFun(useRegisterAtStart(ins->scopeChain()));
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewSlots(MNewSlots *ins)
 {
     // No safepoint needed, since we don't pass a cx.
-    LNewSlots *lir = new LNewSlots(tempFixed(CallTempReg0), tempFixed(CallTempReg1),
-                                   tempFixed(CallTempReg2));
+    LNewSlots *lir = new(alloc()) LNewSlots(tempFixed(CallTempReg0), tempFixed(CallTempReg1),
+                                            tempFixed(CallTempReg2));
     if (!assignSnapshot(lir))
         return false;
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewParallelArray(MNewParallelArray *ins)
 {
-    LNewParallelArray *lir = new LNewParallelArray();
+    LNewParallelArray *lir = new(alloc()) LNewParallelArray();
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewArray(MNewArray *ins)
 {
-    LNewArray *lir = new LNewArray();
+    LNewArray *lir = new(alloc()) LNewArray();
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewObject(MNewObject *ins)
 {
-    LNewObject *lir = new LNewObject();
+    LNewObject *lir = new(alloc()) LNewObject();
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewDeclEnvObject(MNewDeclEnvObject *ins)
 {
-    LNewDeclEnvObject *lir = new LNewDeclEnvObject();
+    LNewDeclEnvObject *lir = new(alloc()) LNewDeclEnvObject();
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewCallObject(MNewCallObject *ins)
 {
     LAllocation slots;
     if (ins->slots()->type() == MIRType_Slots)
         slots = useRegister(ins->slots());
     else
         slots = LConstantIndex::Bogus();
 
-    LNewCallObject *lir = new LNewCallObject(slots);
+    LNewCallObject *lir = new(alloc()) LNewCallObject(slots);
     if (!define(lir, ins))
         return false;
 
     if (!assignSafepoint(lir, ins))
         return false;
 
     return true;
 }
 
 bool
 LIRGenerator::visitNewDerivedTypedObject(MNewDerivedTypedObject *ins)
 {
     LNewDerivedTypedObject *lir =
-        new LNewDerivedTypedObject(useRegisterAtStart(ins->type()),
-                                   useRegisterAtStart(ins->owner()),
-                                   useRegisterAtStart(ins->offset()));
+        new(alloc()) LNewDerivedTypedObject(useRegisterAtStart(ins->type()),
+                                            useRegisterAtStart(ins->owner()),
+                                            useRegisterAtStart(ins->offset()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewCallObjectPar(MNewCallObjectPar *ins)
 {
     const LAllocation &parThreadContext = useRegister(ins->forkJoinSlice());
     const LDefinition &temp1 = temp();
     const LDefinition &temp2 = temp();
 
     LNewCallObjectPar *lir;
     if (ins->slots()->type() == MIRType_Slots) {
         const LAllocation &slots = useRegister(ins->slots());
-        lir = LNewCallObjectPar::NewWithSlots(parThreadContext, slots, temp1, temp2);
+        lir = LNewCallObjectPar::NewWithSlots(alloc(), parThreadContext, slots, temp1, temp2);
     } else {
-        lir = LNewCallObjectPar::NewSansSlots(parThreadContext, temp1, temp2);
+        lir = LNewCallObjectPar::NewSansSlots(alloc(), parThreadContext, temp1, temp2);
     }
 
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewStringObject(MNewStringObject *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_String);
 
-    LNewStringObject *lir = new LNewStringObject(useRegister(ins->input()), temp());
+    LNewStringObject *lir = new(alloc()) LNewStringObject(useRegister(ins->input()), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitAbortPar(MAbortPar *ins)
 {
-    LAbortPar *lir = new LAbortPar();
+    LAbortPar *lir = new(alloc()) LAbortPar();
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitInitElem(MInitElem *ins)
 {
-    LInitElem *lir = new LInitElem(useRegisterAtStart(ins->getObject()));
+    LInitElem *lir = new(alloc()) LInitElem(useRegisterAtStart(ins->getObject()));
     if (!useBoxAtStart(lir, LInitElem::IdIndex, ins->getId()))
         return false;
     if (!useBoxAtStart(lir, LInitElem::ValueIndex, ins->getValue()))
         return false;
 
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitInitElemGetterSetter(MInitElemGetterSetter *ins)
 {
-    LInitElemGetterSetter *lir = new LInitElemGetterSetter(useRegisterAtStart(ins->object()),
-                                                           useRegisterAtStart(ins->value()));
+    LInitElemGetterSetter *lir =
+        new(alloc()) LInitElemGetterSetter(useRegisterAtStart(ins->object()),
+                                           useRegisterAtStart(ins->value()));
     if (!useBoxAtStart(lir, LInitElemGetterSetter::IdIndex, ins->idValue()))
         return false;
 
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitInitProp(MInitProp *ins)
 {
-    LInitProp *lir = new LInitProp(useRegisterAtStart(ins->getObject()));
+    LInitProp *lir = new(alloc()) LInitProp(useRegisterAtStart(ins->getObject()));
     if (!useBoxAtStart(lir, LInitProp::ValueIndex, ins->getValue()))
         return false;
 
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitInitPropGetterSetter(MInitPropGetterSetter *ins)
 {
-    LInitPropGetterSetter *lir = new LInitPropGetterSetter(useRegisterAtStart(ins->object()),
-                                                           useRegisterAtStart(ins->value()));
+    LInitPropGetterSetter *lir =
+        new(alloc()) LInitPropGetterSetter(useRegisterAtStart(ins->object()),
+                                           useRegisterAtStart(ins->value()));
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitPrepareCall(MPrepareCall *ins)
 {
     allocateArguments(ins->argc());
 
@@ -315,93 +317,93 @@ LIRGenerator::visitPassArg(MPassArg *arg
     // This causes snapshots to correctly copy the operand on the stack.
     //
     // This keeps the backing store around longer than strictly required.
     // We could do better by informing snapshots about the argument vector.
     arg->setVirtualRegister(opd->virtualRegister());
 
     // Values take a slow path.
     if (opd->type() == MIRType_Value) {
-        LStackArgV *stack = new LStackArgV(argslot);
+        LStackArgV *stack = new(alloc()) LStackArgV(argslot);
         return useBox(stack, 0, opd) && add(stack);
     }
 
     // Known types can move constant types and/or payloads.
-    LStackArgT *stack = new LStackArgT(argslot, useRegisterOrConstant(opd));
+    LStackArgT *stack = new(alloc()) LStackArgT(argslot, useRegisterOrConstant(opd));
     return add(stack, arg);
 }
 
 bool
 LIRGenerator::visitCreateThisWithTemplate(MCreateThisWithTemplate *ins)
 {
-    LCreateThisWithTemplate *lir = new LCreateThisWithTemplate();
+    LCreateThisWithTemplate *lir = new(alloc()) LCreateThisWithTemplate();
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCreateThisWithProto(MCreateThisWithProto *ins)
 {
     LCreateThisWithProto *lir =
-        new LCreateThisWithProto(useRegisterOrConstantAtStart(ins->getCallee()),
-                                 useRegisterOrConstantAtStart(ins->getPrototype()));
+        new(alloc()) LCreateThisWithProto(useRegisterOrConstantAtStart(ins->getCallee()),
+                                          useRegisterOrConstantAtStart(ins->getPrototype()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCreateThis(MCreateThis *ins)
 {
-    LCreateThis *lir = new LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()));
+    LCreateThis *lir = new(alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCreateArgumentsObject(MCreateArgumentsObject *ins)
 {
     // LAllocation callObj = useRegisterAtStart(ins->getCallObject());
     LAllocation callObj = useFixed(ins->getCallObject(), CallTempReg0);
-    LCreateArgumentsObject *lir = new LCreateArgumentsObject(callObj, tempFixed(CallTempReg1));
+    LCreateArgumentsObject *lir = new(alloc()) LCreateArgumentsObject(callObj, tempFixed(CallTempReg1));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetArgumentsObjectArg(MGetArgumentsObjectArg *ins)
 {
     LAllocation argsObj = useRegister(ins->getArgsObject());
-    LGetArgumentsObjectArg *lir = new LGetArgumentsObjectArg(argsObj, temp());
+    LGetArgumentsObjectArg *lir = new(alloc()) LGetArgumentsObjectArg(argsObj, temp());
     return defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitSetArgumentsObjectArg(MSetArgumentsObjectArg *ins)
 {
     LAllocation argsObj = useRegister(ins->getArgsObject());
-    LSetArgumentsObjectArg *lir = new LSetArgumentsObjectArg(argsObj, temp());
+    LSetArgumentsObjectArg *lir = new(alloc()) LSetArgumentsObjectArg(argsObj, temp());
     if (!useBox(lir, LSetArgumentsObjectArg::ValueIndex, ins->getValue()))
         return false;
 
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitReturnFromCtor(MReturnFromCtor *ins)
 {
-    LReturnFromCtor *lir = new LReturnFromCtor(useRegister(ins->getObject()));
+    LReturnFromCtor *lir = new(alloc()) LReturnFromCtor(useRegister(ins->getObject()));
     if (!useBox(lir, LReturnFromCtor::ValueIndex, ins->getValue()))
         return false;
 
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitComputeThis(MComputeThis *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->input()->type() == MIRType_Value);
 
-    LComputeThis *lir = new LComputeThis();
+    LComputeThis *lir = new(alloc()) LComputeThis();
 
     // Don't use useBoxAtStart because ComputeThis has a safepoint and needs to
     // have its inputs in different registers than its return value so that
     // they aren't clobbered.
     if (!useBox(lir, LComputeThis::ValueIndex, ins->input()))
         return false;
 
     return define(lir, ins) && assignSafepoint(lir, ins);
@@ -429,49 +431,49 @@ LIRGenerator::visitCall(MCall *call)
     if (call->isDOMFunction()) {
         JS_ASSERT(target && target->isNative());
         Register cxReg, objReg, privReg, argsReg;
         GetTempRegForIntArg(0, 0, &cxReg);
         GetTempRegForIntArg(1, 0, &objReg);
         GetTempRegForIntArg(2, 0, &privReg);
         mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &argsReg);
         MOZ_ASSERT(ok, "How can we not have four temp registers?");
-        LCallDOMNative *lir = new LCallDOMNative(argslot, tempFixed(cxReg),
-                                                 tempFixed(objReg), tempFixed(privReg),
-                                                 tempFixed(argsReg));
+        LCallDOMNative *lir = new(alloc()) LCallDOMNative(argslot, tempFixed(cxReg),
+                                                          tempFixed(objReg), tempFixed(privReg),
+                                                          tempFixed(argsReg));
         return (defineReturn(lir, call) && assignSafepoint(lir, call));
     }
 
     // Call known functions.
     if (target) {
         if (target->isNative()) {
             Register cxReg, numReg, vpReg, tmpReg;
             GetTempRegForIntArg(0, 0, &cxReg);
             GetTempRegForIntArg(1, 0, &numReg);
             GetTempRegForIntArg(2, 0, &vpReg);
 
             // Even though this is just a temp reg, use the same API to avoid
             // register collisions.
             mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &tmpReg);
             MOZ_ASSERT(ok, "How can we not have four temp registers?");
 
-            LCallNative *lir = new LCallNative(argslot, tempFixed(cxReg),
-                                               tempFixed(numReg),
-                                               tempFixed(vpReg),
-                                               tempFixed(tmpReg));
+            LCallNative *lir = new(alloc()) LCallNative(argslot, tempFixed(cxReg),
+                                                        tempFixed(numReg),
+                                                        tempFixed(vpReg),
+                                                        tempFixed(tmpReg));
             return (defineReturn(lir, call) && assignSafepoint(lir, call));
         }
 
-        LCallKnown *lir = new LCallKnown(useFixed(call->getFunction(), CallTempReg0),
-                                         argslot, tempFixed(CallTempReg2));
+        LCallKnown *lir = new(alloc()) LCallKnown(useFixed(call->getFunction(), CallTempReg0),
+                                                  argslot, tempFixed(CallTempReg2));
         return (defineReturn(lir, call) && assignSafepoint(lir, call));
     }
 
     // Call anything, using the most generic code.
-    LCallGeneric *lir = new LCallGeneric(useFixed(call->getFunction(), CallTempReg0),
+    LCallGeneric *lir = new(alloc()) LCallGeneric(useFixed(call->getFunction(), CallTempReg0),
         argslot, tempFixed(ArgumentsRectifierReg), tempFixed(CallTempReg2));
     return defineReturn(lir, call) && assignSafepoint(lir, call);
 }
 
 bool
 LIRGenerator::visitApplyArgs(MApplyArgs *apply)
 {
     JS_ASSERT(apply->getFunction()->type() == MIRType_Object);
@@ -479,17 +481,17 @@ LIRGenerator::visitApplyArgs(MApplyArgs 
     // Assert if we cannot build a rectifier frame.
     JS_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
     JS_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
 
     // Assert if the return value is already erased.
     JS_ASSERT(CallTempReg2 != JSReturnReg_Type);
     JS_ASSERT(CallTempReg2 != JSReturnReg_Data);
 
-    LApplyArgsGeneric *lir = new LApplyArgsGeneric(
+    LApplyArgsGeneric *lir = new(alloc()) LApplyArgsGeneric(
         useFixed(apply->getFunction(), CallTempReg3),
         useFixed(apply->getArgc(), CallTempReg0),
         tempFixed(CallTempReg1),  // object register
         tempFixed(CallTempReg2)); // copy register
 
     MDefinition *self = apply->getThis();
     if (!useBoxFixed(lir, LApplyArgsGeneric::ThisIndex, self, CallTempReg4, CallTempReg5))
         return false;
@@ -503,17 +505,17 @@ LIRGenerator::visitApplyArgs(MApplyArgs 
     if (!assignSafepoint(lir, apply))
         return false;
     return true;
 }
 
 bool
 LIRGenerator::visitBail(MBail *bail)
 {
-    LBail *lir = new LBail();
+    LBail *lir = new(alloc()) LBail();
     return assignSnapshot(lir) && add(lir, bail);
 }
 
 bool
 LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
 {
     MIRType type = assertion->input()->type();
     DebugOnly<bool> checkIsFloat32 = assertion->mustBeFloat32();
@@ -532,51 +534,51 @@ bool
 LIRGenerator::visitGetDynamicName(MGetDynamicName *ins)
 {
     MDefinition *scopeChain = ins->getScopeChain();
     JS_ASSERT(scopeChain->type() == MIRType_Object);
 
     MDefinition *name = ins->getName();
     JS_ASSERT(name->type() == MIRType_String);
 
-    LGetDynamicName *lir = new LGetDynamicName(useFixed(scopeChain, CallTempReg0),
-                                               useFixed(name, CallTempReg1),
-                                               tempFixed(CallTempReg2),
-                                               tempFixed(CallTempReg3),
-                                               tempFixed(CallTempReg4));
+    LGetDynamicName *lir = new(alloc()) LGetDynamicName(useFixed(scopeChain, CallTempReg0),
+                                                        useFixed(name, CallTempReg1),
+                                                        tempFixed(CallTempReg2),
+                                                        tempFixed(CallTempReg3),
+                                                        tempFixed(CallTempReg4));
 
     return assignSnapshot(lir) && defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitFilterArgumentsOrEval(MFilterArgumentsOrEval *ins)
 {
     MDefinition *string = ins->getString();
     JS_ASSERT(string->type() == MIRType_String);
 
-    LFilterArgumentsOrEval *lir = new LFilterArgumentsOrEval(useFixed(string, CallTempReg0),
-                                                             tempFixed(CallTempReg1),
-                                                             tempFixed(CallTempReg2));
+    LFilterArgumentsOrEval *lir = new(alloc()) LFilterArgumentsOrEval(useFixed(string, CallTempReg0),
+                                                                      tempFixed(CallTempReg1),
+                                                                      tempFixed(CallTempReg2));
 
     return assignSnapshot(lir) && add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallDirectEval(MCallDirectEval *ins)
 {
     MDefinition *scopeChain = ins->getScopeChain();
     JS_ASSERT(scopeChain->type() == MIRType_Object);
 
     MDefinition *string = ins->getString();
     JS_ASSERT(string->type() == MIRType_String);
 
     MDefinition *thisValue = ins->getThisValue();
 
-    LCallDirectEval *lir = new LCallDirectEval(useRegisterAtStart(scopeChain),
-                                               useRegisterAtStart(string));
+    LCallDirectEval *lir = new(alloc()) LCallDirectEval(useRegisterAtStart(scopeChain),
+                                                        useRegisterAtStart(string));
 
     if (!useBoxAtStart(lir, LCallDirectEval::ThisValueInput, thisValue))
         return false;
 
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 static JSOp
@@ -634,113 +636,113 @@ LIRGenerator::visitTest(MTest *test)
         LDefinition temp0, temp1;
         if (test->operandMightEmulateUndefined()) {
             temp0 = temp();
             temp1 = temp();
         } else {
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
     }
 
     if (opd->type() == MIRType_Object) {
         // If the object might emulate undefined, we have to test for that.
         if (test->operandMightEmulateUndefined())
-            return add(new LTestOAndBranch(useRegister(opd), ifTrue, ifFalse, temp()), test);
+            return add(new(alloc()) LTestOAndBranch(useRegister(opd), ifTrue, ifFalse, temp()), test);
 
         // Otherwise we know it's truthy.
-        return add(new LGoto(ifTrue));
+        return add(new(alloc()) LGoto(ifTrue));
     }
 
     // These must be explicitly sniffed out since they are constants and have
     // no payload.
     if (opd->type() == MIRType_Undefined || opd->type() == MIRType_Null)
-        return add(new LGoto(ifFalse));
+        return add(new(alloc()) LGoto(ifFalse));
 
     // Constant Double operand.
     if (opd->type() == MIRType_Double && opd->isConstant()) {
         bool result = opd->toConstant()->valueToBoolean();
-        return add(new LGoto(result ? ifTrue : ifFalse));
+        return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
 
     // Constant Float32 operand.
     if (opd->type() == MIRType_Float32 && opd->isConstant()) {
         bool result = opd->toConstant()->valueToBoolean();
-        return add(new LGoto(result ? ifTrue : ifFalse));
+        return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
 
     // Constant Int32 operand.
     if (opd->type() == MIRType_Int32 && opd->isConstant()) {
         int32_t num = opd->toConstant()->value().toInt32();
-        return add(new LGoto(num ? ifTrue : ifFalse));
+        return add(new(alloc()) LGoto(num ? ifTrue : ifFalse));
     }
 
     // Constant Boolean operand.
     if (opd->type() == MIRType_Boolean && opd->isConstant()) {
         bool result = opd->toConstant()->value().toBoolean();
-        return add(new LGoto(result ? ifTrue : ifFalse));
+        return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
 
     // Check if the operand for this test is a compare operation. If it is, we want
     // to emit an LCompare*AndBranch rather than an LTest*AndBranch, to fuse the
     // compare and jump instructions.
     if (opd->isCompare() && opd->isEmittedAtUses()) {
         MCompare *comp = opd->toCompare();
         MDefinition *left = comp->lhs();
         MDefinition *right = comp->rhs();
 
         // Try to fold the comparison so that we don't have to handle all cases.
         bool result;
         if (comp->tryFold(&result))
-            return add(new LGoto(result ? ifTrue : ifFalse));
+            return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
 
         // Emit LCompare*AndBranch.
 
         // Compare and branch null/undefined.
         // The second operand has known null/undefined type,
         // so just test the first operand.
         if (comp->compareType() == MCompare::Compare_Null ||
             comp->compareType() == MCompare::Compare_Undefined)
         {
             if (left->type() == MIRType_Object) {
                 MOZ_ASSERT(comp->operandMightEmulateUndefined(),
                            "MCompare::tryFold should handle the never-emulates-undefined case");
 
                 LEmulatesUndefinedAndBranch *lir =
-                    new LEmulatesUndefinedAndBranch(useRegister(left), ifTrue, ifFalse, temp());
+                    new(alloc()) LEmulatesUndefinedAndBranch(useRegister(left), ifTrue, ifFalse, temp());
                 return add(lir, comp);
             }
 
             LDefinition tmp, tmpToUnbox;
             if (comp->operandMightEmulateUndefined()) {
                 tmp = temp();
                 tmpToUnbox = tempToUnbox();
             } else {
                 tmp = LDefinition::BogusTemp();
                 tmpToUnbox = LDefinition::BogusTemp();
             }
 
             LIsNullOrLikeUndefinedAndBranch *lir =
-                new LIsNullOrLikeUndefinedAndBranch(ifTrue, ifFalse, tmp, tmpToUnbox);
+                new(alloc()) LIsNullOrLikeUndefinedAndBranch(ifTrue, ifFalse, tmp, tmpToUnbox);
             if (!useBox(lir, LIsNullOrLikeUndefinedAndBranch::Value, left))
                 return false;
             return add(lir, comp);
         }
 
         // Compare and branch booleans.
         if (comp->compareType() == MCompare::Compare_Boolean) {
             JS_ASSERT(left->type() == MIRType_Value);
             JS_ASSERT(right->type() == MIRType_Boolean);
 
             LAllocation rhs = useRegisterOrConstant(right);
-            LCompareBAndBranch *lir = new LCompareBAndBranch(rhs, ifTrue, ifFalse);
+            LCompareBAndBranch *lir = new(alloc()) LCompareBAndBranch(rhs, ifTrue, ifFalse);
             if (!useBox(lir, LCompareBAndBranch::Lhs, left))
                 return false;
             return add(lir, comp);
         }
 
         // Compare and branch Int32 or Object pointers.
         if (comp->compareType() == MCompare::Compare_Int32 ||
             comp->compareType() == MCompare::Compare_UInt32 ||
@@ -751,79 +753,79 @@ LIRGenerator::visitTest(MTest *test)
             LAllocation rhs;
             if (comp->compareType() == MCompare::Compare_Int32 ||
                 comp->compareType() == MCompare::Compare_UInt32)
             {
                 rhs = useAnyOrConstant(right);
             } else {
                 rhs = useRegister(right);
             }
-            LCompareAndBranch *lir = new LCompareAndBranch(op, lhs, rhs, ifTrue, ifFalse);
+            LCompareAndBranch *lir = new(alloc()) LCompareAndBranch(op, lhs, rhs, ifTrue, ifFalse);
             return add(lir, comp);
         }
 
         // Compare and branch doubles.
         if (comp->isDoubleComparison()) {
             LAllocation lhs = useRegister(left);
             LAllocation rhs = useRegister(right);
-            LCompareDAndBranch *lir = new LCompareDAndBranch(lhs, rhs, ifTrue, ifFalse);
+            LCompareDAndBranch *lir = new(alloc()) LCompareDAndBranch(lhs, rhs, ifTrue, ifFalse);
             return add(lir, comp);
         }
 
         // Compare and branch floats.
         if (comp->isFloat32Comparison()) {
             LAllocation lhs = useRegister(left);
             LAllocation rhs = useRegister(right);
-            LCompareFAndBranch *lir = new LCompareFAndBranch(lhs, rhs, ifTrue, ifFalse);
+            LCompareFAndBranch *lir = new(alloc()) LCompareFAndBranch(lhs, rhs, ifTrue, ifFalse);
             return add(lir, comp);
         }
 
         // Compare values.
         if (comp->compareType() == MCompare::Compare_Value) {
-            LCompareVAndBranch *lir = new LCompareVAndBranch(ifTrue, ifFalse);
+            LCompareVAndBranch *lir = new(alloc()) LCompareVAndBranch(ifTrue, ifFalse);
             if (!useBoxAtStart(lir, LCompareVAndBranch::LhsInput, left))
                 return false;
             if (!useBoxAtStart(lir, LCompareVAndBranch::RhsInput, right))
                 return false;
             return add(lir, comp);
         }
     }
 
     // Check if the operand for this test is a bitand operation. If it is, we want
     // to emit an LBitAndAndBranch rather than an LTest*AndBranch.
     if (opd->isBitAnd() && opd->isEmittedAtUses()) {
         MDefinition *lhs = opd->getOperand(0);
         MDefinition *rhs = opd->getOperand(1);
         if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
             ReorderCommutative(&lhs, &rhs);
-            return lowerForBitAndAndBranch(new LBitAndAndBranch(ifTrue, ifFalse), test, lhs, rhs);
+            return lowerForBitAndAndBranch(new(alloc()) LBitAndAndBranch(ifTrue, ifFalse), test, lhs, rhs);
         }
     }
 
     if (opd->type() == MIRType_Double)
-        return add(new LTestDAndBranch(useRegister(opd), ifTrue, ifFalse));
+        return add(new(alloc()) LTestDAndBranch(useRegister(opd), ifTrue, ifFalse));
 
     if (opd->type() == MIRType_Float32)
-        return add(new LTestFAndBranch(useRegister(opd), ifTrue, ifFalse));
+        return add(new(alloc()) LTestFAndBranch(useRegister(opd), ifTrue, ifFalse));
 
     JS_ASSERT(opd->type() == MIRType_Int32 || opd->type() == MIRType_Boolean);
-    return add(new LTestIAndBranch(useRegister(opd), ifTrue, ifFalse));
+    return add(new(alloc()) LTestIAndBranch(useRegister(opd), ifTrue, ifFalse));
 }
 
 bool
 LIRGenerator::visitFunctionDispatch(MFunctionDispatch *ins)
 {
-    LFunctionDispatch *lir = new LFunctionDispatch(useRegister(ins->input()));
+    LFunctionDispatch *lir = new(alloc()) LFunctionDispatch(useRegister(ins->input()));
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitTypeObjectDispatch(MTypeObjectDispatch *ins)
 {
-    LTypeObjectDispatch *lir = new LTypeObjectDispatch(useRegister(ins->input()), temp());
+    LTypeObjectDispatch *lir = new(alloc()) LTypeObjectDispatch(useRegister(ins->input()), temp());
     return add(lir, ins);
 }
 
 static inline bool
 CanEmitCompareAtUses(MInstruction *ins)
 {
     if (!ins->canEmitAtUses())
         return false;
@@ -846,44 +848,44 @@ bool
 LIRGenerator::visitCompare(MCompare *comp)
 {
     MDefinition *left = comp->lhs();
     MDefinition *right = comp->rhs();
 
     // Try to fold the comparison so that we don't have to handle all cases.
     bool result;
     if (comp->tryFold(&result))
-        return define(new LInteger(result), comp);
+        return define(new(alloc()) LInteger(result), comp);
 
     // Move below the emitAtUses call if we ever implement
     // LCompareSAndBranch. Doing this now wouldn't be wrong, but doesn't
     // make sense and avoids confusion.
     if (comp->compareType() == MCompare::Compare_String) {
-        LCompareS *lir = new LCompareS(useRegister(left), useRegister(right), temp());
+        LCompareS *lir = new(alloc()) LCompareS(useRegister(left), useRegister(right), temp());
         if (!define(lir, comp))
             return false;
         return assignSafepoint(lir, comp);
     }
 
     // Strict compare between value and string
     if (comp->compareType() == MCompare::Compare_StrictString) {
         JS_ASSERT(left->type() == MIRType_Value);
         JS_ASSERT(right->type() == MIRType_String);
 
-        LCompareStrictS *lir = new LCompareStrictS(useRegister(right), temp(), tempToUnbox());
+        LCompareStrictS *lir = new(alloc()) LCompareStrictS(useRegister(right), temp(), tempToUnbox());
         if (!useBox(lir, LCompareStrictS::Lhs, left))
             return false;
         if (!define(lir, comp))
             return false;
         return assignSafepoint(lir, comp);
     }
 
     // Unknown/unspecialized compare use a VM call.
     if (comp->compareType() == MCompare::Compare_Unknown) {
-        LCompareVM *lir = new LCompareVM();
+        LCompareVM *lir = new(alloc()) LCompareVM();
         if (!useBoxAtStart(lir, LCompareVM::LhsInput, left))
             return false;
         if (!useBoxAtStart(lir, LCompareVM::RhsInput, right))
             return false;
         return defineReturn(lir, comp) && assignSafepoint(lir, comp);
     }
 
     // Sniff out if the output of this compare is used only for a branching.
@@ -896,40 +898,40 @@ LIRGenerator::visitCompare(MCompare *com
     // Compare Null and Undefined.
     if (comp->compareType() == MCompare::Compare_Null ||
         comp->compareType() == MCompare::Compare_Undefined)
     {
         if (left->type() == MIRType_Object) {
             MOZ_ASSERT(comp->operandMightEmulateUndefined(),
                        "MCompare::tryFold should have folded this away");
 
-            return define(new LEmulatesUndefined(useRegister(left)), comp);
+            return define(new(alloc()) LEmulatesUndefined(useRegister(left)), comp);
         }
 
         LDefinition tmp, tmpToUnbox;
         if (comp->operandMightEmulateUndefined()) {
             tmp = temp();
             tmpToUnbox = tempToUnbox();
         } else {
             tmp = LDefinition::BogusTemp();
             tmpToUnbox = LDefinition::BogusTemp();
         }
 
-        LIsNullOrLikeUndefined *lir = new LIsNullOrLikeUndefined(tmp, tmpToUnbox);
+        LIsNullOrLikeUndefined *lir = new(alloc()) LIsNullOrLikeUndefined(tmp, tmpToUnbox);
         if (!useBox(lir, LIsNullOrLikeUndefined::Value, left))
             return false;
         return define(lir, comp);
     }
 
     // Compare booleans.
     if (comp->compareType() == MCompare::Compare_Boolean) {
         JS_ASSERT(left->type() == MIRType_Value);
         JS_ASSERT(right->type() == MIRType_Boolean);
 
-        LCompareB *lir = new LCompareB(useRegisterOrConstant(right));
+        LCompareB *lir = new(alloc()) LCompareB(useRegisterOrConstant(right));
         if (!useBox(lir, LCompareB::Lhs, left))
             return false;
         return define(lir, comp);
     }
 
     // Compare Int32 or Object pointers.
     if (comp->compareType() == MCompare::Compare_Int32 ||
         comp->compareType() == MCompare::Compare_UInt32 ||
@@ -940,30 +942,30 @@ LIRGenerator::visitCompare(MCompare *com
         LAllocation rhs;
         if (comp->compareType() == MCompare::Compare_Int32 ||
             comp->compareType() == MCompare::Compare_UInt32)
         {
             rhs = useAnyOrConstant(right);
         } else {
             rhs = useRegister(right);
         }
-        return define(new LCompare(op, lhs, rhs), comp);
+        return define(new(alloc()) LCompare(op, lhs, rhs), comp);
     }
 
     // Compare doubles.
     if (comp->isDoubleComparison())
-        return define(new LCompareD(useRegister(left), useRegister(right)), comp);
+        return define(new(alloc()) LCompareD(useRegister(left), useRegister(right)), comp);
 
     // Compare float32.
     if (comp->isFloat32Comparison())
-        return define(new LCompareF(useRegister(left), useRegister(right)), comp);
+        return define(new(alloc()) LCompareF(useRegister(left), useRegister(right)), comp);
 
     // Compare values.
     if (comp->compareType() == MCompare::Compare_Value) {
-        LCompareV *lir = new LCompareV();
+        LCompareV *lir = new(alloc()) LCompareV();
         if (!useBoxAtStart(lir, LCompareV::LhsInput, left))
             return false;
         if (!useBoxAtStart(lir, LCompareV::RhsInput, right))
             return false;
         return define(lir, comp);
     }
 
     MOZ_ASSUME_UNREACHABLE("Unrecognized compare type.");
@@ -972,60 +974,60 @@ LIRGenerator::visitCompare(MCompare *com
 bool
 LIRGenerator::lowerBitOp(JSOp op, MInstruction *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
 
     if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
         ReorderCommutative(&lhs, &rhs);
-        return lowerForALU(new LBitOpI(op), ins, lhs, rhs);
+        return lowerForALU(new(alloc()) LBitOpI(op), ins, lhs, rhs);
     }
 
-    LBitOpV *lir = new LBitOpV(op);
+    LBitOpV *lir = new(alloc()) LBitOpV(op);
     if (!useBoxAtStart(lir, LBitOpV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBitOpV::RhsInput, rhs))
         return false;
 
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitTypeOf(MTypeOf *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Value);
 
-    LTypeOfV *lir = new LTypeOfV(tempToUnbox());
+    LTypeOfV *lir = new(alloc()) LTypeOfV(tempToUnbox());
     if (!useBox(lir, LTypeOfV::Input, opd))
         return false;
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new LToIdV(tempFloat());
+    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
         return false;
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitBitNot(MBitNot *ins)
 {
     MDefinition *input = ins->getOperand(0);
 
     if (input->type() == MIRType_Int32)
-        return lowerForALU(new LBitNotI(), ins, input);
-
-    LBitNotV *lir = new LBitNotV;
+        return lowerForALU(new(alloc()) LBitNotI(), ins, input);
+
+    LBitNotV *lir = new(alloc()) LBitNotV;
     if (!useBoxAtStart(lir, LBitNotV::Input, input))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 static bool
@@ -1084,32 +1086,32 @@ LIRGenerator::lowerShiftOp(JSOp op, MShi
     MDefinition *rhs = ins->getOperand(1);
 
     if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
         if (ins->type() == MIRType_Double) {
             JS_ASSERT(op == JSOP_URSH);
             return lowerUrshD(ins->toUrsh());
         }
 
-        LShiftI *lir = new LShiftI(op);
+        LShiftI *lir = new(alloc()) LShiftI(op);
         if (op == JSOP_URSH) {
             if (ins->toUrsh()->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
         }
         return lowerForShift(lir, ins, lhs, rhs);
     }
 
     JS_ASSERT(ins->specialization() == MIRType_None);
 
     if (op == JSOP_URSH) {
         // Result is either int32 or double so we have to use BinaryV.
         return lowerBinaryV(JSOP_URSH, ins);
     }
 
-    LBitOpV *lir = new LBitOpV(op);
+    LBitOpV *lir = new(alloc()) LBitOpV(op);
     if (!useBoxAtStart(lir, LBitOpV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBitOpV::RhsInput, rhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
@@ -1132,162 +1134,162 @@ LIRGenerator::visitUrsh(MUrsh *ins)
 
 bool
 LIRGenerator::visitFloor(MFloor *ins)
 {
     MIRType type = ins->num()->type();
     JS_ASSERT(IsFloatingPointType(type));
 
     if (type == MIRType_Double) {
-        LFloor *lir = new LFloor(useRegister(ins->num()));
+        LFloor *lir = new(alloc()) LFloor(useRegister(ins->num()));
         if (!assignSnapshot(lir))
             return false;
         return define(lir, ins);
     }
 
-    LFloorF *lir = new LFloorF(useRegister(ins->num()));
+    LFloorF *lir = new(alloc()) LFloorF(useRegister(ins->num()));
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new LRound(useRegister(ins->num()), tempFloat());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitMinMax(MMinMax *ins)
 {
     MDefinition *first = ins->getOperand(0);
     MDefinition *second = ins->getOperand(1);
 
     ReorderCommutative(&first, &second);
 
     if (ins->specialization() == MIRType_Int32) {
-        LMinMaxI *lir = new LMinMaxI(useRegisterAtStart(first), useRegisterOrConstant(second));
+        LMinMaxI *lir = new(alloc()) LMinMaxI(useRegisterAtStart(first), useRegisterOrConstant(second));
         return defineReuseInput(lir, ins, 0);
     }
 
-    LMinMaxD *lir = new LMinMaxD(useRegisterAtStart(first), useRegister(second));
+    LMinMaxD *lir = new(alloc()) LMinMaxD(useRegisterAtStart(first), useRegister(second));
     return defineReuseInput(lir, ins, 0);
 }
 
 bool
 LIRGenerator::visitAbs(MAbs *ins)
 {
     MDefinition *num = ins->num();
     JS_ASSERT(IsNumberType(num->type()));
 
     if (num->type() == MIRType_Int32) {
-        LAbsI *lir = new LAbsI(useRegisterAtStart(num));
+        LAbsI *lir = new(alloc()) LAbsI(useRegisterAtStart(num));
         // needed to handle abs(INT32_MIN)
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return defineReuseInput(lir, ins, 0);
     }
     if (num->type() == MIRType_Float32) {
-        LAbsF *lir = new LAbsF(useRegisterAtStart(num));
+        LAbsF *lir = new(alloc()) LAbsF(useRegisterAtStart(num));
         return defineReuseInput(lir, ins, 0);
     }
 
-    LAbsD *lir = new LAbsD(useRegisterAtStart(num));
+    LAbsD *lir = new(alloc()) LAbsD(useRegisterAtStart(num));
     return defineReuseInput(lir, ins, 0);
 }
 
 bool
 LIRGenerator::visitSqrt(MSqrt *ins)
 {
     MDefinition *num = ins->num();
     JS_ASSERT(IsFloatingPointType(num->type()));
     if (num->type() == MIRType_Double) {
-        LSqrtD *lir = new LSqrtD(useRegisterAtStart(num));
+        LSqrtD *lir = new(alloc()) LSqrtD(useRegisterAtStart(num));
         return define(lir, ins);
     }
 
-    LSqrtF *lir = new LSqrtF(useRegisterAtStart(num));
+    LSqrtF *lir = new(alloc()) LSqrtF(useRegisterAtStart(num));
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitAtan2(MAtan2 *ins)
 {
     MDefinition *y = ins->y();
     JS_ASSERT(y->type() == MIRType_Double);
 
     MDefinition *x = ins->x();
     JS_ASSERT(x->type() == MIRType_Double);
 
-    LAtan2D *lir = new LAtan2D(useRegisterAtStart(y), useRegisterAtStart(x), tempFixed(CallTempReg0));
+    LAtan2D *lir = new(alloc()) LAtan2D(useRegisterAtStart(y), useRegisterAtStart(x), tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitHypot(MHypot *ins)
 {
     MDefinition *x = ins->x();
     JS_ASSERT(x->type() == MIRType_Double);
 
     MDefinition *y = ins->y();
     JS_ASSERT(y->type() == MIRType_Double);
 
-    LHypot *lir = new LHypot(useRegisterAtStart(x), useRegisterAtStart(y), tempFixed(CallTempReg0));
+    LHypot *lir = new(alloc()) LHypot(useRegisterAtStart(x), useRegisterAtStart(y), tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitPow(MPow *ins)
 {
     MDefinition *input = ins->input();
     JS_ASSERT(input->type() == MIRType_Double);
 
     MDefinition *power = ins->power();
     JS_ASSERT(power->type() == MIRType_Int32 || power->type() == MIRType_Double);
 
     if (power->type() == MIRType_Int32) {
         // Note: useRegisterAtStart here is safe, the temp is a GP register so
         // it will never get the same register.
-        LPowI *lir = new LPowI(useRegisterAtStart(input), useFixed(power, CallTempReg1),
-                               tempFixed(CallTempReg0));
+        LPowI *lir = new(alloc()) LPowI(useRegisterAtStart(input), useFixed(power, CallTempReg1),
+                                        tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
 
-    LPowD *lir = new LPowD(useRegisterAtStart(input), useRegisterAtStart(power),
-                           tempFixed(CallTempReg0));
+    LPowD *lir = new(alloc()) LPowD(useRegisterAtStart(input), useRegisterAtStart(power),
+                                    tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitRandom(MRandom *ins)
 {
-    LRandom *lir = new LRandom(tempFixed(CallTempReg0), tempFixed(CallTempReg1));
+    LRandom *lir = new(alloc()) LRandom(tempFixed(CallTempReg0), tempFixed(CallTempReg1));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitMathFunction(MMathFunction *ins)
 {
     JS_ASSERT(IsFloatingPointType(ins->type()));
     JS_ASSERT_IF(ins->type() == MIRType_Double, ins->input()->type() == MIRType_Double);
     JS_ASSERT_IF(ins->type() == MIRType_Float32, ins->input()->type() == MIRType_Float32);
 
     if (ins->type() == MIRType_Double) {
         // Note: useRegisterAtStart is safe here, the temp is not a FP register.
-        LMathFunctionD *lir = new LMathFunctionD(useRegisterAtStart(ins->input()),
-                                                 tempFixed(CallTempReg0));
+        LMathFunctionD *lir = new(alloc()) LMathFunctionD(useRegisterAtStart(ins->input()),
+                                                          tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
 
-    LMathFunctionF *lir = new LMathFunctionF(useRegisterAtStart(ins->input()),
-                                             tempFixed(CallTempReg0));
+    LMathFunctionF *lir = new(alloc()) LMathFunctionF(useRegisterAtStart(ins->input()),
+                                                      tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 
 // Try to mark an add or sub instruction as able to recover its input when
 // bailing out.
 template <typename S, typename T>
 static void
 MaybeSetRecoversInput(S *mir, T *lir)
@@ -1324,71 +1326,71 @@ LIRGenerator::visitAdd(MAdd *ins)
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
 
     JS_ASSERT(lhs->type() == rhs->type());
 
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs);
-        LAddI *lir = new LAddI;
+        LAddI *lir = new(alloc()) LAddI;
 
         if (ins->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
 
         if (!lowerForALU(lir, ins, lhs, rhs))
             return false;
 
         MaybeSetRecoversInput(ins, lir);
         return true;
     }
 
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         ReorderCommutative(&lhs, &rhs);
-        return lowerForFPU(new LMathD(JSOP_ADD), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathD(JSOP_ADD), ins, lhs, rhs);
     }
 
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         ReorderCommutative(&lhs, &rhs);
-        return lowerForFPU(new LMathF(JSOP_ADD), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathF(JSOP_ADD), ins, lhs, rhs);
     }
 
     return lowerBinaryV(JSOP_ADD, ins);
 }
 
 bool
 LIRGenerator::visitSub(MSub *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
 
     JS_ASSERT(lhs->type() == rhs->type());
 
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
 
-        LSubI *lir = new LSubI;
+        LSubI *lir = new(alloc()) LSubI;
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
 
         if (!lowerForALU(lir, ins, lhs, rhs))
             return false;
 
         MaybeSetRecoversInput(ins, lir);
         return true;
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
-        return lowerForFPU(new LMathD(JSOP_SUB), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathD(JSOP_SUB), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
-        return lowerForFPU(new LMathF(JSOP_SUB), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathF(JSOP_SUB), ins, lhs, rhs);
     }
 
     return lowerBinaryV(JSOP_SUB, ins);
 }
 
 bool
 LIRGenerator::visitMul(MMul *ins)
 {
@@ -1398,39 +1400,39 @@ LIRGenerator::visitMul(MMul *ins)
 
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs);
 
         // If our RHS is a constant -1 and we don't have to worry about
         // overflow, we can optimize to an LNegI.
         if (!ins->fallible() && rhs->isConstant() && rhs->toConstant()->value() == Int32Value(-1))
-            return defineReuseInput(new LNegI(useRegisterAtStart(lhs)), ins, 0);
+            return defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(lhs)), ins, 0);
 
         return lowerMulI(ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         ReorderCommutative(&lhs, &rhs);
 
         // If our RHS is a constant -1.0, we can optimize to an LNegD.
         if (rhs->isConstant() && rhs->toConstant()->value() == DoubleValue(-1.0))
-            return defineReuseInput(new LNegD(useRegisterAtStart(lhs)), ins, 0);
-
-        return lowerForFPU(new LMathD(JSOP_MUL), ins, lhs, rhs);
+            return defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(lhs)), ins, 0);
+
+        return lowerForFPU(new(alloc()) LMathD(JSOP_MUL), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         ReorderCommutative(&lhs, &rhs);
 
         // We apply the same optimizations as for doubles
         if (rhs->isConstant() && rhs->toConstant()->value() == Float32Value(-1.0f))
-            return defineReuseInput(new LNegF(useRegisterAtStart(lhs)), ins, 0);
-
-        return lowerForFPU(new LMathF(JSOP_MUL), ins, lhs, rhs);
+            return defineReuseInput(new(alloc()) LNegF(useRegisterAtStart(lhs)), ins, 0);
+
+        return lowerForFPU(new(alloc()) LMathF(JSOP_MUL), ins, lhs, rhs);
     }
 
     return lowerBinaryV(JSOP_MUL, ins);
 }
 
 bool
 LIRGenerator::visitDiv(MDiv *ins)
 {
@@ -1439,21 +1441,21 @@ LIRGenerator::visitDiv(MDiv *ins)
     JS_ASSERT(lhs->type() == rhs->type());
 
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         return lowerDivI(ins);
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
-        return lowerForFPU(new LMathD(JSOP_DIV), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathD(JSOP_DIV), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
-        return lowerForFPU(new LMathF(JSOP_DIV), ins, lhs, rhs);
+        return lowerForFPU(new(alloc()) LMathF(JSOP_DIV), ins, lhs, rhs);
     }
 
     return lowerBinaryV(JSOP_DIV, ins);
 }
 
 bool
 LIRGenerator::visitMod(MMod *ins)
 {
@@ -1466,34 +1468,34 @@ LIRGenerator::visitMod(MMod *ins)
     }
 
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(ins->type() == MIRType_Double);
         JS_ASSERT(ins->lhs()->type() == MIRType_Double);
         JS_ASSERT(ins->rhs()->type() == MIRType_Double);
 
         // Note: useRegisterAtStart is safe here, the temp is not a FP register.
-        LModD *lir = new LModD(useRegisterAtStart(ins->lhs()), useRegisterAtStart(ins->rhs()),
-                               tempFixed(CallTempReg0));
+        LModD *lir = new(alloc()) LModD(useRegisterAtStart(ins->lhs()), useRegisterAtStart(ins->rhs()),
+                                        tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
 
     return lowerBinaryV(JSOP_MOD, ins);
 }
 
 bool
 LIRGenerator::lowerBinaryV(JSOp op, MBinaryInstruction *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
 
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Value);
 
-    LBinaryV *lir = new LBinaryV(op);
+    LBinaryV *lir = new(alloc()) LBinaryV(op);
     if (!useBoxAtStart(lir, LBinaryV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBinaryV::RhsInput, rhs))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
@@ -1503,84 +1505,84 @@ LIRGenerator::visitConcat(MConcat *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
 
     JS_ASSERT(lhs->type() == MIRType_String);
     JS_ASSERT(rhs->type() == MIRType_String);
     JS_ASSERT(ins->type() == MIRType_String);
 
-    LConcat *lir = new LConcat(useFixedAtStart(lhs, CallTempReg0),
-                               useFixedAtStart(rhs, CallTempReg1),
-                               tempFixed(CallTempReg0),
-                               tempFixed(CallTempReg1),
-                               tempFixed(CallTempReg2),
-                               tempFixed(CallTempReg3),
-                               tempFixed(CallTempReg4));
+    LConcat *lir = new(alloc()) LConcat(useFixedAtStart(lhs, CallTempReg0),
+                                        useFixedAtStart(rhs, CallTempReg1),
+                                        tempFixed(CallTempReg0),
+                                        tempFixed(CallTempReg1),
+                                        tempFixed(CallTempReg2),
+                                        tempFixed(CallTempReg3),
+                                        tempFixed(CallTempReg4));
     if (!defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg5))))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitConcatPar(MConcatPar *ins)
 {
     MDefinition *slice = ins->forkJoinSlice();
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
 
     JS_ASSERT(lhs->type() == MIRType_String);
     JS_ASSERT(rhs->type() == MIRType_String);
     JS_ASSERT(ins->type() == MIRType_String);
 
-    LConcatPar *lir = new LConcatPar(useFixed(slice, CallTempReg4),
-                                     useFixedAtStart(lhs, CallTempReg0),
-                                     useFixedAtStart(rhs, CallTempReg1),
-                                     tempFixed(CallTempReg0),
-                                     tempFixed(CallTempReg1),
-                                     tempFixed(CallTempReg2),
-                                     tempFixed(CallTempReg3));
+    LConcatPar *lir = new(alloc()) LConcatPar(useFixed(slice, CallTempReg4),
+                                              useFixedAtStart(lhs, CallTempReg0),
+                                              useFixedAtStart(rhs, CallTempReg1),
+                                              tempFixed(CallTempReg0),
+                                              tempFixed(CallTempReg1),
+                                              tempFixed(CallTempReg2),
+                                              tempFixed(CallTempReg3));
     if (!defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg5))))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCharCodeAt(MCharCodeAt *ins)
 {
     MDefinition *str = ins->getOperand(0);
     MDefinition *idx = ins->getOperand(1);
 
     JS_ASSERT(str->type() == MIRType_String);
     JS_ASSERT(idx->type() == MIRType_Int32);
 
-    LCharCodeAt *lir = new LCharCodeAt(useRegister(str), useRegister(idx));
+    LCharCodeAt *lir = new(alloc()) LCharCodeAt(useRegister(str), useRegister(idx));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitFromCharCode(MFromCharCode *ins)
 {
     MDefinition *code = ins->getOperand(0);
 
     JS_ASSERT(code->type() == MIRType_Int32);
 
-    LFromCharCode *lir = new LFromCharCode(useRegister(code));
+    LFromCharCode *lir = new(alloc()) LFromCharCode(useRegister(code));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitStart(MStart *start)
 {
     // Create a snapshot that captures the initial state of the function.
-    LStart *lir = new LStart;
+    LStart *lir = new(alloc()) LStart;
     if (!assignSnapshot(lir))
         return false;
 
     if (start->startType() == MStart::StartType_Default)
         lirGraph_.setEntrySnapshot(lir->snapshot());
     return add(lir);
 }
 
@@ -1588,58 +1590,58 @@ bool
 LIRGenerator::visitNop(MNop *nop)
 {
     return true;
 }
 
 bool
 LIRGenerator::visitOsrEntry(MOsrEntry *entry)
 {
-    LOsrEntry *lir = new LOsrEntry;
+    LOsrEntry *lir = new(alloc()) LOsrEntry;
     return defineFixed(lir, entry, LAllocation(AnyRegister(OsrFrameReg)));
 }
 
 bool
 LIRGenerator::visitOsrValue(MOsrValue *value)
 {
-    LOsrValue *lir = new LOsrValue(useRegister(value->entry()));
+    LOsrValue *lir = new(alloc()) LOsrValue(useRegister(value->entry()));
     return defineBox(lir, value);
 }
 
 bool
 LIRGenerator::visitOsrReturnValue(MOsrReturnValue *value)
 {
-    LOsrReturnValue *lir = new LOsrReturnValue(useRegister(value->entry()));
+    LOsrReturnValue *lir = new(alloc()) LOsrReturnValue(useRegister(value->entry()));
     return defineBox(lir, value);
 }
 
 bool
 LIRGenerator::visitOsrScopeChain(MOsrScopeChain *object)
 {
-    LOsrScopeChain *lir = new LOsrScopeChain(useRegister(object->entry()));
+    LOsrScopeChain *lir = new(alloc()) LOsrScopeChain(useRegister(object->entry()));
     return define(lir, object);
 }
 
 bool
 LIRGenerator::visitOsrArgumentsObject(MOsrArgumentsObject *object)
 {
-    LOsrArgumentsObject *lir = new LOsrArgumentsObject(useRegister(object->entry()));
+    LOsrArgumentsObject *lir = new(alloc()) LOsrArgumentsObject(useRegister(object->entry()));
     return define(lir, object);
 }
 
 bool
 LIRGenerator::visitToDouble(MToDouble *convert)
 {
     MDefinition *opd = convert->input();
     mozilla::DebugOnly<MToDouble::ConversionKind> conversion = convert->conversion();
 
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToDouble *lir = new LValueToDouble();
+        LValueToDouble *lir = new(alloc()) LValueToDouble();
         if (!useBox(lir, LValueToDouble::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert);
       }
 
       case MIRType_Null:
         JS_ASSERT(conversion != MToDouble::NumbersOnly && conversion != MToDouble::NonNullNonStringPrimitives);
         return lowerConstantDouble(0, convert);
@@ -1649,23 +1651,23 @@ LIRGenerator::visitToDouble(MToDouble *c
         return lowerConstantDouble(GenericNaN(), convert);
 
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToDouble::NumbersOnly);
         /* FALLTHROUGH */
 
       case MIRType_Int32:
       {
-        LInt32ToDouble *lir = new LInt32ToDouble(useRegister(opd));
+        LInt32ToDouble *lir = new(alloc()) LInt32ToDouble(useRegister(opd));
         return define(lir, convert);
       }
 
       case MIRType_Float32:
       {
-        LFloat32ToDouble *lir = new LFloat32ToDouble(useRegister(opd));
+        LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegister(opd));
         return define(lir, convert);
       }
 
       case MIRType_Double:
         return redefine(convert, opd);
 
       default:
         // Objects might be effectful.
@@ -1678,17 +1680,17 @@ bool
 LIRGenerator::visitToFloat32(MToFloat32 *convert)
 {
     MDefinition *opd = convert->input();
     mozilla::DebugOnly<MToFloat32::ConversionKind> conversion = convert->conversion();
 
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToFloat32 *lir = new LValueToFloat32();
+        LValueToFloat32 *lir = new(alloc()) LValueToFloat32();
         if (!useBox(lir, LValueToFloat32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert);
       }
 
       case MIRType_Null:
         JS_ASSERT(conversion != MToFloat32::NonStringPrimitives);
         return lowerConstantFloat32(0, convert);
@@ -1698,23 +1700,23 @@ LIRGenerator::visitToFloat32(MToFloat32 
         return lowerConstantFloat32(GenericNaN(), convert);
 
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToFloat32::NumbersOnly);
         /* FALLTHROUGH */
 
       case MIRType_Int32:
       {
-        LInt32ToFloat32 *lir = new LInt32ToFloat32(useRegister(opd));
+        LInt32ToFloat32 *lir = new(alloc()) LInt32ToFloat32(useRegister(opd));
         return define(lir, convert);
       }
 
       case MIRType_Double:
       {
-        LDoubleToFloat32 *lir = new LDoubleToFloat32(useRegister(opd));
+        LDoubleToFloat32 *lir = new(alloc()) LDoubleToFloat32(useRegister(opd));
         return define(lir, convert);
       }
 
       case MIRType_Float32:
         return redefine(convert, opd);
 
       default:
         // Objects might be effectful.
@@ -1727,38 +1729,38 @@ LIRGenerator::visitToFloat32(MToFloat32 
 bool
 LIRGenerator::visitToInt32(MToInt32 *convert)
 {
     MDefinition *opd = convert->input();
 
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
       }
 
       case MIRType_Null:
-        return define(new LInteger(0), convert);
+        return define(new(alloc()) LInteger(0), convert);
 
       case MIRType_Int32:
       case MIRType_Boolean:
         return redefine(convert, opd);
 
       case MIRType_Float32:
       {
-        LFloat32ToInt32 *lir = new LFloat32ToInt32(useRegister(opd));
+        LFloat32ToInt32 *lir = new(alloc()) LFloat32ToInt32(useRegister(opd));
         return assignSnapshot(lir) && define(lir, convert);
       }
 
       case MIRType_Double:
       {
-        LDoubleToInt32 *lir = new LDoubleToInt32(useRegister(opd));
+        LDoubleToInt32 *lir = new(alloc()) LDoubleToInt32(useRegister(opd));
         return assignSnapshot(lir) && define(lir, convert);
       }
 
       case MIRType_String:
       case MIRType_Object:
       case MIRType_Undefined:
         // Objects might be effectful. Undefined coerces to NaN, not int32.
         MOZ_ASSUME_UNREACHABLE("ToInt32 invalid input type");
@@ -1772,25 +1774,25 @@ LIRGenerator::visitToInt32(MToInt32 *con
 bool
 LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
 {
     MDefinition *opd = truncate->input();
 
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
       }
 
       case MIRType_Null:
       case MIRType_Undefined:
-        return define(new LInteger(0), truncate);
+        return define(new(alloc()) LInteger(0), truncate);
 
       case MIRType_Int32:
       case MIRType_Boolean:
         return redefine(truncate, opd);
 
       case MIRType_Double:
         return lowerTruncateDToInt32(truncate);
 
@@ -1811,25 +1813,25 @@ LIRGenerator::visitToString(MToString *i
 
     switch (opd->type()) {
       case MIRType_Null:
       case MIRType_Undefined:
       case MIRType_Boolean:
         MOZ_ASSUME_UNREACHABLE("NYI: Lower MToString");
 
       case MIRType_Double: {
-        LDoubleToString *lir = new LDoubleToString(useRegister(opd), temp());
+        LDoubleToString *lir = new(alloc()) LDoubleToString(useRegister(opd), temp());
 
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
 
       case MIRType_Int32: {
-        LIntToString *lir = new LIntToString(useRegister(opd));
+        LIntToString *lir = new(alloc()) LIntToString(useRegister(opd));
 
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
 
       default:
         // Objects might be effectful. (see ToPrimitive)
@@ -1910,216 +1912,216 @@ MustCloneRegExp(MRegExp *regexp)
     return false;
 }
 
 bool
 LIRGenerator::visitRegExp(MRegExp *ins)
 {
     if (!MustCloneRegExp(ins)) {
         RegExpObject *source = ins->source();
-        return define(new LPointer(source), ins);
+        return define(new(alloc()) LPointer(source), ins);
     }
 
-    LRegExp *lir = new LRegExp();
+    LRegExp *lir = new(alloc()) LRegExp();
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitRegExpTest(MRegExpTest *ins)
 {
     JS_ASSERT(ins->regexp()->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
 
-    LRegExpTest *lir = new LRegExpTest(useRegisterAtStart(ins->regexp()),
-                                       useRegisterAtStart(ins->string()));
+    LRegExpTest *lir = new(alloc()) LRegExpTest(useRegisterAtStart(ins->regexp()),
+                                                useRegisterAtStart(ins->string()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitLambda(MLambda *ins)
 {
     if (ins->info().singletonType || ins->info().useNewTypeForClone) {
         // If the function has a singleton type, this instruction will only be
         // executed once so we don't bother inlining it.
         //
         // If UseNewTypeForClone is true, we will assign a singleton type to
         // the clone and we have to clone the script, we can't do that inline.
-        LLambdaForSingleton *lir = new LLambdaForSingleton(useRegisterAtStart(ins->scopeChain()));
+        LLambdaForSingleton *lir = new(alloc()) LLambdaForSingleton(useRegisterAtStart(ins->scopeChain()));
         return defineReturn(lir, ins) && assignSafepoint(lir, ins);
     }
 
-    LLambda *lir = new LLambda(useRegister(ins->scopeChain()));
+    LLambda *lir = new(alloc()) LLambda(useRegister(ins->scopeChain()));
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitLambdaPar(MLambdaPar *ins)
 {
     JS_ASSERT(!ins->info().singletonType);
     JS_ASSERT(!ins->info().useNewTypeForClone);
-    LLambdaPar *lir = new LLambdaPar(useRegister(ins->forkJoinSlice()),
-                                     useRegister(ins->scopeChain()),
-                                     temp(), temp());
+    LLambdaPar *lir = new(alloc()) LLambdaPar(useRegister(ins->forkJoinSlice()),
+                                              useRegister(ins->scopeChain()),
+                                              temp(), temp());
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitImplicitThis(MImplicitThis *ins)
 {
     JS_ASSERT(ins->callee()->type() == MIRType_Object);
 
-    LImplicitThis *lir = new LImplicitThis(useRegister(ins->callee()));
+    LImplicitThis *lir = new(alloc()) LImplicitThis(useRegister(ins->callee()));
     return assignSnapshot(lir) && defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitSlots(MSlots *ins)
 {
-    return define(new LSlots(useRegisterAtStart(ins->object())), ins);
+    return define(new(alloc()) LSlots(useRegisterAtStart(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitElements(MElements *ins)
 {
-    return define(new LElements(useRegisterAtStart(ins->object())), ins);
+    return define(new(alloc()) LElements(useRegisterAtStart(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitConstantElements(MConstantElements *ins)
 {
-    return define(new LPointer(ins->value(), LPointer::NON_GC_THING), ins);
+    return define(new(alloc()) LPointer(ins->value(), LPointer::NON_GC_THING), ins);
 }
 
 bool
 LIRGenerator::visitConvertElementsToDoubles(MConvertElementsToDoubles *ins)
 {
-    LInstruction *check = new LConvertElementsToDoubles(useRegister(ins->elements()));
+    LInstruction *check = new(alloc()) LConvertElementsToDoubles(useRegister(ins->elements()));
     return add(check, ins) && assignSafepoint(check, ins);
 }
 
 bool
 LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->value()->type() == MIRType_Int32);
 
-    LMaybeToDoubleElement *lir = new LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
-                                                           useRegisterAtStart(ins->value()),
-                                                           tempFloat());
+    LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
+                                                                    useRegisterAtStart(ins->value()),
+                                                                    tempFloat());
     return defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 {
     switch (ins->type()) {
       case MIRType_Value:
-        return defineBox(new LLoadSlotV(useRegister(ins->slots())), ins);
+        return defineBox(new(alloc()) LLoadSlotV(useRegister(ins->slots())), ins);
 
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
-        return define(new LLoadSlotT(useRegister(ins->slots())), ins);
+        return define(new(alloc()) LLoadSlotT(useRegister(ins->slots())), ins);
     }
 }
 
 bool
 LIRGenerator::visitFunctionEnvironment(MFunctionEnvironment *ins)
 {
-    return define(new LFunctionEnvironment(useRegisterAtStart(ins->function())), ins);
+    return define(new(alloc()) LFunctionEnvironment(useRegisterAtStart(ins->function())), ins);
 }
 
 bool
 LIRGenerator::visitForkJoinSlice(MForkJoinSlice *ins)
 {
-    LForkJoinSlice *lir = new LForkJoinSlice(tempFixed(CallTempReg0));
+    LForkJoinSlice *lir = new(alloc()) LForkJoinSlice(tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitGuardThreadLocalObject(MGuardThreadLocalObject *ins)
 {
     LGuardThreadLocalObject *lir =
-        new LGuardThreadLocalObject(useFixed(ins->forkJoinSlice(), CallTempReg0),
-                                    useFixed(ins->object(), CallTempReg1),
-                                    tempFixed(CallTempReg2));
+        new(alloc()) LGuardThreadLocalObject(useFixed(ins->forkJoinSlice(), CallTempReg0),
+                                             useFixed(ins->object(), CallTempReg1),
+                                             tempFixed(CallTempReg2));
     lir->setMir(ins);
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitInterruptCheck(MInterruptCheck *ins)
 {
     // Implicit interrupt checks require asm.js signal handlers to be
     // installed. ARM does not yet use implicit interrupt checks, see
     // bug 864220.
 #ifndef JS_CPU_ARM
     if (GetIonContext()->runtime->signalHandlersInstalled()) {
-        LInterruptCheckImplicit *lir = new LInterruptCheckImplicit();
+        LInterruptCheckImplicit *lir = new(alloc()) LInterruptCheckImplicit();
         return add(lir) && assignSafepoint(lir, ins);
     }
 #endif
 
-    LInterruptCheck *lir = new LInterruptCheck();
+    LInterruptCheck *lir = new(alloc()) LInterruptCheck();
     return add(lir) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCheckInterruptPar(MCheckInterruptPar *ins)
 {
     LCheckInterruptPar *lir =
-        new LCheckInterruptPar(useRegister(ins->forkJoinSlice()), temp());
+        new(alloc()) LCheckInterruptPar(useRegister(ins->forkJoinSlice()), temp());
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 
 bool
 LIRGenerator::visitNewPar(MNewPar *ins)
 {
-    LNewPar *lir = new LNewPar(useRegister(ins->forkJoinSlice()), temp(), temp());
+    LNewPar *lir = new(alloc()) LNewPar(useRegister(ins->forkJoinSlice()), temp(), temp());
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitNewDenseArrayPar(MNewDenseArrayPar *ins)
 {
     LNewDenseArrayPar *lir =
-        new LNewDenseArrayPar(useFixed(ins->forkJoinSlice(), CallTempReg0),
-                              useFixed(ins->length(), CallTempReg1),
-                              tempFixed(CallTempReg2),
-                              tempFixed(CallTempReg3),
-                              tempFixed(CallTempReg4));
+        new(alloc()) LNewDenseArrayPar(useFixed(ins->forkJoinSlice(), CallTempReg0),
+                                       useFixed(ins->length(), CallTempReg1),
+                                       tempFixed(CallTempReg2),
+                                       tempFixed(CallTempReg3),
+                                       tempFixed(CallTempReg4));
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitStoreSlot(MStoreSlot *ins)
 {
     LInstruction *lir;
 
     switch (ins->value()->type()) {
       case MIRType_Value:
-        lir = new LStoreSlotV(useRegister(ins->slots()));
+        lir = new(alloc()) LStoreSlotV(useRegister(ins->slots()));
         if (!useBox(lir, LStoreSlotV::Value, ins->value()))
             return false;
         return add(lir, ins);
 
       case MIRType_Double:
-        return add(new LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
+        return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
 
       case MIRType_Float32:
         MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be stored in a slot.");
 
       default:
-        return add(new LStoreSlotT(useRegister(ins->slots()), useRegisterOrConstant(ins->value())),
+        return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegisterOrConstant(ins->value())),
                    ins);
     }
 
     return true;
 }
 
 bool
 LIRGenerator::visitTypeBarrier(MTypeBarrier *ins)
@@ -2133,38 +2135,38 @@ LIRGenerator::visitTypeBarrier(MTypeBarr
     MIRType inputType = ins->getOperand(0)->type();
     DebugOnly<MIRType> outputType = ins->type();
 
     JS_ASSERT(inputType == outputType);
 
     // Handle typebarrier that will always bail.
     // (Emit LBail for visibility).
     if (ins->alwaysBails()) {
-        LBail *bail = new LBail();
+        LBail *bail = new(alloc()) LBail();
         if (!assignSnapshot(bail))
             return false;
         return redefine(ins, ins->input()) && add(bail, ins);
     }
 
     // Handle typebarrier with Value as input.
     if (inputType == MIRType_Value) {
         LDefinition tmp = needTemp ? temp() : tempToUnbox();
-        LTypeBarrierV *barrier = new LTypeBarrierV(tmp);
+        LTypeBarrierV *barrier = new(alloc()) LTypeBarrierV(tmp);
         if (!useBox(barrier, LTypeBarrierV::Input, ins->input()))
             return false;
         if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->input()) && add(barrier, ins);
     }
 
     // Handle typebarrier with specific TypeObject/SingleObjects.
     if (inputType == MIRType_Object && !types->hasType(types::Type::AnyObjectType()))
     {
         LDefinition tmp = needTemp ? temp() : LDefinition::BogusTemp();
-        LTypeBarrierO *barrier = new LTypeBarrierO(useRegister(ins->getOperand(0)), tmp);
+        LTypeBarrierO *barrier = new(alloc()) LTypeBarrierO(useRegister(ins->getOperand(0)), tmp);
         if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->getOperand(0)) && add(barrier, ins);
     }
 
     // Handle remaining cases: No-op, unbox did everything.
     return redefine(ins, ins->getOperand(0));
 }
@@ -2174,40 +2176,40 @@ LIRGenerator::visitMonitorTypes(MMonitor
 {
     // Requesting a non-GC pointer is safe here since we never re-enter C++
     // from inside a type check.
 
     const types::TemporaryTypeSet *types = ins->typeSet();
     bool needTemp = !types->unknownObject() && types->getObjectCount() > 0;
     LDefinition tmp = needTemp ? temp() : tempToUnbox();
 
-    LMonitorTypes *lir = new LMonitorTypes(tmp);
+    LMonitorTypes *lir = new(alloc()) LMonitorTypes(tmp);
     if (!useBox(lir, LMonitorTypes::Input, ins->input()))
         return false;
     return assignSnapshot(lir, Bailout_Normal) && add(lir, ins);
 }
 
 bool
 LIRGenerator::visitPostWriteBarrier(MPostWriteBarrier *ins)
 {
 #ifdef JSGC_GENERATIONAL
     if (!ins->hasValue()) {
         LPostWriteBarrierAllSlots *lir =
-            new LPostWriteBarrierAllSlots(useRegisterOrConstant(ins->object()));
+            new(alloc()) LPostWriteBarrierAllSlots(useRegisterOrConstant(ins->object()));
         return add(lir, ins) && assignSafepoint(lir, ins);
     }
     switch (ins->value()->type()) {
       case MIRType_Object: {
-        LPostWriteBarrierO *lir = new LPostWriteBarrierO(useRegisterOrConstant(ins->object()),
+        LPostWriteBarrierO *lir = new(alloc()) LPostWriteBarrierO(useRegisterOrConstant(ins->object()),
                                                          useRegister(ins->value()));
         return add(lir, ins) && assignSafepoint(lir, ins);
       }
       case MIRType_Value: {
         LPostWriteBarrierV *lir =
-            new LPostWriteBarrierV(useRegisterOrConstant(ins->object()), tempToUnbox());
+            new(alloc()) LPostWriteBarrierV(useRegisterOrConstant(ins->object()), tempToUnbox());
         if (!useBox(lir, LPostWriteBarrierV::Input, ins->value()))
             return false;
         return add(lir, ins) && assignSafepoint(lir, ins);
       }
       default:
         // Currently, only objects can be in the nursery. Other instruction
         // types cannot hold nursery pointers.
         return true;
@@ -2215,67 +2217,67 @@ LIRGenerator::visitPostWriteBarrier(MPos
 #endif // JSGC_GENERATIONAL
     return true;
 }
 
 bool
 LIRGenerator::visitArrayLength(MArrayLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
-    return define(new LArrayLength(useRegisterAtStart(ins->elements())), ins);
+    return define(new(alloc()) LArrayLength(useRegisterAtStart(ins->elements())), ins);
 }
 
 bool
 LIRGenerator::visitSetArrayLength(MSetArrayLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     JS_ASSERT(ins->index()->isConstant());
-    return add(new LSetArrayLength(useRegister(ins->elements()),
-                                   useRegisterOrConstant(ins->index())), ins);
+    return add(new(alloc()) LSetArrayLength(useRegister(ins->elements()),
+                                            useRegisterOrConstant(ins->index())), ins);
 }
 
 bool
 LIRGenerator::visitTypedArrayLength(MTypedArrayLength *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
-    return define(new LTypedArrayLength(useRegisterAtStart(ins->object())), ins);
+    return define(new(alloc()) LTypedArrayLength(useRegisterAtStart(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitTypedArrayElements(MTypedArrayElements *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Elements);
-    return define(new LTypedArrayElements(useRegisterAtStart(ins->object())), ins);
+    return define(new(alloc()) LTypedArrayElements(useRegisterAtStart(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitTypedObjectElements(MTypedObjectElements *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Elements);
-    return define(new LTypedObjectElements(useRegisterAtStart(ins->object())), ins);
+    return define(new(alloc()) LTypedObjectElements(useRegisterAtStart(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitInitializedLength(MInitializedLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
-    return define(new LInitializedLength(useRegisterAtStart(ins->elements())), ins);
+    return define(new(alloc()) LInitializedLength(useRegisterAtStart(ins->elements())), ins);
 }
 
 bool
 LIRGenerator::visitSetInitializedLength(MSetInitializedLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     JS_ASSERT(ins->index()->isConstant());
-    return add(new LSetInitializedLength(useRegister(ins->elements()),
-                                         useRegisterOrConstant(ins->index())), ins);
+    return add(new(alloc()) LSetInitializedLength(useRegister(ins->elements()),
+                                                  useRegisterOrConstant(ins->index())), ins);
 }
 
 bool
 LIRGenerator::visitNot(MNot *ins)
 {
     MDefinition *op = ins->operand();
 
     // String is converted to length of string in the type analysis phase (see
@@ -2286,78 +2288,78 @@ LIRGenerator::visitNot(MNot *ins)
     // - int32: LCompare(x, 0)
     // - double: LCompare(x, 0)
     // - null or undefined: true
     // - object: false if it never emulates undefined, else LNotO(x)
     switch (op->type()) {
       case MIRType_Boolean: {
         MConstant *cons = MConstant::New(alloc(), Int32Value(1));
         ins->block()->insertBefore(ins, cons);
-        return lowerForALU(new LBitOpI(JSOP_BITXOR), ins, op, cons);
+        return lowerForALU(new(alloc()) LBitOpI(JSOP_BITXOR), ins, op, cons);
       }
       case MIRType_Int32: {
-        return define(new LNotI(useRegisterAtStart(op)), ins);
+        return define(new(alloc()) LNotI(useRegisterAtStart(op)), ins);
       }
       case MIRType_Double:
-        return define(new LNotD(useRegister(op)), ins);
+        return define(new(alloc()) LNotD(useRegister(op)), ins);
       case MIRType_Float32:
-        return define(new LNotF(useRegister(op)), ins);
+        return define(new(alloc()) LNotF(useRegister(op)), ins);
       case MIRType_Undefined:
       case MIRType_Null:
-        return define(new LInteger(1), ins);
+        return define(new(alloc()) LInteger(1), ins);
       case MIRType_Object: {
         // Objects that don't emulate undefined can be constant-folded.
         if (!ins->operandMightEmulateUndefined())
-            return define(new LInteger(0), ins);
+            return define(new(alloc()) LInteger(0), ins);
         // All others require further work.
-        return define(new LNotO(useRegister(op)), ins);
+        return define(new(alloc()) LNotO(useRegister(op)), ins);
       }
       case MIRType_Value: {
         LDefinition temp0, temp1;
         if (ins->operandMightEmulateUndefined()) {
             temp0 = temp();
             temp1 = temp();
         } else {
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new LNotV(tempFloat(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
       }
 
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected MIRType.");
     }
 }
 
 bool
 LIRGenerator::visitBoundsCheck(MBoundsCheck *ins)
 {
     LInstruction *check;
     if (ins->minimum() || ins->maximum()) {
-        check = new LBoundsCheckRange(useRegisterOrConstant(ins->index()),
-                                      useAny(ins->length()),
-                                      temp());
+        check = new(alloc()) LBoundsCheckRange(useRegisterOrConstant(ins->index()),
+                                               useAny(ins->length()),
+                                               temp());
     } else {
-        check = new LBoundsCheck(useRegisterOrConstant(ins->index()),
-                                 useAnyOrConstant(ins->length()));
+        check = new(alloc()) LBoundsCheck(useRegisterOrConstant(ins->index()),
+                                          useAnyOrConstant(ins->length()));
     }
     return assignSnapshot(check, Bailout_BoundsCheck) && add(check, ins);
 }
 
 bool
 LIRGenerator::visitBoundsCheckLower(MBoundsCheckLower *ins)
 {
     if (!ins->fallible())
         return true;
 
-    LInstruction *check = new LBoundsCheckLower(useRegister(ins->index()));
+    LInstruction *check = new(alloc()) LBoundsCheckLower(useRegister(ins->index()));
     return assignSnapshot(check, Bailout_BoundsCheck) && add(check, ins);
 }
 
 bool
 LIRGenerator::visitInArray(MInArray *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
@@ -2366,64 +2368,64 @@ LIRGenerator::visitInArray(MInArray *ins
     JS_ASSERT(ins->type() == MIRType_Boolean);
 
     LAllocation object;
     if (ins->needsNegativeIntCheck())
         object = useRegister(ins->object());
     else
         object = LConstantIndex::Bogus();
 
-    LInArray *lir = new LInArray(useRegister(ins->elements()),
-                                 useRegisterOrConstant(ins->index()),
-                                 useRegister(ins->initLength()),
-                                 object);
+    LInArray *lir = new(alloc()) LInArray(useRegister(ins->elements()),
+                                          useRegisterOrConstant(ins->index()),
+                                          useRegister(ins->initLength()),
+                                          object);
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitLoadElement(MLoadElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     switch (ins->type()) {
       case MIRType_Value:
       {
-        LLoadElementV *lir = new LLoadElementV(useRegister(ins->elements()),
+        LLoadElementV *lir = new(alloc()) LLoadElementV(useRegister(ins->elements()),
                                                useRegisterOrConstant(ins->index()));
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return defineBox(lir, ins);
       }
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
-        LLoadElementT *lir = new LLoadElementT(useRegister(ins->elements()),
+        LLoadElementT *lir = new(alloc()) LLoadElementT(useRegister(ins->elements()),
                                                useRegisterOrConstant(ins->index()));
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return define(lir, ins);
       }
     }
 }
 
 bool
 LIRGenerator::visitLoadElementHole(MLoadElementHole *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->initLength()->type() == MIRType_Int32);
     JS_ASSERT(ins->type() == MIRType_Value);
 
-    LLoadElementHole *lir = new LLoadElementHole(useRegister(ins->elements()),
-                                                 useRegisterOrConstant(ins->index()),
-                                                 useRegister(ins->initLength()));
+    LLoadElementHole *lir = new(alloc()) LLoadElementHole(useRegister(ins->elements()),
+                                                          useRegisterOrConstant(ins->index()),
+                                                          useRegister(ins->initLength()));
     if (ins->needsNegativeIntCheck() && !assignSnapshot(lir))
         return false;
     return defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitStoreElement(MStoreElement *ins)
 {
@@ -2431,28 +2433,28 @@ LIRGenerator::visitStoreElement(MStoreEl
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     const LUse elements = useRegister(ins->elements());
     const LAllocation index = useRegisterOrConstant(ins->index());
 
     switch (ins->value()->type()) {
       case MIRType_Value:
       {
-        LInstruction *lir = new LStoreElementV(elements, index);
+        LInstruction *lir = new(alloc()) LStoreElementV(elements, index);
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         if (!useBox(lir, LStoreElementV::Value, ins->value()))
             return false;
         return add(lir, ins);
       }
 
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
-        LInstruction *lir = new LStoreElementT(elements, index, value);
+        LInstruction *lir = new(alloc()) LStoreElementT(elements, index, value);
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return add(lir, ins);
       }
     }
 }
 
 bool
@@ -2463,109 +2465,109 @@ LIRGenerator::visitStoreElementHole(MSto
 
     const LUse object = useRegister(ins->object());
     const LUse elements = useRegister(ins->elements());
     const LAllocation index = useRegisterOrConstant(ins->index());
 
     LInstruction *lir;
     switch (ins->value()->type()) {
       case MIRType_Value:
-        lir = new LStoreElementHoleV(object, elements, index);
+        lir = new(alloc()) LStoreElementHoleV(object, elements, index);
         if (!useBox(lir, LStoreElementHoleV::Value, ins->value()))
             return false;
         break;
 
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
-        lir = new LStoreElementHoleT(object, elements, index, value);
+        lir = new(alloc()) LStoreElementHoleT(object, elements, index, value);
         break;
       }
     }
 
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitEffectiveAddress(MEffectiveAddress *ins)
 {
-    return define(new LEffectiveAddress(useRegister(ins->base()), useRegister(ins->index())), ins);
+    return define(new(alloc()) LEffectiveAddress(useRegister(ins->base()), useRegister(ins->index())), ins);
 }
 
 bool
 LIRGenerator::visitArrayPopShift(MArrayPopShift *ins)
 {
     LUse object = useRegister(ins->object());
 
     switch (ins->type()) {
       case MIRType_Value:
       {
-        LArrayPopShiftV *lir = new LArrayPopShiftV(object, temp(), temp());
+        LArrayPopShiftV *lir = new(alloc()) LArrayPopShiftV(object, temp(), temp());
         return defineBox(lir, ins) && assignSafepoint(lir, ins);
       }
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
-        LArrayPopShiftT *lir = new LArrayPopShiftT(object, temp(), temp());
+        LArrayPopShiftT *lir = new(alloc()) LArrayPopShiftT(object, temp(), temp());
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
     }
 }
 
 bool
 LIRGenerator::visitArrayPush(MArrayPush *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Int32);
 
     LUse object = useRegister(ins->object());
 
     switch (ins->value()->type()) {
       case MIRType_Value:
       {
-        LArrayPushV *lir = new LArrayPushV(object, temp());
+        LArrayPushV *lir = new(alloc()) LArrayPushV(object, temp());
         if (!useBox(lir, LArrayPushV::Value, ins->value()))
             return false;
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
 
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
-        LArrayPushT *lir = new LArrayPushT(object, value, temp());
+        LArrayPushT *lir = new(alloc()) LArrayPushT(object, value, temp());
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
     }
 }
 
 bool
 LIRGenerator::visitArrayConcat(MArrayConcat *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->lhs()->type() == MIRType_Object);
     JS_ASSERT(ins->rhs()->type() == MIRType_Object);
 
-    LArrayConcat *lir = new LArrayConcat(useFixed(ins->lhs(), CallTempReg1),
-                                         useFixed(ins->rhs(), CallTempReg2),
-                                         tempFixed(CallTempReg3),
-                                         tempFixed(CallTempReg4));
+    LArrayConcat *lir = new(alloc()) LArrayConcat(useFixed(ins->lhs(), CallTempReg1),
+                                                  useFixed(ins->rhs(), CallTempReg2),
+                                                  tempFixed(CallTempReg3),
+                                                  tempFixed(CallTempReg4));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitStringSplit(MStringSplit *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     JS_ASSERT(ins->separator()->type() == MIRType_String);
 
-    LStringSplit *lir = new LStringSplit(useRegisterAtStart(ins->string()),
-                                         useRegisterAtStart(ins->separator()));
+    LStringSplit *lir = new(alloc()) LStringSplit(useRegisterAtStart(ins->string()),
+                                                  useRegisterAtStart(ins->separator()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitLoadTypedArrayElement(MLoadTypedArrayElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
@@ -2575,40 +2577,40 @@ LIRGenerator::visitLoadTypedArrayElement
 
     JS_ASSERT(IsNumberType(ins->type()));
 
     // We need a temp register for Uint32Array with known double result.
     LDefinition tempDef = LDefinition::BogusTemp();
     if (ins->arrayType() == ScalarTypeRepresentation::TYPE_UINT32 && IsFloatingPointType(ins->type()))
         tempDef = temp();
 
-    LLoadTypedArrayElement *lir = new LLoadTypedArrayElement(elements, index, tempDef);
+    LLoadTypedArrayElement *lir = new(alloc()) LLoadTypedArrayElement(elements, index, tempDef);
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 {
     MDefinition *in = ins->input();
 
     switch (in->type()) {
       case MIRType_Boolean:
         return redefine(ins, in);
 
       case MIRType_Int32:
-        return defineReuseInput(new LClampIToUint8(useRegisterAtStart(in)), ins, 0);
+        return defineReuseInput(new(alloc()) LClampIToUint8(useRegisterAtStart(in)), ins, 0);
 
       case MIRType_Double:
-        return define(new LClampDToUint8(useRegisterAtStart(in), tempCopy(in, 0)), ins);
+        return define(new(alloc()) LClampDToUint8(useRegisterAtStart(in), tempCopy(in, 0)), ins);
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new LClampVToUint8(tempFloat());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
       }
 
       default:
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
@@ -2620,27 +2622,27 @@ LIRGenerator::visitLoadTypedArrayElement
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     JS_ASSERT(ins->type() == MIRType_Value);
 
     const LUse object = useRegister(ins->object());
     const LAllocation index = useRegisterOrConstant(ins->index());
 
-    LLoadTypedArrayElementHole *lir = new LLoadTypedArrayElementHole(object, index);
+    LLoadTypedArrayElementHole *lir = new(alloc()) LLoadTypedArrayElementHole(object, index);
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitLoadTypedArrayElementStatic(MLoadTypedArrayElementStatic *ins)
 {
     LLoadTypedArrayElementStatic *lir =
-        new LLoadTypedArrayElementStatic(useRegisterAtStart(ins->ptr()));
+        new(alloc()) LLoadTypedArrayElementStatic(useRegisterAtStart(ins->ptr()));
 
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitStoreTypedArrayElement(MStoreTypedArrayElement *ins)
@@ -2662,17 +2664,17 @@ LIRGenerator::visitStoreTypedArrayElemen
     LAllocation index = useRegisterOrConstant(ins->index());
     LAllocation value;
 
     // For byte arrays, the value has to be in a byte register on x86.
     if (ins->isByteArray())
         value = useByteOpRegisterOrNonDoubleConstant(ins->value());
     else
         value = useRegisterOrNonDoubleConstant(ins->value());
-    return add(new LStoreTypedArrayElement(elements, index, value), ins);
+    return add(new(alloc()) LStoreTypedArrayElement(elements, index, value), ins);
 }
 
 bool
 LIRGenerator::visitStoreTypedArrayElementHole(MStoreTypedArrayElementHole *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->length()->type() == MIRType_Int32);
@@ -2692,176 +2694,175 @@ LIRGenerator::visitStoreTypedArrayElemen
     LAllocation index = useRegisterOrConstant(ins->index());
     LAllocation value;
 
     // For byte arrays, the value has to be in a byte register on x86.
     if (ins->isByteArray())
         value = useByteOpRegisterOrNonDoubleConstant(ins->value());
     else
         value = useRegisterOrNonDoubleConstant(ins->value());
-    return add(new LStoreTypedArrayElementHole(elements, length, index, value), ins);
+    return add(new(alloc()) LStoreTypedArrayElementHole(elements, length, index, value), ins);
 }
 
 bool
 LIRGenerator::visitLoadFixedSlot(MLoadFixedSlot *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
 
     if (ins->type() == MIRType_Value) {
-        LLoadFixedSlotV *lir = new LLoadFixedSlotV(useRegister(ins->object()));
+        LLoadFixedSlotV *lir = new(alloc()) LLoadFixedSlotV(useRegister(ins->object()));
         return defineBox(lir, ins);
     }
 
-    LLoadFixedSlotT *lir = new LLoadFixedSlotT(useRegister(ins->object()));
+    LLoadFixedSlotT *lir = new(alloc()) LLoadFixedSlotT(useRegister(ins->object()));
     return define(lir, ins);
 }
 
 bool
 LIRGenerator::visitStoreFixedSlot(MStoreFixedSlot *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
 
     if (ins->value()->type() == MIRType_Value) {
-        LStoreFixedSlotV *lir = new LStoreFixedSlotV(useRegister(ins->object()));
+        LStoreFixedSlotV *lir = new(alloc()) LStoreFixedSlotV(useRegister(ins->object()));
 
         if (!useBox(lir, LStoreFixedSlotV::Value, ins->value()))
             return false;
         return add(lir, ins);
     }
 
-    LStoreFixedSlotT *lir = new LStoreFixedSlotT(useRegister(ins->object()),
-                                                 useRegisterOrConstant(ins->value()));
-
+    LStoreFixedSlotT *lir = new(alloc()) LStoreFixedSlotT(useRegister(ins->object()),
+                                                          useRegisterOrConstant(ins->value()));
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetNameCache(MGetNameCache *ins)
 {
     JS_ASSERT(ins->scopeObj()->type() == MIRType_Object);
 
-    LGetNameCache *lir = new LGetNameCache(useRegister(ins->scopeObj()));
+    LGetNameCache *lir = new(alloc()) LGetNameCache(useRegister(ins->scopeObj()));
     if (!defineBox(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallGetIntrinsicValue(MCallGetIntrinsicValue *ins)
 {
-    LCallGetIntrinsicValue *lir = new LCallGetIntrinsicValue();
+    LCallGetIntrinsicValue *lir = new(alloc()) LCallGetIntrinsicValue();
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallsiteCloneCache(MCallsiteCloneCache *ins)
 {
     JS_ASSERT(ins->callee()->type() == MIRType_Object);
 
-    LCallsiteCloneCache *lir = new LCallsiteCloneCache(useRegister(ins->callee()));
+    LCallsiteCloneCache *lir = new(alloc()) LCallsiteCloneCache(useRegister(ins->callee()));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetPropertyCache(MGetPropertyCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
-        LGetPropertyCacheV *lir = new LGetPropertyCacheV(useRegister(ins->object()));
+        LGetPropertyCacheV *lir = new(alloc()) LGetPropertyCacheV(useRegister(ins->object()));
         if (!defineBox(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
     }
 
-    LGetPropertyCacheT *lir = new LGetPropertyCacheT(useRegister(ins->object()),
-                                                     tempForDispatchCache(ins->type()));
+    LGetPropertyCacheT *lir = new(alloc()) LGetPropertyCacheT(useRegister(ins->object()),
+                                                              tempForDispatchCache(ins->type()));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     if (ins->type() == MIRType_Value) {
-        LGetPropertyPolymorphicV *lir = new LGetPropertyPolymorphicV(useRegister(ins->obj()));
+        LGetPropertyPolymorphicV *lir = new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->obj()));
         return assignSnapshot(lir, Bailout_ShapeGuard) && defineBox(lir, ins);
     }
 
     LDefinition maybeTemp = (ins->type() == MIRType_Double) ? temp() : LDefinition::BogusTemp();
-    LGetPropertyPolymorphicT *lir = new LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
+    LGetPropertyPolymorphicT *lir = new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
     return assignSnapshot(lir, Bailout_ShapeGuard) && define(lir, ins);
 }
 
 bool
 LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     if (ins->value()->type() == MIRType_Value) {
-        LSetPropertyPolymorphicV *lir = new LSetPropertyPolymorphicV(useRegister(ins->obj()), temp());
+        LSetPropertyPolymorphicV *lir = new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->obj()), temp());
         if (!useBox(lir, LSetPropertyPolymorphicV::Value, ins->value()))
             return false;
         return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
     }
 
     LAllocation value = useRegisterOrConstant(ins->value());
     LSetPropertyPolymorphicT *lir =
-        new LSetPropertyPolymorphicT(useRegister(ins->obj()), value, ins->value()->type(), temp());
+        new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->obj()), value, ins->value()->type(), temp());
     return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetElementCache(MGetElementCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
 
     if (ins->type() == MIRType_Value) {
         JS_ASSERT(ins->index()->type() == MIRType_Value);
-        LGetElementCacheV *lir = new LGetElementCacheV(useRegister(ins->object()));
+        LGetElementCacheV *lir = new(alloc()) LGetElementCacheV(useRegister(ins->object()));
         if (!useBox(lir, LGetElementCacheV::Index, ins->index()))
             return false;
         return defineBox(lir, ins) && assignSafepoint(lir, ins);
     }
 
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
-    LGetElementCacheT *lir = new LGetElementCacheT(useRegister(ins->object()),
-                                                   useRegister(ins->index()),
-                                                   tempForDispatchCache(ins->type()));
+    LGetElementCacheT *lir = new(alloc()) LGetElementCacheT(useRegister(ins->object()),
+                                                            useRegister(ins->index()),
+                                                            tempForDispatchCache(ins->type()));
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitBindNameCache(MBindNameCache *ins)
 {
     JS_ASSERT(ins->scopeChain()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Object);
 
-    LBindNameCache *lir = new LBindNameCache(useRegister(ins->scopeChain()));
+    LBindNameCache *lir = new(alloc()) LBindNameCache(useRegister(ins->scopeChain()));
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGuardObjectIdentity(MGuardObjectIdentity *ins)
 {
-    LGuardObjectIdentity *guard = new LGuardObjectIdentity(useRegister(ins->obj()));
+    LGuardObjectIdentity *guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->obj()));
     return assignSnapshot(guard) && add(guard, ins) && redefine(ins, ins->obj());
 }
 
 bool
 LIRGenerator::visitGuardClass(MGuardClass *ins)
 {
     LDefinition t = temp();
-    LGuardClass *guard = new LGuardClass(useRegister(ins->obj()), t);
+    LGuardClass *guard = new(alloc()) LGuardClass(useRegister(ins->obj()), t);
     return assignSnapshot(guard) && add(guard, ins);
 }
 
 bool
 LIRGenerator::visitGuardObject(MGuardObject *ins)
 {
     // The type policy does all the work, so at this point the input
     // is guaranteed to be an object.
@@ -2882,113 +2883,113 @@ bool
 LIRGenerator::visitAssertRange(MAssertRange *ins)
 {
     MDefinition *input = ins->input();
     LInstruction *lir = nullptr;
 
     switch (input->type()) {
       case MIRType_Boolean:
       case MIRType_Int32:
-        lir = new LAssertRangeI(useRegisterAtStart(input));
+        lir = new(alloc()) LAssertRangeI(useRegisterAtStart(input));
         break;
 
       case MIRType_Double:
-        lir = new LAssertRangeD(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
         break;
 
       case MIRType_Float32:
-        lir = new LAssertRangeF(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
         break;
 
       case MIRType_Value:
-        lir = new LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
 
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected Range for MIRType");
         break;
     }
 
     lir->setMir(ins);
     return add(lir);
 }
 
 bool
 LIRGenerator::visitCallGetProperty(MCallGetProperty *ins)
 {
-    LCallGetProperty *lir = new LCallGetProperty();
+    LCallGetProperty *lir = new(alloc()) LCallGetProperty();
     if (!useBoxAtStart(lir, LCallGetProperty::Value, ins->value()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallGetElement(MCallGetElement *ins)
 {
     JS_ASSERT(ins->lhs()->type() == MIRType_Value);
     JS_ASSERT(ins->rhs()->type() == MIRType_Value);
 
-    LCallGetElement *lir = new LCallGetElement();
+    LCallGetElement *lir = new(alloc()) LCallGetElement();
     if (!useBoxAtStart(lir, LCallGetElement::LhsInput, ins->lhs()))
         return false;
     if (!useBoxAtStart(lir, LCallGetElement::RhsInput, ins->rhs()))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallSetProperty(MCallSetProperty *ins)
 {
-    LInstruction *lir = new LCallSetProperty(useRegisterAtStart(ins->object()));
+    LInstruction *lir = new(alloc()) LCallSetProperty(useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallSetProperty::Value, ins->value()))
         return false;
     if (!add(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitDeleteProperty(MDeleteProperty *ins)
 {
-    LCallDeleteProperty *lir = new LCallDeleteProperty();
+    LCallDeleteProperty *lir = new(alloc()) LCallDeleteProperty();
     if(!useBoxAtStart(lir, LCallDeleteProperty::Value, ins->value()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitDeleteElement(MDeleteElement *ins)
 {
-    LCallDeleteElement *lir = new LCallDeleteElement();
+    LCallDeleteElement *lir = new(alloc()) LCallDeleteElement();
     if(!useBoxAtStart(lir, LCallDeleteElement::Value, ins->value()))
         return false;
     if(!useBoxAtStart(lir, LCallDeleteElement::Index, ins->index()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitSetPropertyCache(MSetPropertyCache *ins)
 {
     LUse obj = useRegisterAtStart(ins->object());
     LDefinition slots = tempCopy(ins->object(), 0);
     LDefinition dispatchTemp = tempForDispatchCache();
 
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
-        lir = new LSetPropertyCacheV(obj, slots, dispatchTemp);
+        lir = new(alloc()) LSetPropertyCacheV(obj, slots, dispatchTemp);
         if (!useBox(lir, LSetPropertyCacheV::Value, ins->value()))
             return false;
     } else {
         LAllocation value = useRegisterOrConstant(ins->value());
-        lir = new LSetPropertyCacheT(obj, slots, value, dispatchTemp, ins->value()->type());
+        lir = new(alloc()) LSetPropertyCacheT(obj, slots, value, dispatchTemp, ins->value()->type());
     }
 
     if (!add(lir, ins))
         return false;
 
     return assignSafepoint(lir, ins);
 }
 
@@ -2999,321 +3000,320 @@ LIRGenerator::visitSetElementCache(MSetE
     JS_ASSERT(ins->index()->type() == MIRType_Value);
 
     // Due to lack of registers on x86, we reuse the object register as a
     // temporary. This register may be used in a 1-byte store, which on x86
     // again has constraints; thus the use of |useByteOpRegister| over
     // |useRegister| below.
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
-        lir = new LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                    temp(), tempFloat());
+        lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
+                                             temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
         if (!useBox(lir, LSetElementCacheV::Value, ins->value()))
             return false;
     } else {
-        lir = new LSetElementCacheT(
-            useByteOpRegister(ins->object()),
-            useRegisterOrConstant(ins->value()),
-            tempToUnbox(), temp(), tempFloat());
+        lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
+                                             useRegisterOrConstant(ins->value()),
+                                             tempToUnbox(), temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
     }
 
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallSetElement(MCallSetElement *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->index()->type() == MIRType_Value);
     JS_ASSERT(ins->value()->type() == MIRType_Value);
 
-    LCallSetElement *lir = new LCallSetElement();
+    LCallSetElement *lir = new(alloc()) LCallSetElement();
     lir->setOperand(0, useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallSetElement::Index, ins->index()))
         return false;
     if (!useBoxAtStart(lir, LCallSetElement::Value, ins->value()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallInitElementArray(MCallInitElementArray *ins)
 {
-    LCallInitElementArray *lir = new LCallInitElementArray();
+    LCallInitElementArray *lir = new(alloc()) LCallInitElementArray();
     lir->setOperand(0, useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallInitElementArray::Value, ins->value()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIteratorStart(MIteratorStart *ins)
 {
     // Call a stub if this is not a simple for-in loop.
     if (ins->flags() != JSITER_ENUMERATE) {
-        LCallIteratorStart *lir = new LCallIteratorStart(useRegisterAtStart(ins->object()));
+        LCallIteratorStart *lir = new(alloc()) LCallIteratorStart(useRegisterAtStart(ins->object()));
         return defineReturn(lir, ins) && assignSafepoint(lir, ins);
     }
 
-    LIteratorStart *lir = new LIteratorStart(useRegister(ins->object()), temp(), temp(), temp());
+    LIteratorStart *lir = new(alloc()) LIteratorStart(useRegister(ins->object()), temp(), temp(), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIteratorNext(MIteratorNext *ins)
 {
-    LIteratorNext *lir = new LIteratorNext(useRegister(ins->iterator()), temp());
+    LIteratorNext *lir = new(alloc()) LIteratorNext(useRegister(ins->iterator()), temp());
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIteratorMore(MIteratorMore *ins)
 {
-    LIteratorMore *lir = new LIteratorMore(useRegister(ins->iterator()), temp());
+    LIteratorMore *lir = new(alloc()) LIteratorMore(useRegister(ins->iterator()), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIteratorEnd(MIteratorEnd *ins)
 {
-    LIteratorEnd *lir = new LIteratorEnd(useRegister(ins->iterator()), temp(), temp(), temp());
+    LIteratorEnd *lir = new(alloc()) LIteratorEnd(useRegister(ins->iterator()), temp(), temp(), temp());
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitStringLength(MStringLength *ins)
 {
     JS_ASSERT(ins->string()->type() == MIRType_String);
-    return define(new LStringLength(useRegisterAtStart(ins->string())), ins);
+    return define(new(alloc()) LStringLength(useRegisterAtStart(ins->string())), ins);
 }
 
 bool
 LIRGenerator::visitArgumentsLength(MArgumentsLength *ins)
 {
-    return define(new LArgumentsLength(), ins);
+    return define(new(alloc()) LArgumentsLength(), ins);
 }
 
 bool
 LIRGenerator::visitGetFrameArgument(MGetFrameArgument *ins)
 {
-    LGetFrameArgument *lir = new LGetFrameArgument(useRegisterOrConstant(ins->index()));
+    LGetFrameArgument *lir = new(alloc()) LGetFrameArgument(useRegisterOrConstant(ins->index()));
     return defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitSetFrameArgument(MSetFrameArgument *ins)
 {
     MDefinition *input = ins->input();
 
     if (input->type() == MIRType_Value) {
-        LSetFrameArgumentV *lir = new LSetFrameArgumentV();
+        LSetFrameArgumentV *lir = new(alloc()) LSetFrameArgumentV();
         if (!useBox(lir, LSetFrameArgumentV::Input, input))
             return false;
         return add(lir, ins);
     }
 
     if (input->type() == MIRType_Undefined || input->type() == MIRType_Null) {
         Value val = input->type() == MIRType_Undefined ? UndefinedValue() : NullValue();
-        LSetFrameArgumentC *lir = new LSetFrameArgumentC(val);
+        LSetFrameArgumentC *lir = new(alloc()) LSetFrameArgumentC(val);
         return add(lir, ins);
     }
 
-    LSetFrameArgumentT *lir = new LSetFrameArgumentT(useRegister(input));
+    LSetFrameArgumentT *lir = new(alloc()) LSetFrameArgumentT(useRegister(input));
     return add(lir, ins);
 }
 
 bool
 LIRGenerator::visitRunOncePrologue(MRunOncePrologue *ins)
 {
-    LRunOncePrologue *lir = new LRunOncePrologue;
+    LRunOncePrologue *lir = new(alloc()) LRunOncePrologue;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitRest(MRest *ins)
 {
     JS_ASSERT(ins->numActuals()->type() == MIRType_Int32);
 
-    LRest *lir = new LRest(useFixed(ins->numActuals(), CallTempReg0),
-                           tempFixed(CallTempReg1),
-                           tempFixed(CallTempReg2),
-                           tempFixed(CallTempReg3));
+    LRest *lir = new(alloc()) LRest(useFixed(ins->numActuals(), CallTempReg0),
+                                    tempFixed(CallTempReg1),
+                                    tempFixed(CallTempReg2),
+                                    tempFixed(CallTempReg3));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitRestPar(MRestPar *ins)
 {
     JS_ASSERT(ins->numActuals()->type() == MIRType_Int32);
 
-    LRestPar *lir = new LRestPar(useFixed(ins->forkJoinSlice(), CallTempReg0),
-                                 useFixed(ins->numActuals(), CallTempReg1),
-                                 tempFixed(CallTempReg2),
-                                 tempFixed(CallTempReg3),
-                                 tempFixed(CallTempReg4));
+    LRestPar *lir = new(alloc()) LRestPar(useFixed(ins->forkJoinSlice(), CallTempReg0),
+                                          useFixed(ins->numActuals(), CallTempReg1),
+                                          tempFixed(CallTempReg2),
+                                          tempFixed(CallTempReg3),
+                                          tempFixed(CallTempReg4));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitThrow(MThrow *ins)
 {
     MDefinition *value = ins->getOperand(0);
     JS_ASSERT(value->type() == MIRType_Value);
 
-    LThrow *lir = new LThrow;
+    LThrow *lir = new(alloc()) LThrow;
     if (!useBoxAtStart(lir, LThrow::Value, value))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIn(MIn *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
 
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Object);
 
-    LIn *lir = new LIn(useRegisterAtStart(rhs));
+    LIn *lir = new(alloc()) LIn(useRegisterAtStart(rhs));
     if (!useBoxAtStart(lir, LIn::LHS, lhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitInstanceOf(MInstanceOf *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
 
     JS_ASSERT(lhs->type() == MIRType_Value || lhs->type() == MIRType_Object);
 
     if (lhs->type() == MIRType_Object) {
-        LInstanceOfO *lir = new LInstanceOfO(useRegister(lhs));
+        LInstanceOfO *lir = new(alloc()) LInstanceOfO(useRegister(lhs));
         return define(lir, ins) && assignSafepoint(lir, ins);
     }
 
-    LInstanceOfV *lir = new LInstanceOfV();
+    LInstanceOfV *lir = new(alloc()) LInstanceOfV();
     return useBox(lir, LInstanceOfV::LHS, lhs) && define(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitCallInstanceOf(MCallInstanceOf *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
 
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Object);
 
-    LCallInstanceOf *lir = new LCallInstanceOf(useRegisterAtStart(rhs));
+    LCallInstanceOf *lir = new(alloc()) LCallInstanceOf(useRegisterAtStart(rhs));
     if (!useBoxAtStart(lir, LCallInstanceOf::LHS, lhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitFunctionBoundary(MFunctionBoundary *ins)
 {
-    LFunctionBoundary *lir = new LFunctionBoundary(temp());
+    LFunctionBoundary *lir = new(alloc()) LFunctionBoundary(temp());
     if (!add(lir, ins))
         return false;
     // If slow assertions are enabled, then this node will result in a callVM
     // out to a C++ function for the assertions, so we will need a safepoint.
     return !GetIonContext()->runtime->spsProfiler().slowAssertionsEnabled() ||
            assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitIsCallable(MIsCallable *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Boolean);
-    return define(new LIsCallable(useRegister(ins->object())), ins);
+    return define(new(alloc()) LIsCallable(useRegister(ins->object())), ins);
 }
 
 bool
 LIRGenerator::visitHaveSameClass(MHaveSameClass *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
 
     JS_ASSERT(lhs->type() == MIRType_Object);
     JS_ASSERT(rhs->type() == MIRType_Object);
 
-    return define(new LHaveSameClass(useRegister(lhs), useRegister(rhs), temp()), ins);
+    return define(new(alloc()) LHaveSameClass(useRegister(lhs), useRegister(rhs), temp()), ins);
 }
 
 bool
 LIRGenerator::visitAsmJSLoadGlobalVar(MAsmJSLoadGlobalVar *ins)
 {
-    return define(new LAsmJSLoadGlobalVar, ins);
+    return define(new(alloc()) LAsmJSLoadGlobalVar, ins);
 }
 
 bool
 LIRGenerator::visitAsmJSStoreGlobalVar(MAsmJSStoreGlobalVar *ins)
 {
-    return add(new LAsmJSStoreGlobalVar(useRegisterAtStart(ins->value())), ins);
+    return add(new(alloc()) LAsmJSStoreGlobalVar(useRegisterAtStart(ins->value())), ins);
 }
 
 bool
 LIRGenerator::visitAsmJSLoadFFIFunc(MAsmJSLoadFFIFunc *ins)
 {
-    return define(new LAsmJSLoadFFIFunc, ins);
+    return define(new(alloc()) LAsmJSLoadFFIFunc, ins);
 }
 
 bool
 LIRGenerator::visitAsmJSParameter(MAsmJSParameter *ins)
 {
     ABIArg abi = ins->abi();
     if (abi.argInRegister())
-        return defineFixed(new LAsmJSParameter, ins, LAllocation(abi.reg()));
+        return defineFixed(new(alloc()) LAsmJSParameter, ins, LAllocation(abi.reg()));
 
     JS_ASSERT(ins->type() == MIRType_Int32 || ins->type() == MIRType_Double);
     LAllocation::Kind argKind = ins->type() == MIRType_Int32
                                 ? LAllocation::INT_ARGUMENT
                                 : LAllocation::DOUBLE_ARGUMENT;
-    return defineFixed(new LAsmJSParameter, ins, LArgument(argKind, abi.offsetFromArgBase()));
+    return defineFixed(new(alloc()) LAsmJSParameter, ins, LArgument(argKind, abi.offsetFromArgBase()));
 }
 
 bool
 LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
 {
     MDefinition *rval = ins->getOperand(0);
-    LAsmJSReturn *lir = new LAsmJSReturn;
+    LAsmJSReturn *lir = new(alloc()) LAsmJSReturn;
     if (rval->type() == MIRType_Double)
         lir->setOperand(0, useFixed(rval, ReturnFloatReg));
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
     else
         MOZ_ASSUME_UNREACHABLE("Unexpected asm.js return type");
     return add(lir);
 }
 
 bool
 LIRGenerator::visitAsmJSVoidReturn(MAsmJSVoidReturn *ins)
 {
-    return add(new LAsmJSVoidReturn);
+    return add(new(alloc()) LAsmJSVoidReturn);
 }
 
 bool
 LIRGenerator::visitAsmJSPassStackArg(MAsmJSPassStackArg *ins)
 {
     if (ins->arg()->type() == MIRType_Double) {
         JS_ASSERT(!ins->arg()->isEmittedAtUses());
-        return add(new LAsmJSPassStackArg(useRegisterAtStart(ins->arg())), ins);
+        return add(new(alloc()) LAsmJSPassStackArg(useRegisterAtStart(ins->arg())), ins);
     }
 
-    return add(new LAsmJSPassStackArg(useRegisterOrConstantAtStart(ins->arg())), ins);
+    return add(new(alloc()) LAsmJSPassStackArg(useRegisterOrConstantAtStart(ins->arg())), ins);
 }
 
 bool
 LIRGenerator::visitAsmJSCall(MAsmJSCall *ins)
 {
     gen->setPerformsAsmJSCall();
 
     LAllocation *args = gen->allocate<LAllocation>(ins->numOperands());
@@ -3321,43 +3321,43 @@ LIRGenerator::visitAsmJSCall(MAsmJSCall 
         return false;
 
     for (unsigned i = 0; i < ins->numArgs(); i++)
         args[i] = useFixed(ins->getOperand(i), ins->registerForArg(i));
 
     if (ins->callee().which() == MAsmJSCall::Callee::Dynamic)
         args[ins->dynamicCalleeOperandIndex()] = useFixed(ins->callee().dynamic(), CallTempReg0);
 
-    LInstruction *lir = new LAsmJSCall(args, ins->numOperands());
+    LInstruction *lir = new(alloc()) LAsmJSCall(args, ins->numOperands());
     if (ins->type() == MIRType_None) {
         return add(lir, ins);
     }
     return defineReturn(lir, ins);
 }
 
 bool
 LIRGenerator::visitAsmJSCheckOverRecursed(MAsmJSCheckOverRecursed *ins)
 {
-    return add(new LAsmJSCheckOverRecursed(), ins);
+    return add(new(alloc()) LAsmJSCheckOverRecursed(), ins);
 }
 
 bool
 LIRGenerator::visitSetDOMProperty(MSetDOMProperty *ins)
 {
     MDefinition *val = ins->value();
 
     Register cxReg, objReg, privReg, valueReg;
     GetTempRegForIntArg(0, 0, &cxReg);
     GetTempRegForIntArg(1, 0, &objReg);
     GetTempRegForIntArg(2, 0, &privReg);
     GetTempRegForIntArg(3, 0, &valueReg);
-    LSetDOMProperty *lir = new LSetDOMProperty(tempFixed(cxReg),
-                                               useFixed(ins->object(), objReg),
-                                               tempFixed(privReg),
-                                               tempFixed(valueReg));
+    LSetDOMProperty *lir = new(alloc()) LSetDOMProperty(tempFixed(cxReg),
+                                                        useFixed(ins->object(), objReg),
+                                                        tempFixed(privReg),
+                                                        tempFixed(valueReg));
 
     // Keep using GetTempRegForIntArg, since we want to make sure we
     // don't clobber registers we're already using.
     Register tempReg1, tempReg2;
     GetTempRegForIntArg(4, 0, &tempReg1);
     mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(5, 0, &tempReg2);
     MOZ_ASSERT(ok, "How can we not have six temp registers?");
     if (!useBoxFixed(lir, LSetDOMProperty::Value, val, tempReg1, tempReg2))
@@ -3370,32 +3370,32 @@ bool
 LIRGenerator::visitGetDOMProperty(MGetDOMProperty *ins)
 {
     Register cxReg, objReg, privReg, valueReg;
     GetTempRegForIntArg(0, 0, &cxReg);
     GetTempRegForIntArg(1, 0, &objReg);
     GetTempRegForIntArg(2, 0, &privReg);
     mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &valueReg);
     MOZ_ASSERT(ok, "How can we not have four temp registers?");
-    LGetDOMProperty *lir = new LGetDOMProperty(tempFixed(cxReg),
-                                               useFixed(ins->object(), objReg),
-                                               tempFixed(privReg),
-                                               tempFixed(valueReg));
+    LGetDOMProperty *lir = new(alloc()) LGetDOMProperty(tempFixed(cxReg),
+                                                        useFixed(ins->object(), objReg),
+                                                        tempFixed(privReg),
+                                                        tempFixed(valueReg));
 
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
 {
     MOZ_ASSERT(ins->isDomMovable(), "Members had better be movable");
     MOZ_ASSERT(ins->domAliasSet() == JSJitInfo::AliasNone,
                "Members had better not alias anything");
     LGetDOMMember *lir =
-        new LGetDOMMember(useRegister(ins->object()));
+        new(alloc()) LGetDOMMember(useRegister(ins->object()));
     return defineBox(lir, ins);
 }
 
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {
     fprintf(IonSpewFile, "Current resume point %p details:\n", (void *)resumePoint);
     fprintf(IonSpewFile, "    frame count: %u\n", resumePoint->frameCount());
@@ -3510,17 +3510,17 @@ LIRGenerator::visitBlock(MBasicBlock *bl
 {
     current = block->lir();
     updateResumeState(block);
 
     if (!definePhis())
         return false;
 
     if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
-        if (!add(new LLabel()))
+        if (!add(new(alloc()) LLabel()))
             return false;
     }
 
     for (MInstructionIterator iter = block->begin(); *iter != block->lastIns(); iter++) {
         if (!visitInstruction(*iter))
             return false;
     }
 
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -656,17 +656,17 @@ MParameter::congruentTo(MDefinition *ins
 }
 
 MCall *
 MCall::New(TempAllocator &alloc, JSFunction *target, size_t maxArgc, size_t numActualArgs,
            bool construct)
 {
     JS_ASSERT(maxArgc >= numActualArgs);
     MCall *ins = new(alloc) MCall(target, numActualArgs, construct);
-    if (!ins->init(maxArgc + NumNonArgumentOperands))
+    if (!ins->init(alloc, maxArgc + NumNonArgumentOperands))
         return nullptr;
     return ins;
 }
 
 MApplyArgs *
 MApplyArgs::New(TempAllocator &alloc, JSFunction *target, MDefinition *fun, MDefinition *argc,
                 MDefinition *self)
 {
@@ -2087,17 +2087,17 @@ MUrsh::NewAsmJS(TempAllocator &alloc, MD
     return ins;
 }
 
 MResumePoint *
 MResumePoint::New(TempAllocator &alloc, MBasicBlock *block, jsbytecode *pc, MResumePoint *parent,
                   Mode mode)
 {
     MResumePoint *resume = new(alloc) MResumePoint(block, pc, parent, mode);
-    if (!resume->init())
+    if (!resume->init(alloc))
         return nullptr;
     resume->inherit(block);
     return resume;
 }
 
 MResumePoint::MResumePoint(MBasicBlock *block, jsbytecode *pc, MResumePoint *caller,
                            Mode mode)
   : MNode(block),
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -1786,18 +1786,18 @@ class MPrepareCall : public MNullaryInst
     }
 };
 
 class MVariadicInstruction : public MInstruction
 {
     FixedList<MUse> operands_;
 
   protected:
-    bool init(size_t length) {
-        return operands_.init(length);
+    bool init(TempAllocator &alloc, size_t length) {
+        return operands_.init(alloc, length);
     }
 
   public:
     // Will assert if called before initialization.
     MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {
         return operands_[index].producer();
     }
     size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {
@@ -2314,39 +2314,39 @@ class MCompare
         return compareType() == ins->toCompare()->compareType() &&
                jsop() == ins->toCompare()->jsop();
     }
 };
 
 // Takes a typed value and returns an untyped value.
 class MBox : public MUnaryInstruction
 {
-    MBox(MDefinition *ins)
+    MBox(TempAllocator &alloc, MDefinition *ins)
       : MUnaryInstruction(ins)
     {
         setResultType(MIRType_Value);
         if (ins->resultTypeSet()) {
             setResultTypeSet(ins->resultTypeSet());
         } else if (ins->type() != MIRType_Value) {
             types::Type ntype = ins->type() == MIRType_Object
                                 ? types::Type::AnyObjectType()
                                 : types::Type::PrimitiveType(ValueTypeFromMIRType(ins->type()));
-            setResultTypeSet(GetIonContext()->temp->lifoAlloc()->new_<types::TemporaryTypeSet>(ntype));
+            setResultTypeSet(alloc.lifoAlloc()->new_<types::TemporaryTypeSet>(ntype));
         }
         setMovable();
     }
 
   public:
     INSTRUCTION_HEADER(Box)
     static MBox *New(TempAllocator &alloc, MDefinition *ins)
     {
         // Cannot box a box.
         JS_ASSERT(ins->type() != MIRType_Value);
 
-        return new(alloc) MBox(ins);
+        return new(alloc) MBox(alloc, ins);
     }
 
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
@@ -9018,18 +9018,18 @@ class MResumePoint MOZ_FINAL : public MN
     Mode mode_;
 
     MResumePoint(MBasicBlock *block, jsbytecode *pc, MResumePoint *parent, Mode mode);
     void inherit(MBasicBlock *state);
 
   protected:
     // Initializes operands_ to an empty array of a fixed length.
     // The array may then be filled in by inherit().
-    bool init() {
-        return operands_.init(stackDepth_);
+    bool init(TempAllocator &alloc) {
+        return operands_.init(alloc, stackDepth_);
     }
 
     // Overwrites an operand without updating its Uses.
     void setOperand(size_t index, MDefinition *operand) {
         JS_ASSERT(index < stackDepth_);
         operands_[index].set(operand, this, index);
         operand->addUse(&operands_[index]);
     }
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -300,23 +300,23 @@ MBasicBlock::MBasicBlock(MIRGraph &graph
     columnIndex_(0u)
 #endif
 {
 }
 
 bool
 MBasicBlock::init()
 {
-    return slots_.init(info_.nslots());
+    return slots_.init(graph_.alloc(), info_.nslots());
 }
 
 bool
 MBasicBlock::increaseSlots(size_t num)
 {
-    return slots_.growBy(num);
+    return slots_.growBy(graph_.alloc(), num);
 }
 
 void
 MBasicBlock::copySlots(MBasicBlock *from)
 {
     JS_ASSERT(stackPosition_ <= from->stackPosition_);
 
     for (uint32_t i = 0; i < stackPosition_; i++)
@@ -343,17 +343,17 @@ MBasicBlock::inherit(TempAllocator &allo
     JS_ASSERT(info_.nslots() >= stackPosition_);
     JS_ASSERT(!entryResumePoint_);
 
     // Propagate the caller resume point from the inherited block.
     MResumePoint *callerResumePoint = pred ? pred->callerResumePoint() : nullptr;
 
     // Create a resume point using our initial stack state.
     entryResumePoint_ = new(alloc) MResumePoint(this, pc(), callerResumePoint, MResumePoint::ResumeAt);
-    if (!entryResumePoint_->init())
+    if (!entryResumePoint_->init(alloc))
         return false;
 
     if (pred) {
         if (!predecessors_.append(pred))
             return false;
 
         if (kind_ == PENDING_LOOP_HEADER) {
             for (size_t i = 0; i < stackDepth(); i++) {
--- a/js/src/jit/RegisterAllocator.cpp
+++ b/js/src/jit/RegisterAllocator.cpp
@@ -481,33 +481,33 @@ RegisterAllocator::getInputMoveGroup(uin
 {
     InstructionData *data = &insData[ins];
     JS_ASSERT(!data->ins()->isPhi());
     JS_ASSERT(!data->ins()->isLabel());
 
     if (data->inputMoves())
         return data->inputMoves();
 
-    LMoveGroup *moves = new LMoveGroup(alloc());
+    LMoveGroup *moves = LMoveGroup::New(alloc());
     data->setInputMoves(moves);
     data->block()->insertBefore(data->ins(), moves);
 
     return moves;
 }
 
 LMoveGroup *
 RegisterAllocator::getMoveGroupAfter(uint32_t ins)
 {
     InstructionData *data = &insData[ins];
     JS_ASSERT(!data->ins()->isPhi());
 
     if (data->movesAfter())
         return data->movesAfter();
 
-    LMoveGroup *moves = new LMoveGroup(alloc());
+    LMoveGroup *moves = LMoveGroup::New(alloc());
     data->setMovesAfter(moves);
 
     if (data->ins()->isLabel())
         data->block()->insertAfter(data->block()->getEntryMoveGroup(alloc()), moves);
     else
         data->block()->insertAfter(data->ins(), moves);
     return moves;
 }
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -300,17 +300,17 @@ StupidAllocator::syncForBlockEnd(LBlock 
 
             if (!group) {
                 // The moves we insert here need to happen simultaneously with
                 // each other, yet after any existing moves before the instruction.
                 LMoveGroup *input = getInputMoveGroup(ins->id());
                 if (input->numMoves() == 0) {
                     group = input;
                 } else {
-                    group = new LMoveGroup(alloc());
+                    group = LMoveGroup::New(alloc());
                     block->insertAfter(input, group);
                 }
             }
 
             group->add(source, dest);
         }
     }
 }
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -196,17 +196,17 @@ CodeGeneratorARM::bailoutIf(Assembler::C
         uint8_t *code = deoptTable_->raw() + snapshot->bailoutId() * BAILOUT_TABLE_ENTRY_SIZE;
         masm.ma_b(code, Relocation::HARDCODED, condition);
         return true;
     }
 
     // We could not use a jump table, either because all bailout IDs were
     // reserved, or a jump table is not optimal for this frame size or
     // platform. Whatever, we will generate a lazy bailout.
-    OutOfLineBailout *ool = new OutOfLineBailout(snapshot, masm.framePushed());
+    OutOfLineBailout *ool = new(alloc()) OutOfLineBailout(snapshot, masm.framePushed());
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.ma_b(ool->entry(), condition);
 
     return true;
 }
 bool
@@ -254,17 +254,17 @@ CodeGeneratorARM::bailoutFrom(Label *lab
         uint8_t *code = deoptTable_->raw() + snapshot->bailoutId() * BAILOUT_TABLE_ENTRY_SIZE;
         masm.retarget(label, code, Relocation::HARDCODED);
         return true;
     }
 #endif
     // We could not use a jump table, either because all bailout IDs were
     // reserved, or a jump table is not optimal for this frame size or
     // platform. Whatever, we will generate a lazy bailout.
-    OutOfLineBailout *ool = new OutOfLineBailout(snapshot, masm.framePushed());
+    OutOfLineBailout *ool = new(alloc()) OutOfLineBailout(snapshot, masm.framePushed());
     if (!addOutOfLineCode(ool)) {
         return false;
     }
 
     masm.retarget(label, ool->entry());
 
     return true;
 }
@@ -1127,17 +1127,17 @@ CodeGeneratorARM::emitTableSwitchDispatc
     masm.ma_rsb(index, Imm32(cases - 1), index, SetCond, Assembler::Unsigned);
     AutoForbidPools afp(&masm);
     masm.ma_ldr(DTRAddr(pc, DtrRegImmShift(index, LSL, 2)), pc, Offset, Assembler::Unsigned);
     masm.ma_b(defaultcase);
 
     // To fill in the CodeLabels for the case entries, we need to first
     // generate the case entries (we don't yet know their offsets in the
     // instruction stream).
-    OutOfLineTableSwitch *ool = new OutOfLineTableSwitch(alloc(), mir);
+    OutOfLineTableSwitch *ool = new(alloc()) OutOfLineTableSwitch(alloc(), mir);
     for (int32_t i = 0; i < cases; i++) {
         CodeLabel cl;
         masm.writeCodePointer(cl.dest());
         if (!ool->addCodeLabel(cl))
             return false;
     }
     if (!addOutOfLineCode(ool))
         return false;
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -53,23 +53,23 @@ LAllocation
 LIRGeneratorARM::useByteOpRegisterOrNonDoubleConstant(MDefinition *mir)
 {
     return useRegisterOrNonDoubleConstant(mir);
 }
 
 bool
 LIRGeneratorARM::lowerConstantDouble(double d, MInstruction *mir)
 {
-    return define(new LDouble(d), mir);
+    return define(new(alloc()) LDouble(d), mir);
 }
 
 bool
 LIRGeneratorARM::lowerConstantFloat32(float d, MInstruction *mir)
 {
-    return define(new LFloat32(d), mir);
+    return define(new(alloc()) LFloat32(d), mir);
 }
 
 bool
 LIRGeneratorARM::visitConstant(MConstant *ins)
 {
     if (ins->type() == MIRType_Double)
         return lowerConstantDouble(ins->value().toDouble(), ins);
 
@@ -85,26 +85,26 @@ LIRGeneratorARM::visitConstant(MConstant
 
 bool
 LIRGeneratorARM::visitBox(MBox *box)
 {
     MDefinition *inner = box->getOperand(0);
 
     // If the box wrapped a double, it needs a new register.
     if (IsFloatingPointType(inner->type()))
-        return defineBox(new LBoxFloatingPoint(useRegisterAtStart(inner), tempCopy(inner, 0),
-                                               inner->type()), box);
+        return defineBox(new(alloc()) LBoxFloatingPoint(useRegisterAtStart(inner), tempCopy(inner, 0),
+                                                        inner->type()), box);
 
     if (box->canEmitAtUses())
         return emitAtUses(box);
 
     if (inner->isConstant())
-        return defineBox(new LValue(inner->toConstant()->value()), box);
+        return defineBox(new(alloc()) LValue(inner->toConstant()->value()), box);
 
-    LBox *lir = new LBox(use(inner), inner->type());
+    LBox *lir = new(alloc()) LBox(use(inner), inner->type());
 
     // Otherwise, we should not define a new register for the payload portion
     // of the output, so bypass defineBox().
     uint32_t vreg = getVirtualRegister();
     if (vreg >= MAX_VIRTUAL_REGISTERS)
         return false;
 
     // Note that because we're using PASSTHROUGH, we do not change the type of
@@ -127,26 +127,26 @@ LIRGeneratorARM::visitUnbox(MUnbox *unbo
     // a payload. Unlike most instructions conusming a box, we ask for the type
     // second, so that the result can re-use the first input.
     MDefinition *inner = unbox->getOperand(0);
 
     if (!ensureDefined(inner))
         return false;
 
     if (IsFloatingPointType(unbox->type())) {
-        LUnboxFloatingPoint *lir = new LUnboxFloatingPoint(unbox->type());
+        LUnboxFloatingPoint *lir = new(alloc()) LUnboxFloatingPoint(unbox->type());
         if (unbox->fallible() && !assignSnapshot(lir, unbox->bailoutKind()))
             return false;
         if (!useBox(lir, LUnboxFloatingPoint::Input, inner))
             return false;
         return define(lir, unbox);
     }
 
     // Swap the order we use the box pieces so we can re-use the payload register.
-    LUnbox *lir = new LUnbox;
+    LUnbox *lir = new(alloc()) LUnbox;
     lir->setOperand(0, usePayloadInRegisterAtStart(inner));
     lir->setOperand(1, useType(inner, LUse::REGISTER));
 
     if (unbox->fallible() && !assignSnapshot(lir, unbox->bailoutKind()))
         return false;
 
     // Note that PASSTHROUGH here is illegal, since types and payloads form two
     // separate intervals. If the type becomes dead before the payload, it
@@ -158,17 +158,17 @@ LIRGeneratorARM::visitUnbox(MUnbox *unbo
 }
 
 bool
 LIRGeneratorARM::visitReturn(MReturn *ret)
 {
     MDefinition *opd = ret->getOperand(0);
     JS_ASSERT(opd->type() == MIRType_Value);
 
-    LReturn *ins = new LReturn;
+    LReturn *ins = new(alloc()) LReturn;
     ins->setOperand(0, LUse(JSReturnReg_Type));
     ins->setOperand(1, LUse(JSReturnReg_Data));
     return fillBoxUses(ins, 0, opd) && add(ins);
 }
 
 // x = !y
 bool
 LIRGeneratorARM::lowerForALU(LInstructionHelper<1, 1, 0> *ins, MDefinition *mir, MDefinition *input)
@@ -271,212 +271,213 @@ LIRGeneratorARM::lowerDivI(MDiv *div)
         int32_t rhs = div->rhs()->toConstant()->value().toInt32();
         // Check for division by a positive power of two, which is an easy and
         // important case to optimize. Note that other optimizations are also
         // possible; division by negative powers of two can be optimized in a
         // similar manner as positive powers of two, and division by other
         // constants can be optimized by a reciprocal multiplication technique.
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
-            LDivPowTwoI *lir = new LDivPowTwoI(useRegisterAtStart(div->lhs()), shift);
+            LDivPowTwoI *lir = new(alloc()) LDivPowTwoI(useRegisterAtStart(div->lhs()), shift);
             if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, div);
         }
     }
 
     if (hasIDIV()) {
-        LDivI *lir = new LDivI(useRegister(div->lhs()), useRegister(div->rhs()), temp());
+        LDivI *lir = new(alloc()) LDivI(useRegister(div->lhs()), useRegister(div->rhs()), temp());
         if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
     }
 
-    LSoftDivI *lir = new LSoftDivI(useFixedAtStart(div->lhs(), r0), useFixedAtStart(div->rhs(), r1),
-                                   tempFixed(r1), tempFixed(r2), tempFixed(r3));
+    LSoftDivI *lir = new(alloc()) LSoftDivI(useFixedAtStart(div->lhs(), r0), useFixedAtStart(div->rhs(), r1),
+                                            tempFixed(r1), tempFixed(r2), tempFixed(r3));
     if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
 }
 
 bool
 LIRGeneratorARM::lowerMulI(MMul *mul, MDefinition *lhs, MDefinition *rhs)
 {
-    LMulI *lir = new LMulI;
+    LMulI *lir = new(alloc()) LMulI;
     if (mul->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return lowerForALU(lir, mul, lhs, rhs);
 }
 
 bool
 LIRGeneratorARM::lowerModI(MMod *mod)
 {
     if (mod->isUnsigned())
         return lowerUMod(mod);
 
     if (mod->rhs()->isConstant()) {
         int32_t rhs = mod->rhs()->toConstant()->value().toInt32();
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
-            LModPowTwoI *lir = new LModPowTwoI(useRegister(mod->lhs()), shift);
+            LModPowTwoI *lir = new(alloc()) LModPowTwoI(useRegister(mod->lhs()), shift);
             if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, mod);
         } else if (shift < 31 && (1 << (shift+1)) - 1 == rhs) {
-            LModMaskI *lir = new LModMaskI(useRegister(mod->lhs()), temp(LDefinition::GENERAL), shift+1);
+            LModMaskI *lir = new(alloc()) LModMaskI(useRegister(mod->lhs()), temp(LDefinition::GENERAL), shift+1);
             if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return define(lir, mod);
         }
     }
 
     if (hasIDIV()) {
-        LModI *lir = new LModI(useRegister(mod->lhs()), useRegister(mod->rhs()), temp());
+        LModI *lir = new(alloc()) LModI(useRegister(mod->lhs()), useRegister(mod->rhs()), temp());
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
     }
 
-    LSoftModI *lir = new LSoftModI(useFixedAtStart(mod->lhs(), r0), useFixedAtStart(mod->rhs(), r1),
-                                   tempFixed(r0), tempFixed(r2), tempFixed(r3), temp(LDefinition::GENERAL));
+    LSoftModI *lir = new(alloc()) LSoftModI(useFixedAtStart(mod->lhs(), r0), useFixedAtStart(mod->rhs(), r1),
+                                            tempFixed(r0), tempFixed(r2), tempFixed(r3),
+                                            temp(LDefinition::GENERAL));
     if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
 }
 
 bool
 LIRGeneratorARM::visitPowHalf(MPowHalf *ins)
 {
     MDefinition *input = ins->input();
     JS_ASSERT(input->type() == MIRType_Double);
-    LPowHalfD *lir = new LPowHalfD(useRegisterAtStart(input));
+    LPowHalfD *lir = new(alloc()) LPowHalfD(useRegisterAtStart(input));
     return defineReuseInput(lir, ins, 0);
 }
 
 LTableSwitch *
 LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &inputCopy,
                                        MTableSwitch *tableswitch)
 {
-    return new LTableSwitch(in, inputCopy, tableswitch);
+    return new(alloc()) LTableSwitch(in, inputCopy, tableswitch);
 }
 
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new LTableSwitchV(temp(), tempFloat(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
 }
 
 bool
 LIRGeneratorARM::visitGuardShape(MGuardShape *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardShape *guard = new LGuardShape(useRegister(ins->obj()), tempObj);
+    LGuardShape *guard = new(alloc()) LGuardShape(useRegister(ins->obj()), tempObj);
     if (!assignSnapshot(guard, ins->bailoutKind()))
         return false;
     if (!add(guard, ins))
         return false;
     return redefine(ins, ins->obj());
 }
 
 bool
 LIRGeneratorARM::visitGuardObjectType(MGuardObjectType *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardObjectType *guard = new LGuardObjectType(useRegister(ins->obj()), tempObj);
+    LGuardObjectType *guard = new(alloc()) LGuardObjectType(useRegister(ins->obj()), tempObj);
     if (!assignSnapshot(guard))
         return false;
     if (!add(guard, ins))
         return false;
     return redefine(ins, ins->obj());
 }
 
 bool
 LIRGeneratorARM::lowerUrshD(MUrsh *mir)
 {
     MDefinition *lhs = mir->lhs();
     MDefinition *rhs = mir->rhs();
 
     JS_ASSERT(lhs->type() == MIRType_Int32);
     JS_ASSERT(rhs->type() == MIRType_Int32);
 
-    LUrshD *lir = new LUrshD(useRegister(lhs), useRegisterOrConstant(rhs), temp());
+    LUrshD *lir = new(alloc()) LUrshD(useRegister(lhs), useRegisterOrConstant(rhs), temp());
     return define(lir, mir);
 }
 
 bool
 LIRGeneratorARM::visitAsmJSNeg(MAsmJSNeg *ins)
 {
     if (ins->type() == MIRType_Int32)
-        return define(new LNegI(useRegisterAtStart(ins->input())), ins);
+        return define(new(alloc()) LNegI(useRegisterAtStart(ins->input())), ins);
 
     JS_ASSERT(ins->type() == MIRType_Double);
-    return define(new LNegD(useRegisterAtStart(ins->input())), ins);
+    return define(new(alloc()) LNegD(useRegisterAtStart(ins->input())), ins);
 }
 
 bool
 LIRGeneratorARM::lowerUDiv(MDiv *div)
 {
     MDefinition *lhs = div->getOperand(0);
     MDefinition *rhs = div->getOperand(1);
 
     if (hasIDIV()) {
-        LUDiv *lir = new LUDiv;
+        LUDiv *lir = new(alloc()) LUDiv;
         lir->setOperand(0, useRegister(lhs));
         lir->setOperand(1, useRegister(rhs));
         if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
     } else {
-        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
-                                                 tempFixed(r1), tempFixed(r2), tempFixed(r3));
+        LSoftUDivOrMod *lir = new(alloc()) LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
+                                                          tempFixed(r1), tempFixed(r2), tempFixed(r3));
         if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
     }
 }
 
 bool
 LIRGeneratorARM::lowerUMod(MMod *mod)
 {
     MDefinition *lhs = mod->getOperand(0);
     MDefinition *rhs = mod->getOperand(1);
 
     if (hasIDIV()) {
-        LUMod *lir = new LUMod;
+        LUMod *lir = new(alloc()) LUMod;
         lir->setOperand(0, useRegister(lhs));
         lir->setOperand(1, useRegister(rhs));
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
     } else {
-        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
-                                                 tempFixed(r0), tempFixed(r2), tempFixed(r3));
+        LSoftUDivOrMod *lir = new(alloc()) LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
+                                                          tempFixed(r0), tempFixed(r2), tempFixed(r3));
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
     }
 }
 
 bool
 LIRGeneratorARM::visitAsmJSUnsignedToDouble(MAsmJSUnsignedToDouble *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToDouble *lir = new LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()));
+    LAsmJSUInt32ToDouble *lir = new(alloc()) LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()));
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorARM::visitAsmJSUnsignedToFloat32(MAsmJSUnsignedToFloat32 *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToFloat32 *lir = new LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()));
+    LAsmJSUInt32ToFloat32 *lir = new(alloc()) LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()));
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorARM::visitAsmJSLoadHeap(MAsmJSLoadHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     JS_ASSERT(ptr->type() == MIRType_Int32);
@@ -486,57 +487,57 @@ LIRGeneratorARM::visitAsmJSLoadHeap(MAsm
     if (ptr->isConstant() && ins->skipBoundsCheck()) {
         int32_t ptrValue = ptr->toConstant()->value().toInt32();
         // A bounds check is only skipped for a positive index.
         JS_ASSERT(ptrValue >= 0);
         ptrAlloc = LAllocation(ptr->toConstant()->vp());
     } else
         ptrAlloc = useRegisterAtStart(ptr);
 
-    return define(new LAsmJSLoadHeap(ptrAlloc), ins);
+    return define(new(alloc()) LAsmJSLoadHeap(ptrAlloc), ins);
 }
 
 bool
 LIRGeneratorARM::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     JS_ASSERT(ptr->type() == MIRType_Int32);
     LAllocation ptrAlloc;
 
     if (ptr->isConstant() && ins->skipBoundsCheck()) {
         JS_ASSERT(ptr->toConstant()->value().toInt32() >= 0);
         ptrAlloc = LAllocation(ptr->toConstant()->vp());
     } else
         ptrAlloc = useRegisterAtStart(ptr);
 
-    return add(new LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value())), ins);
+    return add(new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value())), ins);
 }
 
 bool
 LIRGeneratorARM::visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins)
 {
-    return define(new LAsmJSLoadFuncPtr(useRegister(ins->index()), temp()), ins);
+    return define(new(alloc()) LAsmJSLoadFuncPtr(useRegister(ins->index()), temp()), ins);
 }
 
 bool
 LIRGeneratorARM::lowerTruncateDToInt32(MTruncateToInt32 *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    return define(new LTruncateDToInt32(useRegister(opd), LDefinition::BogusTemp()), ins);
+    return define(new(alloc()) LTruncateDToInt32(useRegister(opd), LDefinition::BogusTemp()), ins);
 }
 
 bool
 LIRGeneratorARM::lowerTruncateFToInt32(MTruncateToInt32 *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    return define(new LTruncateFToInt32(useRegister(opd), LDefinition::BogusTemp()), ins);
+    return define(new(alloc()) LTruncateFToInt32(useRegister(opd), LDefinition::BogusTemp()), ins);
 }
 
 bool
 LIRGeneratorARM::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
     MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -714,17 +714,17 @@ class OutOfLineTruncateSlow : public Out
         return needFloat32Conversion_;
     }
 
 };
 
 OutOfLineCode *
 CodeGeneratorShared::oolTruncateDouble(const FloatRegister &src, const Register &dest)
 {
-    OutOfLineTruncateSlow *ool = new OutOfLineTruncateSlow(src, dest);
+    OutOfLineTruncateSlow *ool = new(alloc()) OutOfLineTruncateSlow(src, dest);
     if (!addOutOfLineCode(ool))
         return nullptr;
     return ool;
 }
 
 bool
 CodeGeneratorShared::emitTruncateDouble(const FloatRegister &src, const Register &dest)
 {
@@ -735,17 +735,17 @@ CodeGeneratorShared::emitTruncateDouble(
     masm.branchTruncateDouble(src, dest, ool->entry());
     masm.bind(ool->rejoin());
     return true;
 }
 
 bool
 CodeGeneratorShared::emitTruncateFloat32(const FloatRegister &src, const Register &dest)
 {
-    OutOfLineTruncateSlow *ool = new OutOfLineTruncateSlow(src, dest, true);
+    OutOfLineTruncateSlow *ool = new(alloc()) OutOfLineTruncateSlow(src, dest, true);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.branchTruncateFloat32(src, dest, ool->entry());
     masm.bind(ool->rejoin());
     return true;
 }
 
@@ -813,17 +813,17 @@ CodeGeneratorShared::markArgumentSlots(L
     }
     return true;
 }
 
 OutOfLineAbortPar *
 CodeGeneratorShared::oolAbortPar(ParallelBailoutCause cause, MBasicBlock *basicBlock,
                                  jsbytecode *bytecode)
 {
-    OutOfLineAbortPar *ool = new OutOfLineAbortPar(cause, basicBlock, bytecode);
+    OutOfLineAbortPar *ool = new(alloc()) OutOfLineAbortPar(cause, basicBlock, bytecode);
     if (!ool || !addOutOfLineCode(ool))
         return nullptr;
     return ool;
 }
 
 OutOfLineAbortPar *
 CodeGeneratorShared::oolAbortPar(ParallelBailoutCause cause, LInstruction *lir)
 {
@@ -837,17 +837,17 @@ CodeGeneratorShared::oolAbortPar(Paralle
             pc = block->pc();
     }
     return oolAbortPar(cause, block, pc);
 }
 
 OutOfLinePropagateAbortPar *
 CodeGeneratorShared::oolPropagateAbortPar(LInstruction *lir)
 {
-    OutOfLinePropagateAbortPar *ool = new OutOfLinePropagateAbortPar(lir);
+    OutOfLinePropagateAbortPar *ool = new(alloc()) OutOfLinePropagateAbortPar(lir);
     if (!ool || !addOutOfLineCode(ool))
         return nullptr;
     return ool;
 }
 
 bool
 OutOfLineAbortPar::generate(CodeGeneratorShared *codegen)
 {
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -435,17 +435,17 @@ class CodeGeneratorShared : public LInst
                                    jsbytecode *bytecode);
     OutOfLineAbortPar *oolAbortPar(ParallelBailoutCause cause, LInstruction *lir);
     OutOfLinePropagateAbortPar *oolPropagateAbortPar(LInstruction *lir);
     virtual bool visitOutOfLineAbortPar(OutOfLineAbortPar *ool) = 0;
     virtual bool visitOutOfLinePropagateAbortPar(OutOfLinePropagateAbortPar *ool) = 0;
 };
 
 // An out-of-line path is generated at the end of the function.
-class OutOfLineCode : public OldTempObject
+class OutOfLineCode : public TempObject
 {
     Label entry_;
     Label rejoin_;
     uint32_t framePushed_;
     jsbytecode *pc_;
     JSScript *script_;
 
   public:
@@ -671,17 +671,17 @@ class OutOfLineCallVM : public OutOfLine
     const StoreOutputTo &out() const { return out_; }
 };
 
 template <class ArgSeq, class StoreOutputTo>
 inline OutOfLineCode *
 CodeGeneratorShared::oolCallVM(const VMFunction &fun, LInstruction *lir, const ArgSeq &args,
                                const StoreOutputTo &out)
 {
-    OutOfLineCode *ool = new OutOfLineCallVM<ArgSeq, StoreOutputTo>(lir, fun, args, out);
+    OutOfLineCode *ool = new(alloc()) OutOfLineCallVM<ArgSeq, StoreOutputTo>(lir, fun, args, out);
     if (!addOutOfLineCode(ool))
         return nullptr;
     return ool;
 }
 
 template <class ArgSeq, class StoreOutputTo>
 bool
 CodeGeneratorShared::visitOutOfLineCallVM(OutOfLineCallVM<ArgSeq, StoreOutputTo> *ool)
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -401,17 +401,17 @@ CodeGeneratorX86Shared::bailout(const T 
         binder(masm, deoptTable_->raw() + snapshot->bailoutId() * BAILOUT_TABLE_ENTRY_SIZE);
         return true;
     }
 #endif
 
     // We could not use a jump table, either because all bailout IDs were
     // reserved, or a jump table is not optimal for this frame size or
     // platform. Whatever, we will generate a lazy bailout.
-    OutOfLineBailout *ool = new OutOfLineBailout(snapshot);
+    OutOfLineBailout *ool = new(alloc()) OutOfLineBailout(snapshot);
     if (!addOutOfLineCode(ool))
         return false;
 
     binder(masm, ool->entry());
     return true;
 }
 
 bool
@@ -602,17 +602,17 @@ CodeGeneratorX86Shared::visitAddI(LAddI 
 {
     if (ins->rhs()->isConstant())
         masm.addl(Imm32(ToInt32(ins->rhs())), ToOperand(ins->lhs()));
     else
         masm.addl(ToOperand(ins->rhs()), ToRegister(ins->lhs()));
 
     if (ins->snapshot()) {
         if (ins->recoversInput()) {
-            OutOfLineUndoALUOperation *ool = new OutOfLineUndoALUOperation(ins);
+            OutOfLineUndoALUOperation *ool = new(alloc()) OutOfLineUndoALUOperation(ins);
             if (!addOutOfLineCode(ool))
                 return false;
             masm.j(Assembler::Overflow, ool->entry());
         } else {
             if (!bailoutIf(Assembler::Overflow, ins->snapshot()))
                 return false;
         }
     }
@@ -624,17 +624,17 @@ CodeGeneratorX86Shared::visitSubI(LSubI 
 {
     if (ins->rhs()->isConstant())
         masm.subl(Imm32(ToInt32(ins->rhs())), ToOperand(ins->lhs()));
     else
         masm.subl(ToOperand(ins->rhs()), ToRegister(ins->lhs()));
 
     if (ins->snapshot()) {
         if (ins->recoversInput()) {
-            OutOfLineUndoALUOperation *ool = new OutOfLineUndoALUOperation(ins);
+            OutOfLineUndoALUOperation *ool = new(alloc()) OutOfLineUndoALUOperation(ins);
             if (!addOutOfLineCode(ool))
                 return false;
             masm.j(Assembler::Overflow, ool->entry());
         } else {
             if (!bailoutIf(Assembler::Overflow, ins->snapshot()))
                 return false;
         }
     }
@@ -742,17 +742,17 @@ CodeGeneratorX86Shared::visitMulI(LMulI 
         masm.imull(ToOperand(rhs), ToRegister(lhs));
 
         // Bailout on overflow
         if (mul->canOverflow() && !bailoutIf(Assembler::Overflow, ins->snapshot()))
             return false;
 
         if (mul->canBeNegativeZero()) {
             // Jump to an OOL path if the result is 0.
-            MulNegativeZeroCheck *ool = new MulNegativeZeroCheck(ins);
+            MulNegativeZeroCheck *ool = new(alloc()) MulNegativeZeroCheck(ins);
             if (!addOutOfLineCode(ool))
                 return false;
 
             masm.testl(ToRegister(lhs), ToRegister(lhs));
             masm.j(Assembler::Zero, ool->entry());
             masm.bind(ool->rejoin());
         }
     }
@@ -796,17 +796,17 @@ CodeGeneratorX86Shared::visitUDivOrMod(L
 
     ReturnZero *ool = nullptr;
 
     // Prevent divide by zero.
     if (ins->canBeDivideByZero()) {
         masm.testl(rhs, rhs);
         if (ins->mir()->isTruncated()) {
             if (!ool)
-                ool = new ReturnZero(output);
+                ool = new(alloc()) ReturnZero(output);
             masm.j(Assembler::Zero, ool->entry());
         } else {
             if (!bailoutIf(Assembler::Zero, ins->snapshot()))
                 return false;
         }
     }
 
     masm.mov(ImmWord(0), edx);
@@ -932,17 +932,17 @@ CodeGeneratorX86Shared::visitDivI(LDivI 
     ReturnZero *ool = nullptr;
 
     // Handle divide by zero.
     if (mir->canBeDivideByZero()) {
         masm.testl(rhs, rhs);
         if (mir->isTruncated()) {
             // Truncated division by zero is zero (Infinity|0 == 0)
             if (!ool)
-                ool = new ReturnZero(output);
+                ool = new(alloc()) ReturnZero(output);
             masm.j(Assembler::Zero, ool->entry());
         } else {
             JS_ASSERT(mir->fallible());
             if (!bailoutIf(Assembler::Zero, ins->snapshot()))
                 return false;
         }
     }
 
@@ -1122,17 +1122,17 @@ CodeGeneratorX86Shared::visitModI(LModI 
     ReturnZero *ool = nullptr;
     ModOverflowCheck *overflow = nullptr;
 
     // Prevent divide by zero.
     if (ins->mir()->canBeDivideByZero()) {
         masm.testl(rhs, rhs);
         if (ins->mir()->isTruncated()) {
             if (!ool)
-                ool = new ReturnZero(edx);
+                ool = new(alloc()) ReturnZero(edx);
             masm.j(Assembler::Zero, ool->entry());
         } else {
             if (!bailoutIf(Assembler::Zero, ins->snapshot()))
                 return false;
         }
     }
 
     Label negative;
@@ -1173,17 +1173,17 @@ CodeGeneratorX86Shared::visitModI(LModI 
     if (ins->mir()->canBeNegativeDividend()) {
         masm.jump(&done);
 
         masm.bind(&negative);
 
         // Prevent an integer overflow exception from -2147483648 % -1
         Label notmin;
         masm.cmpl(lhs, Imm32(INT32_MIN));
-        overflow = new ModOverflowCheck(ins, rhs);
+        overflow = new(alloc()) ModOverflowCheck(ins, rhs);
         masm.j(Assembler::Equal, overflow->entry());
         masm.bind(overflow->rejoin());
         masm.cdq();
         masm.idiv(rhs);
 
         if (!ins->mir()->isTruncated()) {
             // A remainder of 0 means that the rval must be -0, which is a double.
             masm.testl(remainder, remainder);
@@ -1404,17 +1404,17 @@ CodeGeneratorX86Shared::emitTableSwitchD
     // Jump to default case if input is out of range
     int32_t cases = mir->numCases();
     masm.cmpl(index, Imm32(cases));
     masm.j(AssemblerX86Shared::AboveOrEqual, defaultcase);
 
     // To fill in the CodeLabels for the case entries, we need to first
     // generate the case entries (we don't yet know their offsets in the
     // instruction stream).
-    OutOfLineTableSwitch *ool = new OutOfLineTableSwitch(mir);
+    OutOfLineTableSwitch *ool = new(alloc()) OutOfLineTableSwitch(mir);
     if (!addOutOfLineCode(ool))
         return false;
 
     // Compute the position where a pointer to the right case stands.
     masm.mov(ool->jumpLabel()->dest(), base);
     Operand pointer = Operand(base, index, ScalePointer);
 
     // Jump to the right case
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -72,17 +72,17 @@ LIRGeneratorShared::defineFixed(LInstruc
     def.setOutput(output);
 
     // Add an LNop to avoid regalloc problems if the next op uses this value
     // with a fixed or at-start policy.
     if (!define(lir, mir, def))
         return false;
 
     if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
-        if (!add(new LNop))
+        if (!add(new(alloc()) LNop))
             return false;
     }
 
     return true;
 }
 
 template <size_t Ops, size_t Temps> bool
 LIRGeneratorShared::defineReuseInput(LInstructionHelper<1, Ops, Temps> *lir, MDefinition *mir, uint32_t operand)
@@ -159,17 +159,17 @@ LIRGeneratorShared::defineReturn(LInstru
         break;
     }
 
     mir->setVirtualRegister(vreg);
     if (!add(lir))
         return false;
 
     if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
-        if (!add(new LNop))
+        if (!add(new(alloc()) LNop))
             return false;
     }
 
     return true;
 }
 
 // In LIR, we treat booleans and integers as the same low-level type (INTEGER).
 // When snapshotting, we recover the actual JS type from MIR. This function
--- a/js/src/jit/shared/Lowering-shared.cpp
+++ b/js/src/jit/shared/Lowering-shared.cpp
@@ -13,23 +13,23 @@ using namespace js;
 using namespace jit;
 
 bool
 LIRGeneratorShared::visitConstant(MConstant *ins)
 {
     const Value &v = ins->value();
     switch (ins->type()) {
       case MIRType_Boolean:
-        return define(new LInteger(v.toBoolean()), ins);
+        return define(new(alloc()) LInteger(v.toBoolean()), ins);
       case MIRType_Int32:
-        return define(new LInteger(v.toInt32()), ins);
+        return define(new(alloc()) LInteger(v.toInt32()), ins);
       case MIRType_String:
-        return define(new LPointer(v.toString()), ins);
+        return define(new(alloc()) LPointer(v.toString()), ins);
       case MIRType_Object:
-        return define(new LPointer(&v.toObject()), ins);
+        return define(new(alloc()) LPointer(&v.toObject()), ins);
       default:
         // Constants of special types (undefined, null) should never flow into
         // here directly. Operations blindly consuming them require a Box.
         JS_ASSERT(!"unexpected constant type");
         return false;
     }
 }
 
@@ -185,13 +185,13 @@ LIRGeneratorShared::assignSafepoint(LIns
 
     ins->initSafepoint(alloc());
 
     MResumePoint *mrp = mir->resumePoint() ? mir->resumePoint() : lastResumePoint_;
     LSnapshot *postSnapshot = buildSnapshot(ins, mrp, Bailout_Normal);
     if (!postSnapshot)
         return false;
 
-    osiPoint_ = new LOsiPoint(ins->safepoint(), postSnapshot);
+    osiPoint_ = new(alloc()) LOsiPoint(ins->safepoint(), postSnapshot);
 
     return lirGraph_.noteNeedsSafepoint(ins);
 }
 
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -16,57 +16,57 @@ using namespace js;
 using namespace js::jit;
 
 using mozilla::FloorLog2;
 
 LTableSwitch *
 LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition &inputCopy,
                                        MTableSwitch *tableswitch)
 {
-    return new LTableSwitch(in, inputCopy, temp(), tableswitch);
+    return new(alloc()) LTableSwitch(in, inputCopy, temp(), tableswitch);
 }
 
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
 }
 
 bool
 LIRGeneratorX86Shared::visitGuardShape(MGuardShape *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
-    LGuardShape *guard = new LGuardShape(useRegister(ins->obj()));
+    LGuardShape *guard = new(alloc()) LGuardShape(useRegister(ins->obj()));
     if (!assignSnapshot(guard, ins->bailoutKind()))
         return false;
     if (!add(guard, ins))
         return false;
     return redefine(ins, ins->obj());
 }
 
 bool
 LIRGeneratorX86Shared::visitGuardObjectType(MGuardObjectType *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
 
-    LGuardObjectType *guard = new LGuardObjectType(useRegister(ins->obj()));
+    LGuardObjectType *guard = new(alloc()) LGuardObjectType(useRegister(ins->obj()));
     if (!assignSnapshot(guard))
         return false;
     if (!add(guard, ins))
         return false;
     return redefine(ins, ins->obj());
 }
 
 bool
 LIRGeneratorX86Shared::visitPowHalf(MPowHalf *ins)
 {
     MDefinition *input = ins->input();
     JS_ASSERT(input->type() == MIRType_Double);
-    LPowHalfD *lir = new LPowHalfD(useRegisterAtStart(input));
+    LPowHalfD *lir = new(alloc()) LPowHalfD(useRegisterAtStart(input));
     return defineReuseInput(lir, ins, 0);
 }
 
 bool
 LIRGeneratorX86Shared::lowerForShift(LInstructionHelper<1, 2, 0> *ins, MDefinition *mir,
                                      MDefinition *lhs, MDefinition *rhs)
 {
     ins->setOperand(0, useRegisterAtStart(lhs));
@@ -115,17 +115,17 @@ LIRGeneratorX86Shared::lowerForBitAndAnd
     return add(baab, mir);
 }
 
 bool
 LIRGeneratorX86Shared::lowerMulI(MMul *mul, MDefinition *lhs, MDefinition *rhs)
 {
     // Note: lhs is used twice, so that we can restore the original value for the
     // negative zero check.
-    LMulI *lir = new LMulI(useRegisterAtStart(lhs), useOrConstant(rhs), use(lhs));
+    LMulI *lir = new(alloc()) LMulI(useRegisterAtStart(lhs), useOrConstant(rhs), use(lhs));
     if (mul->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineReuseInput(lir, mul, 0);
 }
 
 bool
 LIRGeneratorX86Shared::lowerDivI(MDiv *div)
 {
@@ -143,138 +143,138 @@ LIRGeneratorX86Shared::lowerDivI(MDiv *d
         // similar manner as positive powers of two, and division by other
         // constants can be optimized by a reciprocal multiplication technique.
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LAllocation lhs = useRegisterAtStart(div->lhs());
             LDivPowTwoI *lir;
             if (!div->canBeNegativeDividend()) {
                 // Numerator is unsigned, so does not need adjusting.
-                lir = new LDivPowTwoI(lhs, lhs, shift);
+                lir = new(alloc()) LDivPowTwoI(lhs, lhs, shift);
             } else {
                 // Numerator is signed, and needs adjusting, and an extra
                 // lhs copy register is needed.
-                lir = new LDivPowTwoI(lhs, useRegister(div->lhs()), shift);
+                lir = new(alloc()) LDivPowTwoI(lhs, useRegister(div->lhs()), shift);
             }
             if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return defineReuseInput(lir, div, 0);
         }
     }
 
     // Optimize x/x. This is quaint, but it also protects the LDivI code below.
     // Since LDivI requires lhs to be in %eax, and since the register allocator
     // can't put a virtual register in two physical registers at the same time,
     // this puts rhs in %eax too, and since rhs isn't marked usedAtStart, it
     // would conflict with the %eax output register. (rhs could be marked
     // usedAtStart but for the fact that LDivI clobbers %edx early and rhs could
     // happen to be in %edx).
     if (div->lhs() == div->rhs()) {
         if (!div->canBeDivideByZero())
-            return define(new LInteger(1), div);
+            return define(new(alloc()) LInteger(1), div);
 
-        LDivSelfI *lir = new LDivSelfI(useRegisterAtStart(div->lhs()));
+        LDivSelfI *lir = new(alloc()) LDivSelfI(useRegisterAtStart(div->lhs()));
         if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
     }
 
-    LDivI *lir = new LDivI(useFixed(div->lhs(), eax), useRegister(div->rhs()), tempFixed(edx));
+    LDivI *lir = new(alloc()) LDivI(useFixed(div->lhs(), eax), useRegister(div->rhs()), tempFixed(edx));
     if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, div, LAllocation(AnyRegister(eax)));
 }
 
 bool
 LIRGeneratorX86Shared::lowerModI(MMod *mod)
 {
     if (mod->isUnsigned())
         return lowerUMod(mod);
 
     if (mod->rhs()->isConstant()) {
         int32_t rhs = mod->rhs()->toConstant()->value().toInt32();
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
-            LModPowTwoI *lir = new LModPowTwoI(useRegisterAtStart(mod->lhs()), shift);
+            LModPowTwoI *lir = new(alloc()) LModPowTwoI(useRegisterAtStart(mod->lhs()), shift);
             if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return defineReuseInput(lir, mod, 0);
         }
     }
 
     // Optimize x%x. The comments in lowerDivI apply here as well, except
     // that we return 0 for all cases except when x is 0 and we're not
     // truncated.
     if (mod->rhs() == mod->lhs()) {
         if (mod->isTruncated())
-            return define(new LInteger(0), mod);
+            return define(new(alloc()) LInteger(0), mod);
 
-        LModSelfI *lir = new LModSelfI(useRegisterAtStart(mod->lhs()));
+        LModSelfI *lir = new(alloc()) LModSelfI(useRegisterAtStart(mod->lhs()));
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
     }
 
-    LModI *lir = new LModI(useFixedAtStart(mod->lhs(), eax),
-                           useRegister(mod->rhs()),
-                           tempFixed(eax));
+    LModI *lir = new(alloc()) LModI(useFixedAtStart(mod->lhs(), eax),
+                                    useRegister(mod->rhs()),
+                                    tempFixed(eax));
     if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, mod, LAllocation(AnyRegister(edx)));
 }
 
 bool
 LIRGeneratorX86Shared::visitAsmJSNeg(MAsmJSNeg *ins)
 {
     if (ins->type() == MIRType_Int32)
-        return defineReuseInput(new LNegI(useRegisterAtStart(ins->input())), ins, 0);
+        return defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(ins->input())), ins, 0);
 
     JS_ASSERT(ins->type() == MIRType_Double);
-    return defineReuseInput(new LNegD(useRegisterAtStart(ins->input())), ins, 0);
+    return defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(ins->input())), ins, 0);
 }
 
 bool
 LIRGeneratorX86Shared::lowerUDiv(MDiv *div)
 {
     // Optimize x/x. The comments in lowerDivI apply here as well.
     if (div->lhs() == div->rhs()) {
         if (!div->canBeDivideByZero())
-            return define(new LInteger(1), div);
+            return define(new(alloc()) LInteger(1), div);
 
-        LDivSelfI *lir = new LDivSelfI(useRegisterAtStart(div->lhs()));
+        LDivSelfI *lir = new(alloc()) LDivSelfI(useRegisterAtStart(div->lhs()));
         if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, div);
     }
 
-    LUDivOrMod *lir = new LUDivOrMod(useFixedAtStart(div->lhs(), eax),
-                                     useRegister(div->rhs()),
-                                     tempFixed(edx));
+    LUDivOrMod *lir = new(alloc()) LUDivOrMod(useFixedAtStart(div->lhs(), eax),
+                                              useRegister(div->rhs()),
+                                              tempFixed(edx));
     if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, div, LAllocation(AnyRegister(eax)));
 }
 
 bool
 LIRGeneratorX86Shared::lowerUMod(MMod *mod)
 {
     // Optimize x%x. The comments in lowerModI apply here as well.
     if (mod->lhs() == mod->rhs()) {
         if (mod->isTruncated() || (mod->isUnsigned() && !mod->canBeDivideByZero()))
-            return define(new LInteger(0), mod);
+            return define(new(alloc()) LInteger(0), mod);
 
-        LModSelfI *lir = new LModSelfI(useRegisterAtStart(mod->lhs()));
+        LModSelfI *lir = new(alloc()) LModSelfI(useRegisterAtStart(mod->lhs()));
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
     }
 
-    LUDivOrMod *lir = new LUDivOrMod(useFixedAtStart(mod->lhs(), eax),
-                                     useRegister(mod->rhs()),
-                                     tempFixed(eax));
+    LUDivOrMod *lir = new(alloc()) LUDivOrMod(useFixedAtStart(mod->lhs(), eax),
+                                              useRegister(mod->rhs()),
+                                              tempFixed(eax));
     if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, mod, LAllocation(AnyRegister(edx)));
 }
 
 bool
 LIRGeneratorX86Shared::lowerUrshD(MUrsh *mir)
 {
@@ -287,30 +287,30 @@ LIRGeneratorX86Shared::lowerUrshD(MUrsh 
 
 #ifdef JS_CPU_X64
     JS_ASSERT(ecx == rcx);
 #endif
 
     LUse lhsUse = useRegisterAtStart(lhs);
     LAllocation rhsAlloc = rhs->isConstant() ? useOrConstant(rhs) : useFixed(rhs, ecx);
 
-    LUrshD *lir = new LUrshD(lhsUse, rhsAlloc, tempCopy(lhs, 0));
+    LUrshD *lir = new(alloc()) LUrshD(lhsUse, rhsAlloc, tempCopy(lhs, 0));
     return define(lir, mir);
 }
 
 bool
 LIRGeneratorX86Shared::lowerConstantDouble(double d, MInstruction *mir)
 {
-    return define(new LDouble(d), mir);
+    return define(new(alloc()) LDouble(d), mir);
 }
 
 bool
 LIRGeneratorX86Shared::lowerConstantFloat32(float f, MInstruction *mir)
 {
-    return define(new LFloat32(f), mir);
+    return define(new(alloc()) LFloat32(f), mir);
 }
 
 bool
 LIRGeneratorX86Shared::visitConstant(MConstant *ins)
 {
     if (ins->type() == MIRType_Double)
         return lowerConstantDouble(ins->value().toDouble(), ins);
 
@@ -326,20 +326,20 @@ LIRGeneratorX86Shared::visitConstant(MCo
 
 bool
 LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
     LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
-    return define(new LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
+    return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
 bool
 LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
     LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
-    return define(new LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
+    return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }
--- a/js/src/jit/x64/Lowering-x64.cpp
+++ b/js/src/jit/x64/Lowering-x64.cpp
@@ -60,45 +60,45 @@ LIRGeneratorX64::visitBox(MBox *box)
 {
     MDefinition *opd = box->getOperand(0);
 
     // If the operand is a constant, emit near its uses.
     if (opd->isConstant() && box->canEmitAtUses())
         return emitAtUses(box);
 
     if (opd->isConstant())
-        return define(new LValue(opd->toConstant()->value()), box, LDefinition(LDefinition::BOX));
+        return define(new(alloc()) LValue(opd->toConstant()->value()), box, LDefinition(LDefinition::BOX));
 
-    LBox *ins = new LBox(opd->type(), useRegister(opd));
+    LBox *ins = new(alloc()) LBox(opd->type(), useRegister(opd));
     return define(ins, box, LDefinition(LDefinition::BOX));
 }
 
 bool
 LIRGeneratorX64::visitUnbox(MUnbox *unbox)
 {
     MDefinition *box = unbox->getOperand(0);
     LUnboxBase *lir;
     if (IsFloatingPointType(unbox->type()))
-        lir = new LUnboxFloatingPoint(useRegisterAtStart(box), unbox->type());
+        lir = new(alloc()) LUnboxFloatingPoint(useRegisterAtStart(box), unbox->type());
     else
-        lir = new LUnbox(useRegisterAtStart(box));
+        lir = new(alloc()) LUnbox(useRegisterAtStart(box));
 
     if (unbox->fallible() && !assignSnapshot(lir, unbox->bailoutKind()))
         return false;
 
     return define(lir, unbox);
 }
 
 bool
 LIRGeneratorX64::visitReturn(MReturn *ret)
 {
     MDefinition *opd = ret->getOperand(0);
     JS_ASSERT(opd->type() == MIRType_Value);
 
-    LReturn *ins = new LReturn;
+    LReturn *ins = new(alloc()) LReturn;
     ins->setOperand(0, useFixed(opd, JSReturnReg));
     return add(ins);
 }
 
 bool
 LIRGeneratorX64::defineUntypedPhi(MPhi *phi, size_t lirIndex)
 {
     return defineTypedPhi(phi, lirIndex);
@@ -109,43 +109,43 @@ LIRGeneratorX64::lowerUntypedPhiInput(MP
 {
     lowerTypedPhiInput(phi, inputPosition, block, lirIndex);
 }
 
 bool
 LIRGeneratorX64::visitAsmJSUnsignedToDouble(MAsmJSUnsignedToDouble *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToDouble *lir = new LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()));
+    LAsmJSUInt32ToDouble *lir = new(alloc()) LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()));
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorX64::visitAsmJSUnsignedToFloat32(MAsmJSUnsignedToFloat32 *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToFloat32 *lir = new LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()));
+    LAsmJSUInt32ToFloat32 *lir = new(alloc()) LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()));
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorX64::visitAsmJSLoadHeap(MAsmJSLoadHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     JS_ASSERT(ptr->type() == MIRType_Int32);
 
     // The X64 does not inline an explicit bounds check so has no need to keep the
     // index in a register, however only a positive index is accepted because a
     // negative offset encoded as an offset in the addressing mode would not wrap
     // back into the protected area reserved for the heap.
     if (ptr->isConstant() && ptr->toConstant()->value().toInt32() >= 0) {
-        LAsmJSLoadHeap *lir = new LAsmJSLoadHeap(LAllocation(ptr->toConstant()->vp()));
+        LAsmJSLoadHeap *lir = new(alloc()) LAsmJSLoadHeap(LAllocation(ptr->toConstant()->vp()));
         return define(lir, ins);
     }
-    return define(new LAsmJSLoadHeap(useRegisterAtStart(ptr)), ins);
+    return define(new(alloc()) LAsmJSLoadHeap(useRegisterAtStart(ptr)), ins);
 }
 
 bool
 LIRGeneratorX64::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     JS_ASSERT(ptr->type() == MIRType_Int32);
     LAsmJSStoreHeap *lir;
@@ -153,30 +153,30 @@ LIRGeneratorX64::visitAsmJSStoreHeap(MAs
     // Note only a positive constant index is accepted because a negative offset
     // encoded as an offset in the addressing mode would not wrap back into the
     // protected area reserved for the heap.
     LAllocation ptrAlloc = useRegisterOrNonNegativeConstantAtStart(ptr);
     switch (ins->viewType()) {
       case ArrayBufferView::TYPE_INT8: case ArrayBufferView::TYPE_UINT8:
       case ArrayBufferView::TYPE_INT16: case ArrayBufferView::TYPE_UINT16:
       case ArrayBufferView::TYPE_INT32: case ArrayBufferView::TYPE_UINT32:
-        lir = new LAsmJSStoreHeap(ptrAlloc, useRegisterOrConstantAtStart(ins->value()));
+        lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterOrConstantAtStart(ins->value()));
         break;
       case ArrayBufferView::TYPE_FLOAT32: case ArrayBufferView::TYPE_FLOAT64:
-        lir = new LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
+        lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
         break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
 }
 
 bool
 LIRGeneratorX64::visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins)
 {
-    return define(new LAsmJSLoadFuncPtr(useRegister(ins->index()), temp()), ins);
+    return define(new(alloc()) LAsmJSLoadFuncPtr(useRegister(ins->index()), temp()), ins);
 }
 
 bool
 LIRGeneratorX64::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
     MOZ_ASSUME_UNREACHABLE("NYI");
 }
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -459,17 +459,17 @@ CodeGeneratorX86::visitLoadTypedArrayEle
     const MLoadTypedArrayElementStatic *mir = ins->mir();
     ArrayBufferView::ViewType vt = mir->viewType();
 
     Register ptr = ToRegister(ins->ptr());
     const LDefinition *out = ins->output();
 
     OutOfLineLoadTypedArrayOutOfBounds *ool = nullptr;
     if (!mir->fallible()) {
-        ool = new OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
+        ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
         if (!addOutOfLineCode(ool))
             return false;
     }
 
     masm.cmpl(ptr, Imm32(mir->length()));
     if (ool)
         masm.j(Assembler::AboveOrEqual, ool->entry());
     else if (!bailoutIf(Assembler::AboveOrEqual, ins->snapshot()))
@@ -511,17 +511,17 @@ CodeGeneratorX86::visitAsmJSLoadHeap(LAs
     }
 
     Register ptrReg = ToRegister(ptr);
     Address srcAddr(ptrReg, 0);
 
     if (mir->skipBoundsCheck())
         return loadViewTypeElement(vt, srcAddr, out);
 
-    OutOfLineLoadTypedArrayOutOfBounds *ool = new OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
+    OutOfLineLoadTypedArrayOutOfBounds *ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
     if (!addOutOfLineCode(ool))
         return false;
 
     CodeOffsetLabel cmp = masm.cmplWithPatch(ptrReg, Imm32(0));
     masm.j(Assembler::AboveOrEqual, ool->entry());
 
     if (vt == ArrayBufferView::TYPE_FLOAT32) {
         FloatRegister dest = ToFloatRegister(out);
@@ -818,32 +818,32 @@ class OutOfLineTruncateFloat32 : public 
 } // namespace js
 
 bool
 CodeGeneratorX86::visitTruncateDToInt32(LTruncateDToInt32 *ins)
 {
     FloatRegister input = ToFloatRegister(ins->input());
     Register output = ToRegister(ins->output());
 
-    OutOfLineTruncate *ool = new OutOfLineTruncate(ins);
+    OutOfLineTruncate *ool = new(alloc()) OutOfLineTruncate(ins);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.branchTruncateDouble(input, output, ool->entry());
     masm.bind(ool->rejoin());
     return true;
 }
 
 bool
 CodeGeneratorX86::visitTruncateFToInt32(LTruncateFToInt32 *ins)
 {
     FloatRegister input = ToFloatRegister(ins->input());
     Register output = ToRegister(ins->output());
 
-    OutOfLineTruncateFloat32 *ool = new OutOfLineTruncateFloat32(ins);
+    OutOfLineTruncateFloat32 *ool = new(alloc()) OutOfLineTruncateFloat32(ins);
     if (!addOutOfLineCode(ool))
         return false;
 
     masm.branchTruncateFloat32(input, output, ool->entry());
     masm.bind(ool->rejoin());
     return true;
 }
 
--- a/js/src/jit/x86/Lowering-x86.cpp
+++ b/js/src/jit/x86/Lowering-x86.cpp
@@ -78,26 +78,26 @@ LIRGeneratorX86::useByteOpRegisterOrNonD
 
 bool
 LIRGeneratorX86::visitBox(MBox *box)
 {
     MDefinition *inner = box->getOperand(0);
 
     // If the box wrapped a double, it needs a new register.
     if (IsFloatingPointType(inner->type()))
-        return defineBox(new LBoxFloatingPoint(useRegisterAtStart(inner), tempCopy(inner, 0),
-                                               inner->type()), box);
+        return defineBox(new(alloc()) LBoxFloatingPoint(useRegisterAtStart(inner), tempCopy(inner, 0),
+                                                        inner->type()), box);
 
     if (box->canEmitAtUses())
         return emitAtUses(box);
 
     if (inner->isConstant())
-        return defineBox(new LValue(inner->toConstant()->value()), box);
+        return defineBox(new(alloc()) LValue(inner->toConstant()->value()), box);
 
-    LBox *lir = new LBox(use(inner), inner->type());
+    LBox *lir = new(alloc()) LBox(use(inner), inner->type());
 
     // Otherwise, we should not define a new register for the payload portion
     // of the output, so bypass defineBox().
     uint32_t vreg = getVirtualRegister();
     if (vreg >= MAX_VIRTUAL_REGISTERS)
         return false;
 
     // Note that because we're using PASSTHROUGH, we do not change the type of
@@ -120,26 +120,26 @@ LIRGeneratorX86::visitUnbox(MUnbox *unbo
     // a payload. Unlike most instructions conusming a box, we ask for the type
     // second, so that the result can re-use the first input.
     MDefinition *inner = unbox->getOperand(0);
 
     if (!ensureDefined(inner))
         return false;
 
     if (IsFloatingPointType(unbox->type())) {
-        LUnboxFloatingPoint *lir = new LUnboxFloatingPoint(unbox->type());
+        LUnboxFloatingPoint *lir = new(alloc()) LUnboxFloatingPoint(unbox->type());
         if (unbox->fallible() && !assignSnapshot(lir, unbox->bailoutKind()))
             return false;
         if (!useBox(lir, LUnboxFloatingPoint::Input, inner))
             return false;
         return define(lir, unbox);
     }
 
     // Swap the order we use the box pieces so we can re-use the payload register.
-    LUnbox *lir = new LUnbox;
+    LUnbox *lir = new(alloc()) LUnbox;
     lir->setOperand(0, usePayloadInRegisterAtStart(inner));
     lir->setOperand(1, useType(inner, LUse::ANY));
 
     if (unbox->fallible() && !assignSnapshot(lir, unbox->bailoutKind()))
         return false;
 
     // Note that PASSTHROUGH here is illegal, since types and payloads form two
     // separate intervals. If the type becomes dead before the payload, it
@@ -151,17 +151,17 @@ LIRGeneratorX86::visitUnbox(MUnbox *unbo
 }
 
 bool
 LIRGeneratorX86::visitReturn(MReturn *ret)
 {
     MDefinition *opd = ret->getOperand(0);
     JS_ASSERT(opd->type() == MIRType_Value);
 
-    LReturn *ins = new LReturn;
+    LReturn *ins = new(alloc()) LReturn;
     ins->setOperand(0, LUse(JSReturnReg_Type));
     ins->setOperand(1, LUse(JSReturnReg_Data));
     return fillBoxUses(ins, 0, opd) && add(ins);
 }
 
 bool
 LIRGeneratorX86::defineUntypedPhi(MPhi *phi, size_t lirIndex)
 {
@@ -195,25 +195,25 @@ LIRGeneratorX86::lowerUntypedPhiInput(MP
     type->setOperand(inputPosition, LUse(operand->virtualRegister() + VREG_TYPE_OFFSET, LUse::ANY));
     payload->setOperand(inputPosition, LUse(VirtualRegisterOfPayload(operand), LUse::ANY));
 }
 
 bool
 LIRGeneratorX86::visitAsmJSUnsignedToDouble(MAsmJSUnsignedToDouble *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToDouble *lir = new LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()), temp());
+    LAsmJSUInt32ToDouble *lir = new(alloc()) LAsmJSUInt32ToDouble(useRegisterAtStart(ins->input()), temp());
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorX86::visitAsmJSUnsignedToFloat32(MAsmJSUnsignedToFloat32 *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_Int32);
-    LAsmJSUInt32ToFloat32 *lir = new LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()), temp());
+    LAsmJSUInt32ToFloat32 *lir = new(alloc()) LAsmJSUInt32ToFloat32(useRegisterAtStart(ins->input()), temp());
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorX86::visitAsmJSLoadHeap(MAsmJSLoadHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     LAllocation ptrAlloc;
@@ -223,17 +223,17 @@ LIRGeneratorX86::visitAsmJSLoadHeap(MAsm
     if (ptr->isConstant() && ins->skipBoundsCheck()) {
         int32_t ptrValue = ptr->toConstant()->value().toInt32();
         // A bounds check is only skipped for a positive index.
         JS_ASSERT(ptrValue >= 0);
         ptrAlloc = LAllocation(ptr->toConstant()->vp());
     } else {
         ptrAlloc = useRegisterAtStart(ptr);
     }
-    LAsmJSLoadHeap *lir = new LAsmJSLoadHeap(ptrAlloc);
+    LAsmJSLoadHeap *lir = new(alloc()) LAsmJSLoadHeap(ptrAlloc);
     return define(lir, ins);
 }
 
 bool
 LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     LAsmJSStoreHeap *lir;
@@ -241,68 +241,68 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAs
 
     if (ptr->isConstant() && ins->skipBoundsCheck()) {
         int32_t ptrValue = ptr->toConstant()->value().toInt32();
         JS_ASSERT(ptrValue >= 0);
         LAllocation ptrAlloc = LAllocation(ptr->toConstant()->vp());
         switch (ins->viewType()) {
           case ArrayBufferView::TYPE_INT8: case ArrayBufferView::TYPE_UINT8:
             // See comment below.
-            lir = new LAsmJSStoreHeap(ptrAlloc, useFixed(ins->value(), eax));
+            lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useFixed(ins->value(), eax));
             break;
           case ArrayBufferView::TYPE_INT16: case ArrayBufferView::TYPE_UINT16:
           case ArrayBufferView::TYPE_INT32: case ArrayBufferView::TYPE_UINT32:
           case ArrayBufferView::TYPE_FLOAT32: case ArrayBufferView::TYPE_FLOAT64:
             // See comment below.
-            lir = new LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
+            lir = new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value()));
             break;
           default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
         return add(lir, ins);
     }
 
     switch (ins->viewType()) {
       case ArrayBufferView::TYPE_INT8: case ArrayBufferView::TYPE_UINT8:
         // See comment for LIRGeneratorX86::useByteOpRegister.
-        lir = new LAsmJSStoreHeap(useRegister(ins->ptr()), useFixed(ins->value(), eax));
+        lir = new(alloc()) LAsmJSStoreHeap(useRegister(ins->ptr()), useFixed(ins->value(), eax));
         break;
       case ArrayBufferView::TYPE_INT16: case ArrayBufferView::TYPE_UINT16:
       case ArrayBufferView::TYPE_INT32: case ArrayBufferView::TYPE_UINT32:
       case ArrayBufferView::TYPE_FLOAT32: case ArrayBufferView::TYPE_FLOAT64:
         // For now, don't allow constant values. The immediate operand
         // affects instruction layout which affects patching.
-        lir = new LAsmJSStoreHeap(useRegisterAtStart(ptr), useRegisterAtStart(ins->value()));
+        lir = new(alloc()) LAsmJSStoreHeap(useRegisterAtStart(ptr), useRegisterAtStart(ins->value()));
         break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
 }
 
 bool
 LIRGeneratorX86::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
     // The code generated for StoreTypedArrayElementStatic is identical to that
     // for AsmJSStoreHeap, and the same concerns apply.
     LStoreTypedArrayElementStatic *lir;
     switch (ins->viewType()) {
       case ArrayBufferView::TYPE_INT8: case ArrayBufferView::TYPE_UINT8:
       case ArrayBufferView::TYPE_UINT8_CLAMPED:
-        lir = new LStoreTypedArrayElementStatic(useRegister(ins->ptr()),
-                                                useFixed(ins->value(), eax));
+        lir = new(alloc()) LStoreTypedArrayElementStatic(useRegister(ins->ptr()),
+                                                         useFixed(ins->value(), eax));
         break;
       case ArrayBufferView::TYPE_INT16: case ArrayBufferView::TYPE_UINT16:
       case ArrayBufferView::TYPE_INT32: case ArrayBufferView::TYPE_UINT32:
       case ArrayBufferView::TYPE_FLOAT32: case ArrayBufferView::TYPE_FLOAT64:
-        lir = new LStoreTypedArrayElementStatic(useRegisterAtStart(ins->ptr()),
-                                                useRegisterAtStart(ins->value()));
+        lir = new(alloc()) LStoreTypedArrayElementStatic(useRegisterAtStart(ins->ptr()),
+                                                         useRegisterAtStart(ins->value()));
         break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
 }
 
 bool
 LIRGeneratorX86::visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins)
 {
-    return define(new LAsmJSLoadFuncPtr(useRegisterAtStart(ins->index())), ins);
+    return define(new(alloc()) LAsmJSLoadFuncPtr(useRegisterAtStart(ins->index())), ins);
 }