--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -445,17 +445,17 @@ IonBuilder::InliningDecision IonBuilder:
   if (callInfo.constructing()) {
     if (!target->isConstructor()) {
       return DontInline(inlineScript, "Callee is not a constructor");
     }
 
     // Don't inline if creating |this| for this target is complicated, for
     // example when the newTarget.prototype lookup may be effectful.
     if (!target->constructorNeedsUninitializedThis() &&
-        callInfo.getNewTarget() != callInfo.fun()) {
+        callInfo.getNewTarget() != callInfo.callee()) {
       JSFunction* newTargetFun =
           getSingleCallTarget(callInfo.getNewTarget()->resultTypeSet());
       if (!newTargetFun) {
         return DontInline(inlineScript, "Constructing with unknown newTarget");
       }
       if (!newTargetFun->hasNonConfigurablePrototypeDataProperty()) {
         return DontInline(inlineScript,
                           "Constructing with effectful newTarget.prototype");
@@ -1075,17 +1075,17 @@ AbortReasonOr<Ok> IonBuilder::buildInlin
     hasLazyArguments_ = true;
   }
 #endif
 
   insertRecompileCheck(pc);
 
   // Initialize the env chain now that all resume points operands are
   // initialized.
-  MOZ_TRY(initEnvironmentChain(callInfo.fun()));
+  MOZ_TRY(initEnvironmentChain(callInfo.callee()));
 
   auto clearLastPriorResumePoint = mozilla::MakeScopeExit([&] {
     // Discard unreferenced & pre-allocated resume points.
     replaceMaybeFallbackFunctionGetter(nullptr);
   });
 
   MOZ_TRY(traverseBytecode());
 
@@ -4016,34 +4016,34 @@ IonBuilder::InliningResult IonBuilder::i
     return abort(AbortReason::Alloc);
   }
 
   callInfo.setImplicitlyUsedUnchecked();
 
   // Create new |this| on the caller-side for inlined constructors.
   if (callInfo.constructing()) {
     MDefinition* thisDefn =
-        createThis(target, callInfo.fun(), callInfo.getNewTarget(),
+        createThis(target, callInfo.callee(), callInfo.getNewTarget(),
                    /* inlining = */ true);
     callInfo.setThis(thisDefn);
   }
 
   // Capture formals in the outer resume point.
   MOZ_TRY(callInfo.pushCallStack(&mirGen_, current));
 
   MResumePoint* outerResumePoint =
       MResumePoint::New(alloc(), current, pc, MResumePoint::Outer);
   if (!outerResumePoint) {
     return abort(AbortReason::Alloc);
   }
   current->setOuterResumePoint(outerResumePoint);
 
-  // Pop formals again, except leave |fun| on stack for duration of call.
+  // Pop formals again, except leave |callee| on stack for duration of call.
   callInfo.popCallStack(current);
-  current->push(callInfo.fun());
+  current->push(callInfo.callee());
 
   JSScript* calleeScript = target->nonLazyScript();
   BaselineInspector inspector(calleeScript);
 
   // Improve type information of |this| when not set.
   if (callInfo.constructing() && !callInfo.thisArg()->resultTypeSet()) {
     AutoSweepJitScript sweep(calleeScript);
     StackTypeSet* types =
@@ -4598,17 +4598,17 @@ MGetPropertyCache* IonBuilder::getInline
     return nullptr;
   }
 
   MDefinition* thisDef = callInfo.thisArg();
   if (thisDef->type() != MIRType::Object) {
     return nullptr;
   }
 
-  MDefinition* funcDef = callInfo.fun();
+  MDefinition* funcDef = callInfo.callee();
   if (funcDef->type() != MIRType::Object) {
     return nullptr;
   }
 
   // MGetPropertyCache with no uses may be optimized away.
   if (funcDef->isGetPropertyCache()) {
     WrapMGetPropertyCache cache(funcDef->toGetPropertyCache());
     return cache.moveableCache(/* hasTypeBarrier = */ false, thisDef);
@@ -4678,29 +4678,29 @@ IonBuilder::InliningResult IonBuilder::i
         return InliningStatus_WarmUpCountTooLow;
       case InliningDecision_Inline:
         break;
     }
 
     // Inlining will elminate uses of the original callee, but it needs to
     // be preserved in phis if we bail out.  Mark the old callee definition as
     // implicitly used to ensure this happens.
-    callInfo.fun()->setImplicitlyUsedUnchecked();
+    callInfo.callee()->setImplicitlyUsedUnchecked();
 
     // If the callee is not going to be a lambda (which may vary across
     // different invocations), then the callee definition can be replaced by a
     // constant.
     if (target->isSingleton()) {
       // Replace the function with an MConstant.
       MConstant* constFun = constant(ObjectValue(*target));
       if (callInfo.constructing() &&
-          callInfo.getNewTarget() == callInfo.fun()) {
+          callInfo.getNewTarget() == callInfo.callee()) {
         callInfo.setNewTarget(constFun);
       }
-      callInfo.setFun(constFun);
+      callInfo.setCallee(constFun);
     }
 
     return inlineSingleCall(callInfo, target);
   }
 
   // Choose a subset of the targets for polymorphic inlining.
   BoolVector choiceSet(alloc());
   uint32_t numInlined;
@@ -4739,29 +4739,29 @@ AbortReasonOr<Ok> IonBuilder::inlineGene
   return Ok();
 }
 
 AbortReasonOr<Ok> IonBuilder::inlineObjectGroupFallback(
     const Maybe<CallTargets>& targets, CallInfo& callInfo,
     MBasicBlock* dispatchBlock, MObjectGroupDispatch* dispatch,
     MGetPropertyCache* cache, MBasicBlock** fallbackTarget) {
   // Getting here implies the following:
-  // 1. The call function is an MGetPropertyCache, or an MGetPropertyCache
+  // 1. The callee is an MGetPropertyCache, or an MGetPropertyCache
   //    followed by an MTypeBarrier.
-  MOZ_ASSERT(callInfo.fun()->isGetPropertyCache() ||
-             callInfo.fun()->isTypeBarrier());
+  MOZ_ASSERT(callInfo.callee()->isGetPropertyCache() ||
+             callInfo.callee()->isTypeBarrier());
 
   // 2. The MGetPropertyCache has inlineable cases by guarding on the
   // ObjectGroup.
   MOZ_ASSERT(dispatch->numCases() > 0);
 
   // 3. The MGetPropertyCache (and, if applicable, MTypeBarrier) only
   //    have at most a single use.
-  MOZ_ASSERT_IF(callInfo.fun()->isGetPropertyCache(), !cache->hasUses());
-  MOZ_ASSERT_IF(callInfo.fun()->isTypeBarrier(), cache->hasOneUse());
+  MOZ_ASSERT_IF(callInfo.callee()->isGetPropertyCache(), !cache->hasUses());
+  MOZ_ASSERT_IF(callInfo.callee()->isTypeBarrier(), cache->hasOneUse());
 
   // This means that no resume points yet capture the MGetPropertyCache,
   // so everything from the MGetPropertyCache up until the call is movable.
   // We now move the MGetPropertyCache and friends into a fallback path.
   MOZ_ASSERT(cache->idempotent());
 
   // Create a new CallInfo to track modified state within the fallback path.
   CallInfo fallbackInfo(alloc(), pc, callInfo.constructing(),
@@ -4775,17 +4775,17 @@ AbortReasonOr<Ok> IonBuilder::inlineObje
       MResumePoint::New(alloc(), dispatchBlock, pc, MResumePoint::ResumeAt);
   if (!preCallResumePoint) {
     return abort(AbortReason::Alloc);
   }
 
   DebugOnly<size_t> preCallFuncIndex =
       preCallResumePoint->stackDepth() - callInfo.numFormals();
   MOZ_ASSERT(preCallResumePoint->getOperand(preCallFuncIndex) ==
-             fallbackInfo.fun());
+             fallbackInfo.callee());
 
   // In the dispatch block, replace the function's slot entry with Undefined.
   MConstant* undefined = MConstant::New(alloc(), UndefinedValue());
   dispatchBlock->add(undefined);
   dispatchBlock->rewriteAtDepth(-int(callInfo.numFormals()), undefined);
 
   // Construct a block that does nothing but remove formals from the stack.
   // This is effectively changing the entry resume point of the later fallback
@@ -4810,22 +4810,22 @@ AbortReasonOr<Ok> IonBuilder::inlineObje
 
   // Since the getPropBlock inherited the stack from right before the
   // MGetPropertyCache, the target of the MGetPropertyCache is still on the
   // stack.
   DebugOnly<MDefinition*> checkObject = getPropBlock->pop();
   MOZ_ASSERT(checkObject == cache->value());
 
   // Move the MGetPropertyCache and friends into the getPropBlock.
-  if (fallbackInfo.fun()->isGetPropertyCache()) {
-    MOZ_ASSERT(fallbackInfo.fun()->toGetPropertyCache() == cache);
+  if (fallbackInfo.callee()->isGetPropertyCache()) {
+    MOZ_ASSERT(fallbackInfo.callee()->toGetPropertyCache() == cache);
     getPropBlock->addFromElsewhere(cache);
     getPropBlock->push(cache);
   } else {
-    MTypeBarrier* barrier = callInfo.fun()->toTypeBarrier();
+    MTypeBarrier* barrier = callInfo.callee()->toTypeBarrier();
     MOZ_ASSERT(barrier->type() == MIRType::Object);
     MOZ_ASSERT(barrier->input()->isGetPropertyCache());
     MOZ_ASSERT(barrier->input()->toGetPropertyCache() == cache);
 
     getPropBlock->addFromElsewhere(cache);
     getPropBlock->addFromElsewhere(barrier);
     getPropBlock->push(barrier);
   }
@@ -4871,19 +4871,19 @@ AbortReasonOr<Ok> IonBuilder::inlineCall
     }
   }
 
   // Generate a dispatch based on guard kind.
   MDispatchInstruction* dispatch;
   if (maybeCache) {
     dispatch = MObjectGroupDispatch::New(alloc(), maybeCache->value(),
                                          maybeCache->propTable());
-    callInfo.fun()->setImplicitlyUsedUnchecked();
+    callInfo.callee()->setImplicitlyUsedUnchecked();
   } else {
-    dispatch = MFunctionDispatch::New(alloc(), callInfo.fun());
+    dispatch = MFunctionDispatch::New(alloc(), callInfo.callee());
   }
 
   MOZ_ASSERT(dispatchBlock->stackDepth() >= callInfo.numFormals());
   uint32_t stackDepth = dispatchBlock->stackDepth() - callInfo.numFormals() + 1;
 
   // Generate a return block to host the rval-collecting MPhi.
   jsbytecode* postCall = GetNextPc(pc);
   MBasicBlock* returnBlock;
@@ -4937,17 +4937,17 @@ AbortReasonOr<Ok> IonBuilder::inlineCall
 
     // Create a function MConstant to use in the entry ResumePoint. If we
     // can't use a constant, add a no-op MPolyInlineGuard, to prevent
     // hoisting env chain gets above the dispatch instruction.
     MInstruction* funcDef;
     if (target->isSingleton()) {
       funcDef = MConstant::New(alloc(), ObjectValue(*target), constraints());
     } else {
-      funcDef = MPolyInlineGuard::New(alloc(), callInfo.fun());
+      funcDef = MPolyInlineGuard::New(alloc(), callInfo.callee());
     }
 
     funcDef->setImplicitlyUsedUnchecked();
     dispatchBlock->add(funcDef);
 
     // Use the inlined callee in the inline resume point and on stack.
     int funIndex =
         inlineBlock->entryResumePoint()->stackDepth() - callInfo.numFormals();
@@ -4956,19 +4956,20 @@ AbortReasonOr<Ok> IonBuilder::inlineCall
 
     // Create a new CallInfo to track modified state within the inline block.
     CallInfo inlineInfo(alloc(), pc, callInfo.constructing(),
                         callInfo.ignoresReturnValue());
     if (!inlineInfo.init(callInfo)) {
       return abort(AbortReason::Alloc);
     }
     inlineInfo.popCallStack(inlineBlock);
-    inlineInfo.setFun(funcDef);
-
-    if (callInfo.constructing() && callInfo.getNewTarget() == callInfo.fun()) {
+    inlineInfo.setCallee(funcDef);
+
+    if (callInfo.constructing() &&
+        callInfo.getNewTarget() == callInfo.callee()) {
       inlineInfo.setNewTarget(funcDef);
     }
 
     if (maybeCache) {
       // Assign the 'this' value a TypeSet specialized to the groups that
       // can generate this inlining target.
       MOZ_ASSERT(callInfo.thisArg() == maybeCache->value());
       TemporaryTypeSet* thisTypes =
@@ -5045,20 +5046,20 @@ AbortReasonOr<Ok> IonBuilder::inlineCall
           break;
         }
       }
 
       if (!useFallback) {
         // The object group dispatch handles all possible incoming
         // objects, so the cache and barrier will not be reached and
         // can be eliminated.
-        if (callInfo.fun()->isGetPropertyCache()) {
-          MOZ_ASSERT(callInfo.fun() == maybeCache);
+        if (callInfo.callee()->isGetPropertyCache()) {
+          MOZ_ASSERT(callInfo.callee() == maybeCache);
         } else {
-          MTypeBarrier* barrier = callInfo.fun()->toTypeBarrier();
+          MTypeBarrier* barrier = callInfo.callee()->toTypeBarrier();
           MOZ_ASSERT(!barrier->hasUses());
           MOZ_ASSERT(barrier->type() == MIRType::Object);
           MOZ_ASSERT(barrier->input()->isGetPropertyCache());
           MOZ_ASSERT(barrier->input()->toGetPropertyCache() == maybeCache);
           barrier->block()->discard(barrier);
         }
 
         MOZ_ASSERT(!maybeCache->hasUses());
@@ -5942,23 +5943,23 @@ AbortReasonOr<Ok> IonBuilder::jsop_funap
 
   // Arguments
   if (inliningDepth_) {
     if (!callInfo.setArgs(inlineCallInfo_->argv())) {
       return abort(AbortReason::Alloc);
     }
   }
 
-  // This
+  // Pop this.
   MDefinition* argThis = current->pop();
   callInfo.setThis(argThis);
 
-  // Pop function parameter.
+  // Pop callee.
   MDefinition* argFunc = current->pop();
-  callInfo.setFun(argFunc);
+  callInfo.setCallee(argFunc);
 
   // Pop apply function.
   MDefinition* nativeFunc = current->pop();
   nativeFunc->setImplicitlyUsedUnchecked();
 
   // Try to inline the call.
   InliningDecision decision = makeInliningDecision(target, callInfo);
   switch (decision) {
@@ -6178,17 +6179,17 @@ AbortReasonOr<MCall*> IonBuilder::makeCa
                   testShouldDOMCall(thisTypes, target, JSJitInfo::Method));
     }
   }
 
   bool needsThisCheck = false;
   if (callInfo.constructing()) {
     // Inline the this-object allocation on the caller-side.
     MDefinition* create =
-        createThis(target, callInfo.fun(), callInfo.getNewTarget(),
+        createThis(target, callInfo.callee(), callInfo.getNewTarget(),
                    /* inlining = */ false);
     callInfo.thisArg()->setImplicitlyUsedUnchecked();
     callInfo.setThis(create);
     needsThisCheck = create->isCreateThis();
     if (needsThisCheck) {
       // We have to use the LCallGeneric path.
       target = nullptr;
     }
@@ -6262,17 +6263,17 @@ AbortReasonOr<MCall*> IonBuilder::makeCa
     if (!needArgCheck) {
       call->disableArgCheck();
     }
     if (!maybeCrossRealm) {
       call->setNotCrossRealm();
     }
   }
 
-  call->initFunction(callInfo.fun());
+  call->initFunction(callInfo.callee());
 
   current->add(call);
   return call;
 }
 
 static bool DOMCallNeedsBarrier(const JSJitInfo* jitinfo,
                                 TemporaryTypeSet* types) {
   MOZ_ASSERT(jitinfo->type() != JSJitInfo::InlinableNative);
@@ -6366,17 +6367,17 @@ AbortReasonOr<Ok> IonBuilder::jsop_eval(
 
     CallInfo callInfo(alloc(), pc, /* constructing = */ false,
                       /* ignoresReturnValue = */ BytecodeIsPopped(pc));
     if (!callInfo.init(current, argc)) {
       return abort(AbortReason::Alloc);
     }
     callInfo.setImplicitlyUsedUnchecked();
 
-    callInfo.fun()->setImplicitlyUsedUnchecked();
+    callInfo.callee()->setImplicitlyUsedUnchecked();
 
     MDefinition* envChain = current->environmentChain();
     MDefinition* string = callInfo.getArg(0);
 
     // Direct eval acts as identity on non-string types according to
     // ES5 15.1.2.1 step 1.
     if (!string->mightBeType(MIRType::String)) {
       current->push(string);
@@ -13030,17 +13031,17 @@ MInstruction* IonBuilder::setInitialized
 
 MDefinition* IonBuilder::getCallee() {
   if (inliningDepth_ == 0) {
     MInstruction* callee = MCallee::New(alloc());
     current->add(callee);
     return callee;
   }
 
-  return inlineCallInfo_->fun();
+  return inlineCallInfo_->callee();
 }
 
 void IonBuilder::addAbortedPreliminaryGroup(ObjectGroup* group) {
   for (size_t i = 0; i < abortedPreliminaryGroups_.length(); i++) {
     if (group == abortedPreliminaryGroups_[i]) {
       return;
     }
   }

--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -251,17 +251,17 @@ IonBuilder::InliningResult IonBuilder::i
        target->jitInfo()->type() != JSJitInfo::InlinableNative)) {
     // Reaching here means we tried to inline a native for which there is no
     // Ion specialization.
     return InliningStatus_NotInlined;
   }
 
   // Don't inline if we're constructing and new.target != callee. This can
   // happen with Reflect.construct or derived class constructors.
-  if (callInfo.constructing() && callInfo.getNewTarget() != callInfo.fun()) {
+  if (callInfo.constructing() && callInfo.getNewTarget() != callInfo.callee()) {
     return InliningStatus_NotInlined;
   }
 
   if (shouldAbortOnPreliminaryGroups(callInfo.thisArg())) {
     return InliningStatus_NotInlined;
   }
   for (size_t i = 0; i < callInfo.argc(); i++) {
     if (shouldAbortOnPreliminaryGroups(callInfo.getArg(i))) {
@@ -751,17 +751,17 @@ IonBuilder::InliningResult IonBuilder::i
 
   if (getInlineReturnType() != MIRType::Double) {
     return InliningStatus_NotInlined;
   }
   if (!IsNumberType(callInfo.getArg(0)->type())) {
     return InliningStatus_NotInlined;
   }
 
-  callInfo.fun()->setImplicitlyUsedUnchecked();
+  callInfo.callee()->setImplicitlyUsedUnchecked();
   callInfo.thisArg()->setImplicitlyUsedUnchecked();
 
   MMathFunction* ins =
       MMathFunction::New(alloc(), callInfo.getArg(0), function);
   current->add(ins);
   current->push(ins);
   return InliningStatus_Inlined;
 }

--- a/js/src/jit/MIRBuilderShared.h
+++ b/js/src/jit/MIRBuilderShared.h
@@ -106,17 +106,17 @@ class LoopState {
   explicit LoopState(MBasicBlock* header) : header_(header) {}
 
   MBasicBlock* header() const { return header_; }
 };
 using LoopStateStack = Vector<LoopState, 4, JitAllocPolicy>;
 
 // Helper class to manage call state.
 class MOZ_STACK_CLASS CallInfo {
-  MDefinition* fun_;
+  MDefinition* callee_;
   MDefinition* thisArg_;
   MDefinition* newTargetArg_;
   MDefinitionVector args_;
   // If non-empty, this corresponds to the stack prior any implicit inlining
   // such as before JSOp::FunApply.
   MDefinitionVector priorArgs_;
 
   bool constructing_;
@@ -125,30 +125,30 @@ class MOZ_STACK_CLASS CallInfo {
   bool ignoresReturnValue_;
 
   bool setter_;
   bool apply_;
 
  public:
   CallInfo(TempAllocator& alloc, jsbytecode* pc, bool constructing,
            bool ignoresReturnValue)
-      : fun_(nullptr),
+      : callee_(nullptr),
         thisArg_(nullptr),
         newTargetArg_(nullptr),
         args_(alloc),
         priorArgs_(alloc),
         constructing_(constructing),
         ignoresReturnValue_(ignoresReturnValue),
         setter_(false),
         apply_(JSOp(*pc) == JSOp::FunApply) {}
 
   MOZ_MUST_USE bool init(CallInfo& callInfo) {
     MOZ_ASSERT(constructing_ == callInfo.constructing());
 
-    fun_ = callInfo.fun();
+    callee_ = callInfo.callee();
     thisArg_ = callInfo.thisArg();
     ignoresReturnValue_ = callInfo.ignoresReturnValue();
 
     if (constructing()) {
       newTargetArg_ = callInfo.getNewTarget();
     }
 
     if (!args_.appendAll(callInfo.argv())) {
@@ -170,19 +170,19 @@ class MOZ_STACK_CLASS CallInfo {
       setNewTarget(current->pop());
     }
 
     for (int32_t i = argc; i > 0; i--) {
       args_.infallibleAppend(current->peek(-i));
     }
     current->popn(argc);
 
-    // Get |this| and |fun|
+    // Get |this| and |callee|
     setThis(current->pop());
-    setFun(current->pop());
+    setCallee(current->pop());
 
     return true;
   }
 
   // Before doing any pop to the stack, capture whatever flows into the
   // instruction, such that we can restore it later.
   AbortReasonOr<Ok> savePriorCallStack(MIRGenerator* mir, MBasicBlock* current,
                                        size_t peekDepth);
@@ -214,17 +214,17 @@ class MOZ_STACK_CLASS CallInfo {
       uint32_t depth = current->stackDepth() + numFormals();
       if (depth > current->nslots()) {
         if (!current->increaseSlots(depth - current->nslots())) {
           return mir->abort(AbortReason::Alloc);
         }
       }
     }
 
-    current->push(fun());
+    current->push(callee());
     current->push(thisArg());
 
     for (uint32_t i = 0; i < argc(); i++) {
       current->push(getArg(i));
     }
 
     if (constructing()) {
       current->push(getNewTarget());
@@ -281,25 +281,25 @@ class MOZ_STACK_CLASS CallInfo {
   MDefinition* getNewTarget() const {
     MOZ_ASSERT(newTargetArg_);
     return newTargetArg_;
   }
 
   bool isSetter() const { return setter_; }
   void markAsSetter() { setter_ = true; }
 
-  MDefinition* fun() const {
-    MOZ_ASSERT(fun_);
-    return fun_;
+  MDefinition* callee() const {
+    MOZ_ASSERT(callee_);
+    return callee_;
   }
 
-  void setFun(MDefinition* fun) { fun_ = fun; }
+  void setCallee(MDefinition* callee) { callee_ = callee; }
 
   void setImplicitlyUsedUnchecked() {
-    fun_->setImplicitlyUsedUnchecked();
+    callee_->setImplicitlyUsedUnchecked();
     thisArg_->setImplicitlyUsedUnchecked();
     if (newTargetArg_) {
       newTargetArg_->setImplicitlyUsedUnchecked();
     }
     for (uint32_t i = 0; i < argc(); i++) {
       getArg(i)->setImplicitlyUsedUnchecked();
     }
   }

--- a/js/src/jit/WarpBuilder.cpp
+++ b/js/src/jit/WarpBuilder.cpp
@@ -1607,17 +1607,17 @@ bool WarpBuilder::buildCallOp(BytecodeLo
     return TranspileCacheIRToMIR(mirGen(), loc, current, snapshot, callInfo);
   }
 
   // TODO: consider adding a Call IC like Baseline has.
 
   bool needsThisCheck = false;
   if (callInfo.constructing()) {
     // Inline the this-object allocation on the caller-side.
-    MDefinition* callee = callInfo.fun();
+    MDefinition* callee = callInfo.callee();
     MDefinition* newTarget = callInfo.getNewTarget();
     MCreateThis* createThis = MCreateThis::New(alloc(), callee, newTarget);
     current->add(createThis);
     callInfo.setThis(createThis);
     needsThisCheck = true;
   }
 
   MCall* call = makeCall(callInfo, needsThisCheck);

--- a/js/src/jit/WarpBuilderShared.cpp
+++ b/js/src/jit/WarpBuilderShared.cpp
@@ -74,14 +74,14 @@ MCall* WarpBuilderShared::makeCall(CallI
   }
 
   // Add explicit arguments.
   // Skip addArg(0) because it is reserved for |this|.
   for (int32_t i = callInfo.argc() - 1; i >= 0; i--) {
     call->addArg(i + 1, callInfo.getArg(i));
   }
 
-  // Pass |this| and function.
+  // Pass |this| and callee.
   call->addArg(0, callInfo.thisArg());
-  call->initFunction(callInfo.fun());
+  call->initFunction(callInfo.callee());
 
   return call;
 }

--- a/js/src/jit/WarpCacheIRTranspiler.cpp
+++ b/js/src/jit/WarpCacheIRTranspiler.cpp
@@ -1069,17 +1069,17 @@ bool WarpCacheIRTranspiler::emitLoadArgu
 
   // ThisValue
   if (slotIndex == callInfo_->argc()) {
     return defineOperand(resultId, callInfo_->thisArg());
   }
 
   // Callee
   MOZ_ASSERT(slotIndex == callInfo_->argc() + 1);
-  return defineOperand(resultId, callInfo_->fun());
+  return defineOperand(resultId, callInfo_->callee());
 }
 
 bool WarpCacheIRTranspiler::emitLoadArgumentDynamicSlot(ValOperandId resultId,
                                                         Int32OperandId argcId,
                                                         uint8_t slotIndex) {
 #ifdef DEBUG
   MDefinition* argc = getOperand(argcId);
   MOZ_ASSERT(argc->toConstant()->toInt32() ==