Bug 1673553 part 12 - Remove TypeNewScript, PreliminaryObjectArray. r=iain
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 18 Nov 2020 15:46:52 +0000
changeset 557813 678cf10d9be337f69ae3b18c2d8e363239307527
parent 557812 dbcc16d84227761523600aaefe38c18d2fdbb7e4
child 557814 d114b0ebe5f01fd169edf6483f260703a8179a15
push id37962
push userapavel@mozilla.com
push dateWed, 18 Nov 2020 21:51:58 +0000
treeherdermozilla-central@9d797387f57c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersiain
bugs1673553
milestone85.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1673553 part 12 - Remove TypeNewScript, PreliminaryObjectArray. r=iain ObjectGroup::finalize is now an empty function so define it in the header. The objectGroupsMallocHeap memory reporter can also be removed. Differential Revision: https://phabricator.services.mozilla.com/D97292
js/public/MemoryMetrics.h
js/src/frontend/Stencil.cpp
js/src/gc/GCEnum.h
js/src/gc/GCProbes.h
js/src/gc/Marking.cpp
js/src/jit/BaselineIC.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/IonAnalysis.h
js/src/jit/MacroAssembler.cpp
js/src/vm/ArrayObject-inl.h
js/src/vm/Caches-inl.h
js/src/vm/FunctionFlags.h
js/src/vm/Interpreter.cpp
js/src/vm/JSFunction.h
js/src/vm/JSObject.cpp
js/src/vm/MemoryMetrics.cpp
js/src/vm/NativeObject.cpp
js/src/vm/NativeObject.h
js/src/vm/ObjectGroup-inl.h
js/src/vm/ObjectGroup.cpp
js/src/vm/ObjectGroup.h
js/src/vm/PlainObject.cpp
js/src/vm/Shape.cpp
js/src/vm/TypeInference-inl.h
js/src/vm/TypeInference.cpp
js/src/vm/TypeInference.h
js/src/vm/TypeSet.h
js/xpconnect/src/XPCJSRuntime.cpp
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -619,17 +619,16 @@ struct UnusedGCThingSizes {
 struct ZoneStats {
 #define FOR_EACH_SIZE(MACRO)                               \
   MACRO(Other, GCHeapUsed, symbolsGCHeap)                  \
   MACRO(Other, GCHeapUsed, bigIntsGCHeap)                  \
   MACRO(Other, MallocHeap, bigIntsMallocHeap)              \
   MACRO(Other, GCHeapAdmin, gcHeapArenaAdmin)              \
   MACRO(Other, GCHeapUsed, jitCodesGCHeap)                 \
   MACRO(Other, GCHeapUsed, objectGroupsGCHeap)             \
-  MACRO(Other, MallocHeap, objectGroupsMallocHeap)         \
   MACRO(Other, GCHeapUsed, scopesGCHeap)                   \
   MACRO(Other, MallocHeap, scopesMallocHeap)               \
   MACRO(Other, GCHeapUsed, regExpSharedsGCHeap)            \
   MACRO(Other, MallocHeap, regExpSharedsMallocHeap)        \
   MACRO(Other, MallocHeap, typePool)                       \
   MACRO(Other, MallocHeap, regexpZone)                     \
   MACRO(Other, MallocHeap, jitZone)                        \
   MACRO(Other, MallocHeap, baselineStubsOptimized)         \
--- a/js/src/frontend/Stencil.cpp
+++ b/js/src/frontend/Stencil.cpp
@@ -1429,19 +1429,16 @@ static void DumpFunctionFlagsItems(js::J
           json.value("ATOM_EXTRA_FLAG");
           break;
         case FunctionFlags::Flags::RESOLVED_NAME:
           json.value("RESOLVED_NAME");
           break;
         case FunctionFlags::Flags::RESOLVED_LENGTH:
           json.value("RESOLVED_LENGTH");
           break;
-        case FunctionFlags::Flags::NEW_SCRIPT_CLEARED:
-          json.value("NEW_SCRIPT_CLEARED");
-          break;
         default:
           json.value("Unknown(%x)", i);
           break;
       }
     }
   }
 }
 
--- a/js/src/gc/GCEnum.h
+++ b/js/src/gc/GCEnum.h
@@ -111,17 +111,16 @@ enum class GCAbortReason {
   _(RareArgumentsData)                     \
   _(RegExpStatics)                         \
   _(RegExpSharedBytecode)                  \
   _(RegExpSharedNamedCaptureData)          \
   _(TypedArrayElements)                    \
   _(TypeDescrTraceList)                    \
   _(NativeIterator)                        \
   _(JitScript)                             \
-  _(ObjectGroupAddendum)                   \
   _(ScriptDebugScript)                     \
   _(BreakpointSite)                        \
   _(Breakpoint)                            \
   _(ForOfPIC)                              \
   _(ForOfPICStub)                          \
   _(WasmInstanceExports)                   \
   _(WasmInstanceScopes)                    \
   _(WasmInstanceGlobals)                   \
--- a/js/src/gc/GCProbes.h
+++ b/js/src/gc/GCProbes.h
@@ -31,15 +31,14 @@ inline void TenuredAlloc(gc::Cell* thing
 inline void CreateObject(JSObject* object) {}
 inline void MinorGCStart() {}
 inline void PromoteToTenured(gc::Cell* src, gc::Cell* dst) {}
 inline void MinorGCEnd() {}
 inline void MajorGCStart() {}
 inline void TenuredFinalize(gc::Cell* thing) {
 }  // May be called off main thread.
 inline void MajorGCEnd() {}
-inline void TypeNewScript(ObjectGroup* group) {}
 
 }  // namespace gcprobes
 }  // namespace gc
 }  // namespace js
 
 #endif  // gc_GCProbes_h
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1545,24 +1545,16 @@ void js::ObjectGroup::traceChildren(JSTr
     TraceEdge(trc, &proto(), "group_proto");
   }
 
   // Note: the realm's global can be nullptr if we GC while creating the global.
   if (JSObject* global = realm()->unsafeUnbarrieredMaybeGlobal()) {
     TraceManuallyBarrieredEdge(trc, &global, "group_global");
   }
 
-  if (newScript(sweep)) {
-    newScript(sweep)->trace(trc);
-  }
-
-  if (maybePreliminaryObjects(sweep)) {
-    maybePreliminaryObjects(sweep)->trace(trc);
-  }
-
   if (JSObject* descr = maybeTypeDescr()) {
     TraceManuallyBarrieredEdge(trc, &descr, "group_type_descr");
     MOZ_ASSERT(js::IsTypeDescrClass(MaybeForwardedObjectClass(descr)));
     setTypeDescr(static_cast<TypeDescr*>(descr));
   }
 
   if (JSObject* fun = maybeInterpretedFunction()) {
     TraceManuallyBarrieredEdge(trc, &fun, "group_function");
@@ -1582,24 +1574,16 @@ void js::GCMarker::lazilyMarkChildren(Ob
     traverseEdge(group, group->proto().toObject());
   }
 
   // Note: the realm's global can be nullptr if we GC while creating the global.
   if (GlobalObject* global = group->realm()->unsafeUnbarrieredMaybeGlobal()) {
     traverseEdge(group, static_cast<JSObject*>(global));
   }
 
-  if (group->newScript(sweep)) {
-    group->newScript(sweep)->trace(this);
-  }
-
-  if (group->maybePreliminaryObjects(sweep)) {
-    group->maybePreliminaryObjects(sweep)->trace(this);
-  }
-
   if (TypeDescr* descr = group->maybeTypeDescr()) {
     traverseEdge(group, static_cast<JSObject*>(descr));
   }
 
   if (JSFunction* fun = group->maybeInterpretedFunction()) {
     traverseEdge(group, static_cast<JSObject*>(fun));
   }
 }
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2850,26 +2850,23 @@ bool DoNewObjectFallback(JSContext* cx, 
                          ICNewObject_Fallback* stub, MutableHandleValue res) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "NewObject");
 
   RootedObject obj(cx);
 
   RootedObject templateObject(cx, stub->templateObject());
   if (templateObject) {
-    MOZ_ASSERT(
-        !templateObject->group()->maybePreliminaryObjectsDontCheckGeneration());
     obj = NewObjectOperationWithTemplate(cx, templateObject);
   } else {
     RootedScript script(cx, frame->script());
     jsbytecode* pc = stub->icEntry()->pc(script);
     obj = NewObjectOperation(cx, script, pc);
 
-    if (obj && !obj->isSingleton() &&
-        !obj->group()->maybePreliminaryObjectsDontCheckGeneration()) {
+    if (obj && !obj->isSingleton()) {
       templateObject = NewObjectOperation(cx, script, pc, TenuredObject);
       if (!templateObject) {
         return false;
       }
 
       TryAttachStub<NewObjectIRGenerator>("NewObject", cx, frame, stub,
                                           BaselineCacheIRStubKind::Regular,
                                           JSOp(*pc), templateObject);
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -225,18 +225,17 @@ GetPropIRGenerator::GetPropIRGenerator(J
                                        jsbytecode* pc, ICState::Mode mode,
                                        CacheKind cacheKind, HandleValue val,
                                        HandleValue idVal, HandleValue receiver,
                                        GetPropertyResultFlags resultFlags)
     : IRGenerator(cx, script, pc, cacheKind, mode),
       val_(val),
       idVal_(idVal),
       receiver_(receiver),
-      resultFlags_(resultFlags),
-      preliminaryObjectAction_(PreliminaryObjectAction::None) {}
+      resultFlags_(resultFlags) {}
 
 static void EmitLoadSlotResult(CacheIRWriter& writer, ObjOperandId holderId,
                                NativeObject* holder, Shape* shape) {
   if (holder->isFixedSlot(shape->slot())) {
     writer.loadFixedSlotResult(holderId,
                                NativeObject::getFixedSlotOffset(shape->slot()));
   } else {
     size_t dynamicSlotOffset =
@@ -579,36 +578,16 @@ static bool CheckHasNoSuchProperty(JSCon
     }
 
     curObj = curObj->staticPrototype();
   } while (curObj);
 
   return true;
 }
 
-// Return whether obj is in some PreliminaryObjectArray and has a structure
-// that might change in the future.
-static bool IsPreliminaryObject(JSObject* obj) {
-  if (obj->isSingleton()) {
-    return false;
-  }
-
-  AutoSweepObjectGroup sweep(obj->group());
-  TypeNewScript* newScript = obj->group()->newScript(sweep);
-  if (newScript && !newScript->analyzed()) {
-    return true;
-  }
-
-  if (obj->group()->maybePreliminaryObjects(sweep)) {
-    return true;
-  }
-
-  return false;
-}
-
 static bool IsCacheableNoProperty(JSContext* cx, JSObject* obj,
                                   JSObject* holder, Shape* shape, jsid id,
                                   jsbytecode* pc,
                                   GetPropertyResultFlags resultFlags) {
   MOZ_ASSERT(!shape);
   MOZ_ASSERT(!holder);
 
   // Idempotent ICs may only attach missing-property stubs if undefined
@@ -1194,22 +1173,16 @@ AttachDecision GetPropIRGenerator::tryAt
       if (mode_ == ICState::Mode::Megamorphic) {
         attachMegamorphicNativeSlot(objId, id, holder == nullptr);
         return AttachDecision::Attach;
       }
 
       maybeEmitIdGuard(id);
       if (holder) {
         EnsureTrackPropertyTypes(cx_, holder, id);
-        // See the comment in StripPreliminaryObjectStubs.
-        if (IsPreliminaryObject(obj)) {
-          preliminaryObjectAction_ = PreliminaryObjectAction::NotePreliminary;
-        } else {
-          preliminaryObjectAction_ = PreliminaryObjectAction::Unlink;
-        }
       }
       EmitReadSlotResult(writer, obj, holder, shape, objId);
       EmitReadSlotReturn(writer, obj, holder, shape);
 
       trackAttached("NativeSlot");
       return AttachDecision::Attach;
     case CanAttachScriptedGetter:
     case CanAttachNativeGetter: {
@@ -1393,24 +1366,16 @@ AttachDecision GetPropIRGenerator::tryAt
     if (canCache != CanAttachReadSlot) {
       return AttachDecision::NoAction;
     }
 
     if (holder) {
       // Need to be in the compartment of the holder to
       // call EnsureTrackPropertyTypes
       EnsureTrackPropertyTypes(cx_, holder, id);
-      if (unwrapped == holder) {
-        // See the comment in StripPreliminaryObjectStubs.
-        if (IsPreliminaryObject(unwrapped)) {
-          preliminaryObjectAction_ = PreliminaryObjectAction::NotePreliminary;
-        } else {
-          preliminaryObjectAction_ = PreliminaryObjectAction::Unlink;
-        }
-      }
     } else {
       // UNCACHEABLE_PROTO may result in guards against specific
       // (cross-compartment) prototype objects, so don't try to attach IC if we
       // see the flag at all.
       if (UncacheableProtoOnChain(unwrapped)) {
         return AttachDecision::NoAction;
       }
     }
@@ -3500,17 +3465,16 @@ SetPropIRGenerator::SetPropIRGenerator(J
                                        HandleValue idVal, HandleValue rhsVal,
                                        bool needsTypeBarrier,
                                        bool maybeHasExtraIndexedProps)
     : IRGenerator(cx, script, pc, cacheKind, mode),
       lhsVal_(lhsVal),
       idVal_(idVal),
       rhsVal_(rhsVal),
       typeCheckInfo_(cx, needsTypeBarrier),
-      preliminaryObjectAction_(PreliminaryObjectAction::None),
       attachedTypedArrayOOBStub_(false),
       maybeHasExtraIndexedProps_(maybeHasExtraIndexedProps) {}
 
 AttachDecision SetPropIRGenerator::tryAttachStub() {
   AutoAssertNoPendingException aanpe(cx_);
 
   ValOperandId objValId(writer.setInputOperandId(0));
   ValOperandId rhsValId;
@@ -3691,22 +3655,16 @@ AttachDecision SetPropIRGenerator::tryAt
   NativeObject* nobj = &obj->as<NativeObject>();
   if (typeCheckInfo_.needsTypeBarrier()) {
     writer.guardGroupForTypeBarrier(objId, nobj->group());
   }
   if (!IsGlobalLexicalSetGName(JSOp(*pc_), nobj, propShape)) {
     TestMatchingNativeReceiver(writer, nobj, objId);
   }
 
-  if (IsPreliminaryObject(obj)) {
-    preliminaryObjectAction_ = PreliminaryObjectAction::NotePreliminary;
-  } else {
-    preliminaryObjectAction_ = PreliminaryObjectAction::Unlink;
-  }
-
   typeCheckInfo_.set(nobj->group(), id);
   EmitStoreSlotAndReturn(writer, objId, nobj, propShape, rhsId);
 
   trackAttached("NativeSlot");
   return AttachDecision::Attach;
 }
 
 OperandId IRGenerator::emitNumericGuard(ValOperandId valId, Scalar::Type type) {
@@ -4651,29 +4609,18 @@ AttachDecision SetPropIRGenerator::tryAt
   ObjOperandId objId = writer.guardToObject(objValId);
   maybeEmitIdGuard(id);
 
   if (IsTypeInferenceEnabled()) {
     // Guard on the group for the property type barrier and group change.
     writer.guardGroup(objId, oldGroup);
   }
 
-  // If we are adding a property to an object for which the new script
-  // properties analysis hasn't been performed yet, make sure the stub fails
-  // after we run the analysis as a group change may be required here. The
-  // group change is not required for correctness but improves type
-  // information elsewhere.
-  AutoSweepObjectGroup sweep(oldGroup);
-  if (oldGroup->newScript(sweep) && !oldGroup->newScript(sweep)->analyzed()) {
-    writer.guardGroupHasUnanalyzedNewScript(oldGroup);
-    MOZ_ASSERT(IsPreliminaryObject(obj));
-    preliminaryObjectAction_ = PreliminaryObjectAction::NotePreliminary;
-  } else {
-    preliminaryObjectAction_ = PreliminaryObjectAction::Unlink;
-  }
+  // TODO(no-TI): remove GuardGroupHasUnanalyzedNewScript, group-changing code
+  // from AddAndStore* ops.
 
   // Shape guard the object.
   writer.guardShape(objId, oldShape);
 
   // If this is the special function.prototype case, we need to guard the
   // function is a non-builtin constructor. See canAttachAddSlotStub.
   if (obj->is<JSFunction>() && JSID_IS_ATOM(id, cx_->names().prototype)) {
     MOZ_ASSERT(obj->as<JSFunction>().isNonBuiltinConstructor());
@@ -9014,23 +8961,16 @@ ScriptedThisResult CallIRGenerator::getT
     AutoRealm ar(cx_, calleeFunc);
     TaggedProto proto(&protov.toObject());
     ObjectGroup* group = ObjectGroup::defaultNewGroup(cx_, &PlainObject::class_,
                                                       proto, newTarget);
     if (!group) {
       cx_->clearPendingException();
       return ScriptedThisResult::NoAction;
     }
-
-    AutoSweepObjectGroup sweep(group);
-    if (group->newScript(sweep) && !group->newScript(sweep)->analyzed()) {
-      // The new script analysis has not been done on this function.
-      // Don't attach until after the analysis has been done.
-      return ScriptedThisResult::TemporarilyUnoptimizable;
-    }
   }
 
   PlainObject* thisObject =
       CreateThisForFunction(cx_, calleeFunc, newTarget, TenuredObject);
   if (!thisObject) {
     cx_->clearPendingException();
     return ScriptedThisResult::NoAction;
   }
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -1281,19 +1281,16 @@ static inline GetPropertyResultFlags& op
 
 // GetPropIRGenerator generates CacheIR for a GetProp IC.
 class MOZ_RAII GetPropIRGenerator : public IRGenerator {
   HandleValue val_;
   HandleValue idVal_;
   HandleValue receiver_;
   GetPropertyResultFlags resultFlags_;
 
-  enum class PreliminaryObjectAction { None, Unlink, NotePreliminary };
-  PreliminaryObjectAction preliminaryObjectAction_;
-
   AttachDecision tryAttachNative(HandleObject obj, ObjOperandId objId,
                                  HandleId id, ValOperandId receiverId);
   AttachDecision tryAttachUnboxed(HandleObject obj, ObjOperandId objId,
                                   HandleId id);
   AttachDecision tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId,
                                          HandleId id);
   AttachDecision tryAttachObjectLength(HandleObject obj, ObjOperandId objId,
                                        HandleId id);
@@ -1394,24 +1391,16 @@ class MOZ_RAII GetPropIRGenerator : publ
  public:
   GetPropIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
                      ICState::Mode mode, CacheKind cacheKind, HandleValue val,
                      HandleValue idVal, HandleValue receiver,
                      GetPropertyResultFlags resultFlags);
 
   AttachDecision tryAttachStub();
   AttachDecision tryAttachIdempotentStub();
-
-  bool shouldUnlinkPreliminaryObjectStubs() const {
-    return preliminaryObjectAction_ == PreliminaryObjectAction::Unlink;
-  }
-
-  bool shouldNotePreliminaryObjectStub() const {
-    return preliminaryObjectAction_ == PreliminaryObjectAction::NotePreliminary;
-  }
 };
 
 // GetNameIRGenerator generates CacheIR for a GetName IC.
 class MOZ_RAII GetNameIRGenerator : public IRGenerator {
   HandleObject env_;
   HandlePropertyName name_;
 
   AttachDecision tryAttachGlobalNameValue(ObjOperandId objId, HandleId id);
@@ -1488,21 +1477,17 @@ class MOZ_RAII PropertyTypeCheckInfo {
 };
 
 // SetPropIRGenerator generates CacheIR for a SetProp IC.
 class MOZ_RAII SetPropIRGenerator : public IRGenerator {
   HandleValue lhsVal_;
   HandleValue idVal_;
   HandleValue rhsVal_;
   PropertyTypeCheckInfo typeCheckInfo_;
-
-  enum class PreliminaryObjectAction { None, Unlink, NotePreliminary };
-  PreliminaryObjectAction preliminaryObjectAction_;
   bool attachedTypedArrayOOBStub_;
-
   bool maybeHasExtraIndexedProps_;
 
  public:
   enum class DeferType { None, AddSlot };
 
  private:
   DeferType deferType_ = DeferType::None;
 
@@ -1589,24 +1574,16 @@ class MOZ_RAII SetPropIRGenerator : publ
                      bool needsTypeBarrier = true,
                      bool maybeHasExtraIndexedProps = true);
 
   AttachDecision tryAttachStub();
   AttachDecision tryAttachAddSlotStub(HandleObjectGroup oldGroup,
                                       HandleShape oldShape);
   void trackAttached(const char* name);
 
-  bool shouldUnlinkPreliminaryObjectStubs() const {
-    return preliminaryObjectAction_ == PreliminaryObjectAction::Unlink;
-  }
-
-  bool shouldNotePreliminaryObjectStub() const {
-    return preliminaryObjectAction_ == PreliminaryObjectAction::NotePreliminary;
-  }
-
   const PropertyTypeCheckInfo* typeCheckInfo() const { return &typeCheckInfo_; }
 
   bool attachedTypedArrayOOBStub() const { return attachedTypedArrayOOBStub_; }
 
   DeferType deferType() const { return deferType_; }
 };
 
 // HasPropIRGenerator generates CacheIR for a HasProp IC. Used for
--- a/js/src/jit/IonAnalysis.h
+++ b/js/src/jit/IonAnalysis.h
@@ -20,17 +20,16 @@
 #include "js/Utility.h"
 #include "js/Vector.h"
 
 namespace js {
 
 class GenericPrinter;
 class ObjectGroup;
 class PlainObject;
-class TypeNewScriptInitializer;
 
 namespace jit {
 
 class MBasicBlock;
 class MCompare;
 class MDefinition;
 class MIRGenerator;
 class MIRGraph;
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -1927,31 +1927,17 @@ void MacroAssembler::loadDOMExpandoValue
 void MacroAssembler::loadJitActivation(Register dest) {
   loadJSContext(dest);
   loadPtr(Address(dest, offsetof(JSContext, activation_)), dest);
 }
 
 void MacroAssembler::guardGroupHasUnanalyzedNewScript(Register group,
                                                       Register scratch,
                                                       Label* fail) {
-  Label noNewScript;
-  load32(Address(group, ObjectGroup::offsetOfFlags()), scratch);
-  and32(Imm32(OBJECT_FLAG_ADDENDUM_MASK), scratch);
-  branch32(Assembler::NotEqual, scratch,
-           Imm32(uint32_t(ObjectGroup::Addendum_NewScript)
-                 << OBJECT_FLAG_ADDENDUM_SHIFT),
-           &noNewScript);
-
-  // Guard group->newScript()->preliminaryObjects is non-nullptr.
-  loadPtr(Address(group, ObjectGroup::offsetOfAddendum()), scratch);
-  branchPtr(Assembler::Equal,
-            Address(scratch, TypeNewScript::offsetOfPreliminaryObjects()),
-            ImmWord(0), fail);
-
-  bind(&noNewScript);
+  MOZ_CRASH("TODO(no-TI): remove");
 }
 
 void MacroAssembler::guardSpecificAtom(Register str, JSAtom* atom,
                                        Register scratch,
                                        const LiveRegisterSet& volatileRegs,
                                        Label* fail) {
   Label done;
   branchPtr(Assembler::Equal, str, ImmGCPtr(atom), &done);
--- a/js/src/vm/ArrayObject-inl.h
+++ b/js/src/vm/ArrayObject-inl.h
@@ -36,18 +36,16 @@ inline void ArrayObject::setLength(JSCon
 /* static */ inline ArrayObject* ArrayObject::createArrayInternal(
     JSContext* cx, gc::AllocKind kind, gc::InitialHeap heap, HandleShape shape,
     HandleObjectGroup group, AutoSetNewObjectMetadata&) {
   const JSClass* clasp = group->clasp();
   MOZ_ASSERT(shape && group);
   MOZ_ASSERT(clasp == shape->getObjectClass());
   MOZ_ASSERT(clasp == &ArrayObject::class_);
   MOZ_ASSERT_IF(clasp->hasFinalize(), heap == gc::TenuredHeap);
-  MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
-                heap == js::gc::TenuredHeap);
   MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
                 heap == gc::TenuredHeap);
 
   // Arrays can use their fixed slots to store elements, so can't have shapes
   // which allow named properties to be stored in the fixed slots.
   MOZ_ASSERT(shape->numFixedSlots() == 0);
 
   size_t nDynamicSlots = calculateDynamicSlots(0, shape->slotSpan(), clasp);
--- a/js/src/vm/Caches-inl.h
+++ b/js/src/vm/Caches-inl.h
@@ -54,18 +54,16 @@ inline NativeObject* NewObjectCache::new
   ObjectGroup* group = templateObj->groupRaw();
 
   // If we did the lookup based on the proto we might have a group/object from a
   // different (same-compartment) realm, so we have to do a realm check.
   if (group->realm() != cx->realm()) {
     return nullptr;
   }
 
-  MOZ_ASSERT(!group->hasUnanalyzedPreliminaryObjects());
-
   {
     AutoSweepObjectGroup sweepGroup(group);
     if (group->shouldPreTenure(sweepGroup)) {
       heap = gc::TenuredHeap;
     }
   }
 
   if (cx->runtime()->gc.upcomingZealousGC()) {
--- a/js/src/vm/FunctionFlags.h
+++ b/js/src/vm/FunctionFlags.h
@@ -80,19 +80,17 @@ class FunctionFlags {
     ATOM_EXTRA_FLAG = 1 << 12,
     HAS_GUESSED_ATOM = ATOM_EXTRA_FLAG,
     HAS_BOUND_FUNCTION_NAME_PREFIX = ATOM_EXTRA_FLAG,
 
     // The 'length' or 'name property has been resolved. See fun_resolve.
     RESOLVED_NAME = 1 << 13,
     RESOLVED_LENGTH = 1 << 14,
 
-    // For a function used as an interpreted constructor, whether a 'new' type
-    // had constructor information cleared.
-    NEW_SCRIPT_CLEARED = 1 << 15,
+    // (1 << 15 is unused)
 
     // Shifted form of FunctionKinds.
     NORMAL_KIND = NormalFunction << FUNCTION_KIND_SHIFT,
     ASMJS_KIND = AsmJS << FUNCTION_KIND_SHIFT,
     WASM_KIND = Wasm << FUNCTION_KIND_SHIFT,
     ARROW_KIND = Arrow << FUNCTION_KIND_SHIFT,
     METHOD_KIND = Method << FUNCTION_KIND_SHIFT,
     CLASSCONSTRUCTOR_KIND = ClassConstructor << FUNCTION_KIND_SHIFT,
@@ -111,17 +109,17 @@ class FunctionFlags {
     INTERPRETED_LAMBDA = BASESCRIPT | LAMBDA | CONSTRUCTOR | NORMAL_KIND,
     INTERPRETED_LAMBDA_ARROW = BASESCRIPT | LAMBDA | ARROW_KIND,
     INTERPRETED_LAMBDA_GENERATOR_OR_ASYNC = BASESCRIPT | LAMBDA | NORMAL_KIND,
     INTERPRETED_GETTER = BASESCRIPT | GETTER_KIND,
     INTERPRETED_SETTER = BASESCRIPT | SETTER_KIND,
     INTERPRETED_METHOD = BASESCRIPT | METHOD_KIND,
 
     // Flags that XDR ignores. See also: js::BaseScript::MutableFlags.
-    MUTABLE_FLAGS = RESOLVED_NAME | RESOLVED_LENGTH | NEW_SCRIPT_CLEARED,
+    MUTABLE_FLAGS = RESOLVED_NAME | RESOLVED_LENGTH,
 
     // Flags preserved when cloning a function. (Exception:
     // js::MakeDefaultConstructor produces default constructors for ECMAScript
     // classes by cloning self-hosted functions, and then clearing their
     // SELF_HOSTED bit, setting their CONSTRUCTOR bit, and otherwise munging
     // them to look like they originated with the class definition.) */
     STABLE_ACROSS_CLONES =
         CONSTRUCTOR | LAMBDA | SELF_HOSTED | FUNCTION_KIND_MASK
@@ -293,20 +291,16 @@ class FunctionFlags {
     MOZ_ASSERT(isNative());
     MOZ_ASSERT(!isIntrinsic());
     setFlags(SELF_HOSTED);
   }
 
   void setResolvedLength() { setFlags(RESOLVED_LENGTH); }
   void setResolvedName() { setFlags(RESOLVED_NAME); }
 
-  // Mark a function as having its 'new' script information cleared.
-  bool wasNewScriptCleared() const { return hasFlags(NEW_SCRIPT_CLEARED); }
-  void setNewScriptCleared() { setFlags(NEW_SCRIPT_CLEARED); }
-
   void setInferredName() { setFlags(HAS_INFERRED_NAME); }
   void clearInferredName() { clearFlags(HAS_INFERRED_NAME); }
 
   void setGuessedAtom() { setFlags(HAS_GUESSED_ATOM); }
 
   void setPrefixedBoundFunctionName() {
     setFlags(HAS_BOUND_FUNCTION_NAME_PREFIX);
   }
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -5379,22 +5379,17 @@ JSObject* js::NewObjectOperation(JSConte
   } else {
     group = ObjectGroup::allocationSiteGroup(cx, script, pc, JSProto_Object);
     if (!group) {
       return nullptr;
     }
 
     {
       AutoSweepObjectGroup sweep(group);
-      if (group->maybePreliminaryObjects(sweep)) {
-        group->maybePreliminaryObjects(sweep)->maybeAnalyze(cx, group);
-      }
-
-      if (group->shouldPreTenure(sweep) ||
-          group->maybePreliminaryObjects(sweep)) {
+      if (group->shouldPreTenure(sweep)) {
         newKind = TenuredObject;
       }
     }
   }
 
   RootedPlainObject obj(cx);
 
   // Actually allocate the object.
@@ -5408,24 +5403,16 @@ JSObject* js::NewObjectOperation(JSConte
   if (!obj) {
     return nullptr;
   }
 
   if (newKind == SingletonObject) {
     MOZ_ASSERT(obj->isSingleton());
   } else {
     obj->setGroup(group);
-
-    if (!withTemplateGroup) {
-      AutoSweepObjectGroup sweep(group);
-      if (PreliminaryObjectArray* preliminaryObjects =
-              group->maybePreliminaryObjects(sweep)) {
-        preliminaryObjects->registerNewObject(obj);
-      }
-    }
   }
 
   return obj;
 }
 
 JSObject* js::NewObjectOperationWithTemplate(JSContext* cx,
                                              HandleObject templateObject) {
   // This is an optimized version of NewObjectOperation for use when the
--- a/js/src/vm/JSFunction.h
+++ b/js/src/vm/JSFunction.h
@@ -289,20 +289,16 @@ class JSFunction : public js::NativeObje
 
   void setIsBoundFunction() { flags_.setIsBoundFunction(); }
   void setIsSelfHostedBuiltin() { flags_.setIsSelfHostedBuiltin(); }
   void setIsIntrinsic() { flags_.setIsIntrinsic(); }
 
   void setResolvedLength() { flags_.setResolvedLength(); }
   void setResolvedName() { flags_.setResolvedName(); }
 
-  // Mark a function as having its 'new' script information cleared.
-  bool wasNewScriptCleared() const { return flags_.wasNewScriptCleared(); }
-  void setNewScriptCleared() { flags_.setNewScriptCleared(); }
-
   static bool getUnresolvedLength(JSContext* cx, js::HandleFunction fun,
                                   js::MutableHandleValue v);
 
   JSAtom* infallibleGetUnresolvedName(JSContext* cx);
 
   static bool getUnresolvedName(JSContext* cx, js::HandleFunction fun,
                                 js::MutableHandleValue v);
 
--- a/js/src/vm/JSObject.cpp
+++ b/js/src/vm/JSObject.cpp
@@ -945,18 +945,17 @@ JSObject* js::NewObjectWithClassProto(JS
 
 static bool NewObjectWithGroupIsCachable(JSContext* cx, HandleObjectGroup group,
                                          NewObjectKind newKind) {
   if (!group->proto().isObject() || newKind != GenericObject ||
       !group->clasp()->isNative() || cx->isHelperThreadContext()) {
     return false;
   }
 
-  AutoSweepObjectGroup sweep(group);
-  return !group->newScript(sweep) || group->newScript(sweep)->analyzed();
+  return true;
 }
 
 /*
  * Create a plain object with the specified group. This bypasses getNewGroup to
  * avoid losing creation site information for objects made by scripted 'new'.
  */
 JSObject* js::NewObjectWithGroupCommon(JSContext* cx, HandleObjectGroup group,
                                        gc::AllocKind allocKind,
@@ -4162,18 +4161,16 @@ void JSObject::debugCheckNewObject(Objec
   } else {
     MOZ_ASSERT(finalizeFlags == 0);
   }
 
   MOZ_ASSERT_IF(clasp->hasFinalize(),
                 heap == gc::TenuredHeap ||
                     CanNurseryAllocateFinalizedClass(clasp) ||
                     clasp->isProxy());
-  MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
-                heap == gc::TenuredHeap);
 
   // Check that the group's shouldPreTenure flag is respected but ignore
   // environment objects that the JIT expects to be nursery allocated.
   MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration() &&
                     clasp != &CallObject::class_ &&
                     clasp != &LexicalEnvironmentObject::class_,
                 heap == gc::TenuredHeap);
 
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -483,20 +483,17 @@ static void StatsCellCallback(JSRuntime*
         info.shapesGCHeapTree += thingSize;
       }
       shape->addSizeOfExcludingThis(rtStats->mallocSizeOf_, &info);
       zStats->shapeInfo.add(info);
       break;
     }
 
     case JS::TraceKind::ObjectGroup: {
-      ObjectGroup* group = &cellptr.as<ObjectGroup>();
       zStats->objectGroupsGCHeap += thingSize;
-      zStats->objectGroupsMallocHeap +=
-          group->sizeOfExcludingThis(rtStats->mallocSizeOf_);
       break;
     }
 
     case JS::TraceKind::Scope: {
       Scope* scope = &cellptr.as<Scope>();
       zStats->scopesGCHeap += thingSize;
       zStats->scopesMallocHeap +=
           scope->sizeOfExcludingThis(rtStats->mallocSizeOf_);
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -1345,26 +1345,16 @@ static bool WouldDefinePastNonwritableLe
 static MOZ_ALWAYS_INLINE void UpdateShapeTypeAndValue(JSContext* cx,
                                                       NativeObject* obj,
                                                       Shape* shape, jsid id,
                                                       const Value& value) {
   MOZ_ASSERT(id == shape->propid());
 
   if (shape->isDataProperty()) {
     obj->setSlotWithType(cx, shape, value, /* overwriting = */ false);
-
-    // Per the acquired properties analysis, when the shape of a partially
-    // initialized object is changed to its fully initialized shape, its
-    // group can be updated as well.
-    AutoSweepObjectGroup sweep(obj->groupRaw());
-    if (TypeNewScript* newScript = obj->groupRaw()->newScript(sweep)) {
-      if (newScript->initializedShape() == shape) {
-        obj->setGroup(newScript->initializedGroup());
-      }
-    }
   } else {
     MarkTypePropertyNonData(cx, obj, id);
   }
   if (!shape->writable()) {
     MarkTypePropertyNonWritable(cx, obj, id);
   }
 }
 
@@ -1375,26 +1365,16 @@ static MOZ_ALWAYS_INLINE void UpdateShap
   MOZ_ASSERT(id == shape->propid());
 
   MOZ_ASSERT(shape->isDataProperty());
   MOZ_ASSERT(shape->hasDefaultGetter());
   MOZ_ASSERT(shape->hasDefaultSetter());
   MOZ_ASSERT(shape->writable());
 
   obj->setSlotWithType(cx, shape, value, /* overwriting = */ false);
-
-  // Per the acquired properties analysis, when the shape of a partially
-  // initialized object is changed to its fully initialized shape, its
-  // group can be updated as well.
-  AutoSweepObjectGroup sweep(obj->groupRaw());
-  if (TypeNewScript* newScript = obj->groupRaw()->newScript(sweep)) {
-    if (newScript->initializedShape() == shape) {
-      obj->setGroup(newScript->initializedGroup());
-    }
-  }
 }
 
 void js::AddPropertyTypesAfterProtoChange(JSContext* cx, NativeObject* obj,
                                           ObjectGroup* oldGroup) {
   MOZ_ASSERT(obj->group() != oldGroup);
   MOZ_ASSERT(!obj->group()->unknownPropertiesDontCheckGeneration());
 
   AutoSweepObjectGroup sweepOldGroup(oldGroup);
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@@ -1161,19 +1161,16 @@ class NativeObject : public JSObject {
     for (size_t i = start; i < end; i++) {
       getSlotAddressUnchecked(i)->destroy();
     }
   }
 
   inline void shiftDenseElementsUnchecked(uint32_t count);
 
  public:
-  static bool rollbackProperties(JSContext* cx, HandleNativeObject obj,
-                                 uint32_t slotSpan);
-
   MOZ_ALWAYS_INLINE void setSlotWithType(JSContext* cx, Shape* shape,
                                          const Value& value,
                                          bool overwriting = true);
 
   MOZ_ALWAYS_INLINE const Value& getReservedSlot(uint32_t index) const {
     MOZ_ASSERT(index < JSSLOT_FREE(getClass()));
     return getSlot(index);
   }
--- a/js/src/vm/ObjectGroup-inl.h
+++ b/js/src/vm/ObjectGroup-inl.h
@@ -74,28 +74,16 @@ inline bool ObjectGroup::fromAllocationS
 }
 
 inline void ObjectGroup::setShouldPreTenure(const AutoSweepObjectGroup& sweep,
                                             JSContext* cx) {
   MOZ_ASSERT(canPreTenure(sweep));
   setFlags(sweep, cx, OBJECT_FLAG_PRE_TENURE);
 }
 
-inline TypeNewScript* ObjectGroup::newScript(
-    const AutoSweepObjectGroup& sweep) {
-  MOZ_ASSERT(sweep.group() == this);
-  return newScriptDontCheckGeneration();
-}
-
-inline PreliminaryObjectArrayWithTemplate* ObjectGroup::maybePreliminaryObjects(
-    const AutoSweepObjectGroup& sweep) {
-  MOZ_ASSERT(sweep.group() == this);
-  return maybePreliminaryObjectsDontCheckGeneration();
-}
-
 /* static */ inline ObjectGroup* ObjectGroup::lazySingletonGroup(
     JSContext* cx, ObjectGroup* oldGroup, const JSClass* clasp,
     TaggedProto proto) {
   ObjectGroupRealm& realm = oldGroup ? ObjectGroupRealm::get(oldGroup)
                                      : ObjectGroupRealm::getForNewObject(cx);
   JS::Realm* objectRealm = oldGroup ? oldGroup->realm() : cx->realm();
   return lazySingletonGroup(cx, realm, objectRealm, clasp, proto);
 }
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -55,92 +55,40 @@ ObjectGroup::ObjectGroup(const JSClass* 
   if (global) {
     AssertTargetIsNotGray(global);
   }
 #endif
 
   setGeneration(zone()->types.generation);
 }
 
-void ObjectGroup::finalize(JSFreeOp* fop) {
-  if (auto newScript = newScriptDontCheckGeneration()) {
-    newScript->clear();
-    fop->delete_(this, newScript, newScript->gcMallocBytes(),
-                 MemoryUse::ObjectGroupAddendum);
-  }
-  fop->delete_(this, maybePreliminaryObjectsDontCheckGeneration(),
-               MemoryUse::ObjectGroupAddendum);
-}
-
 void ObjectGroup::setProtoUnchecked(TaggedProto proto) {
   proto_ = proto;
   MOZ_ASSERT_IF(proto_.isObject() && proto_.toObject()->isNative(),
                 proto_.toObject()->isDelegate());
 }
 
 void ObjectGroup::setProto(TaggedProto proto) {
   MOZ_ASSERT(singleton());
   setProtoUnchecked(proto);
 }
 
-size_t ObjectGroup::sizeOfExcludingThis(
-    mozilla::MallocSizeOf mallocSizeOf) const {
-  size_t n = 0;
-  if (TypeNewScript* newScript = newScriptDontCheckGeneration()) {
-    n += newScript->sizeOfIncludingThis(mallocSizeOf);
-  }
-  return n;
-}
-
-static inline size_t AddendumAllocSize(ObjectGroup::AddendumKind kind,
-                                       void* addendum) {
-  if (kind == ObjectGroup::Addendum_NewScript) {
-    auto newScript = static_cast<TypeNewScript*>(addendum);
-    return newScript->gcMallocBytes();
-  }
-  if (kind == ObjectGroup::Addendum_PreliminaryObjects) {
-    return sizeof(PreliminaryObjectArrayWithTemplate);
-  }
-  // Other addendum kinds point to GC memory tracked elsewhere.
-  return 0;
-}
-
 void ObjectGroup::setAddendum(AddendumKind kind, void* addendum,
                               bool isSweeping /* = flase */) {
   MOZ_ASSERT(!needsSweep());
-  MOZ_ASSERT(kind <= (OBJECT_FLAG_ADDENDUM_MASK >> OBJECT_FLAG_ADDENDUM_SHIFT));
-
-  RemoveCellMemory(this, AddendumAllocSize(addendumKind(), addendum_),
-                   MemoryUse::ObjectGroupAddendum, isSweeping);
 
-  if (!isSweeping) {
-    // Trigger a write barrier if we are clearing new script or preliminary
-    // object information outside of sweeping. Other addendums are immutable.
-    AutoSweepObjectGroup sweep(this);
-    switch (addendumKind()) {
-      case Addendum_PreliminaryObjects:
-        PreliminaryObjectArrayWithTemplate::preWriteBarrier(
-            maybePreliminaryObjects(sweep));
-        break;
-      case Addendum_NewScript:
-        TypeNewScript::preWriteBarrier(newScript(sweep));
-        break;
-      case Addendum_None:
-        break;
-      default:
-        MOZ_ASSERT(addendumKind() == kind);
-    }
-  }
+  // Note: cast to unsigned to suppress always-true compiler warning.
+  MOZ_ASSERT(unsigned(kind) <=
+             (OBJECT_FLAG_ADDENDUM_MASK >> OBJECT_FLAG_ADDENDUM_SHIFT));
+
+  MOZ_ASSERT_IF(addendumKind() != Addendum_None, addendumKind() == kind);
 
   flags_ &= ~OBJECT_FLAG_ADDENDUM_MASK;
   flags_ |= kind << OBJECT_FLAG_ADDENDUM_SHIFT;
   addendum_ = addendum;
-
-  AddCellMemory(this, AddendumAllocSize(kind, addendum),
-                MemoryUse::ObjectGroupAddendum);
 }
 
 /* static */
 bool ObjectGroup::useSingletonForClone(JSFunction* fun) {
   MOZ_RELEASE_ASSERT(!IsTypeInferenceEnabled());
   return false;
 }
 
@@ -452,41 +400,26 @@ MOZ_ALWAYS_INLINE ObjectGroup* ObjectGro
 ObjectGroup* ObjectGroup::defaultNewGroup(JSContext* cx, const JSClass* clasp,
                                           TaggedProto proto,
                                           JSObject* associated) {
   MOZ_ASSERT(clasp);
   MOZ_ASSERT_IF(associated, proto.isObject());
   MOZ_ASSERT_IF(proto.isObject(),
                 cx->isInsideCurrentCompartment(proto.toObject()));
 
-  if (associated && !associated->is<TypeDescr>() && !IsTypeInferenceEnabled()) {
+  if (associated && !associated->is<TypeDescr>()) {
     associated = nullptr;
   }
 
   if (associated) {
-    if (associated->is<JSFunction>()) {
-      // Canonicalize new functions to use the original one associated with its
-      // script.
-      associated = associated->as<JSFunction>().maybeCanonicalFunction();
-
-      // If we have previously cleared the 'new' script information for this
-      // function, don't try to construct another one. Also, for simplicity,
-      // don't bother optimizing cross-realm constructors.
-      if (associated && (associated->as<JSFunction>().wasNewScriptCleared() ||
-                         associated->as<JSFunction>().realm() != cx->realm())) {
-        associated = nullptr;
-      }
-    } else if (associated->is<TypeDescr>()) {
-      if (!IsTypedObjectClass(clasp)) {
-        // This can happen when we call Reflect.construct with a TypeDescr as
-        // newTarget argument. We're not creating a TypedObject in this case, so
-        // don't set the TypeDescr on the group.
-        associated = nullptr;
-      }
-    } else {
+    MOZ_ASSERT(associated->is<TypeDescr>());
+    if (!IsTypedObjectClass(clasp)) {
+      // This can happen when we call Reflect.construct with a TypeDescr as
+      // newTarget argument. We're not creating a TypedObject in this case, so
+      // don't set the TypeDescr on the group.
       associated = nullptr;
     }
   }
 
   ObjectGroupRealm& groups = ObjectGroupRealm::getForNewObject(cx);
 
   if (ObjectGroup* group =
           groups.defaultNewGroupCache.lookup(clasp, proto, associated)) {
@@ -555,23 +488,17 @@ ObjectGroup* ObjectGroup::defaultNewGrou
   }
 
   if (!table->add(p, ObjectGroupRealm::NewEntry(group, associated))) {
     ReportOutOfMemory(cx);
     return nullptr;
   }
 
   if (associated) {
-    if (associated->is<JSFunction>()) {
-      if (!TypeNewScript::make(cx, group, &associated->as<JSFunction>())) {
-        return nullptr;
-      }
-    } else {
-      group->setTypeDescr(&associated->as<TypeDescr>());
-    }
+    group->setTypeDescr(&associated->as<TypeDescr>());
   }
 
   /*
    * Some builtin objects have slotful native properties baked in at
    * creation via the Shape::{insert,get}initialShape mechanism. Since
    * these properties are never explicitly defined on new objects, update
    * the type information for them here.
    */
@@ -1040,28 +967,16 @@ struct ObjectGroupRealm::PlainObjectEntr
           types[i] = TypeSet::ObjectType(group);
         }
       }
     }
     return true;
   }
 };
 
-static bool CanShareObjectGroup(IdValuePair* properties, size_t nproperties) {
-  // Don't reuse groups for objects containing indexed properties, which
-  // might end up as dense elements.
-  for (size_t i = 0; i < nproperties; i++) {
-    uint32_t index;
-    if (IdIsIndex(properties[i].id, &index)) {
-      return false;
-    }
-  }
-  return true;
-}
-
 static bool AddPlainObjectProperties(JSContext* cx, HandlePlainObject obj,
                                      IdValuePair* properties,
                                      size_t nproperties) {
   RootedId propid(cx);
   RootedValue value(cx);
 
   for (size_t i = 0; i < nproperties; i++) {
     propid = properties[i].id;
@@ -1092,179 +1007,17 @@ JSObject* ObjectGroup::newPlainObject(JS
                                       size_t nproperties,
                                       NewObjectKind newKind) {
   // Watch for simple cases where we don't try to reuse plain object groups.
   if (!IsTypeInferenceEnabled() || newKind == SingletonObject ||
       nproperties == 0 || nproperties >= PropertyTree::MAX_HEIGHT) {
     return NewPlainObjectWithProperties(cx, properties, nproperties, newKind);
   }
 
-  ObjectGroupRealm& realm = ObjectGroupRealm::getForNewObject(cx);
-  ObjectGroupRealm::PlainObjectTable*& table = realm.plainObjectTable;
-
-  if (!table) {
-    table = cx->new_<ObjectGroupRealm::PlainObjectTable>();
-    if (!table) {
-      return nullptr;
-    }
-  }
-
-  ObjectGroupRealm::PlainObjectKey::Lookup lookup(properties, nproperties);
-  ObjectGroupRealm::PlainObjectTable::Ptr p = table->lookup(lookup);
-
-  if (!p) {
-    if (!CanShareObjectGroup(properties, nproperties)) {
-      return NewPlainObjectWithProperties(cx, properties, nproperties, newKind);
-    }
-
-    JSObject* proto = GlobalObject::getOrCreatePrototype(cx, JSProto_Object);
-    if (!proto) {
-      return nullptr;
-    }
-
-    Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
-    RootedObjectGroup group(
-        cx, ObjectGroupRealm::makeGroup(cx, cx->realm(), &PlainObject::class_,
-                                        tagged));
-    if (!group) {
-      return nullptr;
-    }
-
-    gc::AllocKind allocKind = gc::GetGCObjectKind(nproperties);
-    RootedPlainObject obj(cx, NewObjectWithGroup<PlainObject>(
-                                  cx, group, allocKind, TenuredObject));
-    if (!obj || !AddPlainObjectProperties(cx, obj, properties, nproperties)) {
-      return nullptr;
-    }
-
-    // Don't make entries with duplicate property names, which will show up
-    // here as objects with fewer properties than we thought we were
-    // adding to the object. In this case, reset the object's group to the
-    // default (which will have unknown properties) so that the group we
-    // just created will be collected by the GC.
-    if (obj->slotSpan() != nproperties) {
-      ObjectGroup* group =
-          defaultNewGroup(cx, obj->getClass(), obj->taggedProto());
-      if (!group) {
-        return nullptr;
-      }
-      obj->setGroup(group);
-      return obj;
-    }
-
-    // Keep track of the initial objects we create with this type.
-    // If the initial ones have a consistent shape and property types, we
-    // will try to use an unboxed layout for the group.
-    PreliminaryObjectArrayWithTemplate* preliminaryObjects =
-        cx->new_<PreliminaryObjectArrayWithTemplate>(obj->lastProperty());
-    if (!preliminaryObjects) {
-      return nullptr;
-    }
-    group->setPreliminaryObjects(preliminaryObjects);
-    preliminaryObjects->registerNewObject(obj);
-
-    auto ids = cx->make_zeroed_pod_array<jsid>(nproperties);
-    if (!ids) {
-      return nullptr;
-    }
-
-    auto types = cx->make_zeroed_pod_array<TypeSet::Type>(nproperties);
-    if (!types) {
-      return nullptr;
-    }
-
-    for (size_t i = 0; i < nproperties; i++) {
-      ids[i] = properties[i].id;
-      types[i] = GetValueTypeForTable(obj->getSlot(i));
-      AddTypePropertyId(cx, group, nullptr, IdToTypeId(ids[i]), types[i]);
-    }
-
-    ObjectGroupRealm::PlainObjectKey key;
-    key.properties = ids.get();
-    key.nproperties = nproperties;
-    MOZ_ASSERT(ObjectGroupRealm::PlainObjectKey::match(key, lookup));
-
-    ObjectGroupRealm::PlainObjectEntry entry;
-    entry.group.set(group);
-    entry.shape.set(obj->lastProperty());
-    entry.types = types.get();
-
-    ObjectGroupRealm::PlainObjectTable::AddPtr np = table->lookupForAdd(lookup);
-    if (!table->add(np, key, entry)) {
-      ReportOutOfMemory(cx);
-      return nullptr;
-    }
-
-    mozilla::Unused << ids.release();
-    mozilla::Unused << types.release();
-
-    return obj;
-  }
-
-  RootedObjectGroup group(cx, p->value().group);
-
-  // AutoSweepObjectGroup checks no GC happens in its scope, so we use Maybe
-  // and reset() it before GC calls.
-  mozilla::Maybe<AutoSweepObjectGroup> sweep;
-  sweep.emplace(group);
-
-  // Update property types according to the properties we are about to add.
-  // Do this before we do anything which can GC, which might move or remove
-  // this table entry.
-  if (!group->unknownProperties(*sweep)) {
-    for (size_t i = 0; i < nproperties; i++) {
-      TypeSet::Type type = p->value().types[i];
-      TypeSet::Type ntype = GetValueTypeForTable(properties[i].value);
-      if (ntype == type) {
-        continue;
-      }
-      if (ntype.isPrimitive(ValueType::Int32) &&
-          type.isPrimitive(ValueType::Double)) {
-        // The property types already reflect 'int32'.
-      } else {
-        if (ntype.isPrimitive(ValueType::Double) &&
-            type.isPrimitive(ValueType::Int32)) {
-          // Include 'double' in the property types to avoid the update below
-          // later.
-          p->value().types[i] = TypeSet::DoubleType();
-        }
-        AddTypePropertyId(cx, group, nullptr, IdToTypeId(properties[i].id),
-                          ntype);
-      }
-    }
-  }
-
-  RootedShape shape(cx, p->value().shape);
-
-  if (group->maybePreliminaryObjects(*sweep)) {
-    newKind = TenuredObject;
-  }
-
-  sweep.reset();
-
-  gc::AllocKind allocKind = gc::GetGCObjectKind(nproperties);
-  RootedPlainObject obj(
-      cx, NewObjectWithGroup<PlainObject>(cx, group, allocKind, newKind));
-
-  if (!obj || !obj->setLastProperty(cx, shape)) {
-    return nullptr;
-  }
-
-  for (size_t i = 0; i < nproperties; i++) {
-    obj->setSlot(i, properties[i].value);
-  }
-
-  sweep.emplace(group);
-
-  if (group->maybePreliminaryObjects(*sweep)) {
-    group->maybePreliminaryObjects(*sweep)->registerNewObject(obj);
-    group->maybePreliminaryObjects(*sweep)->maybeAnalyze(cx, group);
-  }
-
-  return obj;
+  MOZ_CRASH("TODO(no-TI): remove");
 }
 
 /////////////////////////////////////////////////////////////////////
 // ObjectGroupRealm AllocationSiteTable
 /////////////////////////////////////////////////////////////////////
 
 struct ObjectGroupRealm::AllocationSiteKey {
   WeakHeapPtrScript script;
@@ -1375,74 +1128,17 @@ ObjectGroup* ObjectGroup::allocationSite
       offset >= ObjectGroupRealm::AllocationSiteKey::OFFSET_LIMIT) {
     if (protoArg) {
       return defaultNewGroup(cx, GetClassForProtoKey(kind),
                              TaggedProto(protoArg));
     }
     return defaultNewGroup(cx, kind);
   }
 
-  ObjectGroupRealm& realm = ObjectGroupRealm::getForNewObject(cx);
-  ObjectGroupRealm::AllocationSiteTable*& table = realm.allocationSiteTable;
-
-  if (!table) {
-    table = cx->new_<ObjectGroupRealm::AllocationSiteTable>(cx->zone());
-    if (!table) {
-      return nullptr;
-    }
-  }
-
-  RootedScript script(cx, scriptArg);
-  JSObject* proto = protoArg;
-  if (!proto && kind != JSProto_Null) {
-    proto = GlobalObject::getOrCreatePrototype(cx, kind);
-    if (!proto) {
-      return nullptr;
-    }
-  }
-
-  Rooted<ObjectGroupRealm::AllocationSiteKey> key(
-      cx, ObjectGroupRealm::AllocationSiteKey(script, offset, kind, proto));
-
-  ObjectGroupRealm::AllocationSiteTable::AddPtr p = table->lookupForAdd(key);
-  if (p) {
-    return p->value();
-  }
-
-  AutoEnterAnalysis enter(cx);
-
-  Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
-  ObjectGroup* res = ObjectGroupRealm::makeGroup(
-      cx, script->realm(), GetClassForProtoKey(kind), tagged,
-      OBJECT_FLAG_FROM_ALLOCATION_SITE);
-  if (!res) {
-    return nullptr;
-  }
-
-  if (JSOp(*pc) == JSOp::NewObject) {
-    // Keep track of the preliminary objects with this group, so we can try
-    // to use an unboxed layout for the object once some are allocated.
-    Shape* shape = script->getObject(pc)->as<PlainObject>().lastProperty();
-    if (!shape->isEmptyShape()) {
-      PreliminaryObjectArrayWithTemplate* preliminaryObjects =
-          cx->new_<PreliminaryObjectArrayWithTemplate>(shape);
-      if (preliminaryObjects) {
-        res->setPreliminaryObjects(preliminaryObjects);
-      } else {
-        cx->recoverFromOutOfMemory();
-      }
-    }
-  }
-
-  if (!table->add(p, key, res)) {
-    ReportOutOfMemory(cx);
-    return nullptr;
-  }
-
-  return res;
+  MOZ_CRASH("TODO(no-TI): remove");
 }
 
 /* static */
 ObjectGroup* ObjectGroup::callingAllocationSiteGroup(JSContext* cx,
                                                      JSProtoKey key,
                                                      HandleObject proto) {
   MOZ_ASSERT_IF(proto, key == JSProto_Array);
 
--- a/js/src/vm/ObjectGroup.h
+++ b/js/src/vm/ObjectGroup.h
@@ -20,18 +20,16 @@
 #include "js/TypeDecls.h"
 #include "vm/TaggedProto.h"
 #include "vm/TypeSet.h"
 
 namespace js {
 
 class TypeDescr;
 
-class PreliminaryObjectArrayWithTemplate;
-class TypeNewScript;
 class AutoClearTypeInferenceStateOnOOM;
 class AutoSweepObjectGroup;
 class ObjectGroupRealm;
 class PlainObject;
 
 namespace gc {
 void MergeRealms(JS::Realm* source, JS::Realm* target);
 }  // namespace gc
@@ -209,81 +207,34 @@ class ObjectGroup : public gc::TenuredCe
   // Kinds of addendums which can be attached to ObjectGroups.
   enum AddendumKind {
     Addendum_None,
 
     // When used by interpreted function, the addendum stores the
     // canonical JSFunction object.
     Addendum_InterpretedFunction,
 
-    // When used by the 'new' group when constructing an interpreted
-    // function, the addendum stores a TypeNewScript.
-    Addendum_NewScript,
-
-    // For some plain objects, the addendum stores a
-    // PreliminaryObjectArrayWithTemplate.
-    Addendum_PreliminaryObjects,
-
     // When used by typed objects, the addendum stores a TypeDescr.
     Addendum_TypeDescr
   };
 
  private:
   void setAddendum(AddendumKind kind, void* addendum, bool isSweeping = false);
 
   AddendumKind addendumKind() const {
     return (AddendumKind)((flags_ & OBJECT_FLAG_ADDENDUM_MASK) >>
                           OBJECT_FLAG_ADDENDUM_SHIFT);
   }
 
-  TypeNewScript* newScriptDontCheckGeneration() const {
-    if (addendumKind() == Addendum_NewScript) {
-      return reinterpret_cast<TypeNewScript*>(addendum_);
-    }
-    return nullptr;
-  }
-
-  void detachNewScript(bool isSweeping, ObjectGroup* replacement);
-
   ObjectGroupFlags flagsDontCheckGeneration() const { return flags_; }
 
  public:
   inline ObjectGroupFlags flags(const AutoSweepObjectGroup&);
   inline void addFlags(const AutoSweepObjectGroup&, ObjectGroupFlags flags);
   inline void clearFlags(const AutoSweepObjectGroup&, ObjectGroupFlags flags);
-  inline TypeNewScript* newScript(const AutoSweepObjectGroup& sweep);
-
-  void setNewScript(TypeNewScript* newScript) {
-    MOZ_ASSERT(newScript);
-    setAddendum(Addendum_NewScript, newScript);
-  }
-  void detachNewScript() { setAddendum(Addendum_None, nullptr); }
-
-  inline PreliminaryObjectArrayWithTemplate* maybePreliminaryObjects(
-      const AutoSweepObjectGroup& sweep);
-
-  PreliminaryObjectArrayWithTemplate*
-  maybePreliminaryObjectsDontCheckGeneration() {
-    if (addendumKind() == Addendum_PreliminaryObjects) {
-      return reinterpret_cast<PreliminaryObjectArrayWithTemplate*>(addendum_);
-    }
-    return nullptr;
-  }
-
-  void setPreliminaryObjects(
-      PreliminaryObjectArrayWithTemplate* preliminaryObjects) {
-    setAddendum(Addendum_PreliminaryObjects, preliminaryObjects);
-  }
-
-  void detachPreliminaryObjects() {
-    MOZ_ASSERT(maybePreliminaryObjectsDontCheckGeneration());
-    setAddendum(Addendum_None, nullptr);
-  }
-
-  inline bool hasUnanalyzedPreliminaryObjects();
 
   TypeDescr* maybeTypeDescr() {
     // Note: there is no need to sweep when accessing the type descriptor
     // of an object, as it is strongly held and immutable.
     if (addendumKind() == Addendum_TypeDescr) {
       return &typeDescr();
     }
     return nullptr;
@@ -390,18 +341,16 @@ class ObjectGroup : public gc::TenuredCe
                               JSObject* obj, jsid id, HeapTypeSet* types);
   void addDefiniteProperties(JSContext* cx, Shape* shape);
   void markPropertyNonData(JSContext* cx, JSObject* obj, jsid id);
   void markPropertyNonWritable(JSContext* cx, JSObject* obj, jsid id);
   void markStateChange(const AutoSweepObjectGroup& sweep, JSContext* cx);
   void setFlags(const AutoSweepObjectGroup& sweep, JSContext* cx,
                 ObjectGroupFlags flags);
   void markUnknown(const AutoSweepObjectGroup& sweep, JSContext* cx);
-  void maybeClearNewScriptOnOOM();
-  void clearNewScript(JSContext* cx, ObjectGroup* replacement = nullptr);
 
   void print(const AutoSweepObjectGroup& sweep);
 
   inline void clearProperties(const AutoSweepObjectGroup& sweep);
   void traceChildren(JSTracer* trc);
 
   inline bool needsSweep();
   void sweep(const AutoSweepObjectGroup& sweep);
@@ -415,19 +364,19 @@ class ObjectGroup : public gc::TenuredCe
  public:
   void setGeneration(uint32_t generation) {
     MOZ_ASSERT(generation <=
                (OBJECT_FLAG_GENERATION_MASK >> OBJECT_FLAG_GENERATION_SHIFT));
     flags_ &= ~OBJECT_FLAG_GENERATION_MASK;
     flags_ |= generation << OBJECT_FLAG_GENERATION_SHIFT;
   }
 
-  size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
-
-  void finalize(JSFreeOp* fop);
+  void finalize(JSFreeOp* fop) {
+    // Nothing to do.
+  }
 
   static const JS::TraceKind TraceKind = JS::TraceKind::ObjectGroup;
 
  public:
   const ObjectGroupFlags* addressOfFlags() const { return &flags_; }
 
   inline uint32_t basePropertyCount(const AutoSweepObjectGroup& sweep);
   inline uint32_t basePropertyCountDontCheckGeneration();
--- a/js/src/vm/PlainObject.cpp
+++ b/js/src/vm/PlainObject.cpp
@@ -37,86 +37,28 @@ using js::NewObjectGCKind;
 using js::NewObjectKind;
 using js::NewObjectWithGroup;
 using js::NewSingletonObjectWithGivenTaggedProtoAndKind;
 using js::ObjectGroup;
 using js::PlainObject;
 using js::SingletonObject;
 using js::TaggedProto;
 using js::TenuredObject;
-using js::TypeNewScript;
 
 static PlainObject* CreateThisForFunctionWithGroup(JSContext* cx,
                                                    Handle<ObjectGroup*> group,
                                                    NewObjectKind newKind) {
-  TypeNewScript* maybeNewScript;
-  {
-    AutoSweepObjectGroup sweep(group);
-    maybeNewScript = group->newScript(sweep);
-  }
-
-  if (maybeNewScript) {
-    if (maybeNewScript->analyzed()) {
-      // The definite properties analysis has been performed for this
-      // group, so get the shape and alloc kind to use from the
-      // TypeNewScript's template.
-      Rooted<PlainObject*> templateObject(cx, maybeNewScript->templateObject());
-      MOZ_ASSERT(templateObject->group() == group);
-
-      Rooted<PlainObject*> res(
-          cx, CopyInitializerObject(cx, templateObject, newKind));
-      if (!res) {
-        return nullptr;
-      }
-
-      if (newKind == SingletonObject) {
-        Rooted<TaggedProto> proto(
-            cx, TaggedProto(templateObject->staticPrototype()));
-        if (!JSObject::splicePrototype(cx, res, proto)) {
-          return nullptr;
-        }
-      } else {
-        res->setGroup(group);
-      }
-      return res;
-    }
-
-    // The initial objects registered with a TypeNewScript can't be in the
-    // nursery.
-    if (newKind == GenericObject) {
-      newKind = TenuredObject;
-    }
-
-    // Not enough objects with this group have been created yet, so make a
-    // plain object and register it with the group. Use the maximum number
-    // of fixed slots, as is also required by the TypeNewScript.
-    js::gc::AllocKind allocKind =
-        GuessObjectGCKind(PlainObject::MAX_FIXED_SLOTS);
-    PlainObject* res =
-        NewObjectWithGroup<PlainObject>(cx, group, allocKind, newKind);
-    if (!res) {
-      return nullptr;
-    }
-
-    // Make sure group->newScript is still there.
-    AutoSweepObjectGroup sweep(group);
-    if (newKind != SingletonObject && group->newScript(sweep)) {
-      group->newScript(sweep)->registerNewObject(res);
-    }
-
-    return res;
-  }
-
   js::gc::AllocKind allocKind = NewObjectGCKind(&PlainObject::class_);
 
   if (newKind == SingletonObject) {
     Rooted<TaggedProto> protoRoot(cx, group->proto());
     return NewSingletonObjectWithGivenTaggedProtoAndKind<PlainObject>(
         cx, protoRoot, allocKind);
   }
+
   return NewObjectWithGroup<PlainObject>(cx, group, allocKind, newKind);
 }
 
 PlainObject* js::CreateThisForFunctionWithProto(
     JSContext* cx, Handle<JSFunction*> callee, Handle<JSObject*> newTarget,
     Handle<JSObject*> proto, NewObjectKind newKind /* = GenericObject */) {
   MOZ_ASSERT(!callee->constructorNeedsUninitializedThis());
 
@@ -131,36 +73,16 @@ PlainObject* js::CreateThisForFunctionWi
 
   if (proto) {
     Rooted<ObjectGroup*> group(
         cx, ObjectGroup::defaultNewGroup(cx, &PlainObject::class_,
                                          TaggedProto(proto), newTarget));
     if (!group) {
       return nullptr;
     }
-
-    {
-      AutoSweepObjectGroup sweep(group);
-      if (group->newScript(sweep) && !group->newScript(sweep)->analyzed()) {
-        bool regenerate;
-        if (!group->newScript(sweep)->maybeAnalyze(cx, group, &regenerate)) {
-          return nullptr;
-        }
-        if (regenerate) {
-          // The script was analyzed successfully and may have changed
-          // the new type table, so refetch the group.
-          group = ObjectGroup::defaultNewGroup(cx, &PlainObject::class_,
-                                               TaggedProto(proto), newTarget);
-          AutoSweepObjectGroup sweepNewGroup(group);
-          MOZ_ASSERT(group);
-          MOZ_ASSERT(group->newScript(sweepNewGroup));
-        }
-      }
-    }
-
     res = CreateThisForFunctionWithGroup(cx, group, newKind);
   } else {
     res = NewBuiltinClassInstanceWithKind<PlainObject>(cx, newKind);
   }
 
   MOZ_ASSERT_IF(res, res->nonCCWRealm() == callee->realm());
 
   return res;
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1407,42 +1407,16 @@ void NativeObject::clear(JSContext* cx, 
   }
 
   MOZ_ALWAYS_TRUE(obj->setLastProperty(cx, shape));
 
   obj->checkShapeConsistency();
 }
 
 /* static */
-bool NativeObject::rollbackProperties(JSContext* cx, HandleNativeObject obj,
-                                      uint32_t slotSpan) {
-  /*
-   * Remove properties from this object until it has a matching slot span.
-   * The object cannot have escaped in a way which would prevent safe
-   * removal of the last properties.
-   */
-  MOZ_ASSERT(!obj->inDictionaryMode() && slotSpan <= obj->slotSpan());
-  while (true) {
-    if (obj->lastProperty()->isEmptyShape()) {
-      MOZ_ASSERT(slotSpan == 0);
-      break;
-    }
-    uint32_t slot = obj->lastProperty()->slot();
-    if (slot < slotSpan) {
-      break;
-    }
-    if (!NativeObject::removeProperty(cx, obj, obj->lastProperty()->propid())) {
-      return false;
-    }
-  }
-
-  return true;
-}
-
-/* static */
 Shape* NativeObject::replaceWithNewEquivalentShape(JSContext* cx,
                                                    HandleNativeObject obj,
                                                    Shape* oldShape,
                                                    Shape* newShape,
                                                    bool accessorShape) {
   MOZ_ASSERT(cx->isInsideCurrentZone(oldShape));
   MOZ_ASSERT_IF(oldShape != obj->lastProperty(),
                 obj->inDictionaryMode() &&
--- a/js/src/vm/TypeInference-inl.h
+++ b/js/src/vm/TypeInference-inl.h
@@ -328,151 +328,16 @@ const char* TypeIdStringImpl(jsid id);
 static inline const char* TypeIdString(jsid id) {
 #ifdef DEBUG
   return TypeIdStringImpl(id);
 #else
   return "(missing)";
 #endif
 }
 
-// New script properties analyses overview.
-//
-// When constructing objects using 'new' on a script, we attempt to determine
-// the properties which that object will eventually have. This is done via two
-// analyses. One of these, the definite properties analysis, is static, and the
-// other, the acquired properties analysis, is dynamic. As objects are
-// constructed using 'new' on some script to create objects of group G, our
-// analysis strategy is as follows:
-//
-// - When the first objects are created, no analysis is immediately performed.
-//   Instead, all objects of group G are accumulated in an array.
-//
-// - After a certain number of such objects have been created, the definite
-//   properties analysis is performed. This analyzes the body of the
-//   constructor script and any other functions it calls to look for properties
-//   which will definitely be added by the constructor in a particular order,
-//   creating an object with shape S.
-//
-// - The properties in S are compared with the greatest common prefix P of the
-//   shapes of the objects that have been created. If P has more properties
-//   than S, the acquired properties analysis is performed.
-//
-// - The acquired properties analysis marks all properties in P as definite
-//   in G, and creates a new group IG for objects which are partially
-//   initialized. Objects of group IG are initially created with shape S, and if
-//   they are later given shape P, their group can be changed to G.
-//
-// For objects which are rarely created, the definite properties analysis can
-// be triggered after only one or a few objects have been allocated, when code
-// being Ion compiled might access them. In this case type information in the
-// constructor might not be good enough for the definite properties analysis to
-// compute useful information, but the acquired properties analysis will still
-// be able to identify definite properties in this case.
-//
-// This layered approach is designed to maximize performance on easily
-// analyzable code, while still allowing us to determine definite properties
-// robustly when code consistently adds the same properties to objects, but in
-// complex ways which can't be understood statically.
-class TypeNewScript {
- private:
-  // Variable-length list of TypeNewScriptInitializer pointers.
-  struct InitializerList {
-    size_t length;
-    TypeNewScriptInitializer entries[1];
-  };
-
-  // Scripted function which this information was computed for.
-  HeapPtr<JSFunction*> function_ = {};
-
-  // Any preliminary objects with the type. The analyses are not performed
-  // until this array is cleared.
-  PreliminaryObjectArray* preliminaryObjects = nullptr;
-
-  // After the new script properties analyses have been performed, a template
-  // object to use for newly constructed objects. The shape of this object
-  // reflects all definite properties the object will have, and the
-  // allocation kind to use.
-  HeapPtr<PlainObject*> templateObject_ = {};
-
-  // Order in which definite properties become initialized. We need this in
-  // case the definite properties are invalidated (such as by adding a setter
-  // to an object on the prototype chain) while an object is in the middle of
-  // being initialized, so we can walk the stack and fixup any objects which
-  // look for in-progress objects which were prematurely set with an incorrect
-  // shape. Property assignments in inner frames are preceded by a series of
-  // SETPROP_FRAME entries specifying the stack down to the frame containing
-  // the write.
-  InitializerList* initializerList = nullptr;
-
-  // If there are additional properties found by the acquired properties
-  // analysis which were not found by the definite properties analysis, this
-  // shape contains all such additional properties (plus the definite
-  // properties). When an object of this group acquires this shape, it is
-  // fully initialized and its group can be changed to initializedGroup.
-  HeapPtr<Shape*> initializedShape_ = {};
-
-  // Group with definite properties set for all properties found by
-  // both the definite and acquired properties analyses.
-  HeapPtr<ObjectGroup*> initializedGroup_ = {};
-
- public:
-  TypeNewScript() = default;
-
-  ~TypeNewScript() {
-    js_delete(preliminaryObjects);
-    js_free(initializerList);
-  }
-
-  void clear() {
-    function_ = nullptr;
-    templateObject_ = nullptr;
-    initializedShape_ = nullptr;
-    initializedGroup_ = nullptr;
-  }
-
-  static void preWriteBarrier(TypeNewScript* newScript);
-
-  bool analyzed() const { return preliminaryObjects == nullptr; }
-
-  PlainObject* templateObject() const { return templateObject_; }
-
-  Shape* initializedShape() const { return initializedShape_; }
-
-  ObjectGroup* initializedGroup() const { return initializedGroup_; }
-
-  JSFunction* function() const { return function_; }
-
-  void trace(JSTracer* trc);
-  void sweep();
-
-  void registerNewObject(PlainObject* res);
-  bool maybeAnalyze(JSContext* cx, ObjectGroup* group, bool* regenerate,
-                    bool force = false);
-
-  bool rollbackPartiallyInitializedObjects(JSContext* cx, ObjectGroup* group);
-
-  static bool make(JSContext* cx, ObjectGroup* group, JSFunction* fun);
-
-  size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
-
-  size_t gcMallocBytes() const;
-
-  static size_t offsetOfPreliminaryObjects() {
-    return offsetof(TypeNewScript, preliminaryObjects);
-  }
-
-  static size_t sizeOfInitializerList(size_t length);
-};
-
-inline bool ObjectGroup::hasUnanalyzedPreliminaryObjects() {
-  return (newScriptDontCheckGeneration() &&
-          !newScriptDontCheckGeneration()->analyzed()) ||
-         maybePreliminaryObjectsDontCheckGeneration();
-}
-
 class MOZ_RAII AutoSuppressAllocationMetadataBuilder {
   JS::Zone* zone;
   bool saved;
 
  public:
   explicit AutoSuppressAllocationMetadataBuilder(JSContext* cx)
       : AutoSuppressAllocationMetadataBuilder(cx->realm()->zone()) {}
 
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -576,24 +576,16 @@ void TypeSet::addType(Type type, LifoAll
 
   if (type.isGroup()) {
     ObjectGroup* ngroup = type.group();
     MOZ_ASSERT(!ngroup->singleton());
     AutoSweepObjectGroup sweep(ngroup);
     if (ngroup->unknownProperties(sweep)) {
       goto unknownObject;
     }
-
-    // If we add a partially initialized group to a type set, add the
-    // corresponding fully initialized group, as an object's group may change
-    // from the former to the latter via the acquired properties analysis.
-    if (ngroup->newScript(sweep) &&
-        ngroup->newScript(sweep)->initializedGroup()) {
-      addType(ObjectType(ngroup->newScript(sweep)->initializedGroup()), alloc);
-    }
   }
 
   if (false) {
   unknownObject:
     flags |= TYPE_FLAG_ANYOBJECT;
     clearObjects();
   }
 }
@@ -1152,26 +1144,16 @@ void js::AddTypePropertyId(JSContext* cx
   types->addType(sweep, cx, type);
 
   // If this addType caused the type set to be marked as containing any
   // object, make sure that is reflected in other type sets the addType is
   // propagated to below.
   if (type.isObjectUnchecked() && types->unknownObject()) {
     type = TypeSet::AnyObjectType();
   }
-
-  // Propagate new types from partially initialized groups to fully
-  // initialized groups for the acquired properties analysis. Note that we
-  // don't need to do this for other property changes, as these will also be
-  // reflected via shape changes on the object that will prevent the object
-  // from acquiring the fully initialized group.
-  if (group->newScript(sweep) && group->newScript(sweep)->initializedGroup()) {
-    AddTypePropertyId(cx, group->newScript(sweep)->initializedGroup(), nullptr,
-                      id, type);
-  }
 }
 
 void js::AddTypePropertyId(JSContext* cx, ObjectGroup* group, JSObject* obj,
                            jsid id, const Value& value) {
   AddTypePropertyId(cx, group, obj, id, TypeSet::GetValueType(value));
 }
 
 void js::AddMagicTypePropertyId(JSContext* cx, JSObject* obj, jsid id,
@@ -1262,36 +1244,28 @@ void ObjectGroup::setFlags(const AutoSwe
   AutoEnterAnalysis enter(cx);
 
   addFlags(sweep, flags);
 
   InferSpew(ISpewOps, "%s: setFlags 0x%x",
             TypeSet::ObjectGroupString(this).get(), flags);
 
   ObjectStateChange(sweep, cx, this, false);
-
-  // Propagate flag changes from partially to fully initialized groups for the
-  // acquired properties analysis.
-  if (newScript(sweep) && newScript(sweep)->initializedGroup()) {
-    AutoSweepObjectGroup sweepInit(newScript(sweep)->initializedGroup());
-    newScript(sweep)->initializedGroup()->setFlags(sweepInit, cx, flags);
-  }
 }
 
 void ObjectGroup::markUnknown(const AutoSweepObjectGroup& sweep,
                               JSContext* cx) {
   AutoEnterAnalysis enter(cx);
 
   MOZ_ASSERT(cx->zone()->types.activeAnalysis);
   MOZ_ASSERT(!unknownProperties(sweep));
 
   InferSpew(ISpewOps, "UnknownProperties: %s",
             TypeSet::ObjectGroupString(this).get());
 
-  clearNewScript(cx);
   ObjectStateChange(sweep, cx, this, true);
 
   /*
    * Existing constraints may have already been added to this object, which we
    * need to do the right thing for. We can't ensure that we will mark all
    * unknown objects before they have been accessed, as the __proto__ of a known
    * object could be dynamically set to an unknown object, and we can decide to
    * ignore properties of an object during analysis (i.e. hashmaps). Adding
@@ -1306,121 +1280,16 @@ void ObjectGroup::markUnknown(const Auto
       prop->types.addType(sweep, cx, TypeSet::UnknownType());
       prop->types.setNonDataProperty(sweep, cx);
     }
   }
 
   clearProperties(sweep);
 }
 
-void ObjectGroup::detachNewScript(bool isSweeping, ObjectGroup* replacement) {
-  // Clear the TypeNewScript from this ObjectGroup and, if it has been
-  // analyzed, remove it from the newObjectGroups table so that it will not be
-  // produced by calling 'new' on the associated function anymore.
-  // The TypeNewScript is not actually destroyed.
-  AutoSweepObjectGroup sweep(this);
-  TypeNewScript* newScript = this->newScript(sweep);
-  MOZ_ASSERT(newScript);
-
-  if (newScript->analyzed()) {
-    ObjectGroupRealm& objectGroups = ObjectGroupRealm::get(this);
-    const JSClass* clasp = this->clasp();
-    MOZ_ASSERT(clasp == &PlainObject::class_);
-    TaggedProto proto = this->proto();
-    if (proto.isObject() && IsForwarded(proto.toObject())) {
-      proto = TaggedProto(Forwarded(proto.toObject()));
-    }
-    JSObject* associated = MaybeForwarded(newScript->function());
-    if (replacement) {
-      AutoSweepObjectGroup sweepReplacement(replacement);
-      MOZ_ASSERT(replacement->newScript(sweepReplacement)->function() ==
-                 newScript->function());
-      objectGroups.replaceDefaultNewGroup(clasp, proto, associated,
-                                          replacement);
-    } else {
-      objectGroups.removeDefaultNewGroup(clasp, proto, associated);
-    }
-  } else {
-    MOZ_ASSERT(!replacement);
-  }
-
-  setAddendum(Addendum_None, nullptr, isSweeping);
-}
-
-void ObjectGroup::maybeClearNewScriptOnOOM() {
-  MOZ_ASSERT(zone()->isGCSweepingOrCompacting());
-
-  if (!isMarkedAny()) {
-    return;
-  }
-
-  AutoSweepObjectGroup sweep(this);
-  TypeNewScript* newScript = this->newScript(sweep);
-  if (!newScript) {
-    return;
-  }
-
-  addFlags(sweep, OBJECT_FLAG_NEW_SCRIPT_CLEARED);
-
-  // This method is called during GC sweeping, so don't trigger pre barriers.
-  detachNewScript(/* isSweeping = */ true, nullptr);
-
-  js_delete(newScript);
-}
-
-void ObjectGroup::clearNewScript(JSContext* cx,
-                                 ObjectGroup* replacement /* = nullptr*/) {
-  AutoSweepObjectGroup sweep(this);
-  TypeNewScript* newScript = this->newScript(sweep);
-  if (!newScript) {
-    return;
-  }
-
-  AutoEnterAnalysis enter(cx);
-
-  if (!replacement) {
-    // Invalidate any Ion code constructing objects of this type.
-    setFlags(sweep, cx, OBJECT_FLAG_NEW_SCRIPT_CLEARED);
-
-    // Mark the constructing function as having its 'new' script cleared, so we
-    // will not try to construct another one later.
-    newScript->function()->setNewScriptCleared();
-  }
-
-  detachNewScript(/* isSweeping = */ false, replacement);
-
-  if (!cx->isHelperThreadContext()) {
-    bool found = newScript->rollbackPartiallyInitializedObjects(cx, this);
-
-    // If we managed to rollback any partially initialized objects, then
-    // any definite properties we added due to analysis of the new script
-    // are now invalid, so remove them. If there weren't any partially
-    // initialized objects then we don't need to change type information,
-    // as no more objects of this type will be created and the 'new' script
-    // analysis was still valid when older objects were created.
-    if (found) {
-      for (unsigned i = 0; i < getPropertyCount(sweep); i++) {
-        Property* prop = getProperty(sweep, i);
-        if (!prop) {
-          continue;
-        }
-        if (prop->types.definiteProperty()) {
-          prop->types.setNonDataProperty(sweep, cx);
-        }
-      }
-    }
-  } else {
-    // Helper threads are not allowed to run scripts.
-    MOZ_ASSERT(!cx->activation());
-  }
-
-  js_delete(newScript);
-  markStateChange(sweep, cx);
-}
-
 void ObjectGroup::print(const AutoSweepObjectGroup& sweep) {
   TaggedProto tagged(proto());
   fprintf(
       stderr, "%s : %s", TypeSet::ObjectGroupString(this).get(),
       tagged.isObject()
           ? TypeSet::TypeString(TypeSet::ObjectType(tagged.toObject())).get()
       : tagged.isDynamic() ? "(dynamic)"
                            : "(null)");
@@ -1449,401 +1318,28 @@ void ObjectGroup::print(const AutoSweepO
 
   if (count == 0) {
     fprintf(stderr, " {}\n");
     return;
   }
 
   fprintf(stderr, " {");
 
-  if (newScript(sweep)) {
-    if (newScript(sweep)->analyzed()) {
-      fprintf(stderr, "\n    newScript %d properties",
-              (int)newScript(sweep)->templateObject()->slotSpan());
-      if (newScript(sweep)->initializedGroup()) {
-        fprintf(stderr, " initializedGroup %#" PRIxPTR " with %d properties",
-                uintptr_t(newScript(sweep)->initializedGroup()),
-                int(newScript(sweep)->initializedShape()->slotSpan()));
-      }
-    } else {
-      fprintf(stderr, "\n    newScript unanalyzed");
-    }
-  }
-
   for (unsigned i = 0; i < count; i++) {
     Property* prop = getProperty(sweep, i);
     if (prop) {
       fprintf(stderr, "\n    %s:", TypeIdString(prop->id));
       prop->types.print();
     }
   }
 
   fprintf(stderr, "\n}\n");
 }
 
 /////////////////////////////////////////////////////////////////////
-// PreliminaryObjectArray
-/////////////////////////////////////////////////////////////////////
-
-void PreliminaryObjectArray::registerNewObject(PlainObject* res) {
-  MOZ_ASSERT(IsTypeInferenceEnabled());
-
-  // The preliminary object pointers are weak, and won't be swept properly
-  // during nursery collections, so the preliminary objects need to be
-  // initially tenured.
-  MOZ_ASSERT(!IsInsideNursery(res));
-
-  for (size_t i = 0; i < COUNT; i++) {
-    if (!objects[i]) {
-      objects[i] = res;
-      return;
-    }
-  }
-
-  MOZ_CRASH("There should be room for registering the new object");
-}
-
-bool PreliminaryObjectArray::full() const {
-  for (size_t i = 0; i < COUNT; i++) {
-    if (!objects[i]) {
-      return false;
-    }
-  }
-  return true;
-}
-
-void PreliminaryObjectArray::sweep() {
-  MOZ_ASSERT(IsTypeInferenceEnabled());
-
-  // All objects in the array are weak, so clear any that are about to be
-  // destroyed.
-  for (size_t i = 0; i < COUNT; i++) {
-    JSObject** ptr = &objects[i];
-    if (*ptr && IsAboutToBeFinalizedUnbarriered(ptr)) {
-      *ptr = nullptr;
-    }
-  }
-}
-
-void PreliminaryObjectArrayWithTemplate::trace(JSTracer* trc) {
-  MOZ_ASSERT(IsTypeInferenceEnabled());
-  TraceNullableEdge(trc, &shape_, "PreliminaryObjectArrayWithTemplate_shape");
-}
-
-/* static */
-void PreliminaryObjectArrayWithTemplate::preWriteBarrier(
-    PreliminaryObjectArrayWithTemplate* objects) {
-  Shape* shape = objects->shape();
-
-  if (!shape) {
-    return;
-  }
-
-  JS::Zone* zone = shape->zoneFromAnyThread();
-  if (zone->needsIncrementalBarrier()) {
-    objects->trace(zone->barrierTracer());
-  }
-}
-
-// Return whether shape consists entirely of plain data properties.
-static bool OnlyHasDataProperties(Shape* shape) {
-  MOZ_ASSERT(!shape->inDictionary());
-
-  while (!shape->isEmptyShape()) {
-    if (!shape->isDataProperty() || !shape->configurable() ||
-        !shape->enumerable() || !shape->writable()) {
-      return false;
-    }
-    shape = shape->previous();
-  }
-
-  return true;
-}
-
-// Find the most recent common ancestor of two shapes, or an empty shape if
-// the two shapes have no common ancestor.
-static Shape* CommonPrefix(Shape* first, Shape* second) {
-  MOZ_ASSERT(OnlyHasDataProperties(first));
-  MOZ_ASSERT(OnlyHasDataProperties(second));
-
-  while (first->slotSpan() > second->slotSpan()) {
-    first = first->previous();
-  }
-  while (second->slotSpan() > first->slotSpan()) {
-    second = second->previous();
-  }
-
-  while (first != second && !first->isEmptyShape()) {
-    first = first->previous();
-    second = second->previous();
-  }
-
-  return first;
-}
-
-void PreliminaryObjectArrayWithTemplate::maybeAnalyze(JSContext* cx,
-                                                      ObjectGroup* group,
-                                                      bool force) {
-  // Don't perform the analyses until sufficient preliminary objects have
-  // been allocated.
-  if (!force && !full()) {
-    return;
-  }
-
-  AutoEnterAnalysis enter(cx);
-
-  UniquePtr<PreliminaryObjectArrayWithTemplate> preliminaryObjects(this);
-  group->detachPreliminaryObjects();
-
-  MOZ_ASSERT(shape());
-  MOZ_ASSERT(shape()->slotSpan() != 0);
-  MOZ_ASSERT(OnlyHasDataProperties(shape()));
-
-  // Make sure all the preliminary objects reflect the properties originally
-  // in the template object.
-  for (size_t i = 0; i < PreliminaryObjectArray::COUNT; i++) {
-    JSObject* objBase = preliminaryObjects->get(i);
-    if (!objBase) {
-      continue;
-    }
-    PlainObject* obj = &objBase->as<PlainObject>();
-
-    if (obj->inDictionaryMode() ||
-        !OnlyHasDataProperties(obj->lastProperty())) {
-      return;
-    }
-
-    if (CommonPrefix(obj->lastProperty(), shape()) != shape()) {
-      return;
-    }
-  }
-
-  // Since the preliminary objects still reflect the template object's
-  // properties, and all objects in the future will be created with those
-  // properties, the properties can be marked as definite for objects in the
-  // group.
-  group->addDefiniteProperties(cx, shape());
-}
-
-/////////////////////////////////////////////////////////////////////
-// TypeNewScript
-/////////////////////////////////////////////////////////////////////
-
-// Make a TypeNewScript for |group|, and set it up to hold the preliminary
-// objects created with the group.
-/* static */
-bool TypeNewScript::make(JSContext* cx, ObjectGroup* group, JSFunction* fun) {
-  AutoSweepObjectGroup sweep(group);
-  MOZ_ASSERT(cx->zone()->types.activeAnalysis);
-  MOZ_ASSERT(!group->newScript(sweep));
-  MOZ_ASSERT(cx->realm() == group->realm());
-  MOZ_ASSERT(cx->realm() == fun->realm());
-
-  // rollbackPartiallyInitializedObjects expects function_ to be
-  // canonicalized.
-  MOZ_ASSERT(fun->maybeCanonicalFunction() == fun);
-
-  if (group->unknownProperties(sweep)) {
-    return true;
-  }
-
-  auto newScript = cx->make_unique<TypeNewScript>();
-  if (!newScript) {
-    return false;
-  }
-
-  newScript->function_ = fun;
-
-  newScript->preliminaryObjects = group->zone()->new_<PreliminaryObjectArray>();
-  if (!newScript->preliminaryObjects) {
-    return true;
-  }
-
-  group->setNewScript(newScript.release());
-
-  gc::gcprobes::TypeNewScript(group);
-  return true;
-}
-
-size_t TypeNewScript::sizeOfIncludingThis(
-    mozilla::MallocSizeOf mallocSizeOf) const {
-  size_t n = mallocSizeOf(this);
-  n += mallocSizeOf(preliminaryObjects);
-  n += mallocSizeOf(initializerList);
-  return n;
-}
-
-/* static */ size_t TypeNewScript::sizeOfInitializerList(size_t length) {
-  // TypeNewScriptInitializer struct contains [1] element in its size.
-  size_t size = sizeof(TypeNewScript::InitializerList);
-  if (length > 0) {
-    size += (length - 1) * sizeof(TypeNewScriptInitializer);
-  }
-  return size;
-}
-
-size_t TypeNewScript::gcMallocBytes() const {
-  size_t size = sizeof(TypeNewScript);
-  if (preliminaryObjects) {
-    size += sizeof(PreliminaryObjectArray);
-  }
-  if (initializerList) {
-    size += sizeOfInitializerList(initializerList->length);
-  }
-  return size;
-}
-
-void TypeNewScript::registerNewObject(PlainObject* res) {
-  MOZ_ASSERT(!analyzed());
-
-  // New script objects must have the maximum number of fixed slots, so that
-  // we can adjust their shape later to match the number of fixed slots used
-  // by the template object we eventually create.
-  MOZ_ASSERT(res->numFixedSlots() == NativeObject::MAX_FIXED_SLOTS);
-
-  preliminaryObjects->registerNewObject(res);
-}
-
-bool TypeNewScript::maybeAnalyze(JSContext* cx, ObjectGroup* group,
-                                 bool* regenerate, bool force) {
-  MOZ_CRASH("TODO(no-TI): remove");
-}
-
-bool TypeNewScript::rollbackPartiallyInitializedObjects(JSContext* cx,
-                                                        ObjectGroup* group) {
-  // If we cleared this new script while in the middle of initializing an
-  // object, it will still have the new script's shape and reflect the no
-  // longer correct state of the object once its initialization is completed.
-  // We can't detect the possibility of this statically while remaining
-  // robust, but the new script keeps track of where each property is
-  // initialized so we can walk the stack and fix up any such objects.
-  // Return whether any objects were modified.
-
-  if (!initializerList) {
-    return false;
-  }
-
-  bool found = false;
-
-  RootedFunction function(cx, this->function());
-  Vector<uint32_t, 32> pcOffsets(cx);
-  for (AllScriptFramesIter iter(cx); !iter.done(); ++iter) {
-    {
-      AutoEnterOOMUnsafeRegion oomUnsafe;
-      if (!pcOffsets.append(iter.script()->pcToOffset(iter.pc()))) {
-        oomUnsafe.crash("rollbackPartiallyInitializedObjects");
-      }
-    }
-
-    if (!iter.isConstructing()) {
-      continue;
-    }
-
-    MOZ_ASSERT(iter.calleeTemplate()->maybeCanonicalFunction());
-
-    if (iter.calleeTemplate()->maybeCanonicalFunction() != function) {
-      continue;
-    }
-
-    // Derived class constructors initialize their this-binding later and
-    // we shouldn't run the definite properties analysis on them.
-    MOZ_ASSERT(!iter.script()->isDerivedClassConstructor());
-
-    Value thisv = iter.thisArgument(cx);
-    if (!thisv.isObject() || thisv.toObject().hasLazyGroup() ||
-        thisv.toObject().group() != group) {
-      continue;
-    }
-
-    // Found a matching frame.
-    RootedPlainObject obj(cx, &thisv.toObject().as<PlainObject>());
-
-    // If not finished, number of properties that have been added.
-    uint32_t numProperties = 0;
-
-    // Whether the current SetProp is within an inner frame which has
-    // finished entirely.
-    bool pastProperty = false;
-
-    // Index in pcOffsets of the outermost frame.
-    int callDepth = pcOffsets.length() - 1;
-
-    // Index in pcOffsets of the frame currently being checked for a SetProp.
-    int setpropDepth = callDepth;
-
-    size_t i;
-    for (i = 0; i < initializerList->length; i++) {
-      const TypeNewScriptInitializer init = initializerList->entries[i];
-      if (init.kind == TypeNewScriptInitializer::SETPROP) {
-        if (!pastProperty && pcOffsets[setpropDepth] < init.offset) {
-          // Have not yet reached this setprop.
-          break;
-        }
-        // This setprop has executed, reset state for the next one.
-        numProperties++;
-        pastProperty = false;
-        setpropDepth = callDepth;
-      } else {
-        MOZ_ASSERT(init.kind == TypeNewScriptInitializer::SETPROP_FRAME);
-        if (!pastProperty) {
-          if (pcOffsets[setpropDepth] < init.offset) {
-            // Have not yet reached this inner call.
-            break;
-          } else if (pcOffsets[setpropDepth] > init.offset) {
-            // Have advanced past this inner call.
-            pastProperty = true;
-          } else if (setpropDepth == 0) {
-            // Have reached this call but not yet in it.
-            break;
-          } else {
-            // Somewhere inside this inner call.
-            setpropDepth--;
-          }
-        }
-      }
-    }
-
-    // Whether all identified 'new' properties have been initialized.
-    bool finished = i == initializerList->length;
-
-    if (!finished) {
-      (void)NativeObject::rollbackProperties(cx, obj, numProperties);
-      found = true;
-    }
-  }
-
-  return found;
-}
-
-void TypeNewScript::trace(JSTracer* trc) {
-  TraceEdge(trc, &function_, "TypeNewScript_function");
-  TraceNullableEdge(trc, &templateObject_, "TypeNewScript_templateObject");
-  TraceNullableEdge(trc, &initializedShape_, "TypeNewScript_initializedShape");
-  TraceNullableEdge(trc, &initializedGroup_, "TypeNewScript_initializedGroup");
-}
-
-/* static */
-void TypeNewScript::preWriteBarrier(TypeNewScript* newScript) {
-  if (JS::RuntimeHeapIsCollecting()) {
-    return;
-  }
-
-  JS::Zone* zone = newScript->function()->zoneFromAnyThread();
-  if (zone->needsIncrementalBarrier()) {
-    newScript->trace(zone->barrierTracer());
-  }
-}
-
-void TypeNewScript::sweep() {
-  if (preliminaryObjects) {
-    preliminaryObjects->sweep();
-  }
-}
-
-/////////////////////////////////////////////////////////////////////
 // Tracing
 /////////////////////////////////////////////////////////////////////
 
 static inline void TraceObjectKey(JSTracer* trc, TypeSet::ObjectKey** keyp) {
   TypeSet::ObjectKey* key = *keyp;
   if (key->isGroup()) {
     ObjectGroup* group = key->groupNoBarrier();
     TraceManuallyBarrieredEdge(trc, &group, "objectKey_group");
@@ -2005,24 +1501,16 @@ void ObjectGroup::sweep(const AutoSweepO
 
   Maybe<AutoClearTypeInferenceStateOnOOM> clearStateOnOOM;
   if (!zone()->types.isSweepingTypes()) {
     clearStateOnOOM.emplace(zone());
   }
 
   AutoTouchingGrayThings tgt;
 
-  if (maybePreliminaryObjects(sweep)) {
-    maybePreliminaryObjects(sweep)->sweep();
-  }
-
-  if (newScript(sweep)) {
-    newScript(sweep)->sweep();
-  }
-
   LifoAlloc& typeLifoAlloc = zone()->types.typeLifoAlloc();
 
   /*
    * Properties were allocated from the old arena, and need to be copied over
    * to the new one.
    */
   unsigned propertyCount = basePropertyCount(sweep);
   if (propertyCount >= 2) {
@@ -2171,42 +1659,33 @@ void TypeZone::beginSweep() {
 
   generation = !generation;
 }
 
 void TypeZone::endSweep(JSRuntime* rt) {
   rt->gc.queueAllLifoBlocksForFree(&sweepTypeLifoAlloc.ref());
 }
 
-void TypeZone::clearAllNewScriptsOnOOM() {
-  for (auto group = zone()->cellIter<ObjectGroup>(); !group.done();
-       group.next()) {
-    group->maybeClearNewScriptOnOOM();
-  }
-}
-
 AutoClearTypeInferenceStateOnOOM::AutoClearTypeInferenceStateOnOOM(Zone* zone)
     : zone(zone) {
   MOZ_RELEASE_ASSERT(CurrentThreadCanAccessZone(zone));
   MOZ_ASSERT(!TlsContext.get()->inUnsafeCallWithABI);
   zone->types.setSweepingTypes(true);
 }
 
 AutoClearTypeInferenceStateOnOOM::~AutoClearTypeInferenceStateOnOOM() {
   if (zone->types.hadOOMSweepingTypes()) {
     gc::AutoSetThreadIsSweeping threadIsSweeping(zone);
     JSRuntime* rt = zone->runtimeFromMainThread();
     JSFreeOp fop(rt);
     js::CancelOffThreadIonCompile(rt);
     zone->setPreservingCode(false);
     zone->discardJitCode(&fop, Zone::KeepBaselineCode);
-    zone->types.clearAllNewScriptsOnOOM();
   }
 
   zone->types.setSweepingTypes(false);
 }
 
 JS::ubi::Node::Size JS::ubi::Concrete<js::ObjectGroup>::size(
     mozilla::MallocSizeOf mallocSizeOf) const {
   Size size = js::gc::Arena::thingSize(get().asTenured().getAllocKind());
-  size += get().sizeOfExcludingThis(mallocSizeOf);
   return size;
 }
--- a/js/src/vm/TypeInference.h
+++ b/js/src/vm/TypeInference.h
@@ -95,73 +95,16 @@ class MOZ_RAII AutoSweepJitScript : publ
 #ifdef DEBUG
   inline ~AutoSweepJitScript();
 
   jit::JitScript* jitScript() const { return jitScript_; }
   Zone* zone() const { return zone_; }
 #endif
 };
 
-// For groups where only a small number of objects have been allocated, this
-// structure keeps track of all objects in the group. Once COUNT objects have
-// been allocated, this structure is cleared and the objects are analyzed, to
-// perform the new script properties analyses or determine if an unboxed
-// representation can be used.
-class PreliminaryObjectArray {
- public:
-  static const uint32_t COUNT = 20;
-
- private:
-  // All objects with the type which have been allocated. The pointers in
-  // this array are weak.
-  JSObject* objects[COUNT] = {};  // zeroes
-
- public:
-  PreliminaryObjectArray() = default;
-
-  void registerNewObject(PlainObject* res);
-
-  JSObject* get(size_t i) const {
-    MOZ_ASSERT(i < COUNT);
-    return objects[i];
-  }
-
-  bool full() const;
-  void sweep();
-};
-
-class PreliminaryObjectArrayWithTemplate : public PreliminaryObjectArray {
-  HeapPtr<Shape*> shape_;
-
- public:
-  explicit PreliminaryObjectArrayWithTemplate(Shape* shape) : shape_(shape) {}
-
-  Shape* shape() { return shape_; }
-
-  void maybeAnalyze(JSContext* cx, ObjectGroup* group, bool force = false);
-
-  void trace(JSTracer* trc);
-
-  static void preWriteBarrier(
-      PreliminaryObjectArrayWithTemplate* preliminaryObjects);
-};
-
-/**
- * A type representing the initializer of a property within a script being
- * 'new'd.
- */
-class TypeNewScriptInitializer {
- public:
-  enum Kind { SETPROP, SETPROP_FRAME } kind;
-  uint32_t offset;
-
-  TypeNewScriptInitializer(Kind kind, uint32_t offset)
-      : kind(kind), offset(offset) {}
-};
-
 /* Is this a reasonable PC to be doing inlining on? */
 inline bool isInlinableCall(jsbytecode* pc);
 
 bool ClassCanHaveExtraProperties(const JSClass* clasp);
 
 class RecompileInfo {
   JSScript* script_;
   IonCompilationId id_;
@@ -225,17 +168,16 @@ class TypeZone {
 #ifdef JS_CRASH_DIAGNOSTICS
     MOZ_RELEASE_ASSERT(CurrentThreadCanAccessZone(zone_));
 #endif
     return typeLifoAlloc_.ref();
   }
 
   void beginSweep();
   void endSweep(JSRuntime* rt);
-  void clearAllNewScriptsOnOOM();
 
   /* Mark a script as needing recompilation once inference has finished. */
   void addPendingRecompile(JSContext* cx, const RecompileInfo& info);
   void addPendingRecompile(JSContext* cx, JSScript* script);
 
   void processPendingRecompiles(JSFreeOp* fop, RecompileInfoVector& recompiles);
 
   bool isSweepingTypes() const { return sweepingTypes; }
--- a/js/src/vm/TypeSet.h
+++ b/js/src/vm/TypeSet.h
@@ -53,17 +53,16 @@ class TempAllocator;
 }  // namespace jit
 
 class AutoClearTypeInferenceStateOnOOM;
 class AutoSweepBase;
 class AutoSweepObjectGroup;
 class LifoAlloc;
 class ObjectGroup;
 class SystemAllocPolicy;
-class TypeNewScript;
 class TypeZone;
 
 /*
  * Type inference memory management overview.
  *
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
@@ -192,19 +191,16 @@ enum : uint32_t {
    * Whether objects with this type should be allocated directly in the
    * tenured heap.
    */
   OBJECT_FLAG_PRE_TENURE = 0x00800000,
 
   /* Whether objects with this type might have copy on write elements. */
   OBJECT_FLAG_COPY_ON_WRITE = 0x01000000,
 
-  /* Whether this type has had its 'new' script cleared in the past. */
-  OBJECT_FLAG_NEW_SCRIPT_CLEARED = 0x02000000,
-
   /*
    * Whether all properties of this object are considered unknown.
    * If set, all other flags in DYNAMIC_MASK will also be set.
    */
   OBJECT_FLAG_UNKNOWN_PROPERTIES = 0x04000000,
 
   /* Flags which indicate dynamic properties of represented objects. */
   OBJECT_FLAG_DYNAMIC_MASK = 0x07ff0000,
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -1404,19 +1404,16 @@ static void ReportZoneStats(const JS::Zo
 
   ZRREPORT_GC_BYTES(pathPrefix + "jit-codes-gc-heap"_ns, zStats.jitCodesGCHeap,
                     "References to executable code pools used by the JITs.");
 
   ZRREPORT_GC_BYTES(
       pathPrefix + "object-groups/gc-heap"_ns, zStats.objectGroupsGCHeap,
       "Classification and type inference information about objects.");
 
-  ZRREPORT_BYTES(pathPrefix + "object-groups/malloc-heap"_ns,
-                 zStats.objectGroupsMallocHeap, "Object group addenda.");
-
   ZRREPORT_GC_BYTES(pathPrefix + "scopes/gc-heap"_ns, zStats.scopesGCHeap,
                     "Scope information for scripts.");
 
   ZRREPORT_BYTES(pathPrefix + "scopes/malloc-heap"_ns, zStats.scopesMallocHeap,
                  "Arrays of binding names and other binding-related data.");
 
   ZRREPORT_GC_BYTES(pathPrefix + "regexp-shareds/gc-heap"_ns,
                     zStats.regExpSharedsGCHeap, "Shared compiled regexp data.");