--- a/js/src/jit/AliasAnalysis.cpp
+++ b/js/src/jit/AliasAnalysis.cpp
@@ -190,17 +190,18 @@ AliasAnalysis::analyze()
             } else {
                 // Find the most recent store on which this instruction depends.
                 MInstruction* lastStore = firstIns;
 
                 for (AliasSetIterator iter(set); iter; iter++) {
                     MInstructionVector& aliasedStores = stores[*iter];
                     for (int i = aliasedStores.length() - 1; i >= 0; i--) {
                         MInstruction* store = aliasedStores[i];
-                        if (def->mightAlias(store) != MDefinition::AliasType::NoAlias &&
+                        if (genericMightAlias(*def, store) != MDefinition::AliasType::NoAlias &&
+                            def->mightAlias(store) != MDefinition::AliasType::NoAlias &&
                             BlockMightReach(store->block(), *block))
                         {
                             if (lastStore->id() < store->id())
                                 lastStore = store;
                             break;
                         }
                     }
                 }
@@ -237,17 +238,19 @@ AliasAnalysis::analyze()
 
                 bool hasAlias = false;
                 for (AliasSetIterator iter(set); iter; iter++) {
                     MInstructionVector& aliasedStores = stores[*iter];
                     for (int i = aliasedStores.length() - 1;; i--) {
                         MInstruction* store = aliasedStores[i];
                         if (store->id() < firstLoopIns->id())
                             break;
-                        if (ins->mightAlias(store) != MDefinition::AliasType::NoAlias) {
+                        if (genericMightAlias(ins, store) != MDefinition::AliasType::NoAlias &&
+                            ins->mightAlias(store) != MDefinition::AliasType::NoAlias)
+                        {
                             hasAlias = true;
                             IonSpewDependency(ins, store, "aliases", "store in loop body");
                             break;
                         }
                     }
                     if (hasAlias)
                         break;
                 }

--- a/js/src/jit/AliasAnalysisShared.cpp
+++ b/js/src/jit/AliasAnalysisShared.cpp
@@ -1,16 +1,18 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jit/AliasAnalysisShared.h"
 
+#include "jit/MIR.h"
+
 namespace js {
 namespace jit {
 
 void
 AliasAnalysisShared::spewDependencyList()
 {
 #ifdef JS_JITSPEW
     if (JitSpewEnabled(JitSpew_AliasSummaries)) {
@@ -35,10 +37,149 @@ AliasAnalysisShared::spewDependencyList(
                 MDefinition::PrintOpcodeName(print, def->dependency()->op());
                 print.printf("%d\n", def->dependency()->id());
             }
         }
     }
 #endif
 }
 
+// Unwrap any slot or element to its corresponding object.
+static inline const MDefinition*
+MaybeUnwrap(const MDefinition* object)
+{
+
+    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles() ||
+           object->isTypedArrayElements() || object->isTypedObjectElements())
+    {
+        MOZ_ASSERT(object->numOperands() == 1);
+        object = object->getOperand(0);
+    }
+
+    if (object->isConstantElements())
+        return nullptr;
+
+    return object;
+}
+
+// Get the object of any load/store. Returns nullptr if not tied to
+// an object.
+static inline const MDefinition*
+GetObject(const MDefinition* ins)
+{
+    if (!ins->getAliasSet().isStore() && !ins->getAliasSet().isLoad())
+        return nullptr;
+
+    const MDefinition* object = nullptr;
+    switch (ins->op()) {
+      case MDefinition::Op_GetPropertyCache:
+        if (!ins->toGetPropertyCache()->idempotent())
+            return nullptr;
+        object = ins->getOperand(0);
+        break;
+      case MDefinition::Op_InitializedLength:
+      case MDefinition::Op_LoadElement:
+      case MDefinition::Op_LoadUnboxedScalar:
+      case MDefinition::Op_LoadUnboxedObjectOrNull:
+      case MDefinition::Op_LoadUnboxedString:
+      case MDefinition::Op_StoreElement:
+      case MDefinition::Op_StoreUnboxedObjectOrNull:
+      case MDefinition::Op_StoreUnboxedString:
+      case MDefinition::Op_StoreUnboxedScalar:
+      case MDefinition::Op_SetInitializedLength:
+      case MDefinition::Op_ArrayLength:
+      case MDefinition::Op_SetArrayLength:
+      case MDefinition::Op_StoreElementHole:
+      case MDefinition::Op_TypedObjectDescr:
+      case MDefinition::Op_Slots:
+      case MDefinition::Op_Elements:
+      case MDefinition::Op_MaybeCopyElementsForWrite:
+      case MDefinition::Op_MaybeToDoubleElement:
+      case MDefinition::Op_UnboxedArrayLength:
+      case MDefinition::Op_UnboxedArrayInitializedLength:
+      case MDefinition::Op_IncrementUnboxedArrayInitializedLength:
+      case MDefinition::Op_SetUnboxedArrayInitializedLength:
+      case MDefinition::Op_TypedArrayLength:
+      case MDefinition::Op_SetTypedObjectOffset:
+      case MDefinition::Op_SetDisjointTypedElements:
+      case MDefinition::Op_ArrayPopShift:
+      case MDefinition::Op_ArrayPush:
+      case MDefinition::Op_ArraySlice:
+      case MDefinition::Op_LoadTypedArrayElementHole:
+      case MDefinition::Op_StoreTypedArrayElementHole:
+      case MDefinition::Op_LoadFixedSlot:
+      case MDefinition::Op_LoadFixedSlotAndUnbox:
+      case MDefinition::Op_StoreFixedSlot:
+      case MDefinition::Op_GetPropertyPolymorphic:
+      case MDefinition::Op_SetPropertyPolymorphic:
+      case MDefinition::Op_GuardShape:
+      case MDefinition::Op_GuardReceiverPolymorphic:
+      case MDefinition::Op_GuardObjectGroup:
+      case MDefinition::Op_GuardObjectIdentity:
+      case MDefinition::Op_GuardClass:
+      case MDefinition::Op_GuardUnboxedExpando:
+      case MDefinition::Op_LoadUnboxedExpando:
+      case MDefinition::Op_LoadSlot:
+      case MDefinition::Op_StoreSlot:
+      case MDefinition::Op_InArray:
+      case MDefinition::Op_LoadElementHole:
+      case MDefinition::Op_TypedArrayElements:
+      case MDefinition::Op_TypedObjectElements:
+        object = ins->getOperand(0);
+        break;
+      case MDefinition::Op_LoadTypedArrayElementStatic:
+      case MDefinition::Op_StoreTypedArrayElementStatic:
+      case MDefinition::Op_GetDOMProperty:
+      case MDefinition::Op_GetDOMMember:
+      case MDefinition::Op_Call:
+      case MDefinition::Op_Compare:
+      case MDefinition::Op_GetArgumentsObjectArg:
+      case MDefinition::Op_SetArgumentsObjectArg:
+      case MDefinition::Op_GetFrameArgument:
+      case MDefinition::Op_SetFrameArgument:
+      case MDefinition::Op_CompareExchangeTypedArrayElement:
+      case MDefinition::Op_AtomicExchangeTypedArrayElement:
+      case MDefinition::Op_AtomicTypedArrayElementBinop:
+      case MDefinition::Op_AsmJSLoadHeap:
+      case MDefinition::Op_AsmJSStoreHeap:
+      case MDefinition::Op_AsmJSCompareExchangeHeap:
+      case MDefinition::Op_AsmJSAtomicBinopHeap:
+      case MDefinition::Op_AsmJSLoadGlobalVar:
+      case MDefinition::Op_AsmJSStoreGlobalVar:
+      case MDefinition::Op_ArrayJoin:
+        return nullptr;
+      default:
+#ifdef DEBUG
+        // Crash when the default aliasSet is overriden, but when not added in the list above.
+        if (!ins->getAliasSet().isStore() || ins->getAliasSet().flags() != AliasSet::Flag::Any)
+            MOZ_CRASH("Overridden getAliasSet without updating AliasAnalysisShared GetObject");
+#endif
+
+        return nullptr;
+    }
+
+    MOZ_ASSERT(!ins->getAliasSet().isStore() || ins->getAliasSet().flags() != AliasSet::Flag::Any);
+    object = MaybeUnwrap(object);
+    MOZ_ASSERT_IF(object, object->type() == MIRType::Object);
+    return object;
+}
+
+// Generic comparing if a load aliases a store using TI information.
+MDefinition::AliasType
+AliasAnalysisShared::genericMightAlias(const MDefinition* load, const MDefinition* store)
+{
+    const MDefinition* loadObject = GetObject(load);
+    const MDefinition* storeObject = GetObject(store);
+    if (!loadObject || !storeObject)
+        return MDefinition::AliasType::MayAlias;
+
+    if (!loadObject->resultTypeSet() || !storeObject->resultTypeSet())
+        return MDefinition::AliasType::MayAlias;
+
+    if (loadObject->resultTypeSet()->objectsIntersect(storeObject->resultTypeSet()))
+        return MDefinition::AliasType::MayAlias;
+
+    return MDefinition::AliasType::NoAlias;
+}
+
+
 } // namespace jit
 } // namespace js

--- a/js/src/jit/AliasAnalysisShared.h
+++ b/js/src/jit/AliasAnalysisShared.h
@@ -26,16 +26,20 @@ class AliasAnalysisShared
       : mir(mir),
         graph_(graph)
     {}
 
     virtual MOZ_MUST_USE bool analyze() {
         return true;
     }
 
+    static MDefinition::AliasType genericMightAlias(const MDefinition* load,
+                                                    const MDefinition* store);
+
+
   protected:
     void spewDependencyList();
 
     TempAllocator& alloc() const {
         return graph_.alloc();
     }
 };
 

--- a/js/src/jit/FlowAliasAnalysis.cpp
+++ b/js/src/jit/FlowAliasAnalysis.cpp
@@ -206,22 +206,28 @@ LoadAliasesStore(MDefinition* load, MDef
     // if it aliases anything in the full loop. Which we do lateron.
     if (store->isControlInstruction())
         return true;
 
     // Check if the alias categories alias eachother.
     if ((load->getAliasSet() & store->getAliasSet()).isNone())
         return false;
 
+    // On any operation that has a specific alias category we can use TI to know
+    // the objects operating on don't intersect.
+    MDefinition::AliasType mightAlias = AliasAnalysisShared::genericMightAlias(load, store);
+    if (mightAlias == MDefinition::AliasType::NoAlias)
+        return false;
+
     // Check if the instruction might alias eachother.
-    MDefinition::AliasType type = load->mightAlias(store);
-    if (type != MDefinition::AliasType::NoAlias)
-        return true;
+    mightAlias = load->mightAlias(store);
+    if (mightAlias == MDefinition::AliasType::NoAlias)
+        return false;
 
-    return false;
+    return true;
 }
 
 #ifdef JS_JITSPEW
 static void
 DumpAliasSet(AliasSet set)
 {
     Fprinter &print = JitSpewPrinter();
 

--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3605,48 +3605,48 @@ LIRGenerator::visitGetPropertyCache(MGet
         define(lir, ins);
         assignSafepoint(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     if (ins->type() == MIRType::Value) {
         LGetPropertyPolymorphicV* lir =
-            new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->obj()));
+            new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->object()));
         assignSnapshot(lir, Bailout_ShapeGuard);
         defineBox(lir, ins);
     } else {
         LDefinition maybeTemp = (ins->type() == MIRType::Double) ? temp() : LDefinition::BogusTemp();
         LGetPropertyPolymorphicT* lir =
-            new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
+            new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->object()), maybeTemp);
         assignSnapshot(lir, Bailout_ShapeGuard);
         define(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     if (ins->value()->type() == MIRType::Value) {
         LSetPropertyPolymorphicV* lir =
-            new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->obj()),
+            new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->object()),
                                                   useBox(ins->value()),
                                                   temp());
         assignSnapshot(lir, Bailout_ShapeGuard);
         add(lir, ins);
     } else {
         LAllocation value = useRegisterOrConstant(ins->value());
         LSetPropertyPolymorphicT* lir =
-            new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->obj()), value,
+            new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->object()), value,
                                                   ins->value()->type(), temp());
         assignSnapshot(lir, Bailout_ShapeGuard);
         add(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitBindNameCache(MBindNameCache* ins)
@@ -3667,28 +3667,28 @@ LIRGenerator::visitCallBindVar(MCallBind
 
     LCallBindVar* lir = new(alloc()) LCallBindVar(useRegister(ins->scopeChain()));
     define(lir, ins);
 }
 
 void
 LIRGenerator::visitGuardObjectIdentity(MGuardObjectIdentity* ins)
 {
-    LGuardObjectIdentity* guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->obj()),
+    LGuardObjectIdentity* guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->object()),
                                                                     useRegister(ins->expected()));
     assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitGuardClass(MGuardClass* ins)
 {
     LDefinition t = temp();
-    LGuardClass* guard = new(alloc()) LGuardClass(useRegister(ins->obj()), t);
+    LGuardClass* guard = new(alloc()) LGuardClass(useRegister(ins->object()), t);
     assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
     add(guard, ins);
 }
 
 void
 LIRGenerator::visitGuardObject(MGuardObject* ins)
 {
     // The type policy does all the work, so at this point the input
@@ -3706,49 +3706,49 @@ LIRGenerator::visitGuardString(MGuardStr
     redefine(ins, ins->input());
 }
 
 void
 LIRGenerator::visitGuardSharedTypedArray(MGuardSharedTypedArray* ins)
 {
     MOZ_ASSERT(ins->input()->type() == MIRType::Object);
     LGuardSharedTypedArray* guard =
-        new(alloc()) LGuardSharedTypedArray(useRegister(ins->obj()), temp());
+        new(alloc()) LGuardSharedTypedArray(useRegister(ins->object()), temp());
     assignSnapshot(guard, Bailout_NonSharedTypedArrayInput);
     add(guard, ins);
 }
 
 void
 LIRGenerator::visitPolyInlineGuard(MPolyInlineGuard* ins)
 {
     MOZ_ASSERT(ins->input()->type() == MIRType::Object);
     redefine(ins, ins->input());
 }
 
 void
 LIRGenerator::visitGuardReceiverPolymorphic(MGuardReceiverPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
     MOZ_ASSERT(ins->type() == MIRType::Object);
 
     LGuardReceiverPolymorphic* guard =
-        new(alloc()) LGuardReceiverPolymorphic(useRegister(ins->obj()), temp());
+        new(alloc()) LGuardReceiverPolymorphic(useRegister(ins->object()), temp());
     assignSnapshot(guard, Bailout_ShapeGuard);
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitGuardUnboxedExpando(MGuardUnboxedExpando* ins)
 {
     LGuardUnboxedExpando* guard =
-        new(alloc()) LGuardUnboxedExpando(useRegister(ins->obj()));
+        new(alloc()) LGuardUnboxedExpando(useRegister(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitLoadUnboxedExpando(MLoadUnboxedExpando* ins)
 {
     LLoadUnboxedExpando* lir =
         new(alloc()) LLoadUnboxedExpando(useRegisterAtStart(ins->object()));
     define(lir, ins);

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4860,158 +4860,16 @@ MLoadUnboxedObjectOrNull::foldsTo(TempAl
         return this;
 
     if (store->offsetAdjustment() != offsetAdjustment())
         return this;
 
     return foldsToStoredValue(alloc, store->value());
 }
 
-// Gets the MDefinition* representing the source/target object's storage.
-// Usually this is just an MElements*, but sometimes there are layers
-// of indirection or inlining, which are handled elsewhere.
-static inline const MElements*
-MaybeUnwrapElements(const MDefinition* elementsOrObj)
-{
-    // Sometimes there is a level of indirection for conversion.
-    if (elementsOrObj->isConvertElementsToDoubles())
-        return MaybeUnwrapElements(elementsOrObj->toConvertElementsToDoubles()->elements());
-
-    // For inline elements, the object may be passed directly, for example as MUnbox.
-    if (elementsOrObj->type() == MIRType::Object)
-        return nullptr;
-
-    // MTypedArrayElements and MTypedObjectElements aren't handled.
-    if (!elementsOrObj->isElements())
-        return nullptr;
-
-    return elementsOrObj->toElements();
-}
-
-static inline const MDefinition*
-GetElementsObject(const MDefinition* elementsOrObj)
-{
-    if (elementsOrObj->type() == MIRType::Object)
-        return elementsOrObj;
-
-    const MDefinition* elements = MaybeUnwrapElements(elementsOrObj);
-    if (elements)
-        return elements->toElements()->input();
-
-    return nullptr;
-}
-
-// Gets the MDefinition of the target Object for the given store operation.
-static inline const MDefinition*
-GetStoreObject(const MDefinition* store)
-{
-    switch (store->op()) {
-      case MDefinition::Op_StoreElement:
-        return GetElementsObject(store->toStoreElement()->elements());
-
-      case MDefinition::Op_StoreElementHole:
-        return store->toStoreElementHole()->object();
-
-      case MDefinition::Op_StoreUnboxedObjectOrNull:
-        return GetElementsObject(store->toStoreUnboxedObjectOrNull()->elements());
-
-      case MDefinition::Op_StoreUnboxedString:
-        return GetElementsObject(store->toStoreUnboxedString()->elements());
-
-      case MDefinition::Op_StoreUnboxedScalar:
-        return GetElementsObject(store->toStoreUnboxedScalar()->elements());
-
-      default:
-        return nullptr;
-    }
-}
-
-// Implements mightAlias() logic common to all load operations.
-static MDefinition::AliasType
-GenericLoadMightAlias(const MDefinition* elementsOrObj, const MDefinition* store)
-{
-    const MElements* elements = MaybeUnwrapElements(elementsOrObj);
-    if (elements)
-        return elements->mightAlias(store);
-
-    // Unhandled Elements kind.
-    if (elementsOrObj->type() != MIRType::Object)
-        return MDefinition::AliasType::MayAlias;
-
-    // Inline storage for objects.
-    // Refer to IsValidElementsType().
-    const MDefinition* object = elementsOrObj;
-    MOZ_ASSERT(object->type() == MIRType::Object);
-    if (!object->resultTypeSet())
-        return MDefinition::AliasType::MayAlias;
-
-    const MDefinition* storeObject = GetStoreObject(store);
-    if (!storeObject)
-        return MDefinition::AliasType::MayAlias;
-    if (!storeObject->resultTypeSet())
-        return MDefinition::AliasType::MayAlias;
-
-    if (object->resultTypeSet()->objectsIntersect(storeObject->resultTypeSet()))
-        return MDefinition::AliasType::MayAlias;
-    return MDefinition::AliasType::NoAlias;
-}
-
-MDefinition::AliasType
-MElements::mightAlias(const MDefinition* store) const
-{
-    if (!input()->resultTypeSet())
-        return AliasType::MayAlias;
-
-    const MDefinition* storeObj = GetStoreObject(store);
-    if (!storeObj)
-        return AliasType::MayAlias;
-    if (!storeObj->resultTypeSet())
-        return AliasType::MayAlias;
-
-    if (input()->resultTypeSet()->objectsIntersect(storeObj->resultTypeSet()))
-        return AliasType::MayAlias;
-    return AliasType::NoAlias;
-}
-
-MDefinition::AliasType
-MLoadElement::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MInitializedLength::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedObjectOrNull::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedString::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedScalar::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MUnboxedArrayInitializedLength::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(object(), store);
-}
-
 bool
 MGuardReceiverPolymorphic::congruentTo(const MDefinition* ins) const
 {
     if (!ins->isGuardReceiverPolymorphic())
         return false;
 
     const MGuardReceiverPolymorphic* other = ins->toGuardReceiverPolymorphic();
 

--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -8529,17 +8529,16 @@ class MElements
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins) &&
                ins->toElements()->unboxed() == unboxed();
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MElements)
 };
 
 // A constant value for some object's typed array elements.
 class MConstantElements : public MNullaryInstruction
 {
     SharedMem<void*> value_;
@@ -8723,17 +8722,16 @@ class MInitializedLength
         return getOperand(0);
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     void computeRange(TempAllocator& alloc) override;
 
     ALLOW_CLONE(MInitializedLength)
 };
 
 // Store to the initialized length in an elements header. Note the input is an
 // *index*, one less than the desired length.
@@ -8821,17 +8819,16 @@ class MUnboxedArrayInitializedLength
         return getOperand(0);
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MUnboxedArrayInitializedLength)
 };
 
 // Increment the initialized length of an unboxed array object.
 class MIncrementUnboxedArrayInitializedLength
   : public MUnaryInstruction,
     public SingleObjectPolicy::Data
@@ -9453,17 +9450,16 @@ class MLoadElement
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(other);
     }
     MDefinition* foldsTo(TempAllocator& alloc) override;
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::Element);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadElement)
 };
 
 // Load a value from the elements vector for a dense native or unboxed array.
 // If the index is out-of-bounds, or the indexed slot has a hole, undefined is
 // returned instead.
 class MLoadElementHole
@@ -9610,17 +9606,16 @@ class MLoadUnboxedObjectOrNull
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(other);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
     MDefinition* foldsTo(TempAllocator& alloc) override;
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadUnboxedObjectOrNull)
 };
 
 class MLoadUnboxedString
   : public MBinaryInstruction,
     public SingleObjectPolicy::Data
 {
@@ -9660,17 +9655,16 @@ class MLoadUnboxedString
         const MLoadUnboxedString* other = ins->toLoadUnboxedString();
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadUnboxedString)
 };
 
 class MStoreElementCommon
 {
     MIRType elementType_;
     bool needsBarrier_;
@@ -10268,17 +10262,16 @@ class MLoadUnboxedScalar
     }
     AliasSet getAliasSet() const override {
         // When a barrier is needed make the instruction effectful by
         // giving it a "store" effect.
         if (requiresBarrier_)
             return AliasSet::Store(AliasSet::UnboxedElement);
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     bool congruentTo(const MDefinition* ins) const override {
         if (requiresBarrier_)
             return false;
         if (!ins->isLoadUnboxedScalar())
             return false;
         const MLoadUnboxedScalar* other = ins->toLoadUnboxedScalar();
         if (storageType_ != other->storageType_)
@@ -11145,17 +11138,17 @@ class MGetPropertyPolymorphic
         return receivers_[i].receiver;
     }
     Shape* shape(size_t i) const {
         return receivers_[i].shape;
     }
     PropertyName* name() const {
         return name_;
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const override {
         bool hasUnboxedLoad = false;
         for (size_t i = 0; i < numReceivers(); i++) {
             if (!shape(i)) {
                 hasUnboxedLoad = true;
                 break;
@@ -11218,17 +11211,17 @@ class MSetPropertyPolymorphic
         return receivers_[i].receiver;
     }
     Shape* shape(size_t i) const {
         return receivers_[i].shape;
     }
     PropertyName* name() const {
         return name_;
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     MDefinition* value() const {
         return getOperand(1);
     }
     bool needsBarrier() const {
         return needsBarrier_;
     }
@@ -11504,17 +11497,17 @@ class MGuardShape
     INSTRUCTION_HEADER(GuardShape)
 
     static MGuardShape* New(TempAllocator& alloc, MDefinition* obj, Shape* shape,
                             BailoutKind bailoutKind)
     {
         return new(alloc) MGuardShape(obj, shape, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const Shape* shape() const {
         return shape_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
@@ -11551,17 +11544,17 @@ class MGuardReceiverPolymorphic
 
   public:
     INSTRUCTION_HEADER(GuardReceiverPolymorphic)
 
     static MGuardReceiverPolymorphic* New(TempAllocator& alloc, MDefinition* obj) {
         return new(alloc) MGuardReceiverPolymorphic(alloc, obj);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     bool addReceiver(const ReceiverGuard& receiver) {
         return receivers_.append(receiver);
     }
     size_t numReceivers() const {
         return receivers_.length();
@@ -11606,17 +11599,17 @@ class MGuardObjectGroup
   public:
     INSTRUCTION_HEADER(GuardObjectGroup)
 
     static MGuardObjectGroup* New(TempAllocator& alloc, MDefinition* obj, ObjectGroup* group,
                                   bool bailOnEquality, BailoutKind bailoutKind) {
         return new(alloc) MGuardObjectGroup(obj, group, bailOnEquality, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const ObjectGroup* group() const {
         return group_;
     }
     bool bailOnEquality() const {
         return bailOnEquality_;
     }
@@ -11658,17 +11651,17 @@ class MGuardObjectIdentity
   public:
     INSTRUCTION_HEADER(GuardObjectIdentity)
 
     static MGuardObjectIdentity* New(TempAllocator& alloc, MDefinition* obj, MDefinition* expected,
                                      bool bailOnEquality) {
         return new(alloc) MGuardObjectIdentity(obj, expected, bailOnEquality);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     MDefinition* expected() const {
         return getOperand(1);
     }
     bool bailOnEquality() const {
         return bailOnEquality_;
     }
@@ -11701,17 +11694,17 @@ class MGuardClass
 
   public:
     INSTRUCTION_HEADER(GuardClass)
 
     static MGuardClass* New(TempAllocator& alloc, MDefinition* obj, const Class* clasp) {
         return new(alloc) MGuardClass(obj, clasp);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const Class* getClass() const {
         return class_;
     }
     bool congruentTo(const MDefinition* ins) const override {
         if (!ins->isGuardClass())
             return false;
@@ -11747,17 +11740,17 @@ class MGuardUnboxedExpando
   public:
     INSTRUCTION_HEADER(GuardUnboxedExpando)
 
     static MGuardUnboxedExpando* New(TempAllocator& alloc, MDefinition* obj,
                                      bool requireExpando, BailoutKind bailoutKind) {
         return new(alloc) MGuardUnboxedExpando(obj, requireExpando, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     bool requireExpando() const {
         return requireExpando_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
@@ -12358,17 +12351,17 @@ class MSetDOMProperty
     {
         return new(alloc) MSetDOMProperty(func, obj, val);
     }
 
     JSJitSetterOp fun() const {
         return func_;
     }
 
-    MDefinition* object() {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     MDefinition* value()
     {
         return getOperand(1);
     }
 
@@ -12460,17 +12453,17 @@ class MGetDOMProperty
     }
     size_t domMemberSlotIndex() const {
         MOZ_ASSERT(info_->isAlwaysInSlot || info_->isLazilyCachedInSlot);
         return info_->slotIndex;
     }
     bool valueMayBeInSlot() const {
         return info_->isLazilyCachedInSlot;
     }
-    MDefinition* object() {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     bool congruentTo(const MDefinition* ins) const override {
         if (!ins->isGetDOMProperty())
             return false;
 
         return congruentTo(ins->toGetDOMProperty());
@@ -13905,17 +13898,17 @@ class MGuardSharedTypedArray
     }
 
 public:
     INSTRUCTION_HEADER(GuardSharedTypedArray)
 
     static MGuardSharedTypedArray* New(TempAllocator& alloc, MDefinition* obj) {
         return new(alloc) MGuardSharedTypedArray(obj);
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 };
 
 class MCompareExchangeTypedArrayElement

--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -560,17 +560,17 @@ ObjectMemoryView::visitPostWriteBarrier(
 
 void
 ObjectMemoryView::visitStoreSlot(MStoreSlot* ins)
 {
     // Skip stores made on other objects.
     MSlots* slots = ins->slots()->toSlots();
     if (slots->object() != obj_) {
         // Guard objects are replaced when they are visited.
-        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
+        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->object() != obj_);
         return;
     }
 
     // Clone the state and update the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         if (!state_) {
             oom_ = true;
@@ -592,17 +592,17 @@ ObjectMemoryView::visitStoreSlot(MStoreS
 
 void
 ObjectMemoryView::visitLoadSlot(MLoadSlot* ins)
 {
     // Skip loads made on other objects.
     MSlots* slots = ins->slots()->toSlots();
     if (slots->object() != obj_) {
         // Guard objects are replaced when they are visited.
-        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
+        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->object() != obj_);
         return;
     }
 
     // Replace load by the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getDynamicSlot(ins->slot()));
     } else {
         // UnsafeGetReserveSlot can access baked-in slots which are guarded by
@@ -615,17 +615,17 @@ ObjectMemoryView::visitLoadSlot(MLoadSlo
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
 void
 ObjectMemoryView::visitGuardShape(MGuardShape* ins)
 {
     // Skip loads made on other objects.
-    if (ins->obj() != obj_)
+    if (ins->object() != obj_)
         return;
 
     // Replace the shape guard by its object.
     ins->replaceAllUsesWith(obj_);
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }

--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -372,35 +372,35 @@ LIRGeneratorARM::newLTableSwitchV(MTable
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), tableswitch);
 }
 
 void
 LIRGeneratorARM::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->obj()), tempObj);
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorARM::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->obj()), tempObj);
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorARM::lowerUrshD(MUrsh* mir)
 {
     MDefinition* lhs = mir->lhs();
     MDefinition* rhs = mir->rhs();
 

--- a/js/src/jit/mips-shared/Lowering-mips-shared.cpp
+++ b/js/src/jit/mips-shared/Lowering-mips-shared.cpp
@@ -221,35 +221,35 @@ LIRGeneratorMIPSShared::newLTableSwitchV
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), temp(), tableswitch);
 }
 
 void
 LIRGeneratorMIPSShared::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->obj()), tempObj);
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorMIPSShared::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->obj()), tempObj);
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorMIPSShared::lowerUrshD(MUrsh* mir)
 {
     MDefinition* lhs = mir->lhs();
     MDefinition* rhs = mir->rhs();
 

--- a/js/src/jit/x86-shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/x86-shared/Lowering-x86-shared.cpp
@@ -31,33 +31,33 @@ LIRGeneratorX86Shared::newLTableSwitchV(
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), temp(), tableswitch);
 }
 
 void
 LIRGeneratorX86Shared::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegisterAtStart(ins->obj()));
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegisterAtStart(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorX86Shared::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegisterAtStart(ins->obj()));
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegisterAtStart(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorX86Shared::visitPowHalf(MPowHalf* ins)
 {
     MDefinition* input = ins->input();
     MOZ_ASSERT(input->type() == MIRType::Double);
     LPowHalfD* lir = new(alloc()) LPowHalfD(useRegisterAtStart(input));