--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -8212,52 +8212,16 @@ void CodeGenerator::visitModD(LModD* ins
   } else {
     masm.setupUnalignedABICall(ToRegister(ins->temp()));
     masm.passABIArg(lhs, MoveOp::DOUBLE);
     masm.passABIArg(rhs, MoveOp::DOUBLE);
     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, NumberMod), MoveOp::DOUBLE);
   }
 }
 
-void CodeGenerator::visitBinaryV(LBinaryV* lir) {
-  pushArg(ToValue(lir, LBinaryV::RhsInput));
-  pushArg(ToValue(lir, LBinaryV::LhsInput));
-
-  using Fn = bool (*)(JSContext*, MutableHandleValue, MutableHandleValue,
-                      MutableHandleValue);
-  switch (lir->jsop()) {
-    case JSOp::BitAnd:
-      callVM<Fn, js::BitAnd>(lir);
-      break;
-
-    case JSOp::BitOr:
-      callVM<Fn, js::BitOr>(lir);
-      break;
-
-    case JSOp::BitXor:
-      callVM<Fn, js::BitXor>(lir);
-      break;
-
-    case JSOp::Lsh:
-      callVM<Fn, js::BitLsh>(lir);
-      break;
-
-    case JSOp::Rsh:
-      callVM<Fn, js::BitRsh>(lir);
-      break;
-
-    case JSOp::Ursh:
-      callVM<Fn, js::UrshValues>(lir);
-      break;
-
-    default:
-      MOZ_CRASH("Unexpected binary op");
-  }
-}
-
 void CodeGenerator::emitCompareS(LInstruction* lir, JSOp op, Register left,
                                  Register right, Register output) {
   MOZ_ASSERT(lir->isCompareS() || lir->isCompareStrictS());
 
   OutOfLineCode* ool = nullptr;
 
   using Fn = bool (*)(JSContext*, HandleString, HandleString, bool*);
   if (op == JSOp::Eq || op == JSOp::StrictEq) {
@@ -8323,18 +8287,18 @@ void CodeGenerator::visitCompareS(LCompa
   Register left = ToRegister(lir->left());
   Register right = ToRegister(lir->right());
   Register output = ToRegister(lir->output());
 
   emitCompareS(lir, op, left, right, output);
 }
 
 void CodeGenerator::visitCompareVM(LCompareVM* lir) {
-  pushArg(ToValue(lir, LBinaryV::RhsInput));
-  pushArg(ToValue(lir, LBinaryV::LhsInput));
+  pushArg(ToValue(lir, LCompareVM::RhsInput));
+  pushArg(ToValue(lir, LCompareVM::LhsInput));
 
   using Fn =
       bool (*)(JSContext*, MutableHandleValue, MutableHandleValue, bool*);
   switch (lir->mir()->jsop()) {
     case JSOp::Eq:
       callVM<Fn, jit::LooselyEqual<EqualityKind::Equal>>(lir);
       break;
 

--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1114,32 +1114,36 @@ void LIRGenerator::visitSameValue(MSameV
       new (alloc()) LSameValueVM(useBoxAtStart(lhs), useBoxAtStart(rhs));
   defineReturn(lir, ins);
   assignSafepoint(lir, ins);
 }
 
 void LIRGenerator::lowerBitOp(JSOp op, MBinaryBitwiseInstruction* ins) {
   MDefinition* lhs = ins->getOperand(0);
   MDefinition* rhs = ins->getOperand(1);
-
-  if (lhs->type() == MIRType::Int32) {
+  MOZ_ASSERT(IsIntType(ins->type()));
+  MOZ_ASSERT(ins->type() == ins->specialization());
+
+  if (ins->type() == MIRType::Int32) {
+    MOZ_ASSERT(lhs->type() == MIRType::Int32);
     MOZ_ASSERT(rhs->type() == MIRType::Int32);
     ReorderCommutative(&lhs, &rhs, ins);
     lowerForALU(new (alloc()) LBitOpI(op), ins, lhs, rhs);
     return;
   }
 
-  if (lhs->type() == MIRType::Int64) {
+  if (ins->type() == MIRType::Int64) {
+    MOZ_ASSERT(lhs->type() == MIRType::Int64);
     MOZ_ASSERT(rhs->type() == MIRType::Int64);
     ReorderCommutative(&lhs, &rhs, ins);
     lowerForALUInt64(new (alloc()) LBitOpI64(op), ins, lhs, rhs);
     return;
   }
 
-  lowerBinaryV(op, ins);
+  MOZ_CRASH("Unhandled integer specialization");
 }
 
 void LIRGenerator::visitTypeOf(MTypeOf* ins) {
   MDefinition* opd = ins->input();
   MOZ_ASSERT(opd->type() == MIRType::Value);
 
   LTypeOfV* lir = new (alloc()) LTypeOfV(useBox(opd), tempToUnbox());
   define(lir, ins);
@@ -1215,44 +1219,49 @@ void LIRGenerator::visitBitAnd(MBitAnd* 
 
 void LIRGenerator::visitBitOr(MBitOr* ins) { lowerBitOp(JSOp::BitOr, ins); }
 
 void LIRGenerator::visitBitXor(MBitXor* ins) { lowerBitOp(JSOp::BitXor, ins); }
 
 void LIRGenerator::lowerShiftOp(JSOp op, MShiftInstruction* ins) {
   MDefinition* lhs = ins->getOperand(0);
   MDefinition* rhs = ins->getOperand(1);
-
-  if (lhs->type() == MIRType::Int32) {
+  MOZ_ASSERT(ins->type() == ins->specialization());
+
+  if (op == JSOp::Ursh && ins->type() == MIRType::Double) {
+    MOZ_ASSERT(lhs->type() == MIRType::Int32);
     MOZ_ASSERT(rhs->type() == MIRType::Int32);
-
-    if (ins->type() == MIRType::Double) {
-      MOZ_ASSERT(op == JSOp::Ursh);
-      lowerUrshD(ins->toUrsh());
-      return;
-    }
+    lowerUrshD(ins->toUrsh());
+    return;
+  }
+
+  MOZ_ASSERT(IsIntType(ins->type()));
+
+  if (ins->type() == MIRType::Int32) {
+    MOZ_ASSERT(lhs->type() == MIRType::Int32);
+    MOZ_ASSERT(rhs->type() == MIRType::Int32);
 
     LShiftI* lir = new (alloc()) LShiftI(op);
     if (op == JSOp::Ursh) {
       if (ins->toUrsh()->fallible()) {
         assignSnapshot(lir, Bailout_OverflowInvalidate);
       }
     }
     lowerForShift(lir, ins, lhs, rhs);
     return;
   }
 
-  if (lhs->type() == MIRType::Int64) {
+  if (ins->type() == MIRType::Int64) {
+    MOZ_ASSERT(lhs->type() == MIRType::Int64);
     MOZ_ASSERT(rhs->type() == MIRType::Int64);
     lowerForShiftInt64(new (alloc()) LShiftI64(op), ins, lhs, rhs);
     return;
   }
 
-  MOZ_ASSERT(ins->specialization() == MIRType::None);
-  lowerBinaryV(op, ins);
+  MOZ_CRASH("Unhandled integer specialization");
 }
 
 void LIRGenerator::visitLsh(MLsh* ins) { lowerShiftOp(JSOp::Lsh, ins); }
 
 void LIRGenerator::visitRsh(MRsh* ins) { lowerShiftOp(JSOp::Rsh, ins); }
 
 void LIRGenerator::visitUrsh(MUrsh* ins) { lowerShiftOp(JSOp::Ursh, ins); }
 
@@ -1831,29 +1840,16 @@ void LIRGenerator::visitMod(MMod* ins) {
                                      useRegisterAtStart(ins->rhs()), maybeTemp);
     defineReturn(lir, ins);
     return;
   }
 
   MOZ_CRASH("Unhandled number specialization");
 }
 
-void LIRGenerator::lowerBinaryV(JSOp op, MBinaryInstruction* ins) {
-  MDefinition* lhs = ins->getOperand(0);
-  MDefinition* rhs = ins->getOperand(1);
-
-  MOZ_ASSERT(lhs->type() == MIRType::Value);
-  MOZ_ASSERT(rhs->type() == MIRType::Value);
-
-  LBinaryV* lir =
-      new (alloc()) LBinaryV(op, useBoxAtStart(lhs), useBoxAtStart(rhs));
-  defineReturn(lir, ins);
-  assignSafepoint(lir, ins);
-}
-
 void LIRGenerator::visitConcat(MConcat* ins) {
   MDefinition* lhs = ins->getOperand(0);
   MDefinition* rhs = ins->getOperand(1);
 
   MOZ_ASSERT(lhs->type() == MIRType::String);
   MOZ_ASSERT(rhs->type() == MIRType::String);
   MOZ_ASSERT(ins->type() == MIRType::String);
 

--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -52,17 +52,16 @@ class LIRGenerator final : public LIRGen
   }
 
   LBoxAllocation useBoxFixedAtStart(MDefinition* mir, ValueOperand op);
   LBoxAllocation useBoxAtStart(MDefinition* mir,
                                LUse::Policy policy = LUse::REGISTER);
 
   void lowerBitOp(JSOp op, MBinaryBitwiseInstruction* ins);
   void lowerShiftOp(JSOp op, MShiftInstruction* ins);
-  void lowerBinaryV(JSOp op, MBinaryInstruction* ins);
   void definePhis();
 
   MOZ_MUST_USE bool lowerCallArguments(MCall* call);
 
   friend class LIRGeneratorShared;
   void visitInstructionDispatch(MInstruction* ins);
 
   MOZ_MUST_USE bool visitInstruction(MInstruction* ins);

--- a/js/src/jit/VMFunctionList-inl.h
+++ b/js/src/jit/VMFunctionList-inl.h
@@ -66,22 +66,17 @@ namespace jit {
   _(BigIntStringGreaterThanOrEqual,                                            \
     js::jit::BigIntStringCompare<js::jit::ComparisonKind::GreaterThanOrEqual>) \
   _(BigIntStringLessThan,                                                      \
     js::jit::BigIntStringCompare<js::jit::ComparisonKind::LessThan>)           \
   _(BigIntStringNotEqual,                                                      \
     js::jit::BigIntStringEqual<js::jit::EqualityKind::NotEqual>)               \
   _(BigIntSub, JS::BigInt::sub)                                                \
   _(BindVarOperation, js::BindVarOperation)                                    \
-  _(BitAnd, js::BitAnd)                                                        \
-  _(BitLsh, js::BitLsh)                                                        \
   _(BitNot, js::BitNot)                                                        \
-  _(BitOr, js::BitOr)                                                          \
-  _(BitRsh, js::BitRsh)                                                        \
-  _(BitXor, js::BitXor)                                                        \
   _(BoxBoxableValue, js::wasm::BoxBoxableValue)                                \
   _(BoxNonStrictThis, js::BoxNonStrictThis)                                    \
   _(CallNativeGetter, js::jit::CallNativeGetter)                               \
   _(CallNativeGetterByValue, js::jit::CallNativeGetterByValue)                 \
   _(CallNativeSetter, js::jit::CallNativeSetter)                               \
   _(CharCodeAt, js::jit::CharCodeAt)                                           \
   _(CheckClassHeritageOperation, js::CheckClassHeritageOperation)              \
   _(CheckGlobalOrEvalDeclarationConflicts,                                     \
@@ -272,18 +267,17 @@ namespace jit {
   _(ThrowMsgOperation, js::ThrowMsgOperation)                                  \
   _(ThrowObjectCoercible, js::ThrowObjectCoercible)                            \
   _(ThrowOperation, js::ThrowOperation)                                        \
   _(ThrowRuntimeLexicalError, js::jit::ThrowRuntimeLexicalError)               \
   _(ThrowUninitializedThis, js::ThrowUninitializedThis)                        \
   _(ToIdOperation, js::ToIdOperation)                                          \
   _(ToObjectSlow, js::ToObjectSlow)                                            \
   _(ToStringSlow, js::ToStringSlow<CanGC>)                                     \
-  _(TrySkipAwait, js::jit::TrySkipAwait)                                       \
-  _(UrshValues, js::UrshValues)
+  _(TrySkipAwait, js::jit::TrySkipAwait)
 
 // The list below is for tail calls. The third argument specifies the number of
 // non-argument Values the VM wrapper should pop from the stack. This is used
 // for Baseline ICs.
 #define TAIL_CALL_VMFUNCTION_LIST(_)                            \
   _(DoBinaryArithFallback, js::jit::DoBinaryArithFallback, 2)   \
   _(DoBindNameFallback, js::jit::DoBindNameFallback, 0)         \
   _(DoCompareFallback, js::jit::DoCompareFallback, 2)           \

--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -2708,37 +2708,16 @@ class LModD : public LBinaryMath<1> {
     setOperand(1, rhs);
     setTemp(0, temp);
     setIsCall();
   }
   const LDefinition* temp() { return getTemp(0); }
   MMod* mir() const { return mir_->toMod(); }
 };
 
-// Call a VM function to perform a binary operation.
-class LBinaryV : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0> {
-  JSOp jsop_;
-
- public:
-  LIR_HEADER(BinaryV)
-
-  LBinaryV(JSOp jsop, const LBoxAllocation& lhs, const LBoxAllocation& rhs)
-      : LCallInstructionHelper(classOpcode), jsop_(jsop) {
-    setBoxOperand(LhsInput, lhs);
-    setBoxOperand(RhsInput, rhs);
-  }
-
-  JSOp jsop() const { return jsop_; }
-
-  const char* extraName() const { return CodeName(jsop_); }
-
-  static const size_t LhsInput = 0;
-  static const size_t RhsInput = BOX_PIECES;
-};
-
 // Adds two string, returning a string.
 class LConcat : public LInstructionHelper<1, 2, 5> {
  public:
   LIR_HEADER(Concat)
 
   LConcat(const LAllocation& lhs, const LAllocation& rhs,
           const LDefinition& temp1, const LDefinition& temp2,
           const LDefinition& temp3, const LDefinition& temp4,