--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -587,52 +587,24 @@ void JitCode::finalize(JSFreeOp* fop) {
     pool_->release(headerSize_ + bufferSize_, CodeKind(kind_));
   }
 
   zone()->decJitMemory(headerSize_ + bufferSize_);
 
   pool_ = nullptr;
 }
 
-IonScript::IonScript(IonCompilationId compilationId)
-    : method_(nullptr),
-      osrPc_(nullptr),
-      osrEntryOffset_(0),
-      skipArgCheckEntryOffset_(0),
-      invalidateEpilogueOffset_(0),
-      invalidateEpilogueDataOffset_(0),
-      numBailouts_(0),
-      hasProfilingInstrumentation_(false),
-      recompiling_(false),
-      runtimeData_(0),
-      runtimeSize_(0),
-      icIndex_(0),
-      icEntries_(0),
-      safepointIndexOffset_(0),
-      safepointIndexEntries_(0),
-      safepointsStart_(0),
-      safepointsSize_(0),
-      frameSlots_(0),
-      argumentSlots_(0),
-      frameSize_(0),
-      bailoutTable_(0),
-      bailoutEntries_(0),
-      osiIndexOffset_(0),
-      osiIndexEntries_(0),
-      snapshots_(0),
-      snapshotsListSize_(0),
-      snapshotsRVATableSize_(0),
-      recovers_(0),
-      recoversSize_(0),
-      constantTable_(0),
-      constantEntries_(0),
-      invalidationCount_(0),
+IonScript::IonScript(IonCompilationId compilationId, uint32_t frameSlots,
+                     uint32_t argumentSlots, uint32_t frameSize,
+                     OptimizationLevel optimizationLevel)
+    : frameSlots_(frameSlots),
+      argumentSlots_(argumentSlots),
+      frameSize_(frameSize),
       compilationId_(compilationId),
-      optimizationLevel_(OptimizationLevel::Normal),
-      osrPcMismatchCounter_(0) {}
+      optimizationLevel_(optimizationLevel) {}
 
 IonScript* IonScript::New(JSContext* cx, IonCompilationId compilationId,
                           uint32_t frameSlots, uint32_t argumentSlots,
                           uint32_t frameSize, size_t snapshotsListSize,
                           size_t snapshotsRVATableSize, size_t recoversSize,
                           size_t bailoutEntries, size_t constants,
                           size_t safepointIndices, size_t osiIndices,
                           size_t icEntries, size_t runtimeSize,
@@ -669,17 +641,18 @@ IonScript* IonScript::New(JSContext* cx,
                  paddedSafepointIndicesSize + paddedSafepointSize +
                  paddedBailoutSize + paddedOsiIndicesSize +
                  paddedSnapshotsSize + paddedRecoversSize + paddedConstantsSize;
 
   IonScript* script = cx->pod_malloc_with_extra<IonScript, uint8_t>(bytes);
   if (!script) {
     return nullptr;
   }
-  new (script) IonScript(compilationId);
+  new (script) IonScript(compilationId, frameSlots, argumentSlots, frameSize,
+                         optimizationLevel);
 
   uint32_t offsetCursor = sizeof(IonScript);
 
   script->runtimeData_ = offsetCursor;
   script->runtimeSize_ = runtimeSize;
   offsetCursor += paddedRuntimeSize;
 
   script->icIndex_ = offsetCursor;
@@ -713,23 +686,16 @@ IonScript* IonScript::New(JSContext* cx,
 
   script->constantTable_ = offsetCursor;
   script->constantEntries_ = constants;
   offsetCursor += paddedConstantsSize;
 
   script->allocBytes_ = sizeof(IonScript) + bytes;
   MOZ_ASSERT(offsetCursor == script->allocBytes_);
 
-  script->frameSlots_ = frameSlots;
-  script->argumentSlots_ = argumentSlots;
-
-  script->frameSize_ = frameSize;
-
-  script->optimizationLevel_ = optimizationLevel;
-
   return script;
 }
 
 void IonScript::trace(JSTracer* trc) {
   if (method_) {
     TraceEdge(trc, &method_, "method");
   }
 

--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -150,111 +150,111 @@ class CodegenSafepointIndex;
 class SafepointIndex;
 class OsiIndex;
 class IonIC;
 
 // An IonScript attaches Ion-generated information to a JSScript.
 struct IonScript {
  private:
   // Code pointer containing the actual method.
-  HeapPtrJitCode method_;
+  HeapPtrJitCode method_ = nullptr;
 
   // Entrypoint for OSR, or nullptr.
-  jsbytecode* osrPc_;
+  jsbytecode* osrPc_ = nullptr;
 
   // Offset to OSR entrypoint from method_->raw(), or 0.
-  uint32_t osrEntryOffset_;
+  uint32_t osrEntryOffset_ = 0;
 
   // Offset to entrypoint skipping type arg check from method_->raw().
-  uint32_t skipArgCheckEntryOffset_;
+  uint32_t skipArgCheckEntryOffset_ = 0;
 
   // Offset of the invalidation epilogue (which pushes this IonScript
   // and calls the invalidation thunk).
-  uint32_t invalidateEpilogueOffset_;
+  uint32_t invalidateEpilogueOffset_ = 0;
 
   // The offset immediately after the IonScript immediate.
   // NOTE: technically a constant delta from
   // |invalidateEpilogueOffset_|, so we could hard-code this
   // per-platform if we want.
-  uint32_t invalidateEpilogueDataOffset_;
+  uint32_t invalidateEpilogueDataOffset_ = 0;
 
   // Number of times this script bailed out without invalidation.
-  uint32_t numBailouts_;
+  uint32_t numBailouts_ = 0;
 
   // Flag set if IonScript was compiled with profiling enabled.
-  bool hasProfilingInstrumentation_;
+  bool hasProfilingInstrumentation_ = false;
 
   // Flag for if this script is getting recompiled.
-  uint32_t recompiling_;
+  uint32_t recompiling_ = 0;
 
   // Any kind of data needed by the runtime, these can be either cache
   // information or profiling info.
-  uint32_t runtimeData_;
-  uint32_t runtimeSize_;
+  uint32_t runtimeData_ = 0;
+  uint32_t runtimeSize_ = 0;
 
   // State for polymorphic caches in the compiled code. All caches are stored
   // in the runtimeData buffer and indexed by the icIndex which gives a
   // relative offset in the runtimeData array.
-  uint32_t icIndex_;
-  uint32_t icEntries_;
+  uint32_t icIndex_ = 0;
+  uint32_t icEntries_ = 0;
 
   // Map code displacement to safepoint / OSI-patch-delta.
-  uint32_t safepointIndexOffset_;
-  uint32_t safepointIndexEntries_;
+  uint32_t safepointIndexOffset_ = 0;
+  uint32_t safepointIndexEntries_ = 0;
 
   // Offset to and length of the safepoint table in bytes.
-  uint32_t safepointsStart_;
-  uint32_t safepointsSize_;
+  uint32_t safepointsStart_ = 0;
+  uint32_t safepointsSize_ = 0;
 
   // Number of bytes this function reserves on the stack.
-  uint32_t frameSlots_;
+  uint32_t frameSlots_ = 0;
 
   // Number of bytes used passed in as formal arguments or |this|.
-  uint32_t argumentSlots_;
+  uint32_t argumentSlots_ = 0;
 
   // Frame size is the value that can be added to the StackPointer along
   // with the frame prefix to get a valid JitFrameLayout.
-  uint32_t frameSize_;
+  uint32_t frameSize_ = 0;
 
   // Table mapping bailout IDs to snapshot offsets.
-  uint32_t bailoutTable_;
-  uint32_t bailoutEntries_;
+  uint32_t bailoutTable_ = 0;
+  uint32_t bailoutEntries_ = 0;
 
   // Map OSI-point displacement to snapshot.
-  uint32_t osiIndexOffset_;
-  uint32_t osiIndexEntries_;
+  uint32_t osiIndexOffset_ = 0;
+  uint32_t osiIndexEntries_ = 0;
 
   // Offset from the start of the code buffer to its snapshot buffer.
-  uint32_t snapshots_;
-  uint32_t snapshotsListSize_;
-  uint32_t snapshotsRVATableSize_;
+  uint32_t snapshots_ = 0;
+  uint32_t snapshotsListSize_ = 0;
+  uint32_t snapshotsRVATableSize_ = 0;
 
   // List of instructions needed to recover stack frames.
-  uint32_t recovers_;
-  uint32_t recoversSize_;
+  uint32_t recovers_ = 0;
+  uint32_t recoversSize_ = 0;
 
   // Constant table for constants stored in snapshots.
-  uint32_t constantTable_;
-  uint32_t constantEntries_;
+  uint32_t constantTable_ = 0;
+  uint32_t constantEntries_ = 0;
 
   // The size of this allocation.
   uint32_t allocBytes_ = 0;
 
   // Number of references from invalidation records.
-  uint32_t invalidationCount_;
+  uint32_t invalidationCount_ = 0;
 
   // Identifier of the compilation which produced this code.
   IonCompilationId compilationId_;
 
   // The optimization level this script was compiled in.
   OptimizationLevel optimizationLevel_;
 
   // Number of times we tried to enter this script via OSR but failed due to
   // a LOOPENTRY pc other than osrPc_.
-  uint32_t osrPcMismatchCounter_;
+  uint32_t osrPcMismatchCounter_ = 0;
 
   // TraceLogger events that are baked into the IonScript.
   TraceLoggerEventVector traceLoggerEvents_;
 
  private:
   inline uint8_t* bottomBuffer() { return reinterpret_cast<uint8_t*>(this); }
   inline const uint8_t* bottomBuffer() const {
     return reinterpret_cast<const uint8_t*>(this);
@@ -277,20 +277,22 @@ struct IonScript {
   }
   const OsiIndex* osiIndices() const {
     return const_cast<IonScript*>(this)->osiIndices();
   }
   OsiIndex* osiIndices() { return (OsiIndex*)&bottomBuffer()[osiIndexOffset_]; }
   uint32_t* icIndex() { return (uint32_t*)&bottomBuffer()[icIndex_]; }
   uint8_t* runtimeData() { return &bottomBuffer()[runtimeData_]; }
 
+ private:
+  IonScript(IonCompilationId compilationId, uint32_t frameSlots,
+            uint32_t argumentSlots, uint32_t frameSize,
+            OptimizationLevel optimizationLevel);
+
  public:
-  // Do not call directly, use IonScript::New. This is public for cx->new_.
-  explicit IonScript(IonCompilationId compilationId);
-
   static IonScript* New(JSContext* cx, IonCompilationId compilationId,
                         uint32_t frameSlots, uint32_t argumentSlots,
                         uint32_t frameSize, size_t snapshotsListSize,
                         size_t snapshotsRVATableSize, size_t recoversSize,
                         size_t bailoutEntries, size_t constants,
                         size_t safepointIndexEntries, size_t osiIndexEntries,
                         size_t icEntries, size_t runtimeSize,
                         size_t safepointsSize,