--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -669,17 +669,17 @@ bool
 BaselineCacheIRCompiler::emitLoadObject()
 {
     Register reg = allocator.defineRegister(masm, reader.objOperandId());
     masm.loadPtr(stubAddress(reader.stubOffset()), reg);
     return true;
 }
 
 bool
-BaselineCacheIRCompiler::emitGuardDOMExpandoObject()
+BaselineCacheIRCompiler::emitGuardDOMExpandoMissingOrGuardShape()
 {
     ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
     AutoScratchRegister shapeScratch(allocator, masm);
     AutoScratchRegister objScratch(allocator, masm);
     Address shapeAddr(stubAddress(reader.stubOffset()));
 
     FailurePath* failure;
     if (!addFailurePath(&failure))
@@ -692,17 +692,17 @@ BaselineCacheIRCompiler::emitGuardDOMExp
     masm.unboxObject(val, objScratch);
     masm.branchTestObjShape(Assembler::NotEqual, objScratch, shapeScratch, failure->label());
 
     masm.bind(&done);
     return true;
 }
 
 bool
-BaselineCacheIRCompiler::emitGuardDOMExpandoGeneration()
+BaselineCacheIRCompiler::emitLoadDOMExpandoValueGuardGeneration()
 {
     Register obj = allocator.useRegister(masm, reader.objOperandId());
     Address expandoAndGenerationAddr(stubAddress(reader.stubOffset()));
     Address generationAddr(stubAddress(reader.stubOffset()));
 
     AutoScratchRegister scratch(allocator, masm);
     ValueOperand output = allocator.defineValueRegister(masm, reader.valOperandId());
 

--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -48,16 +48,36 @@ EmitLoadSlotResult(CacheIRWriter& writer
     if (holder->isFixedSlot(shape->slot())) {
         writer.loadFixedSlotResult(holderOp, NativeObject::getFixedSlotOffset(shape->slot()));
     } else {
         size_t dynamicSlotOffset = holder->dynamicSlotIndex(shape->slot()) * sizeof(Value);
         writer.loadDynamicSlotResult(holderOp, dynamicSlotOffset);
     }
 }
 
+// DOM proxies
+// -----------
+//
+// DOM proxies are proxies that are used to implement various DOM objects like
+// HTMLDocument and NodeList. DOM proxies may have an expando object - a native
+// object that stores extra properties added to the object. The following
+// CacheIR instructions are only used with DOM proxies:
+//
+// * LoadDOMExpandoValue: returns the Value in the proxy's expando slot. This
+//   returns either an UndefinedValue (no expando), ObjectValue (the expando
+//   object), or PrivateValue(ExpandoAndGeneration*).
+//
+// * LoadDOMExpandoValueGuardGeneration: guards the Value in the proxy's expando
+//   slot is the same PrivateValue(ExpandoAndGeneration*), then guards on its
+//   generation, then returns expandoAndGeneration->expando. This Value is
+//   either an UndefinedValue or ObjectValue.
+//
+// * GuardDOMExpandoMissingOrGuardShape: takes an expando Value as input, then
+//   guards it's either UndefinedValue or an object with the expected shape.
+
 enum class ProxyStubType {
     None,
     DOMShadowed,
     DOMUnshadowed,
     Generic
 };
 
 static ProxyStubType
@@ -560,32 +580,32 @@ CheckDOMProxyExpandoDoesNotShadow(CacheI
 {
     MOZ_ASSERT(IsCacheableDOMProxy(obj));
 
     Value expandoVal = GetProxyExtra(obj, GetDOMProxyExpandoSlot());
 
     ValOperandId expandoId;
     if (!expandoVal.isObject() && !expandoVal.isUndefined()) {
         ExpandoAndGeneration* expandoAndGeneration = (ExpandoAndGeneration*)expandoVal.toPrivate();
-        expandoId = writer.guardDOMExpandoGeneration(objId, expandoAndGeneration,
-                                                     expandoAndGeneration->generation);
+        expandoId = writer.loadDOMExpandoValueGuardGeneration(objId, expandoAndGeneration,
+                                                              expandoAndGeneration->generation);
         expandoVal = expandoAndGeneration->expando;
     } else {
         expandoId = writer.loadDOMExpandoValue(objId);
     }
 
     if (expandoVal.isUndefined()) {
         // Guard there's no expando object.
         writer.guardType(expandoId, JSVAL_TYPE_UNDEFINED);
     } else if (expandoVal.isObject()) {
         // Guard the proxy either has no expando object or, if it has one, that
         // the shape matches the current expando object.
         NativeObject& expandoObj = expandoVal.toObject().as<NativeObject>();
         MOZ_ASSERT(!expandoObj.containsPure(id));
-        writer.guardDOMExpandoObject(expandoId, expandoObj.lastProperty());
+        writer.guardDOMExpandoMissingOrGuardShape(expandoId, expandoObj.lastProperty());
     } else {
         MOZ_CRASH("Invalid expando value");
     }
 }
 
 bool
 GetPropIRGenerator::tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId objId, HandleId id)
 {

--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -157,19 +157,20 @@ enum class CacheKind : uint8_t
     _(GuardNoDenseElements)               \
     _(GuardNoUnboxedExpando)              \
     _(GuardAndLoadUnboxedExpando)         \
     _(GuardAndGetIndexFromString)         \
     _(LoadObject)                         \
     _(LoadProto)                          \
     _(LoadEnclosingEnvironment)           \
                                           \
+    /* See CacheIR.cpp 'DOM proxies' comment. */ \
     _(LoadDOMExpandoValue)                \
-    _(GuardDOMExpandoObject)              \
-    _(GuardDOMExpandoGeneration)          \
+    _(LoadDOMExpandoValueGuardGeneration) \
+    _(GuardDOMExpandoMissingOrGuardShape) \
                                           \
     /* The *Result ops load a value into the cache's result register. */ \
     _(LoadFixedSlotResult)                \
     _(LoadDynamicSlotResult)              \
     _(LoadUnboxedPropertyResult)          \
     _(LoadTypedObjectResult)              \
     _(LoadDenseElementResult)             \
     _(LoadDenseElementHoleResult)         \
@@ -517,26 +518,26 @@ class MOZ_RAII CacheIRWriter : public JS
     }
 
     ValOperandId loadDOMExpandoValue(ObjOperandId obj) {
         ValOperandId res(nextOperandId_++);
         writeOpWithOperandId(CacheOp::LoadDOMExpandoValue, obj);
         writeOperandId(res);
         return res;
     }
-    void guardDOMExpandoObject(ValOperandId expando, Shape* shape) {
-        writeOpWithOperandId(CacheOp::GuardDOMExpandoObject, expando);
+    void guardDOMExpandoMissingOrGuardShape(ValOperandId expando, Shape* shape) {
+        writeOpWithOperandId(CacheOp::GuardDOMExpandoMissingOrGuardShape, expando);
         addStubField(uintptr_t(shape), StubField::Type::Shape);
     }
-    ValOperandId guardDOMExpandoGeneration(ObjOperandId obj,
-                                           ExpandoAndGeneration* expandoAndGeneration,
-                                           uint64_t generation)
+    ValOperandId loadDOMExpandoValueGuardGeneration(ObjOperandId obj,
+                                                    ExpandoAndGeneration* expandoAndGeneration,
+                                                    uint64_t generation)
     {
         ValOperandId res(nextOperandId_++);
-        writeOpWithOperandId(CacheOp::GuardDOMExpandoGeneration, obj);
+        writeOpWithOperandId(CacheOp::LoadDOMExpandoValueGuardGeneration, obj);
         addStubField(uintptr_t(expandoAndGeneration), StubField::Type::RawWord);
         addStubField(generation, StubField::Type::RawInt64);
         writeOperandId(res);
         return res;
     }
 
     void loadUndefinedResult() {
         writeOp(CacheOp::LoadUndefinedResult);

--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -863,17 +863,17 @@ IonCacheIRCompiler::emitLoadObject()
 {
     Register reg = allocator.defineRegister(masm, reader.objOperandId());
     JSObject* obj = objectStubField(reader.stubOffset());
     masm.movePtr(ImmGCPtr(obj), reg);
     return true;
 }
 
 bool
-IonCacheIRCompiler::emitGuardDOMExpandoObject()
+IonCacheIRCompiler::emitGuardDOMExpandoMissingOrGuardShape()
 {
     ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
     Shape* shape = shapeStubField(reader.stubOffset());
 
     AutoScratchRegister objScratch(allocator, masm);
 
     FailurePath* failure;
     if (!addFailurePath(&failure))
@@ -885,17 +885,17 @@ IonCacheIRCompiler::emitGuardDOMExpandoO
     masm.unboxObject(val, objScratch);
     masm.branchTestObjShape(Assembler::NotEqual, objScratch, shape, failure->label());
 
     masm.bind(&done);
     return true;
 }
 
 bool
-IonCacheIRCompiler::emitGuardDOMExpandoGeneration()
+IonCacheIRCompiler::emitLoadDOMExpandoValueGuardGeneration()
 {
     Register obj = allocator.useRegister(masm, reader.objOperandId());
     ExpandoAndGeneration* expandoAndGeneration =
         rawWordStubField<ExpandoAndGeneration*>(reader.stubOffset());
     uint64_t generation = rawInt64StubField<uint64_t>(reader.stubOffset());
 
     AutoScratchRegister scratch(allocator, masm);
     ValueOperand output = allocator.defineValueRegister(masm, reader.valOperandId());