Bug 1317703 - Port Baseline native getter stub to CacheIR. r=h4writer,bz
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 25 Nov 2016 09:19:23 +0100
changeset 324294 629069be312e79f7b50005adf6c68bf446f5064e
parent 324293 70f538269f501ef0a6269966376a2c441f7e0c1e
child 324295 b982373cb0e953976fd45f342910d1d1ea123fbb
child 324311 08cbfe9c9060505ef904b744ada975a65ec9ca73
push id24
push usermaklebus@msu.edu
push dateTue, 20 Dec 2016 03:11:33 +0000
reviewersh4writer, bz
bugs1317703
milestone53.0a1
Bug 1317703 - Port Baseline native getter stub to CacheIR. r=h4writer,bz
js/src/jit/BaselineCacheIR.cpp
js/src/jit/BaselineDebugModeOSR.cpp
js/src/jit/BaselineIC.cpp
js/src/jit/BaselineInspector.cpp
js/src/jit/BaselineInspector.h
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/IonBuilder.cpp
js/src/jit/IonBuilder.h
js/src/jit/IonCaches.cpp
js/src/jit/IonCaches.h
js/src/jit/SharedIC.cpp
js/src/jit/SharedIC.h
js/src/jit/SharedICList.h
--- a/js/src/jit/BaselineCacheIR.cpp
+++ b/js/src/jit/BaselineCacheIR.cpp
@@ -454,17 +454,19 @@ class MOZ_RAII BaselineCacheIRCompiler :
     uint32_t framePushedAtEnterStubFrame_;
 #endif
 
     uint32_t stubDataOffset_;
     bool inStubFrame_;
     bool makesGCCalls_;
 
     void enterStubFrame(MacroAssembler& masm, Register scratch);
-    void leaveStubFrame(MacroAssembler& masm, bool calledIntoIon);
+    void leaveStubFrame(MacroAssembler& masm, bool calledIntoIon = false);
+
+    MOZ_MUST_USE bool callVM(MacroAssembler& masm, const VMFunction& fun);
 
   public:
     BaselineCacheIRCompiler(JSContext* cx, const CacheIRWriter& writer, ICStubEngine engine,
                             uint32_t stubDataOffset)
       : CacheIRCompiler(cx, writer),
         engine_(engine),
 #ifdef DEBUG
         framePushedAtEnterStubFrame_(0),
@@ -551,16 +553,33 @@ BaselineCacheIRCompiler::leaveStubFrame(
 #endif
 
         EmitBaselineLeaveStubFrame(masm, calledIntoIon);
     } else {
         EmitIonLeaveStubFrame(masm);
     }
 }
 
+bool
+BaselineCacheIRCompiler::callVM(MacroAssembler& masm, const VMFunction& fun)
+{
+    MOZ_ASSERT(inStubFrame_);
+
+    JitCode* code = cx_->jitRuntime()->getVMWrapper(fun);
+    if (!code)
+        return false;
+
+    MOZ_ASSERT(fun.expectTailCall == NonTailCall);
+    if (engine_ == ICStubEngine::Baseline)
+        EmitBaselineCallVM(code, masm);
+    else
+        EmitIonCallVM(code, fun.explicitStackSlots(), masm);
+    return true;
+}
+
 JitCode*
 BaselineCacheIRCompiler::compile()
 {
 #ifndef JS_USE_LINK_REGISTER
     // The first value contains the return addres,
     // which we pull into ICTailCallReg for tail calls.
     masm.adjustFrame(sizeof(intptr_t));
 #endif
@@ -971,16 +990,19 @@ BaselineCacheIRCompiler::emitGuardClass(
         clasp = &UnboxedArrayObject::class_;
         break;
       case GuardClassKind::MappedArguments:
         clasp = &MappedArgumentsObject::class_;
         break;
       case GuardClassKind::UnmappedArguments:
         clasp = &UnmappedArgumentsObject::class_;
         break;
+      case GuardClassKind::WindowProxy:
+        clasp = cx_->maybeWindowProxyClass();
+        break;
     }
 
     MOZ_ASSERT(clasp);
     masm.branchTestObjClass(Assembler::NotEqual, obj, scratch, clasp, failure->label());
     return true;
 }
 
 bool
@@ -1120,16 +1142,54 @@ BaselineCacheIRCompiler::emitCallScripte
     masm.callJit(code);
 
     leaveStubFrame(masm, true);
 
     emitEnterTypeMonitorIC();
     return true;
 }
 
+typedef bool (*DoCallNativeGetterFn)(JSContext*, HandleFunction, HandleObject, MutableHandleValue);
+static const VMFunction DoCallNativeGetterInfo =
+    FunctionInfo<DoCallNativeGetterFn>(DoCallNativeGetter, "DoCallNativeGetter");
+
+bool
+BaselineCacheIRCompiler::emitCallNativeGetterResult()
+{
+    // We use ICTailCallReg when entering the stub frame, so ensure it's not
+    // used for something else.
+    Maybe<AutoScratchRegister> tail;
+    if (allocator.isAllocatable(ICTailCallReg))
+        tail.emplace(allocator, masm, ICTailCallReg);
+
+    Register obj = allocator.useRegister(masm, reader.objOperandId());
+    Address getterAddr(stubAddress(reader.stubOffset()));
+
+    AutoScratchRegister scratch(allocator, masm);
+
+    allocator.discardStack(masm);
+
+    // Push a stub frame so that we can perform a non-tail call.
+    enterStubFrame(masm, scratch);
+
+    // Load the callee in the scratch register.
+    masm.loadPtr(getterAddr, scratch);
+
+    masm.Push(obj);
+    masm.Push(scratch);
+
+    if (!callVM(masm, DoCallNativeGetterInfo))
+        return false;
+
+    leaveStubFrame(masm);
+
+    emitEnterTypeMonitorIC();
+    return true;
+}
+
 bool
 BaselineCacheIRCompiler::emitLoadUnboxedPropertyResult()
 {
     Register obj = allocator.useRegister(masm, reader.objOperandId());
     AutoScratchRegister scratch(allocator, masm);
 
     JSValueType fieldType = reader.valueType();
 
--- a/js/src/jit/BaselineDebugModeOSR.cpp
+++ b/js/src/jit/BaselineDebugModeOSR.cpp
@@ -697,17 +697,16 @@ RecompileBaselineScriptForDebugMode(JSCo
     _(Call_ClassHook)                           \
     _(Call_ScriptedApplyArray)                  \
     _(Call_ScriptedApplyArguments)              \
     _(Call_ScriptedFunCall)                     \
     _(GetElem_NativePrototypeCallNativeName)    \
     _(GetElem_NativePrototypeCallNativeSymbol)  \
     _(GetElem_NativePrototypeCallScriptedName)  \
     _(GetElem_NativePrototypeCallScriptedSymbol) \
-    _(GetProp_CallNative)                       \
     _(GetProp_CallNativeGlobal)                 \
     _(GetProp_CallDOMProxyNative)               \
     _(GetProp_CallDOMProxyWithGenerationNative) \
     _(GetProp_DOMProxyShadowed)                 \
     _(GetProp_Generic)                          \
     _(SetProp_CallScripted)                     \
     _(SetProp_CallNative)
 
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3819,17 +3819,16 @@ TryAttachGlobalNameAccessorStub(JSContex
         {
             *attached = true;
             return true;
         }
         ICGetPropCallNativeCompiler compiler(cx, ICStub::GetProp_CallNativeGlobal,
                                              ICStubCompiler::Engine::Baseline,
                                              monitorStub, globalLexical, current,
                                              getter, script->pcToOffset(pc),
-                                             /* outerClass = */ nullptr,
                                              /* inputDefinitelyObject = */ true);
 
         ICStub* newStub = compiler.getStub(compiler.getStubSpace(script));
         if (!newStub)
             return false;
 
         stub->addNewStub(newStub);
         *attached = true;
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -668,27 +668,17 @@ BaselineInspector::templateCallObject()
     MOZ_ASSERT(res);
 
     return &res->as<CallObject>();
 }
 
 static Shape*
 GlobalShapeForGetPropFunction(ICStub* stub)
 {
-    if (stub->isGetProp_CallNative()) {
-        ICGetProp_CallNative* nstub = stub->toGetProp_CallNative();
-        if (nstub->isOwnGetter())
-            return nullptr;
-
-        const HeapReceiverGuard& guard = nstub->receiverGuard();
-        if (Shape* shape = guard.shape()) {
-            if (shape->getObjectClass()->flags & JSCLASS_IS_GLOBAL)
-                return shape;
-        }
-    } else if (stub->isGetProp_CallNativeGlobal()) {
+    if (stub->isGetProp_CallNativeGlobal()) {
         ICGetProp_CallNativeGlobal* nstub = stub->toGetProp_CallNativeGlobal();
         if (nstub->isOwnGetter())
             return nullptr;
 
         Shape* shape = nstub->globalShape();
         MOZ_ASSERT(shape->getObjectClass()->flags & JSCLASS_IS_GLOBAL);
         return shape;
     }
@@ -740,46 +730,73 @@ MatchCacheIRReceiverGuard(CacheIRReader&
     if (!reader.matchOp(CacheOp::GuardShape, expandoId))
         return false;
 
     receiver->shape = stub->stubInfo()->getStubField<Shape*>(stub, reader.stubOffset());
     return true;
 }
 
 static bool
-AddCacheIRGetPropFunction(ICCacheIR_Monitored* stub, JSObject** holder, Shape** holderShape,
+AddCacheIRGetPropFunction(ICCacheIR_Monitored* stub, bool innerized,
+                          JSObject** holder, Shape** holderShape,
                           JSFunction** commonGetter, Shape** globalShape, bool* isOwnProperty,
                           BaselineInspector::ReceiverVector& receivers,
                           BaselineInspector::ObjectGroupVector& convertUnboxedGroups)
 {
     // We match either an own getter:
     //
     //   GuardIsObject objId
+    //   [..WindowProxy innerization..]
     //   <GuardReceiver objId>
-    //   CallScriptedGetterResult objId
+    //   Call(Scripted|Native)GetterResult objId
     //
     // Or a getter on the prototype:
     //
     //   GuardIsObject objId
+    //   [..WindowProxy innerization..]
     //   <GuardReceiver objId>
     //   LoadObject holderId
     //   GuardShape holderId
-    //   CallScriptedGetterResult objId
+    //   Call(Scripted|Native)GetterResult objId
+    //
+    // If |innerized| is true, we replaced a WindowProxy with the Window
+    // object and we're only interested in Baseline getter stubs that performed
+    // the same optimization. This means we expect the following ops for the
+    // [..WindowProxy innerization..] above:
+    //
+    //   GuardClass objId WindowProxy
+    //   objId = LoadObject <global>
 
     CacheIRReader reader(stub->stubInfo());
 
     ObjOperandId objId = ObjOperandId(0);
     if (!reader.matchOp(CacheOp::GuardIsObject, objId))
         return false;
 
+    if (innerized) {
+        if (!reader.matchOp(CacheOp::GuardClass, objId) ||
+            reader.guardClassKind() != GuardClassKind::WindowProxy)
+        {
+            return false;
+        }
+        if (!reader.matchOp(CacheOp::LoadObject))
+            return false;
+        objId = reader.objOperandId();
+        DebugOnly<JSObject*> obj =
+            stub->stubInfo()->getStubField<JSObject*>(stub, reader.stubOffset()).get();
+        MOZ_ASSERT(obj->is<GlobalObject>());
+    }
+
     ReceiverGuard receiver;
     if (!MatchCacheIRReceiverGuard(reader, stub, objId, &receiver))
         return false;
 
-    if (reader.matchOp(CacheOp::CallScriptedGetterResult, objId)) {
+    if (reader.matchOp(CacheOp::CallScriptedGetterResult, objId) ||
+        reader.matchOp(CacheOp::CallNativeGetterResult, objId))
+    {
         // This is an own property getter, the first case.
         MOZ_ASSERT(receiver.shape);
         MOZ_ASSERT(!receiver.group);
 
         size_t offset = reader.stubOffset();
         JSFunction* getter =
             &stub->stubInfo()->getStubField<JSObject*>(stub, offset)->as<JSFunction>();
 
@@ -798,26 +815,39 @@ AddCacheIRGetPropFunction(ICCacheIR_Moni
         return false;
     ObjOperandId holderId = reader.objOperandId();
     JSObject* obj = stub->stubInfo()->getStubField<JSObject*>(stub, reader.stubOffset());
 
     if (!reader.matchOp(CacheOp::GuardShape, holderId))
         return false;
     Shape* objShape = stub->stubInfo()->getStubField<Shape*>(stub, reader.stubOffset());
 
-    if (!reader.matchOp(CacheOp::CallScriptedGetterResult, objId))
+    if (!reader.matchOp(CacheOp::CallScriptedGetterResult, objId) &&
+        !reader.matchOp(CacheOp::CallNativeGetterResult, objId))
+    {
         return false;
+    }
 
     // A getter on the prototype.
     size_t offset = reader.stubOffset();
     JSFunction* getter =
         &stub->stubInfo()->getStubField<JSObject*>(stub, offset)->as<JSFunction>();
 
-    if (*commonGetter && (*isOwnProperty || *globalShape || *holderShape != objShape))
+    Shape* thisGlobalShape = nullptr;
+    if (getter->isNative() && receiver.shape &&
+        (receiver.shape->getObjectClass()->flags & JSCLASS_IS_GLOBAL))
+    {
+        thisGlobalShape = receiver.shape;
+    }
+
+    if (*commonGetter &&
+        (*isOwnProperty || *globalShape != thisGlobalShape || *holderShape != objShape))
+    {
         return false;
+    }
 
     MOZ_ASSERT_IF(*commonGetter, *commonGetter == getter);
 
     if (obj->as<NativeObject>().lastProperty() != objShape) {
         // Skip this stub as the shape is no longer correct.
         return true;
     }
 
@@ -827,36 +857,35 @@ AddCacheIRGetPropFunction(ICCacheIR_Moni
     *holder = obj;
     *holderShape = objShape;
     *commonGetter = getter;
     *isOwnProperty = false;
     return true;
 }
 
 bool
-BaselineInspector::commonGetPropFunction(jsbytecode* pc, JSObject** holder, Shape** holderShape,
+BaselineInspector::commonGetPropFunction(jsbytecode* pc, bool innerized,
+                                         JSObject** holder, Shape** holderShape,
                                          JSFunction** commonGetter, Shape** globalShape,
                                          bool* isOwnProperty,
                                          ReceiverVector& receivers,
                                          ObjectGroupVector& convertUnboxedGroups)
 {
     if (!hasBaselineScript())
         return false;
 
     MOZ_ASSERT(receivers.empty());
     MOZ_ASSERT(convertUnboxedGroups.empty());
 
     *globalShape = nullptr;
     *commonGetter = nullptr;
     const ICEntry& entry = icEntryFromPC(pc);
 
     for (ICStub* stub = entry.firstStub(); stub; stub = stub->next()) {
-        if (stub->isGetProp_CallNative() ||
-            stub->isGetProp_CallNativeGlobal())
-        {
+        if (stub->isGetProp_CallNativeGlobal()) {
             ICGetPropCallGetter* nstub = static_cast<ICGetPropCallGetter*>(stub);
             bool isOwn = nstub->isOwnGetter();
             if (!isOwn && !AddReceiver(nstub->receiverGuard(), receivers, convertUnboxedGroups))
                 return false;
 
             if (!*commonGetter) {
                 *holder = isOwn ? nullptr : nstub->holder().get();
                 *holderShape = nstub->holderShape();
@@ -867,17 +896,18 @@ BaselineInspector::commonGetPropFunction
                        GlobalShapeForGetPropFunction(nstub) != *globalShape ||
                        isOwn != *isOwnProperty)
             {
                 return false;
             } else {
                 MOZ_ASSERT(*commonGetter == nstub->getter());
             }
         } else if (stub->isCacheIR_Monitored()) {
-            if (!AddCacheIRGetPropFunction(stub->toCacheIR_Monitored(), holder, holderShape,
+            if (!AddCacheIRGetPropFunction(stub->toCacheIR_Monitored(), innerized,
+                                           holder, holderShape,
                                            commonGetter, globalShape, isOwnProperty, receivers,
                                            convertUnboxedGroups))
             {
                 return false;
             }
         } else if (stub->isGetProp_Fallback()) {
             // If we have an unoptimizable access, don't try to optimize.
             if (stub->toGetProp_Fallback()->hadUnoptimizableAccess())
@@ -984,17 +1014,16 @@ BaselineInspector::expectedPropertyAcces
           case ICStub::GetProp_Generic:
             return MIRType::Value;
 
           case ICStub::GetProp_ArgumentsLength:
           case ICStub::GetElem_Arguments:
             // Either an object or magic arguments.
             return MIRType::Value;
 
-          case ICStub::GetProp_CallNative:
           case ICStub::GetProp_CallDOMProxyNative:
           case ICStub::GetProp_CallDOMProxyWithGenerationNative:
           case ICStub::GetProp_DOMProxyShadowed:
           case ICStub::GetElem_NativeSlotName:
           case ICStub::GetElem_NativeSlotSymbol:
           case ICStub::GetElem_NativePrototypeSlotName:
           case ICStub::GetElem_NativePrototypeSlotSymbol:
           case ICStub::GetElem_NativePrototypeCallNativeName:
--- a/js/src/jit/BaselineInspector.h
+++ b/js/src/jit/BaselineInspector.h
@@ -124,20 +124,26 @@ class BaselineInspector
     // object itself isn't.
     ObjectGroup* getTemplateObjectGroup(jsbytecode* pc);
 
     JSFunction* getSingleCallee(jsbytecode* pc);
 
     LexicalEnvironmentObject* templateNamedLambdaObject();
     CallObject* templateCallObject();
 
-    MOZ_MUST_USE bool commonGetPropFunction(jsbytecode* pc, JSObject** holder, Shape** holderShape,
+    // If |innerized| is true, we're doing a GETPROP on a WindowProxy and
+    // IonBuilder unwrapped/innerized it to do the lookup on the Window (the
+    // global object) instead. In this case we should only look for Baseline
+    // stubs that performed the same optimization.
+    MOZ_MUST_USE bool commonGetPropFunction(jsbytecode* pc, bool innerized,
+                                            JSObject** holder, Shape** holderShape,
                                             JSFunction** commonGetter, Shape** globalShape,
                                             bool* isOwnProperty, ReceiverVector& receivers,
                                             ObjectGroupVector& convertUnboxedGroups);
+
     MOZ_MUST_USE bool commonSetPropFunction(jsbytecode* pc, JSObject** holder, Shape** holderShape,
                                             JSFunction** commonSetter, bool* isOwnProperty,
                                             ReceiverVector& receivers,
                                             ObjectGroupVector& convertUnboxedGroups);
 
     MOZ_MUST_USE bool instanceOfData(jsbytecode* pc, Shape** shape, uint32_t* slot,
                                      JSObject** prototypeObject);
 };
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -67,16 +67,18 @@ GetPropIRGenerator::tryAttachStub(Maybe<
         if (!emitted_ && !tryAttachUnboxed(*writer, obj, objId))
             return false;
         if (!emitted_ && !tryAttachUnboxedExpando(*writer, obj, objId))
             return false;
         if (!emitted_ && !tryAttachTypedObject(*writer, obj, objId))
             return false;
         if (!emitted_ && !tryAttachModuleNamespace(*writer, obj, objId))
             return false;
+        if (!emitted_ && !tryAttachWindowProxy(*writer, obj, objId))
+            return false;
         return true;
     }
 
     if (!emitted_ && !tryAttachPrimitive(*writer, valId))
         return false;
 
     return true;
 }
@@ -132,16 +134,19 @@ CanAttachNativeGetProp(JSContext* cx, Ha
     }
 
     if (IsCacheableGetPropCallScripted(obj, holder, shape, isTemporarilyUnoptimizable)) {
         // See bug 1226816.
         if (engine == ICStubEngine::Baseline)
             return CanAttachCallGetter;
     }
 
+    if (IsCacheableGetPropCallNative(obj, holder, shape))
+        return CanAttachCallGetter;
+
     return CanAttachNone;
 }
 
 static void
 GeneratePrototypeGuards(CacheIRWriter& writer, JSObject* obj, JSObject* holder, ObjOperandId objId)
 {
     // The guards here protect against the effects of JSObject::swap(). If the
     // prototype chain is directly altered, then TI will toss the jitcode, so we
@@ -250,16 +255,23 @@ EmitCallGetterResult(CacheIRWriter& writ
     if (obj != holder) {
         GeneratePrototypeGuards(writer, obj, holder, objId);
 
         // Guard on the holder's shape.
         ObjOperandId holderId = writer.loadObject(holder);
         writer.guardShape(holderId, holder->as<NativeObject>().lastProperty());
     }
 
+    if (IsCacheableGetPropCallNative(obj, holder, shape)) {
+        JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
+        MOZ_ASSERT(target->isNative());
+        writer.callNativeGetterResult(objId, target);
+        return;
+    }
+
     MOZ_ASSERT(IsCacheableGetPropCallScripted(obj, holder, shape));
 
     JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
     MOZ_ASSERT(target->hasJITCode());
     writer.callScriptedGetterResult(objId, target);
 }
 
 bool
@@ -298,16 +310,65 @@ GetPropIRGenerator::tryAttachNative(Cach
       default:
         MOZ_CRASH("Bad NativeGetPropCacheability");
     }
 
     return true;
 }
 
 bool
+GetPropIRGenerator::tryAttachWindowProxy(CacheIRWriter& writer, HandleObject obj,
+                                         ObjOperandId objId)
+{
+    // Attach a stub when the receiver is a WindowProxy and we are calling some
+    // kinds of JSNative getters on the Window object (the global object).
+
+    MOZ_ASSERT(!emitted_);
+
+    if (!IsWindowProxy(obj))
+        return true;
+
+    // This must be a WindowProxy for the current Window/global. Else it would
+    // be a cross-compartment wrapper and IsWindowProxy returns false for
+    // those.
+    MOZ_ASSERT(obj->getClass() == cx_->maybeWindowProxyClass());
+    MOZ_ASSERT(ToWindowIfWindowProxy(obj) == cx_->global());
+
+    // Now try to do the lookup on the Window (the current global) and see if
+    // it's a native getter.
+    HandleObject windowObj = cx_->global();
+    RootedShape shape(cx_);
+    RootedNativeObject holder(cx_);
+    RootedId id(cx_, NameToId(name_));
+    NativeGetPropCacheability type = CanAttachNativeGetProp(cx_, windowObj, id, &holder, &shape, pc_,
+                                                            engine_, isTemporarilyUnoptimizable_);
+    if (type != CanAttachCallGetter ||
+        !IsCacheableGetPropCallNative(windowObj, holder, shape))
+    {
+        return true;
+    }
+
+    // Make sure the native getter is okay with the IC passing the Window
+    // instead of the WindowProxy as |this| value.
+    JSFunction* callee = &shape->getterObject()->as<JSFunction>();
+    MOZ_ASSERT(callee->isNative());
+    if (!callee->jitInfo() || callee->jitInfo()->needsOuterizedThisObject())
+        return true;
+
+    emitted_ = true;
+
+    // Guard the incoming object is a WindowProxy and inline a getter call based
+    // on the Window object.
+    writer.guardClass(objId, GuardClassKind::WindowProxy);
+    ObjOperandId windowObjId = writer.loadObject(windowObj);
+    EmitCallGetterResult(writer, windowObj, holder, shape, windowObjId);
+    return true;
+}
+
+bool
 GetPropIRGenerator::tryAttachUnboxed(CacheIRWriter& writer, HandleObject obj, ObjOperandId objId)
 {
     MOZ_ASSERT(!emitted_);
 
     if (!obj->is<UnboxedPlainObject>())
         return true;
 
     const UnboxedLayout::Property* property = obj->as<UnboxedPlainObject>().layout().lookup(name_);
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -96,16 +96,17 @@ class ObjOperandId : public OperandId
     _(LoadFixedSlotResult)                \
     _(LoadDynamicSlotResult)              \
     _(LoadUnboxedPropertyResult)          \
     _(LoadTypedObjectResult)              \
     _(LoadInt32ArrayLengthResult)         \
     _(LoadUnboxedArrayLengthResult)       \
     _(LoadArgumentsObjectLengthResult)    \
     _(CallScriptedGetterResult)           \
+    _(CallNativeGetterResult)             \
     _(LoadUndefinedResult)
 
 enum class CacheOp {
 #define DEFINE_OP(op) op,
     CACHE_IR_OPS(DEFINE_OP)
 #undef DEFINE_OP
 };
 
@@ -123,22 +124,23 @@ struct StubField {
 
     StubField(uintptr_t word, GCType gcType)
       : word(word), gcType(gcType)
     {}
 };
 
 // We use this enum as GuardClass operand, instead of storing Class* pointers
 // in the IR, to keep the IR compact and the same size on all platforms.
-enum class GuardClassKind
+enum class GuardClassKind : uint8_t
 {
     Array,
     UnboxedArray,
     MappedArguments,
     UnmappedArguments,
+    WindowProxy,
 };
 
 // Class to record CacheIR + some additional metadata for code generation.
 class MOZ_RAII CacheIRWriter
 {
     CompactBufferWriter buffer_;
 
     uint32_t nextOperandId_;
@@ -263,17 +265,18 @@ class MOZ_RAII CacheIRWriter
         writeOpWithOperandId(CacheOp::GuardGroup, obj);
         addStubWord(uintptr_t(group), StubField::GCType::ObjectGroup);
     }
     void guardProto(ObjOperandId obj, JSObject* proto) {
         writeOpWithOperandId(CacheOp::GuardProto, obj);
         addStubWord(uintptr_t(proto), StubField::GCType::JSObject);
     }
     void guardClass(ObjOperandId obj, GuardClassKind kind) {
-        MOZ_ASSERT(uint32_t(kind) <= UINT8_MAX);
+        static_assert(sizeof(GuardClassKind) == sizeof(uint8_t),
+                      "GuardClassKind must fit in a byte");
         writeOpWithOperandId(CacheOp::GuardClass, obj);
         buffer_.writeByte(uint32_t(kind));
     }
     void guardSpecificObject(ObjOperandId obj, JSObject* expected) {
         writeOpWithOperandId(CacheOp::GuardSpecificObject, obj);
         addStubWord(uintptr_t(expected), StubField::GCType::JSObject);
     }
     void guardNoDetachedTypedObjects() {
@@ -335,16 +338,20 @@ class MOZ_RAII CacheIRWriter
     }
     void loadArgumentsObjectLengthResult(ObjOperandId obj) {
         writeOpWithOperandId(CacheOp::LoadArgumentsObjectLengthResult, obj);
     }
     void callScriptedGetterResult(ObjOperandId obj, JSFunction* getter) {
         writeOpWithOperandId(CacheOp::CallScriptedGetterResult, obj);
         addStubWord(uintptr_t(getter), StubField::GCType::JSObject);
     }
+    void callNativeGetterResult(ObjOperandId obj, JSFunction* getter) {
+        writeOpWithOperandId(CacheOp::CallNativeGetterResult, obj);
+        addStubWord(uintptr_t(getter), StubField::GCType::JSObject);
+    }
 };
 
 class CacheIRStubInfo;
 
 // Helper class for reading CacheIR bytecode.
 class MOZ_RAII CacheIRReader
 {
     CompactBufferReader buffer_;
@@ -424,16 +431,18 @@ class MOZ_RAII GetPropIRGenerator
     MOZ_MUST_USE bool tryAttachUnboxedExpando(CacheIRWriter& writer, HandleObject obj,
                                               ObjOperandId objId);
     MOZ_MUST_USE bool tryAttachTypedObject(CacheIRWriter& writer, HandleObject obj,
                                            ObjOperandId objId);
     MOZ_MUST_USE bool tryAttachObjectLength(CacheIRWriter& writer, HandleObject obj,
                                             ObjOperandId objId);
     MOZ_MUST_USE bool tryAttachModuleNamespace(CacheIRWriter& writer, HandleObject obj,
                                                ObjOperandId objId);
+    MOZ_MUST_USE bool tryAttachWindowProxy(CacheIRWriter& writer, HandleObject obj,
+                                           ObjOperandId objId);
 
     MOZ_MUST_USE bool tryAttachPrimitive(CacheIRWriter& writer, ValOperandId valId);
 
     GetPropIRGenerator(const GetPropIRGenerator&) = delete;
     GetPropIRGenerator& operator=(const GetPropIRGenerator&) = delete;
 
   public:
     GetPropIRGenerator(JSContext* cx, jsbytecode* pc, ICStubEngine engine,
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12155,28 +12155,28 @@ IonBuilder::addShapeGuardsForGetterSette
     MDefinition* holderDef = constant(ObjectValue(*holder));
     addShapeGuard(holderDef, holderShape, Bailout_ShapeGuard);
 
     return addGuardReceiverPolymorphic(obj, receivers);
 }
 
 bool
 IonBuilder::getPropTryCommonGetter(bool* emitted, MDefinition* obj, PropertyName* name,
-                                   TemporaryTypeSet* types)
+                                   TemporaryTypeSet* types, bool innerized)
 {
     MOZ_ASSERT(*emitted == false);
 
     Shape* lastProperty = nullptr;
     JSFunction* commonGetter = nullptr;
     Shape* globalShape = nullptr;
     JSObject* foundProto = nullptr;
     bool isOwnProperty = false;
     BaselineInspector::ReceiverVector receivers(alloc());
     BaselineInspector::ObjectGroupVector convertUnboxedGroups(alloc());
-    if (!inspector->commonGetPropFunction(pc, &foundProto, &lastProperty, &commonGetter,
+    if (!inspector->commonGetPropFunction(pc, innerized, &foundProto, &lastProperty, &commonGetter,
                                           &globalShape, &isOwnProperty,
                                           receivers, convertUnboxedGroups))
     {
         return true;
     }
 
     TemporaryTypeSet* objTypes = obj->resultTypeSet();
     MDefinition* guard = nullptr;
@@ -12647,18 +12647,21 @@ IonBuilder::getPropTryInnerize(bool* emi
         if (!getPropTryConstant(emitted, inner, NameToId(name), types) || *emitted)
             return *emitted;
 
         trackOptimizationAttempt(TrackedStrategy::GetProp_StaticName);
         if (!getStaticName(&script()->global(), name, emitted) || *emitted)
             return *emitted;
 
         trackOptimizationAttempt(TrackedStrategy::GetProp_CommonGetter);
-        if (!getPropTryCommonGetter(emitted, inner, name, types) || *emitted)
+        if (!getPropTryCommonGetter(emitted, inner, name, types, /* innerized = */true) ||
+            *emitted)
+        {
             return *emitted;
+        }
     }
 
     // Passing the inner object to GetProperty IC is safe, see the
     // needsOuterizedThisObject check in IsCacheableGetPropCallNative.
     BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
                                                        inner, name, types);
     trackOptimizationAttempt(TrackedStrategy::GetProp_InlineCache);
     if (!getPropTryCache(emitted, inner, name, barrier, types) || *emitted)
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -439,17 +439,17 @@ class IonBuilder
                                            TemporaryTypeSet* types);
     MOZ_MUST_USE bool getPropTryDefiniteSlot(bool* emitted, MDefinition* obj, PropertyName* name,
                                              BarrierKind barrier, TemporaryTypeSet* types);
     MOZ_MUST_USE bool getPropTryModuleNamespace(bool* emitted, MDefinition* obj, PropertyName* name,
                                                 BarrierKind barrier, TemporaryTypeSet* types);
     MOZ_MUST_USE bool getPropTryUnboxed(bool* emitted, MDefinition* obj, PropertyName* name,
                                         BarrierKind barrier, TemporaryTypeSet* types);
     MOZ_MUST_USE bool getPropTryCommonGetter(bool* emitted, MDefinition* obj, PropertyName* name,
-                                             TemporaryTypeSet* types);
+                                             TemporaryTypeSet* types, bool innerized = false);
     MOZ_MUST_USE bool getPropTryInlineAccess(bool* emitted, MDefinition* obj, PropertyName* name,
                                              BarrierKind barrier, TemporaryTypeSet* types);
     MOZ_MUST_USE bool getPropTryTypedObject(bool* emitted, MDefinition* obj, PropertyName* name);
     MOZ_MUST_USE bool getPropTryScalarPropOfTypedObject(bool* emitted, MDefinition* typedObj,
                                                         int32_t fieldOffset,
                                                         TypedObjectPrediction fieldTypeReprs);
     MOZ_MUST_USE bool getPropTryReferencePropOfTypedObject(bool* emitted, MDefinition* typedObj,
                                                            int32_t fieldOffset,
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -550,18 +550,18 @@ IsOptimizableArgumentsObjectForGetElem(J
 
     int32_t idint = idval.toInt32();
     if (idint < 0 || static_cast<uint32_t>(idint) >= argsObj.initialLength())
         return false;
 
     return true;
 }
 
-static bool
-IsCacheableGetPropCallNative(JSObject* obj, JSObject* holder, Shape* shape)
+bool
+jit::IsCacheableGetPropCallNative(JSObject* obj, JSObject* holder, Shape* shape)
 {
     if (!shape || !IsCacheableProtoChainForIonOrCacheIR(obj, holder))
         return false;
 
     if (!shape->hasGetterValue() || !shape->getterValue().isObject())
         return false;
 
     if (!shape->getterValue().toObject().is<JSFunction>())
--- a/js/src/jit/IonCaches.h
+++ b/js/src/jit/IonCaches.h
@@ -839,13 +839,14 @@ class NameIC : public IonCache
 IONCACHE_KIND_LIST(CACHE_CASTS)
 #undef OPCODE_CASTS
 
 bool IsCacheableProtoChainForIonOrCacheIR(JSObject* obj, JSObject* holder);
 bool IsCacheableGetPropReadSlotForIonOrCacheIR(JSObject* obj, JSObject* holder, Shape* shape);
 
 bool IsCacheableGetPropCallScripted(JSObject* obj, JSObject* holder, Shape* shape,
                                     bool* isTemporarilyUnoptimizable = nullptr);
+bool IsCacheableGetPropCallNative(JSObject* obj, JSObject* holder, Shape* shape);
 
 } // namespace jit
 } // namespace js
 
 #endif /* jit_IonCaches_h */
--- a/js/src/jit/SharedIC.cpp
+++ b/js/src/jit/SharedIC.cpp
@@ -179,17 +179,16 @@ ICStub::NonCacheIRStubMakesGCCalls(Kind 
       case GetElem_NativeSlotSymbol:
       case GetElem_NativePrototypeSlotName:
       case GetElem_NativePrototypeSlotSymbol:
       case GetElem_NativePrototypeCallNativeName:
       case GetElem_NativePrototypeCallNativeSymbol:
       case GetElem_NativePrototypeCallScriptedName:
       case GetElem_NativePrototypeCallScriptedSymbol:
       case GetElem_UnboxedPropertyName:
-      case GetProp_CallNative:
       case GetProp_CallNativeGlobal:
       case GetProp_CallDOMProxyNative:
       case GetProp_CallDOMProxyWithGenerationNative:
       case GetProp_DOMProxyShadowed:
       case GetProp_Generic:
       case SetProp_CallScripted:
       case SetProp_CallNative:
       case RetSub_Fallback:
@@ -482,24 +481,16 @@ ICStub::trace(JSTracer* trc)
         break;
       }
       case ICStub::GetProp_DOMProxyShadowed: {
         ICGetProp_DOMProxyShadowed* propStub = toGetProp_DOMProxyShadowed();
         TraceEdge(trc, &propStub->shape(), "baseline-getproplistbaseshadowed-stub-shape");
         TraceEdge(trc, &propStub->name(), "baseline-getproplistbaseshadowed-stub-name");
         break;
       }
-      case ICStub::GetProp_CallNative: {
-        ICGetProp_CallNative* callStub = toGetProp_CallNative();
-        callStub->receiverGuard().trace(trc);
-        TraceEdge(trc, &callStub->holder(), "baseline-getpropcallnative-stub-holder");
-        TraceEdge(trc, &callStub->holderShape(), "baseline-getpropcallnative-stub-holdershape");
-        TraceEdge(trc, &callStub->getter(), "baseline-getpropcallnative-stub-getter");
-        break;
-      }
       case ICStub::GetProp_CallNativeGlobal: {
         ICGetProp_CallNativeGlobal* callStub = toGetProp_CallNativeGlobal();
         callStub->receiverGuard().trace(trc);
         TraceEdge(trc, &callStub->holder(), "baseline-getpropcallnativeglobal-stub-holder");
         TraceEdge(trc, &callStub->holderShape(), "baseline-getpropcallnativeglobal-stub-holdershape");
         TraceEdge(trc, &callStub->globalShape(), "baseline-getpropcallnativeglobal-stub-globalshape");
         TraceEdge(trc, &callStub->getter(), "baseline-getpropcallnativeglobal-stub-getter");
         break;
@@ -2385,18 +2376,17 @@ IsCacheableGetPropCall(JSContext* cx, JS
 // If 'getter' is an own property, holder == receiver must be true.
 bool
 UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub,
                                ICStub::Kind kind,
                                HandleNativeObject holder,
                                HandleObject receiver,
                                HandleFunction getter)
 {
-    MOZ_ASSERT(kind == ICStub::GetProp_CallNative ||
-               kind == ICStub::GetProp_CallNativeGlobal);
+    MOZ_ASSERT(kind == ICStub::GetProp_CallNativeGlobal);
     MOZ_ASSERT(fallbackStub->isGetName_Fallback() ||
                fallbackStub->isGetProp_Fallback());
     MOZ_ASSERT(holder);
     MOZ_ASSERT(receiver);
 
     bool isOwnGetter = (holder == receiver);
     bool foundMatchingStub = false;
     ReceiverGuard receiverGuard(receiver);
@@ -2485,53 +2475,29 @@ TryAttachNativeGetAccessorPropStub(JSCon
         ICStub* newStub = compiler.getStub(compiler.getStubSpace(info->outerScript(cx)));
         if (!newStub)
             return false;
         stub->addNewStub(newStub);
         *attached = true;
         return true;
     }
 
-    const Class* outerClass = nullptr;
-    if (!isDOMProxy && !obj->isNative()) {
-        outerClass = obj->getClass();
-        if (!IsWindowProxy(obj))
-            return true;
-
-        // This must be a WindowProxy for the current Window/global. Else it'd
-        // be a cross-compartment wrapper and IsWindowProxy returns false for
-        // those.
-        MOZ_ASSERT(ToWindowIfWindowProxy(obj) == cx->global());
-        obj = cx->global();
-
-        if (!EffectlesslyLookupProperty(cx, obj, id, &holder, &shape, &isDOMProxy,
-                                        &domProxyShadowsResult, &domProxyHasGeneration))
-        {
-            return false;
-        }
-        cacheableCall = IsCacheableGetPropCall(cx, obj, holder, shape, &isScripted,
-                                               isTemporarilyUnoptimizable, isDOMProxy);
-    }
-
     // Try handling JSNative getters.
     if (!cacheableCall || isScripted)
         return true;
 
     if (!shape || !shape->hasGetterValue() || !shape->getterValue().isObject() ||
         !shape->getterObject()->is<JSFunction>())
     {
         return true;
     }
 
     RootedFunction callee(cx, &shape->getterObject()->as<JSFunction>());
     MOZ_ASSERT(callee->isNative());
 
-    if (outerClass && (!callee->jitInfo() || callee->jitInfo()->needsOuterizedThisObject()))
-        return true;
-
     JitSpew(JitSpew_BaselineIC, "  Generating GetProp(%s%s/NativeGetter %p) stub",
             isDOMProxy ? "DOMProxyObj" : "NativeObj",
             isDOMProxy && domProxyHasGeneration ? "WithGeneration" : "",
             callee->native());
 
     ICStub* newStub = nullptr;
     if (isDOMProxy) {
         MOZ_ASSERT(obj != holder);
@@ -2545,27 +2511,17 @@ TryAttachNativeGetAccessorPropStub(JSCon
         } else {
             kind = ICStub::GetProp_CallDOMProxyNative;
         }
         Rooted<ProxyObject*> proxy(cx, &obj->as<ProxyObject>());
         ICGetPropCallDOMProxyNativeCompiler compiler(cx, kind, info->engine(), monitorStub, proxy, holder,
                                                      callee, info->pcOffset());
         newStub = compiler.getStub(compiler.getStubSpace(info->outerScript(cx)));
     } else {
-        if (UpdateExistingGetPropCallStubs(stub, ICStub::GetProp_CallNative,
-                                           holder.as<NativeObject>(), obj, callee))
-        {
-            *attached = true;
-            return true;
-        }
-
-        ICGetPropCallNativeCompiler compiler(cx, ICStub::GetProp_CallNative, info->engine(),
-                                             monitorStub, obj, holder, callee,
-                                             info->pcOffset(), outerClass);
-        newStub = compiler.getStub(compiler.getStubSpace(info->outerScript(cx)));
+        return true;
     }
     if (!newStub)
         return false;
     stub->addNewStub(newStub);
     *attached = true;
     return true;
 }
 
@@ -3009,29 +2965,22 @@ static const VMFunction DoCallNativeGett
 bool
 ICGetPropCallNativeCompiler::generateStubCode(MacroAssembler& masm)
 {
     Label failure;
 
     AllocatableGeneralRegisterSet regs(availableGeneralRegs(1));
     Register objReg = InvalidReg;
 
-    MOZ_ASSERT(!(inputDefinitelyObject_ && outerClass_));
     if (inputDefinitelyObject_) {
         objReg = R0.scratchReg();
     } else {
         // Guard input is an object and unbox.
         masm.branchTestObject(Assembler::NotEqual, R0, &failure);
         objReg = masm.extractObject(R0, ExtractTemp0);
-        if (outerClass_) {
-            Register tmp = regs.takeAny();
-            masm.branchTestObjClass(Assembler::NotEqual, objReg, tmp, outerClass_, &failure);
-            masm.movePtr(ImmGCPtr(cx->global()), objReg);
-            regs.add(tmp);
-        }
     }
 
     Register scratch = regs.takeAnyExcluding(ICTailCallReg);
 
     // Shape guard.
     GuardReceiverObject(masm, ReceiverGuard(receiver_), objReg, scratch,
                         ICGetPropCallGetter::offsetOfReceiverGuard(), &failure);
 
@@ -3099,21 +3048,16 @@ ICGetPropCallNativeCompiler::generateStu
 
 ICStub*
 ICGetPropCallNativeCompiler::getStub(ICStubSpace* space)
 {
     ReceiverGuard guard(receiver_);
     Shape* holderShape = holder_->as<NativeObject>().lastProperty();
 
     switch (kind) {
-      case ICStub::GetProp_CallNative:
-        return newStub<ICGetProp_CallNative>(space, getStubCode(), firstMonitorStub_,
-                                             guard, holder_, holderShape,
-                                             getter_, pcOffset_);
-
       case ICStub::GetProp_CallNativeGlobal: {
         Shape* globalShape = receiver_->as<LexicalEnvironmentObject>().global().lastProperty();
         return newStub<ICGetProp_CallNativeGlobal>(space, getStubCode(), firstMonitorStub_,
                                                    guard, holder_, holderShape, globalShape,
                                                    getter_, pcOffset_);
       }
 
       default:
@@ -3552,31 +3496,21 @@ ICGetPropCallGetter::ICGetPropCallGetter
                                          uint32_t pcOffset)
   : ICMonitoredStub(kind, stubCode, firstMonitorStub),
     receiverGuard_(receiverGuard),
     holder_(holder),
     holderShape_(holderShape),
     getter_(getter),
     pcOffset_(pcOffset)
 {
-    MOZ_ASSERT(kind == ICStub::GetProp_CallNative    ||
-               kind == ICStub::GetProp_CallNativeGlobal ||
+    MOZ_ASSERT(kind == ICStub::GetProp_CallNativeGlobal ||
                kind == ICStub::GetProp_CallDOMProxyNative ||
                kind == ICStub::GetProp_CallDOMProxyWithGenerationNative);
 }
 
-/* static */ ICGetProp_CallNative*
-ICGetProp_CallNative::Clone(JSContext* cx, ICStubSpace* space, ICStub* firstMonitorStub,
-                            ICGetProp_CallNative& other)
-{
-    return New<ICGetProp_CallNative>(cx, space, other.jitCode(), firstMonitorStub,
-                                     other.receiverGuard(), other.holder_,
-                                     other.holderShape_, other.getter_, other.pcOffset_);
-}
-
 /* static */ ICGetProp_CallNativeGlobal*
 ICGetProp_CallNativeGlobal::Clone(JSContext* cx, ICStubSpace* space, ICStub* firstMonitorStub,
                             ICGetProp_CallNativeGlobal& other)
 {
     return New<ICGetProp_CallNativeGlobal>(cx, space, other.jitCode(), firstMonitorStub,
                                            other.receiverGuard(), other.holder_,
                                            other.holderShape_, other.globalShape_,
                                            other.getter_, other.pcOffset_);
--- a/js/src/jit/SharedIC.h
+++ b/js/src/jit/SharedIC.h
@@ -2600,67 +2600,42 @@ class ICGetPropCallGetter : public ICMon
 
     class Compiler : public ICStubCompiler {
       protected:
         ICStub* firstMonitorStub_;
         RootedObject receiver_;
         RootedObject holder_;
         RootedFunction getter_;
         uint32_t pcOffset_;
-        const Class* outerClass_;
 
         virtual int32_t getKey() const {
             // ICGetPropCallNativeCompiler::getKey adds more bits to our
             // return value, so be careful when making changes here.
             return static_cast<int32_t>(engine_) |
                   (static_cast<int32_t>(kind) << 1) |
                   (HeapReceiverGuard::keyBits(receiver_) << 17) |
-                  (static_cast<int32_t>(!!outerClass_) << 19) |
-                  (static_cast<int32_t>(receiver_ != holder_) << 20);
+                  (static_cast<int32_t>(receiver_ != holder_) << 19);
         }
 
       public:
         Compiler(JSContext* cx, ICStub::Kind kind, Engine engine, ICStub* firstMonitorStub,
                  HandleObject receiver, HandleObject holder, HandleFunction getter,
-                 uint32_t pcOffset, const Class* outerClass)
+                 uint32_t pcOffset)
           : ICStubCompiler(cx, kind, engine),
             firstMonitorStub_(firstMonitorStub),
             receiver_(cx, receiver),
             holder_(cx, holder),
             getter_(cx, getter),
-            pcOffset_(pcOffset),
-            outerClass_(outerClass)
+            pcOffset_(pcOffset)
         {
-            MOZ_ASSERT(kind == ICStub::GetProp_CallNative ||
-                       kind == ICStub::GetProp_CallNativeGlobal);
+            MOZ_ASSERT(kind == ICStub::GetProp_CallNativeGlobal);
         }
     };
 };
 
-// Stub for calling a native getter on a native object.
-class ICGetProp_CallNative : public ICGetPropCallGetter
-{
-    friend class ICStubSpace;
-
-  protected:
-
-    ICGetProp_CallNative(JitCode* stubCode, ICStub* firstMonitorStub,
-                         ReceiverGuard receiverGuard,
-                         JSObject* holder, Shape* holderShape,
-                         JSFunction* getter, uint32_t pcOffset)
-      : ICGetPropCallGetter(GetProp_CallNative, stubCode, firstMonitorStub,
-                            receiverGuard, holder, holderShape, getter, pcOffset)
-    {}
-
-  public:
-    static ICGetProp_CallNative* Clone(JSContext* cx, ICStubSpace* space, ICStub* firstMonitorStub,
-                                       ICGetProp_CallNative& other);
-
-};
-
 // Stub for calling a native getter on the GlobalObject.
 class ICGetProp_CallNativeGlobal : public ICGetPropCallGetter
 {
     friend class ICStubSpace;
 
   protected:
     GCPtrShape globalShape_;
 
@@ -2697,19 +2672,19 @@ class ICGetPropCallNativeCompiler : publ
         MOZ_ASSERT((baseKey >> 21) == 0);
         return baseKey | (static_cast<int32_t>(inputDefinitelyObject_) << 21);
     }
 
   public:
     ICGetPropCallNativeCompiler(JSContext* cx, ICStub::Kind kind, ICStubCompiler::Engine engine,
                                 ICStub* firstMonitorStub, HandleObject receiver,
                                 HandleObject holder, HandleFunction getter, uint32_t pcOffset,
-                                const Class* outerClass, bool inputDefinitelyObject = false)
+                                bool inputDefinitelyObject = false)
       : ICGetPropCallGetter::Compiler(cx, kind, engine, firstMonitorStub, receiver, holder,
-                                      getter, pcOffset, outerClass),
+                                      getter, pcOffset),
         inputDefinitelyObject_(inputDefinitelyObject)
     {}
 
     ICStub* getStub(ICStubSpace* space);
 };
 
 class ICGetPropCallDOMProxyNativeStub : public ICGetPropCallGetter
 {
@@ -2861,17 +2836,17 @@ class ICGetProp_DOMProxyShadowed : publi
         RootedPropertyName name_;
         uint32_t pcOffset_;
 
         MOZ_MUST_USE bool generateStubCode(MacroAssembler& masm);
 
       public:
         Compiler(JSContext* cx, Engine engine, ICStub* firstMonitorStub, Handle<ProxyObject*> proxy,
                  HandlePropertyName name, uint32_t pcOffset)
-          : ICStubCompiler(cx, ICStub::GetProp_CallNative, engine),
+          : ICStubCompiler(cx, ICStub::GetProp_DOMProxyShadowed, engine),
             firstMonitorStub_(firstMonitorStub),
             proxy_(cx, proxy),
             name_(cx, name),
             pcOffset_(pcOffset)
         {}
 
         ICStub* getStub(ICStubSpace* space);
     };
--- a/js/src/jit/SharedICList.h
+++ b/js/src/jit/SharedICList.h
@@ -31,17 +31,16 @@ namespace jit {
     _(Compare_String)                            \
     _(Compare_Boolean)                           \
     _(Compare_Object)                            \
     _(Compare_ObjectWithUndefined)               \
     _(Compare_Int32WithBoolean)                  \
                                                  \
     _(GetProp_Fallback)                          \
     _(GetProp_StringLength)                      \
-    _(GetProp_CallNative)                        \
     _(GetProp_CallNativeGlobal)                  \
     _(GetProp_CallDOMProxyNative)                \
     _(GetProp_CallDOMProxyWithGenerationNative)  \
     _(GetProp_DOMProxyShadowed)                  \
     _(GetProp_ArgumentsLength)                   \
     _(GetProp_ArgumentsCallee)                   \
     _(GetProp_Generic)                           \
                                                  \