diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 37902e0040d6..89ea0944c085 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -325,7 +325,7 @@ BacktrackingAllocator::groupAndQueueRegisters()
         for (size_t j = 0; j < block->numPhis(); j++) {
             LPhi *phi = block->getPhi(j);
             uint32_t output = phi->getDef(0)->virtualRegister();
-            for (size_t k = 0; k < phi->numOperands(); k++) {
+            for (size_t k = 0, kend = phi->numOperands(); k < kend; k++) {
                 uint32_t input = phi->getOperand(k)->toUse()->virtualRegister();
                 if (!tryGroupRegisters(input, output))
                     return false;
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 879355def98e..f76641aa770b 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -5587,13 +5587,11 @@ class MPhi;
 // corresponding to the predecessor taken in the control flow graph.
 class LPhi MOZ_FINAL : public LInstruction
 {
-    uint32_t numInputs_;
     LAllocation *inputs_;
     LDefinition def_;
 
-    bool init(MIRGenerator *gen);
-
-    LPhi(MPhi *mir);
+    LPhi()
+    { }
 
   public:
     LIR_HEADER(Phi)
@@ -5612,7 +5610,7 @@ class LPhi MOZ_FINAL : public LInstruction
         def_ = def;
     }
     size_t numOperands() const {
-        return numInputs_;
+        return mir_->toPhi()->numOperands();
     }
     LAllocation *getOperand(size_t index) {
         JS_ASSERT(index < numOperands());
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 761fca86eb4b..82aaf8507b1c 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -197,24 +197,16 @@ LSnapshot::rewriteRecoveredInput(LUse input)
     }
 }
 
-bool
-LPhi::init(MIRGenerator *gen)
-{
-    inputs_ = gen->allocate<LAllocation>(numInputs_);
-    return !!inputs_;
-}
-
-LPhi::LPhi(MPhi *mir)
-  : numInputs_(mir->numOperands())
-{
-}
-
 LPhi *
 LPhi::New(MIRGenerator *gen, MPhi *ins)
 {
-    LPhi *phi = new(gen->alloc()) LPhi(ins);
-    if (!phi->init(gen))
+    LPhi *phi = new (gen->alloc()) LPhi();
+    LAllocation *inputs = gen->allocate<LAllocation>(ins->numOperands());
+    if (!inputs)
         return nullptr;
+
+    phi->inputs_ = inputs;
+    phi->setMir(ins);
     return phi;
 }
 
diff --git a/js/src/jit/RegisterAllocator.cpp b/js/src/jit/RegisterAllocator.cpp
index 97a6855c50c5..7f4cf9abf2a3 100644
--- a/js/src/jit/RegisterAllocator.cpp
+++ b/js/src/jit/RegisterAllocator.cpp
@@ -42,7 +42,7 @@ AllocationIntegrityState::record()
             virtualRegisters[vreg] = phi->getDef(0);
             if (!info.outputs.append(*phi->getDef(0)))
                 return false;
-            for (size_t k = 0; k < phi->numOperands(); k++) {
+            for (size_t k = 0, kend = phi->numOperands(); k < kend; k++) {
                 if (!info.inputs.append(*phi->getOperand(k)))
                     return false;
             }
@@ -232,7 +232,7 @@ AllocationIntegrityState::checkIntegrity(LBlock *block, LInstruction *ins,
         const InstructionInfo &info = blocks[block->mir()->id()].phis[i];
         LPhi *phi = block->getPhi(i);
         if (info.outputs[0].virtualRegister() == vreg) {
-            for (size_t j = 0; j < phi->numOperands(); j++) {
+            for (size_t j = 0, jend = phi->numOperands(); j < jend; j++) {
                 uint32_t newvreg = info.inputs[j].toUse()->virtualRegister();
                 LBlock *predecessor = graph.getBlock(block->mir()->getPredecessor(j)->id());
                 if (!addPredecessor(predecessor, newvreg, alloc))
@@ -244,7 +244,7 @@ AllocationIntegrityState::checkIntegrity(LBlock *block, LInstruction *ins,
 
     // No phi which defined the vreg we are tracking, follow back through all
     // predecessors with the existing vreg.
-    for (size_t i = 0; i < block->mir()->numPredecessors(); i++) {
+    for (size_t i = 0, iend = block->mir()->numPredecessors(); i < iend; i++) {
         LBlock *predecessor = graph.getBlock(block->mir()->getPredecessor(i)->id());
         if (!addPredecessor(predecessor, vreg, alloc))
             return false;