Issue #2308 & #1240 Follow-up - Replace JSOP_POS in ++/-- with JSOP_TONUMERIC. https://bugzilla.mozilla.org/show_bug.cgi?id=1519135

js/src/jit/MIR.h

@@ -5534,6 +5534,43 @@ class MInt64ToFloatingPoint
     }
 };
 
+// Takes a boxed Value and returns a Value containing either a Number or a
+// BigInt.  Usually this will be the value itself, but it may be an object that
+// has a @@toPrimitive, valueOf, or toString method.
+class MToNumeric : public MUnaryInstruction, public BoxInputsPolicy::Data
+{
+    MToNumeric(MDefinition* arg, TemporaryTypeSet* types)
+               : MUnaryInstruction(arg)
+    {
+        MOZ_ASSERT(!IsNumericType(arg->type()),
+                   "Unboxable definitions don't need ToNumeric");
+        setResultType(MIRType::Value);
+        // Although `types' is always Int32|Double|BigInt, we have to compute it in
+        // IonBuilder to know whether emitting an MToNumeric is needed, so we just
+        // pass it through as an argument instead of recomputing it here.
+        setResultTypeSet(types);
+        setGuard();
+        setMovable();
+    }
+
+  public:
+    INSTRUCTION_HEADER(ToNumeric)
+    TRIVIAL_NEW_WRAPPERS
+
+        static MToNumeric* New(TempAllocator& alloc, MDefinition* arg,
+                               TemporaryTypeSet* types) {
+        return new (alloc) MToNumeric(arg, types);
+    }
+
+    void computeRange(TempAllocator& alloc) override;
+    bool congruentTo(const MDefinition* ins) const override {
+        return congruentIfOperandsEqual(ins);
+    }
+    MDefinition* foldsTo(TempAllocator& alloc) override;
+
+    ALLOW_CLONE(MToNumeric)
+};
+
 // Converts a primitive (either typed or untyped) to an int32. If the input is
 // not primitive at runtime, a bailout occurs. If the input cannot be converted
 // to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs.