Bug 1710075 part 3 - Cache array shape in a global object slot. r=jonco

This will be used by a later patch in the stack, but can likely be used in more
places in the future.

Depends on D114604

Differential Revision: https://phabricator.services.mozilla.com/D114605

js/public/Class.h

@@ -572,7 +572,7 @@ static const uint32_t JSCLASS_FOREGROUND_FINALIZE =
 // application.
 static const uint32_t JSCLASS_GLOBAL_APPLICATION_SLOTS = 5;
 static const uint32_t JSCLASS_GLOBAL_SLOT_COUNT =
-    JSCLASS_GLOBAL_APPLICATION_SLOTS + JSProto_LIMIT * 2 + 30;
+    JSCLASS_GLOBAL_APPLICATION_SLOTS + JSProto_LIMIT * 2 + 31;
 
 static constexpr uint32_t JSCLASS_GLOBAL_FLAGS_WITH_SLOTS(uint32_t n) {
   return JSCLASS_IS_GLOBAL |

js/src/builtin/Array.cpp

@@ -3887,6 +3887,9 @@ static MOZ_ALWAYS_INLINE ArrayObject* NewArray(JSContext* cx, uint32_t length,
     }
     shape = arr->lastProperty();
     EmptyShape::insertInitialShape(cx, shape);
+    if (proto == cx->global()->maybeGetArrayPrototype()) {
+      cx->global()->setArrayShape(shape);
+    }
   }
 
   if (isCachable) {

js/src/vm/GlobalObject.h

@@ -125,6 +125,7 @@ class GlobalObject : public NativeObject {
     INSTRUMENTATION,
     SOURCE_URLS,
     REALM_KEY_OBJECT,
+    ARRAY_SHAPE,
 
     /* Total reserved-slot count for global objects. */
     RESERVED_SLOTS
@@ -905,6 +906,16 @@ class GlobalObject : public NativeObject {
     getSlotRef(SOURCE_URLS).unbarrieredSet(UndefinedValue());
   }
 
+  void setArrayShape(Shape* shape) {
+    MOZ_ASSERT(getSlot(ARRAY_SHAPE).isUndefined());
+    initSlot(ARRAY_SHAPE, PrivateGCThingValue(shape));
+  }
+  Shape* maybeArrayShape() const {
+    Value v = getSlot(ARRAY_SHAPE);
+    MOZ_ASSERT(v.isUndefined() || v.isPrivateGCThing());
+    return v.isPrivateGCThing() ? v.toGCThing()->as<Shape>() : nullptr;
+  }
+
   // Returns an object that represents the realm, used by embedder.
   static JSObject* getOrCreateRealmKeyObject(JSContext* cx,
                                              Handle<GlobalObject*> global);