Bug 1852238 - Unbox GetName and BindName inputs instead of relying on the type policy. r=iain

This is similar to the `CloseIter` IC, they all take an object instead of a boxed
value.

Differential Revision: https://phabricator.services.mozilla.com/D187784

js/src/jit-test/tests/warp/bug1852238.js

@@ -0,0 +1,14 @@
+// |jit-test| --fast-warmup
+(function() {
+    eval("");
+    (function() {
+        var arr = [];
+        var res = 0;
+        for (var i = 2; i < 50; i++) {
+            for (var j = 1; j < 10; j++) {
+                res = JSON;
+            }
+        }
+        return res;
+    })();
+})();

js/src/jit/WarpBuilder.cpp

@@ -1850,6 +1850,7 @@ bool WarpBuilder::build_GetName(BytecodeLocation loc) {
   MOZ_ASSERT(usesEnvironmentChain());
 
   MDefinition* env = current->environmentChain();
+  env = unboxObjectInfallible(env, IsMovable::Yes);
   return buildIC(loc, CacheKind::GetName, {env});
 }
 
@@ -1864,6 +1865,7 @@ bool WarpBuilder::build_BindName(BytecodeLocation loc) {
   MOZ_ASSERT(usesEnvironmentChain());
 
   MDefinition* env = current->environmentChain();
+  env = unboxObjectInfallible(env, IsMovable::Yes);
   return buildIC(loc, CacheKind::BindName, {env});
 }