Bug 1326589 - Correct CacheIR issue with uninitialized let and GetGName. r=jandem

js/src/jit-test/tests/baseline/getgname-uninitialized-let.js

@@ -0,0 +1,8 @@
+for (var i = 0; i < 12; i++) {
+    try {
+        // GetGName
+        void x;
+    } catch (e) { }
+}
+
+let x;

js/src/jit-test/tests/baseline/getname-uninitialized-let.js

@@ -0,0 +1,13 @@
+function f() {
+    for (var i = 0; i < 12; i++) {
+        try {
+            eval("");
+
+            void x;
+        } catch (e) { }
+    }
+}
+
+f();
+
+let x;

js/src/jit/CacheIR.cpp

@@ -1218,6 +1218,10 @@ GetNameIRGenerator::tryAttachGlobalNameValue(ObjOperandId objId, HandleId id)
     if (!shape->hasDefaultGetter() || !shape->hasSlot())
         return false;
 
+    // This might still be an uninitialized lexical.
+    if (holder->getSlot(shape->slot()).isMagic())
+        return false;
+
     // Instantiate this global property, for use during Ion compilation.
     if (IsIonEnabled(cx_))
         EnsureTrackPropertyTypes(cx_, holder, id);
@@ -1332,6 +1336,8 @@ GetNameIRGenerator::tryAttachEnvironmentName(ObjOperandId objId, HandleId id)
     holder = &env->as<NativeObject>();
     if (!IsCacheableGetPropReadSlotForIonOrCacheIR(holder, holder, shape))
         return false;
+    if (holder->getSlot(shape->slot()).isMagic())
+        return false;
 
     ObjOperandId lastObjId = objId;
     env = env_;