Back out 2424dfed0c3c, tagged with wrong bug number. r=i-am-so-smrt-still

--HG--
extra : rebase_source : 066cb2c2ee7c1c85cfe9bf1e2d62c0e3b0d0725b

js/src/jit/CodeGenerator.cpp

@@ -3567,7 +3567,7 @@ CodeGenerator::visitNewCallObject(LNewCallObject *lir)
         return false;
 
 #ifdef JSGC_GENERATIONAL
-    if (templateObj->hasDynamicSlots()) {
+    if (ins->templateObject()->hasDynamicSlots()) {
         // Slot initialization is unbarriered in this case, so we must either
         // allocate in the nursery or bail if that is not possible.
         masm.jump(ool->entry());