Bug 1739660 - Part 3: Transpile SpreadNew and SpreadSuperCall. r=iain

After the preparations from the preceding patches, we can now simply enable
transpiling `SpreadNew` and `SpreadSuperCall`.

Differential Revision: https://phabricator.services.mozilla.com/D130490

js/src/jit/WarpBuilder.cpp

@@ -2879,6 +2879,10 @@ bool WarpBuilder::build_SpreadNew(BytecodeLocation loc) {
   CallInfo callInfo(alloc(), constructing, loc.resultIsPopped());
   callInfo.initForSpreadCall(current);
 
+  if (auto* cacheIRSnapshot = getOpSnapshot<WarpCacheIR>(loc)) {
+    return transpileCall(loc, cacheIRSnapshot, &callInfo);
+  }
+
   buildCreateThis(callInfo);
 
   bool needsThisCheck = true;

js/src/jit/WarpBuilderShared.h

@@ -264,9 +264,8 @@ class MOZ_STACK_CLASS CallInfo {
   MDefinition* arrayArg() const {
     MOZ_ASSERT(argFormat_ == ArgFormat::Array);
     // The array argument for a spread call or FunApply is always the last
-    // argument, unless the spread call is constructing, in which case the
+    // argument.
-    // last argument is NewTarget, and the array argument is second-last.
+    return getArg(argc() - 1);
-    return getArg(argc() - 1 - constructing_);
   }
 };
 

js/src/jit/WarpOracle.cpp

@@ -480,6 +480,8 @@ AbortReasonOr<WarpScriptSnapshot*> WarpScriptOracle::createScriptSnapshot() {
       case JSOp::New:
       case JSOp::SuperCall:
       case JSOp::SpreadCall:
+      case JSOp::SpreadNew:
+      case JSOp::SpreadSuperCall:
       case JSOp::ToNumeric:
       case JSOp::Pos:
       case JSOp::Inc:
@@ -643,8 +645,6 @@ AbortReasonOr<WarpScriptSnapshot*> WarpScriptOracle::createScriptSnapshot() {
       case JSOp::CheckIsObj:
       case JSOp::CheckObjCoercible:
       case JSOp::FunWithProto:
-      case JSOp::SpreadNew:
-      case JSOp::SpreadSuperCall:
       case JSOp::Debugger:
       case JSOp::TableSwitch:
       case JSOp::Exception: