Bug 1883542: Add test and assertion r=jandem

I ran a one-line patch containing only the assertion through `./mach try auto` and everything passed.

Differential Revision: https://phabricator.services.mozilla.com/D204131

js/src/jit-test/tests/cacheir/bug1883542.js

@@ -0,0 +1,13 @@
+Object.defineProperty(this, "getter", {get: foo});
+
+var output;
+let i = 20;
+function foo() {
+  eval("");
+  output = this;
+  if (i--) {
+    getter++;
+  }
+}
+foo();
+output.newString();

js/src/jit/CacheIR.cpp

@@ -1146,6 +1146,7 @@ AttachDecision GetPropIRGenerator::tryAttachNative(HandleObject obj,
     case NativeGetPropKind::ScriptedGetter:
     case NativeGetPropKind::NativeGetter: {
       auto* nobj = &obj->as<NativeObject>();
+      MOZ_ASSERT(!IsWindow(nobj));
 
       maybeEmitIdGuard(id);