Bug 1723715 part 5 - Move ForOfPICChain to GlobalObjectData. r=jonco

Depends on D121984

Differential Revision: https://phabricator.services.mozilla.com/D121985

js/public/Class.h

@@ -572,7 +572,7 @@ static const uint32_t JSCLASS_FOREGROUND_FINALIZE =
 // application.
 static const uint32_t JSCLASS_GLOBAL_APPLICATION_SLOTS = 5;
 static const uint32_t JSCLASS_GLOBAL_SLOT_COUNT =
-    JSCLASS_GLOBAL_APPLICATION_SLOTS + JSProto_LIMIT * 2 + 27;
+    JSCLASS_GLOBAL_APPLICATION_SLOTS + JSProto_LIMIT * 2 + 26;
 
 static constexpr uint32_t JSCLASS_GLOBAL_FLAGS_WITH_SLOTS(uint32_t n) {
   return JSCLASS_IS_GLOBAL |

js/src/vm/GlobalObject.cpp

@@ -875,7 +875,7 @@ NativeObject* GlobalObject::getOrCreateForOfPICObject(
   if (!forOfPIC) {
     return nullptr;
   }
-  global->setReservedSlot(FOR_OF_PIC_CHAIN, ObjectValue(*forOfPIC));
+  global->data().forOfPICChain.init(forOfPIC);
   return forOfPIC;
 }
 
@@ -1138,4 +1138,5 @@ void GlobalObjectData::trace(JSTracer* trc) {
   TraceEdge(trc, &emptyGlobalScope, "global-empty-scope");
   TraceNullableEdge(trc, &regExpStatics, "global-regexp-statics");
   TraceNullableEdge(trc, &intrinsicsHolder, "global-intrinsics-holder");
+  TraceNullableEdge(trc, &forOfPICChain, "global-for-of-pic");
 }

js/src/vm/GlobalObject.h

@@ -75,6 +75,9 @@ class GlobalObjectData {
   // Functions and other top-level values for self-hosted code.
   HeapPtr<NativeObject*> intrinsicsHolder;
 
+  // Cache used to optimize certain for-of operations.
+  HeapPtr<NativeObject*> forOfPICChain;
+
   void trace(JSTracer* trc);
 };
 
@@ -140,7 +143,6 @@ class GlobalObject : public NativeObject {
     EXPORT_ENTRY_PROTO,
     REQUESTED_MODULE_PROTO,
     MODULE_REQUEST_PROTO,
-    FOR_OF_PIC_CHAIN,
     WINDOW_PROXY,
     GLOBAL_THIS_RESOLVED,
     SOURCE_URLS,
@@ -894,13 +896,7 @@ class GlobalObject : public NativeObject {
     return realm()->getDebuggers();
   }
 
-  inline NativeObject* getForOfPICObject() {
-    Value forOfPIC = getReservedSlot(FOR_OF_PIC_CHAIN);
-    if (forOfPIC.isUndefined()) {
-      return nullptr;
-    }
-    return &forOfPIC.toObject().as<NativeObject>();
-  }
+  inline NativeObject* getForOfPICObject() { return data().forOfPICChain; }
   static NativeObject* getOrCreateForOfPICObject(JSContext* cx,
                                                  Handle<GlobalObject*> global);