Bug 1820602 - Use shape guard instead of class guard for CallDOMFunction. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D171836

js/src/jit/CacheIR.cpp

@@ -10884,8 +10884,8 @@ AttachDecision CallIRGenerator::tryAttachCallNative(HandleFunction calleeFunc) {
         writer.loadArgumentDynamicSlot(ArgumentKind::This, argcId, flags);
     ObjOperandId thisObjId = writer.guardToObject(thisValId);
 
-    // Guard on the |this| class to make sure it's the right instance.
-    writer.guardAnyClass(thisObjId, thisval_.toObject().getClass());
+    // Guard on the |this| shape to make sure it's the right instance.
+    writer.guardShape(thisObjId, thisval_.toObject().shape());
 
     // Ensure callee matches this stub's callee
     writer.guardSpecificFunction(calleeObjId, calleeFunc);

js/src/jit/WarpBuilderShared.h

@@ -313,12 +313,12 @@ MCall* MakeCall(TempAllocator& alloc, Undef addUndefined, CallInfo& callInfo,
 
   mozilla::Maybe<DOMObjectKind> objKind;
   if (isDOMCall) {
-    const JSClass* clasp = callInfo.thisArg()->toGuardToClass()->getClass();
-    MOZ_ASSERT(clasp->isDOMClass());
-    if (clasp->isNativeObject()) {
+    const Shape* shape = callInfo.thisArg()->toGuardShape()->shape();
+    MOZ_ASSERT(shape->getObjectClass()->isDOMClass());
+    if (shape->isNative()) {
       objKind.emplace(DOMObjectKind::Native);
     } else {
-      MOZ_ASSERT(clasp->isProxyObject());
+      MOZ_ASSERT(shape->isProxy());
       objKind.emplace(DOMObjectKind::Proxy);
     }
   }