Bug 1651732 - Part 3: Change ProxyHas to use ToPropertyKey. r=jandem

Similar to part 1, replace `ToValueId()` with `ToPropertyKey()`.

Differential Revision: https://phabricator.services.mozilla.com/D83054

js/src/jit-test/tests/cacheir/bug1651732-proxy-has.js

@@ -0,0 +1,24 @@
+// An object with a custom [Symbol.toPrimitive] function.
+var key = {
+  value: "a",
+
+  [Symbol.toPrimitive]() {
+    return this.value;
+  }
+};
+
+var target = {
+  a: 0,
+  [Symbol.iterator]: 0,
+};
+var obj = new Proxy(target, {});
+
+for (var i = 0; i < 100; ++i) {
+  // Change key[Symbol.toPrimitive] to return a symbol after some warm-up.
+  if (i > 80) {
+    key.value = Symbol.iterator;
+  }
+
+  // Attach an IC for JSOp::In on proxies.
+  assertEq(key in obj, true);
+}

js/src/proxy/Proxy.cpp

@@ -258,7 +258,7 @@ bool Proxy::has(JSContext* cx, HandleObject proxy, HandleId id, bool* bp) {
 bool js::ProxyHas(JSContext* cx, HandleObject proxy, HandleValue idVal,
                   bool* result) {
   RootedId id(cx);
-  if (!ValueToId<CanGC>(cx, idVal, &id)) {
+  if (!ToPropertyKey(cx, idVal, &id)) {
     return false;
   }