Bug 1652049 - Handle GuardNullProto in GetObject. r=anba

Differential Revision: https://phabricator.services.mozilla.com/D83488

js/src/jit-test/tests/warp/bug1652049.js

@@ -0,0 +1,7 @@
+function f() {
+    var o = {__proto__: null};
+    for (var i = 0; i < 15; i++) {
+        assertEq("foo" in o, false);
+    }
+}
+f();

js/src/jit/AliasAnalysis.cpp

@@ -137,6 +137,7 @@ static inline const MDefinition* GetObject(const MDefinition* ins) {
     case MDefinition::Opcode::GuardObjectGroup:
     case MDefinition::Opcode::GuardObjectIdentity:
     case MDefinition::Opcode::GuardProto:
+    case MDefinition::Opcode::GuardNullProto:
     case MDefinition::Opcode::LoadDynamicSlot:
     case MDefinition::Opcode::StoreDynamicSlot:
     case MDefinition::Opcode::InArray: