Bug 1820602 - Add test and comment. r=iain

Depends on D171836

Differential Revision: https://phabricator.services.mozilla.com/D171837

UltraBlame original commit: ce69715cc73d6d870844c58a5fd1fafc51f60e7c

js/src/jit-test/tests/ion/bug1820602.js

@@ -0,0 +1,154 @@
+let
+domObject
+=
+new
+FakeDOMObject
+(
+)
+;
+let
+{
+object
+transplant
+}
+=
+transplantableObject
+(
+{
+object
+:
+domObject
+}
+)
+;
+assertEq
+(
+object
+domObject
+)
+;
+let
+global1
+=
+newGlobal
+(
+{
+newCompartment
+:
+true
+}
+)
+;
+let
+global2
+=
+newGlobal
+(
+{
+newCompartment
+:
+true
+}
+)
+;
+transplant
+(
+global1
+)
+;
+transplant
+(
+global2
+)
+;
+transplant
+(
+global1
+)
+;
+assertEq
+(
+object
+domObject
+)
+;
+global1
+.
+domObj
+=
+domObject
+;
+global1
+.
+evaluate
+(
+"
+(
+"
++
+function
+f
+(
+)
+{
+var
+domObjNormal
+=
+new
+FakeDOMObject
+(
+)
+;
+for
+(
+var
+i
+=
+0
+;
+i
+<
+5000
+;
+i
++
++
+)
+{
+var
+obj
+=
+i
+<
+1500
+?
+domObjNormal
+:
+domObj
+;
+assertEq
+(
+obj
+.
+doFoo
+(
+4
+5
+)
+2
+)
+;
+}
+}
+.
+toString
+(
+)
++
+"
+)
+(
+)
+"
+)
+;

js/src/jit/CacheIR.cpp

@@ -71031,6 +71031,22 @@ the
 right
 instance
 .
+This
+also
+/
+/
+ensures
+DOM_OBJECT_SLOT
+is
+stored
+in
+a
+fixed
+slot
+.
+See
+CanAttachDOMCall
+.
 writer
 .
 guardShape