Bug 1820602 - Add test and comment. r=iain

Depends on D171836

Differential Revision: https://phabricator.services.mozilla.com/D171837

js/src/jit-test/tests/ion/bug1820602.js

@@ -0,0 +1,23 @@
+let domObject = new FakeDOMObject();
+
+let {object, transplant} = transplantableObject({object: domObject});
+assertEq(object, domObject);
+
+let global1 = newGlobal({newCompartment: true});
+let global2 = newGlobal({newCompartment: true});
+
+transplant(global1);
+transplant(global2);
+transplant(global1);
+
+assertEq(object, domObject);
+
+global1.domObj = domObject;
+
+global1.evaluate("(" + function f() {
+    var domObjNormal = new FakeDOMObject();
+    for (var i = 0; i < 5000; i++) {
+        var obj = i < 1500 ? domObjNormal : domObj;
+        assertEq(obj.doFoo(4, 5), 2);
+    }
+}.toString() + ")()");

js/src/jit/CacheIR.cpp

@@ -11106,7 +11106,8 @@ AttachDecision CallIRGenerator::tryAttachCallNative(HandleFunction calleeFunc) {
         writer.loadArgumentDynamicSlot(ArgumentKind::This, argcId, flags);
     ObjOperandId thisObjId = writer.guardToObject(thisValId);
 
-    // Guard on the |this| shape to make sure it's the right instance.
+    // Guard on the |this| shape to make sure it's the right instance. This also
+    // ensures DOM_OBJECT_SLOT is stored in a fixed slot. See CanAttachDOMCall.
     writer.guardShape(thisObjId, thisval_.toObject().shape());
 
     // Ensure callee matches this stub's callee