[JSC] JSCell::toX should use jsDynamicCast/jsSecureCast

https://bugs.webkit.org/show_bug.cgi?id=270797
rdar://124119022

Reviewed by Mark Lam.

General code quality improvement. We also might as well add a release assert
that the final case is correct as it doesn't seem to be a perf regression.

* Source/JavaScriptCore/runtime/JSCell.cpp:
(JSC::JSCell::toPrimitive const):
(JSC::JSCell::toNumber const):
(JSC::JSCell::toObjectSlow const):

Canonical link: https://commits.webkit.org/275948@main

Source/JavaScriptCore/runtime/JSCell.cpp

@@ -147,36 +147,35 @@ bool JSCell::deletePropertyByIndex(JSCell* cell, JSGlobalObject* globalObject, u
 
 JSValue JSCell::toPrimitive(JSGlobalObject* globalObject, PreferredPrimitiveType preferredType) const
 {
-    if (isString())
-        return static_cast<const JSString*>(this)->toPrimitive(globalObject, preferredType);
-    if (isSymbol())
-        return static_cast<const Symbol*>(this)->toPrimitive(globalObject, preferredType);
-    if (isHeapBigInt())
-        return static_cast<const JSBigInt*>(this)->toPrimitive(globalObject, preferredType);
-    return static_cast<const JSObject*>(this)->toPrimitive(globalObject, preferredType);
+    if (const auto* string = jsDynamicCast<const JSString*>(this))
+        return string->toPrimitive(globalObject, preferredType);
+    if (const auto* symbol = jsDynamicCast<const Symbol*>(this))
+        return symbol->toPrimitive(globalObject, preferredType);
+    if (const auto* bigInt = jsDynamicCast<const JSBigInt*>(this))
+        return bigInt->toPrimitive(globalObject, preferredType);
+    return jsSecureCast<const JSObject*>(this)->toPrimitive(globalObject, preferredType);
 }
 
 double JSCell::toNumber(JSGlobalObject* globalObject) const
 {
-    if (isString())
-        return static_cast<const JSString*>(this)->toNumber(globalObject);
-    if (isSymbol())
-        return static_cast<const Symbol*>(this)->toNumber(globalObject);
-    if (isHeapBigInt())
-        return static_cast<const JSBigInt*>(this)->toNumber(globalObject);
-    return static_cast<const JSObject*>(this)->toNumber(globalObject);
+    if (const auto* string = jsDynamicCast<const JSString*>(this))
+        return string->toNumber(globalObject);
+    if (const auto* symbol = jsDynamicCast<const Symbol*>(this))
+        return symbol->toNumber(globalObject);
+    if (const auto* bigInt = jsDynamicCast<const JSBigInt*>(this))
+        return bigInt->toNumber(globalObject);
+    return jsSecureCast<const JSObject*>(this)->toNumber(globalObject);
 }
 
 JSObject* JSCell::toObjectSlow(JSGlobalObject* globalObject) const
 {
     Integrity::auditStructureID(structureID());
     ASSERT(!isObject());
-    if (isString())
-        return static_cast<const JSString*>(this)->toObject(globalObject);
-    if (isHeapBigInt())
-        return static_cast<const JSBigInt*>(this)->toObject(globalObject);
-    ASSERT(isSymbol());
-    return static_cast<const Symbol*>(this)->toObject(globalObject);
+    if (const auto* string = jsDynamicCast<const JSString*>(this))
+        return string->toObject(globalObject);
+    if (const auto* bigInt = jsDynamicCast<const JSBigInt*>(this))
+        return bigInt->toObject(globalObject);
+    return jsSecureCast<const Symbol*>(this)->toObject(globalObject);
 }
 
 void slowValidateCell(JSCell* cell)