Bug 1823042 - Switch to bound function target's realm before creating…

… |this|. r=iain

For non-constructing calls it's simpler and faster to switch after pushing the arguments
and loading the bound function's target, but for constructor calls this needs to happen
earlier.

Differential Revision: https://phabricator.services.mozilla.com/D173281

js/src/jit-test/tests/cacheir/construct-bound-realm.js

@@ -0,0 +1,10 @@
+function f() {
+    var g = newGlobal({sameCompartmentAs: this});
+    g.evaluate(`function f() {}`);
+    var boundF = g.f.bind(null);
+    for (var i = 0; i < 50; i++) {
+        var obj = new boundF();
+        assertEq(objectGlobal(obj), g);
+    }
+}
+f();

js/src/jit/BaselineCacheIRCompiler.cpp

@@ -3422,7 +3422,16 @@ bool BaselineCacheIRCompiler::emitCallBoundScriptedFunction(
   AutoStubFrame stubFrame(*this);
   stubFrame.enter(masm, scratch);
 
+  Address boundTarget(calleeReg, BoundFunctionObject::offsetOfTargetSlot());
+
+  // If we're constructing, switch to the target's realm and create |this|. If
+  // we're not constructing, we switch to the target's realm after pushing the
+  // arguments and loading the target.
   if (isConstructing) {
+    if (!isSameRealm) {
+      masm.unboxObject(boundTarget, scratch);
+      masm.switchToObjectRealm(scratch, scratch);
+    }
     createThis(argcReg, calleeReg, scratch, flags,
                /* isBoundFunction = */ true);
   }
@@ -3432,10 +3441,9 @@ bool BaselineCacheIRCompiler::emitCallBoundScriptedFunction(
                              numBoundArgs, /* isJitCall = */ true);
 
   // Load the target JSFunction.
-  Address boundTarget(calleeReg, BoundFunctionObject::offsetOfTargetSlot());
   masm.unboxObject(boundTarget, calleeReg);
 
-  if (!isSameRealm) {
+  if (!isConstructing && !isSameRealm) {
     masm.switchToObjectRealm(calleeReg, scratch);
   }