Investigate gecko's use of generations for dom objects

[jdm]

13:29 <bz> smaug: the only reason for the ExpandoAndGeneration mess is the slots crap on JS proxies
13:30 <bz> smaug: If that ever gets fixed, we can simplify it greatly, right?
13:30 <bz> smaug: Store the expando in a slot directly, store the pointer to the generation in another slot
13:31 <bz> smaug: Right now the problem is we only have two slots to work with, and one of them points to the Gecko object...
13:31 <smaug> ah
13:32 <bz> So we jump through hoops of all sorts
13:33 <mccr8> And you don't want to store the pointer to the expando on the Gecko object?
13:33 <bz> well, that's what we do right now, effectively
13:33 <bz> we store the pointer to the expando on the expandoandgeneration
13:34 <bz> which is stored in the Gecko object
13:39 <jdm> remind me what generation is used for?
13:39 <bz> JIT IC invalidation
13:40 <bz> The IC guards on the value of the generation to make sure that we didn't start shadowing something it cares about

That sounds like it could be important!

[jdm]

Subsequent conversation revealed that it's only necessary for OverrideBuiltins support, which is #12978.