Bug 1616535: MCheckClassHeritage can be effectful because the error case can invoke toSource. r=jandem

`CheckClassHeritageOperation` calls `ReportIsNotFunction` for non-callable
objects and `ReportIsNotFunction` can end up in `ValueToSource`, which in turn
can invoke a user-defined `toSource` function. That means MCheckClassHeritage
must be treated as an effectful operation.

When bug 1418769 is fixed, it should be possible to revert this change, because
then user-defined `toSource` functions are no longer called.

Differential Revision: https://phabricator.services.mozilla.com/D63316

--HG--
extra : moz-landing-system : lando

js/src/jit-test/tests/class/bug1616535.js

@@ -0,0 +1,3 @@
+// |jit-test| error:TypeError
+
+class C extends (/x/) {}

js/src/jit/IonBuilder.cpp

@@ -9906,7 +9906,7 @@ AbortReasonOr<Ok> IonBuilder::jsop_checkclassheritage() {
   auto* ins = MCheckClassHeritage::New(alloc(), current->pop());
   current->add(ins);
   current->push(ins);
-  return Ok();
+  return resumeAfter(ins);
 }
 
 AbortReasonOr<Ok> IonBuilder::jsop_checkthis() {

js/src/jit/MIR.h

@@ -10973,8 +10973,6 @@ class MCheckClassHeritage : public MUnaryInstruction,
   INSTRUCTION_HEADER(CheckClassHeritage)
   TRIVIAL_NEW_WRAPPERS
   NAMED_OPERANDS((0, heritage))
-
-  AliasSet getAliasSet() const override { return AliasSet::None(); }
 };
 
 class MDebugCheckSelfHosted : public MUnaryInstruction,