PrivateScriptData currently has separate arrays for objects (RegExp, JSFunction, PlainObject, ArrayObject), scopes, and consts (BigInt). These each require different head fields (uses memory) and are awkward to access easily from JITs.

Instead, we can unify them into an array of GCPtr<SomeTaggedPointer> and generate bytecode so they share the same index space. Most accesses would be able to mask off the low-bit tag (Cell* are always aligned). When tracing for GC, the type tag would allow us to maintain typed GC-tracing.

After bug 1471062, the array will also be located at a fixed offset in PrivateScriptData.

Does GCCellPtr work for this? We may need to add it to the FOR_EACH_PUBLIC_TAGGED_GC_POINTER_TYPE define to trace it easily.

I was originally thinking about avoiding GCCellPtr to avoid arenaKind lookups and arbitrary trace dispatch, but that may be an excessive optimization at this point.

Once the other data is moved out of PrivateScriptData, this GC-thing array will be stored
at a fixed offset. At that point we can simplify PrivateScriptData and get fast indexing
into this array, important for the Baseline Interpreter.

https://hg.mozilla.org/mozilla-central/rev/5dec6c60fb6f