Now that we use XOR to unbox Values (since Spectre), we can optimize fallible unboxing a bit more. To unbox a Value in rax to an object in rbx on x64, instead of generating this:

movq       %rax, %r11
shrq       $47, %r11
cmpl       $0x1fffc, %r11d
jne        <bail>
movabsq    $0xfffe000000000000, %rbx
xorq       %rax, %rbx

We can do this:

movabsq    $0xfffe000000000000, %r11
xorq       %rax, %r11
movq       %r11, %rbx
shrq       $47, %r11
jnz        <bail>

The new version on ARM64:

eor       x2, x1, #0xfffe000000000000
cmp       xzr, x2, lsr 47
bne       <bail>

This is a measurable win on some benchmarks with Warp enabled.

On 64-bit platforms we can generate better code for a fallible unbox by first
doing a XOR to unbox and then doing the type check with a right-shift + check-non-zero.

For int32 and boolean we still use a separate branch + unbox: these types can be
unboxed more efficiently because they only use 32 payload bits.

Depends on D76827

Depends on D76828

Also adds support for object/string/symbol/bigint to the FoldLoadsWithUnbox
optimization pass: with the old unboxing scheme this would have been inefficient
on 64-bit platforms (loading the Value twice, for type guard and unbox) but
fallibleUnboxPtr now does a single load on x64 and ARM64.

Depends on D76829

https://hg.mozilla.org/mozilla-central/rev/e0c0917c6826
https://hg.mozilla.org/mozilla-central/rev/b53f40d2b305
https://hg.mozilla.org/mozilla-central/rev/abc180c57420
https://hg.mozilla.org/mozilla-central/rev/abab86b25b5f