I am experimenting with adding a type guard to the first DenseElement stub we attach. If the stub fails we can attach a normal Value load and because we now attach at the front there is basically no downside, except maybe some wasted memory.

The motivation for this is again getElementById-1.html. To be able to hoist some of the instructions we have to make sure the actual getElementById call doesn't use AliasSet::Any. This however always happen when the parameter to the function is a Value, see MCallDOMNative::getAliasSet. So by using a typed load we unlock the better typeset.

Still not sure if this is worth it, but the actual patch is super simple.

I think it would be better for the getElementById call to do the type guard on the arguments. That way it would work also if the argument isn't a LoadDenseElement. Unfortunately we don't have a great way to do this tiering in CacheIR right now...