Previously, slot accessors in NativeObject asserted only that slot indices were within capacity (i.e., slot < numFixedSlots() or slot < numFixedSlots() + numDynamicSlots()). However, slot accesses should also be within the actual slot span. If a shape says that "objects with this shape span 3 slots", then slot indices accessed on those objects should be within [0, 3), even if we allocate 4 slots' worth of capacity in practice to avoid reallocation. Add asserts to ensure this is truly the case.

The attached patch passes all jstests and jit-tests, but a broader try run may be in order before fully landing it.

Previously, slot accessors in NativeObject asserted only that slot
indices were within capacity (i.e., slot < numFixedSlots() or slot < numFixedSlots() + numDynamicSlots()). However, slot accesses should
also be within the actual slot span. If a shape says that "objects
with this shape span 3 slots", then slot indices accessed on those
objects should be within [0, 3), even if we allocate 4 slots' worth of
capacity in practice to avoid reallocation. Add asserts to ensure this
is truly the case.

This patch gets there in a few steps:

• Add a few more xxxMaybeForwarded method variants to NativeObject
  to account for accesses coming from trace hooks.

• Change NativeObject::slotInRange from checking the slot index
  against the slot capacity to checking it against the slot span, while
  still asserting that the slot span is within capacity.

• Annotate anywhere we assert NativeObject::slotIsFixed(slot) with an
  additional NativeObject::slotInRange(slot).

Required Rationale: Changing severity to S3 because enhancement

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:mismith, could you have a look please?
For more information, please visit auto_nag documentation.

The bug assignee didn't login in Bugzilla in the last 7 months, so the assignee is being reset.

Redirect a needinfo that is pending on an inactive user to the triage owner.
:sdetar, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.