Discovered while attempting to bench Ion+Baseline combined performance. Some ion scripts are repeatedly bailing out, and baseline is repeatedly re-entering it, because the Call_Scripted stub does not check the bailoutExpected flag of the IonScript it's about to enter. This causes significant slowdowns and makes comparison of Ion+Baseline and Ion+JM infeasible.

It would be really nice to have a "void *jitcode" pointer in JSScript that either points to ion->method()->raw() or baseline->method()->raw(). Then when we set bailoutExpected we can just switch that pointer to the baseline script, and we can avoid some loads and branches when doing calls.

We can do this when we change Ion's visitCallGeneric and friends to check for baseline jitcode.

This makes bailoutExpected_ into an int32 for easier checks via masm.branch32(...).