Bug 1685925 - Only tryAttachTypedArrayLength for specialized stubs. r=iain, a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D101344

js/src/jit/CacheIR.cpp

@@ -1791,6 +1791,10 @@ AttachDecision GetPropIRGenerator::tryAttachTypedArrayLength(HandleObject obj,
     return AttachDecision::NoAction;
   }
 
+  if (mode_ != ICState::Mode::Specialized) {
+    return AttachDecision::NoAction;
+  }
+
   // Receiver should be the object.
   if (isSuper()) {
     return AttachDecision::NoAction;