[turbofan] Serialize IsUnboxedDoubleField.

I'm also changing the function signature to take the descriptor_index
instead of the FieldIndex, because this lets me reuse the vector of
property descriptors as storage.

Bug: v8:7790
Change-Id: Ie9dadcba2204b6825e5791f9c630fc8b1079a930
Reviewed-on: https://chromium-review.googlesource.com/1227873
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55981}

src/compiler/js-create-lowering.cc

@@ -1667,7 +1667,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
         MaybeHandle<Map>(), Type::Any(),    MachineType::AnyTagged(),
         kFullWriteBarrier};
     Node* value;
-    if (boilerplate.map().IsUnboxedDoubleField(index)) {
+    if (boilerplate_map.IsUnboxedDoubleField(i)) {
       access.machine_type = MachineType::Float64();
       access.type = Type::Number();
       value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));

src/compiler/js-heap-broker.cc

@@ -494,6 +494,7 @@ struct PropertyDescriptor {
   FieldIndex field_index;
   MapData* field_owner = nullptr;
   ObjectData* field_type = nullptr;
+  bool is_unboxed_double_field = false;
 };
 
 class MapData : public HeapObjectData {
@@ -1078,6 +1079,8 @@ void MapData::SerializeDescriptors() {
       d.field_owner =
           broker()->GetOrCreateData(map->FindFieldOwner(isolate, i))->AsMap();
       d.field_type = broker()->GetOrCreateData(descriptors->GetFieldType(i));
+      d.is_unboxed_double_field = map->IsUnboxedDoubleField(d.field_index);
+      // Recurse.
       d.field_owner->SerializeDescriptors();
     }
     descriptors_.push_back(d);
@@ -1567,7 +1570,6 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
     return object<JSObject>()->RawFastDoublePropertyAt(index);
   }
   JSObjectData* object_data = data()->AsJSObject();
-  CHECK(map().IsUnboxedDoubleField(index));
   CHECK(index.is_inobject());
   return object_data->GetInobjectField(index.property_index()).AsDouble();
 }
@@ -1581,7 +1583,6 @@ ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
                             broker()->isolate()));
   }
   JSObjectData* object_data = data()->AsJSObject();
-  CHECK(!map().IsUnboxedDoubleField(index));
   CHECK(index.is_inobject());
   return ObjectRef(
       object_data->GetInobjectField(index.property_index()).AsObject());
@@ -1688,9 +1689,17 @@ ObjectRef MapRef::GetFieldType(int descriptor_index) const {
       data()->AsMap()->descriptors().at(descriptor_index).field_type);
 }
 
-bool MapRef::IsUnboxedDoubleField(FieldIndex index) const {
-  AllowHandleDereference allow_handle_dereference;
-  return object<Map>()->IsUnboxedDoubleField(index);
+bool MapRef::IsUnboxedDoubleField(int descriptor_index) const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return object<Map>()->IsUnboxedDoubleField(
+        FieldIndex::ForDescriptor(*object<Map>(), descriptor_index));
+  }
+  return data()
+      ->AsMap()
+      ->descriptors()
+      .at(descriptor_index)
+      .is_unboxed_double_field;
 }
 
 uint16_t StringRef::GetFirstChar() {

src/compiler/js-heap-broker.h

@@ -340,7 +340,7 @@ class MapRef : public HeapObjectRef {
   NameRef GetPropertyKey(int descriptor_index) const;
   FieldIndex GetFieldIndexFor(int descriptor_index) const;
   ObjectRef GetFieldType(int descriptor_index) const;
-  bool IsUnboxedDoubleField(FieldIndex index) const;
+  bool IsUnboxedDoubleField(int descriptor_index) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {