Revert "[turbofan] More brokerization in JSCreateLowering."

This reverts commit 7f67cbd4.

Reason for revert: Speculative revert because of https://ci.chromium.org/p/v8/builders/luci.v8.ci/Mac%20V8%20FYI%20Release%20(Intel)/1842

Original change's description:
> [turbofan] More brokerization in JSCreateLowering.
> 
> Brokerized ReduceJSCreateEmptyLiteralObject and added the scope
> for ReduceJSCreateLiteralArrayOrObject.
> 
> Bug: v8:7790
> Change-Id: Ife34a6b610678a3fe24152151cf343400ee515bd
> Reviewed-on: https://chromium-review.googlesource.com/1140306
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54507}

TBR=jarin@chromium.org,neis@chromium.org,mslekova@chromium.org

Change-Id: Ic4a89cd872b13e4b5f28636e0d91b3b013d6649a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1141964Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54524}

src/compiler/js-create-lowering.cc

@@ -1133,7 +1133,6 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
-  DisallowHeapAccess no_heap_access;
   DCHECK(node->opcode() == IrOpcode::kJSCreateLiteralArray ||
          node->opcode() == IrOpcode::kJSCreateLiteralObject);
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
@@ -1183,16 +1182,15 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
-  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateEmptyLiteralObject, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Retrieve the initial map for the object.
-  MapRef map = native_context_ref().ObjectLiteralMapFromCache();
-  DCHECK(!map.is_dictionary_map());
-  DCHECK(!map.IsInobjectSlackTrackingInProgress());
-  Node* js_object_map = jsgraph()->Constant(map);
+  Handle<Map> map = factory()->ObjectLiteralMapFromCache(native_context(), 0);
+  DCHECK(!map->is_dictionary_map());
+  DCHECK(!map->IsInobjectSlackTrackingInProgress());
+  Node* js_object_map = jsgraph()->HeapConstant(map);
 
   // Setup elements and properties.
   Node* elements = jsgraph()->EmptyFixedArrayConstant();
@@ -1200,12 +1198,13 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
 
   // Perform the allocation of the actual JSArray object.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(map.instance_size());
+  a.Allocate(map->instance_size());
   a.Store(AccessBuilder::ForMap(), js_object_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
-  for (int i = 0; i < map.GetInObjectProperties(); i++) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
+  for (int i = 0; i < map->GetInObjectProperties(); i++) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(
+                MapRef(js_heap_broker(), map), i),
             jsgraph()->UndefinedConstant());
   }
 

src/compiler/js-heap-broker.cc

@@ -396,8 +396,6 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
 bool AllocationSiteRef::IsFastLiteral() const {
-  AllowHeapAllocation
-      allow_heap_allocation;  // This is needed for TryMigrateInstance.
   AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   int max_properties = kMaxFastLiteralProperties;
@@ -818,15 +816,6 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   return get(index).AsMap();
 }
 
-MapRef NativeContextRef::ObjectLiteralMapFromCache() const {
-  AllowHeapAllocation heap_allocation;
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference allow_handle_dereference;
-  Factory* factory = broker()->isolate()->factory();
-  Handle<Map> map = factory->ObjectLiteralMapFromCache(object<Context>(), 0);
-  return MapRef(broker(), map);
-}
-
 bool ObjectRef::BooleanValue() {
   AllowHandleDereference allow_handle_dereference;
   return object<Object>()->BooleanValue(broker()->isolate());

src/compiler/js-heap-broker.h

@@ -247,7 +247,6 @@ class NativeContextRef : public ContextRef {
   JSFunctionRef array_function() const;
 
   MapRef GetFunctionMapFromIndex(int index) const;
-  MapRef ObjectLiteralMapFromCache() const;
 };
 
 class NameRef : public HeapObjectRef {