[compiler] Replace Cell with direct reads

Bug: v8:7790
Change-Id: I2f0c2fdcb44c216471a8778816b9e041478f0792
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410191Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69965}

src/compiler/heap-refs.h

@@ -65,6 +65,7 @@ enum class OddballType : uint8_t {
   V(AccessorInfo)                                   \
   V(ArrayBoilerplateDescription)                    \
   V(BigInt)                                         \
+  V(Cell)                                           \
   V(HeapNumber)                                     \
   V(TemplateObjectDescription)
 
@@ -97,7 +98,6 @@ enum class OddballType : uint8_t {
   /* Subtypes of HeapObject */                \
   V(AllocationSite)                           \
   V(CallHandlerInfo)                          \
-  V(Cell)                                     \
   V(Code)                                     \
   V(DescriptorArray)                          \
   V(FeedbackCell)                             \

src/compiler/js-heap-broker.cc

@@ -1903,27 +1903,12 @@ void SourceTextModuleData::Serialize(JSHeapBroker* broker) {
 
 class CellData : public HeapObjectData {
  public:
-  CellData(JSHeapBroker* broker, ObjectData** storage, Handle<Cell> object);
-
-  void Serialize(JSHeapBroker* broker);
-  ObjectData* value() { return value_; }
-
- private:
-  ObjectData* value_ = nullptr;
+  CellData(JSHeapBroker* broker, ObjectData** storage, Handle<Cell> object)
+      : HeapObjectData(broker, storage, object) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 };
 
-CellData::CellData(JSHeapBroker* broker, ObjectData** storage,
-                   Handle<Cell> object)
-    : HeapObjectData(broker, storage, object) {}
-
-void CellData::Serialize(JSHeapBroker* broker) {
-  if (value_ != nullptr) return;
-
-  TraceScope tracer(broker, this, "CellData::Serialize");
-  auto cell = Handle<Cell>::cast(object());
-  value_ = broker->GetOrCreateData(cell->value());
-}
-
 class JSGlobalObjectData : public JSObjectData {
  public:
   JSGlobalObjectData(JSHeapBroker* broker, ObjectData** storage,
@@ -3368,8 +3353,6 @@ BIMODAL_ACCESSOR_C(BytecodeArray, int, parameter_count)
 BIMODAL_ACCESSOR_C(BytecodeArray, interpreter::Register,
                    incoming_new_target_or_generator_register)
 
-BIMODAL_ACCESSOR(Cell, Object, value)
-
 BIMODAL_ACCESSOR_C(FeedbackVector, double, invocation_count)
 
 BIMODAL_ACCESSOR(HeapObject, Map, map)