[compiler] Replace TemplateObjectDescription with direct reads

Bug: v8:7790
Change-Id: I5391c6688dfad81e37d260fbfef22c3dbdce0dce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404769
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69905}

src/compiler/heap-refs.h

@@ -67,7 +67,8 @@ enum class OddballType : uint8_t {
   V(AccessorInfo)                                   \
   V(ArrayBoilerplateDescription)                    \
   V(BigInt)                                         \
-  V(HeapNumber)
+  V(HeapNumber)                                     \
+  V(TemplateObjectDescription)
 
 // This list is sorted such that subtypes appear before their supertypes.
 // DO NOT VIOLATE THIS PROPERTY!
@@ -110,7 +111,6 @@ enum class OddballType : uint8_t {
   V(PropertyCell)                             \
   V(SharedFunctionInfo)                       \
   V(SourceTextModule)                         \
-  V(TemplateObjectDescription)                \
   /* Subtypes of Object */                    \
   V(HeapObject)
 

src/compiler/js-heap-broker.cc

@@ -2006,7 +2006,9 @@ class TemplateObjectDescriptionData : public HeapObjectData {
  public:
   TemplateObjectDescriptionData(JSHeapBroker* broker, ObjectData** storage,
                                 Handle<TemplateObjectDescription> object)
-      : HeapObjectData(broker, storage, object) {}
+      : HeapObjectData(broker, storage, object) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 };
 
 class CodeData : public HeapObjectData {