[map] Faster HasOutOfObjectProperties check

The used_or_unused_instance_size_in_words field already determines
whether the used fields are in- or out-of-object, so we can use it's
value for a fast HasOutOfObjectProperties check rather than using
NumberOfFields (which includes an iteration over the descriptor
array).

Change-Id: I6c5b4f3f793b8df7832def7465106f2af7306759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718152
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81828}

src/objects/map-inl.h

@@ -313,6 +313,13 @@ void Map::SetInObjectPropertiesStartInWords(int value) {
   set_inobject_properties_start_or_constructor_function_index(value);
 }
 
+bool Map::HasOutOfObjectProperties() const {
+  bool ret = used_or_unused_instance_size_in_words() < JSObject::kFieldsAdded;
+  DCHECK_EQ(ret, GetInObjectProperties() <
+                     NumberOfFields(ConcurrencyMode::kSynchronous));
+  return ret;
+}
+
 int Map::GetInObjectProperties() const {
   DCHECK(IsJSObjectMap());
   return instance_size_in_words() - GetInObjectPropertiesStartInWords();

src/objects/map.cc

@@ -571,11 +571,6 @@ Map::FieldCounts Map::GetFieldCounts() const {
   return FieldCounts(mutable_count, const_count);
 }
 
-bool Map::HasOutOfObjectProperties() const {
-  return GetInObjectProperties() <
-         NumberOfFields(ConcurrencyMode::kSynchronous);
-}
-
 void Map::DeprecateTransitionTree(Isolate* isolate) {
   if (is_deprecated()) return;
   TransitionsAccessor transitions(isolate, *this);

src/objects/map.h

@@ -240,6 +240,8 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
   // is equal to the instance size).
   inline int UsedInstanceSize() const;
 
+  inline bool HasOutOfObjectProperties() const;
+
   // Tells how many unused property fields (in-object or out-of object) are
   // available in the instance (only used for JSObject in fast mode).
   inline int UnusedPropertyFields() const;
@@ -505,8 +507,6 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
   FieldCounts GetFieldCounts() const;
   int NumberOfFields(ConcurrencyMode cmode) const;
 
-  bool HasOutOfObjectProperties() const;
-
   // TODO(ishell): candidate with JSObject::MigrateToMap().
   bool InstancesNeedRewriting(Map target, ConcurrencyMode cmode) const;
   bool InstancesNeedRewriting(Map target, int target_number_of_fields,