[compiler] Replace boilerplate objects with direct reads

Namely:
 * ObjectBoilerplateDescription
 * ArrayBoilerplateDescription

Bug: v8:7790
Change-Id: I05d106b5e557604e67e0cebaef7489fa3faf3562
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398641
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69811}

src/compiler/heap-refs.h

@@ -55,9 +55,12 @@ enum class OddballType : uint8_t {
 // Classes on this list will skip serialization when
 // FLAG_turbo_direct_heap_access is on. Otherwise, they might get serialized.
 #define HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(V) \
+  /* Subtypes of FixedArray */                      \
+  V(ObjectBoilerplateDescription)                   \
   /* Subtypes of FixedArrayBase */                  \
   V(FixedDoubleArray)                               \
   /* Subtypes of HeapObject */                      \
+  V(ArrayBoilerplateDescription)                    \
   V(HeapNumber)
 
 // This list is sorted such that subtypes appear before their supertypes.
@@ -76,7 +79,6 @@ enum class OddballType : uint8_t {
   V(NativeContext)                            \
   /* Subtypes of FixedArray */                \
   V(Context)                                  \
-  V(ObjectBoilerplateDescription)             \
   V(ScopeInfo)                                \
   V(ScriptContextTable)                       \
   /* Subtypes of FixedArrayBase */            \
@@ -91,7 +93,6 @@ enum class OddballType : uint8_t {
   /* Subtypes of HeapObject */                \
   V(AccessorInfo)                             \
   V(AllocationSite)                           \
-  V(ArrayBoilerplateDescription)              \
   V(BigInt)                                   \
   V(CallHandlerInfo)                          \
   V(Cell)                                     \

src/compiler/js-heap-broker.cc

@@ -571,7 +571,9 @@ class ArrayBoilerplateDescriptionData : public HeapObjectData {
   ArrayBoilerplateDescriptionData(JSHeapBroker* broker, ObjectData** storage,
                                   Handle<ArrayBoilerplateDescription> object)
       : HeapObjectData(broker, storage, object),
-        constants_elements_length_(object->constant_elements().length()) {}
+        constants_elements_length_(object->constant_elements().length()) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 
   int constants_elements_length() const { return constants_elements_length_; }
 
@@ -583,7 +585,9 @@ class ObjectBoilerplateDescriptionData : public HeapObjectData {
  public:
   ObjectBoilerplateDescriptionData(JSHeapBroker* broker, ObjectData** storage,
                                    Handle<ObjectBoilerplateDescription> object)
-      : HeapObjectData(broker, storage, object), size_(object->size()) {}
+      : HeapObjectData(broker, storage, object), size_(object->size()) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 
   int size() const { return size_; }
 
@@ -3187,15 +3191,6 @@ int ArrayBoilerplateDescriptionRef::constants_elements_length() const {
   return data()->AsArrayBoilerplateDescription()->constants_elements_length();
 }
 
-int ObjectBoilerplateDescriptionRef::size() const {
-  if (data_->should_access_heap()) {
-    AllowHandleDereferenceIfNeeded allow_handle_dereference(data()->kind(),
-                                                            broker()->mode());
-    return object()->size();
-  }
-  return data()->AsObjectBoilerplateDescription()->size();
-}
-
 ObjectRef FixedArrayRef::get(int i) const {
   if (data_->should_access_heap()) {
     AllowHandleAllocationIfNeeded allow_handle_allocation(data()->kind(),
@@ -3413,6 +3408,8 @@ BIMODAL_ACCESSOR_C(Code, unsigned, inlined_bytecode_size)
 BROKER_NATIVE_CONTEXT_FIELDS(DEF_NATIVE_CONTEXT_ACCESSOR)
 #undef DEF_NATIVE_CONTEXT_ACCESSOR
 
+BIMODAL_ACCESSOR_C(ObjectBoilerplateDescription, int, size)
+
 BIMODAL_ACCESSOR(PropertyCell, Object, value)
 BIMODAL_ACCESSOR_C(PropertyCell, PropertyDetails, property_details)