[compiler] Allow access to length_string in access-info

.. since it's located in ReadOnlySpace and thus immutable. We could
extend this to other strings in RO-space but for now I want to avoid
too much movement. This bumps jetstream2/gbemu scores by ~30%.

Bug: v8:12790,v8:12161
Change-Id: I3fe10703e9ceca19c110d19c83143d811e090192
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607994
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80188}

src/compiler/access-info.cc

@@ -829,16 +829,14 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
     // Don't search on the prototype chain for special indices in case of
     // integer indexed exotic objects (see ES6 section 9.4.5).
     if (map.object()->IsJSTypedArrayMap() && name.IsString()) {
-      if (broker()->IsMainThread()) {
-        if (IsSpecialIndex(String::cast(*name.object()))) {
-          return Invalid();
-        }
-      } else {
-        // TODO(jgruber): We are being conservative here since we can't access
-        // string contents from background threads. Should that become possible
-        // in the future, remove this bailout.
+      // TODO(jgruber,v8:12790): Extend this to other strings in read-only
+      // space. When doing so, make sure there are no unexpected regressions on
+      // jetstream2.
+      if (!broker()->IsMainThread() &&
+          *name.object() != ReadOnlyRoots(isolate()).length_string()) {
         return Invalid();
       }
+      if (IsSpecialIndex(String::cast(*name.object()))) return Invalid();
     }
 
     // Don't search on the prototype when storing in literals, or performing a