Reland "[compiler] Replace Symbol with direct reads"

This is a reland of d3b295fa

Got speculatively reverted in https://crrev.com/c/v8/v8/+/2403256 but
doesn't seem to have been causing the TSAN failures

Original change's description:
> [compiler] Replace Symbol with direct reads
>
> Bug: v8:7790
> Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69812}

Bug: v8:7790
Change-Id: I459f4bfc881c641258dcc46fc55fce21f9e03dec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403921
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69822}

src/compiler/heap-refs.h

@@ -59,6 +59,8 @@ enum class OddballType : uint8_t {
   V(ObjectBoilerplateDescription)                   \
   /* Subtypes of FixedArrayBase */                  \
   V(FixedDoubleArray)                               \
+  /* Subtypes of Name */                            \
+  V(Symbol)                                         \
   /* Subtypes of HeapObject */                      \
   V(ArrayBoilerplateDescription)                    \
   V(HeapNumber)
@@ -87,7 +89,6 @@ enum class OddballType : uint8_t {
   /* Subtypes of Name */                      \
   V(InternalizedString)                       \
   V(String)                                   \
-  V(Symbol)                                   \
   /* Subtypes of JSReceiver */                \
   V(JSObject)                                 \
   /* Subtypes of HeapObject */                \

src/compiler/js-heap-broker.cc

@@ -838,7 +838,9 @@ class StringData : public NameData {
 class SymbolData : public NameData {
  public:
   SymbolData(JSHeapBroker* broker, ObjectData** storage, Handle<Symbol> object)
-      : NameData(broker, storage, object) {}
+      : NameData(broker, storage, object) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 };
 
 StringData::StringData(JSHeapBroker* broker, ObjectData** storage,

src/compiler/pipeline.cc

@@ -1509,6 +1509,9 @@ struct TyperPhase {
     LoopVariableOptimizer induction_vars(data->jsgraph()->graph(),
                                          data->common(), temp_zone);
     if (FLAG_turbo_loop_variable) induction_vars.Run();
+
+    // The typer inspects heap objects, so we need to unpark the local heap.
+    UnparkedScopeIfNeeded scope(data->broker());
     typer->Run(roots, &induction_vars);
   }
 };