[compiler] Simplify JSCreateLowering::TryAllocateFastLiteral a little

I don't see any reason why we need to convert the 'uninitialized'
Oddball into a Smi 0 in the Smi case, nor why we need to convert the
hole-NaN HeapNumber into the Oddball in the Tagged case. These are
temporary anyways.

Change-Id: Ifdcd67528c7b19c36a1bde11291d78c3f211897f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2953291Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75151}

src/compiler/js-create-lowering.cc

@@ -1702,34 +1702,23 @@ base::Optional<Node*> JSCreateLowering::TryAllocateFastLiteral(
     // Note: We don't need to take a compilation dependency verifying the value
     // of `boilerplate_value`, since boilerplate properties are constant after
     // initialization modulo map migration. We protect against concurrent map
-    // migrations via the boilerplate_migration_access lock.
+    // migrations (other than elements kind transition, which don't affect us)
+    // via the boilerplate_migration_access lock.
     ObjectRef boilerplate_value = maybe_boilerplate_value.value();
 
-    // Uninitialized fields are marked through the `uninitialized_value`, or in
-    // the case of double representation through a HeapNumber containing a
-    // special sentinel value. The boilerplate value is not updated to keep up
-    // with the map, thus conversions may be necessary. Specifically:
-    //
-    // - Smi representation: uninitialized is converted to Smi 0.
-    // - Not double representation: the special heap number sentinel is
-    //   converted to `uninitialized_value`.
-    //
+    // Uninitialized fields are marked through the `uninitialized_value` Oddball
+    // (even for Smi representation!), or in the case of Double representation
+    // through a HeapNumber containing the hole-NaN. Since Double-to-Tagged
+    // representation changes are done in-place, we may even encounter these
+    // HeapNumbers in Tagged representation.
     // Note that although we create nodes to write `uninitialized_value` into
     // the object, the field should be overwritten immediately with a real
     // value, and `uninitialized_value` should never be exposed to JS.
-    bool is_uninitialized = false;
-    if (boilerplate_value.IsHeapObject() &&
-        boilerplate_value.AsHeapObject().map().oddball_type() ==
-            OddballType::kUninitialized) {
-      is_uninitialized = true;
-      access.const_field_info = ConstFieldInfo::None();
-    } else if (!property_details.representation().IsDouble() &&
-               boilerplate_value.IsHeapNumber() &&
-               boilerplate_value.AsHeapNumber().value_as_bits() ==
-                   kHoleNanInt64) {
-      is_uninitialized = true;
-      boilerplate_value =
-          MakeRef<HeapObject>(broker(), factory()->uninitialized_value());
+    ObjectRef uninitialized_oddball =
+        MakeRef<HeapObject>(broker(), factory()->uninitialized_value());
+    if (boilerplate_value.equals(uninitialized_oddball) ||
+        (boilerplate_value.IsHeapNumber() &&
+         boilerplate_value.AsHeapNumber().value_as_bits() == kHoleNanInt64)) {
       access.const_field_info = ConstFieldInfo::None();
     }
 
@@ -1750,11 +1739,13 @@ base::Optional<Node*> JSCreateLowering::TryAllocateFastLiteral(
       builder.Store(AccessBuilder::ForHeapNumberValue(),
                     jsgraph()->Constant(number));
       value = effect = builder.Finish();
-    } else if (property_details.representation().IsSmi()) {
-      // Ensure that value is stored as smi.
-      value = is_uninitialized ? jsgraph()->ZeroConstant()
-                               : jsgraph()->Constant(boilerplate_value.AsSmi());
     } else {
+      // It's fine to store the 'uninitialized' Oddball into a Smi field since
+      // it will get overwritten anyways and the store's MachineType (AnyTagged)
+      // is compatible with it.
+      DCHECK_IMPLIES(property_details.representation().IsSmi() &&
+                         !boilerplate_value.IsSmi(),
+                     boilerplate_value.equals(uninitialized_oddball));
       value = jsgraph()->Constant(boilerplate_value);
     }
     inobject_fields.push_back(std::make_pair(access, value));