Reland x2 "[compiler] Replace Symbol with direct reads""

Inside of LoopPeeler::PeelInnerLoopsOfTree we call the typer, which
inspects heap objects, so we need to unpark the local heap.

Reverted in https://chromium-review.googlesource.com/c/v8/v8/+/2502333

Original change's description:
> [compiler] Replace Symbol with direct reads
>
> Bug: v8:7790
> Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69812}

Bug: v8:7790, chromium:1137594
Change-Id: I8539175002e19b04b84009eb6b2cc5ced4ee53c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502339
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70872}

src/compiler/heap-refs.h

@@ -61,6 +61,8 @@ enum class OddballType : uint8_t {
   /* Subtypes of FixedArray */                      \
   V(ObjectBoilerplateDescription)                   \
   V(ScopeInfo)                                      \
+  /* Subtypes of Name */                            \
+  V(Symbol)                                         \
   /* Subtypes of HeapObject */                      \
   V(AccessorInfo)                                   \
   V(ArrayBoilerplateDescription)                    \
@@ -92,7 +94,6 @@ enum class OddballType : uint8_t {
   /* Subtypes of Name */                      \
   V(InternalizedString)                       \
   V(String)                                   \
-  V(Symbol)                                   \
   /* Subtypes of JSReceiver */                \
   V(JSObject)                                 \
   /* Subtypes of HeapObject */                \

src/compiler/js-heap-broker.cc

@@ -850,7 +850,9 @@ class StringData : public NameData {
 class SymbolData : public NameData {
  public:
   SymbolData(JSHeapBroker* broker, ObjectData** storage, Handle<Symbol> object)
-      : NameData(broker, storage, object) {}
+      : NameData(broker, storage, object) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 };
 
 namespace {

src/compiler/pipeline.cc

@@ -1692,6 +1692,9 @@ struct LoopPeelingPhase {
 
     LoopTree* loop_tree = LoopFinder::BuildLoopTree(
         data->jsgraph()->graph(), &data->info()->tick_counter(), temp_zone);
+    // We call the typer inside of PeelInnerLoopsOfTree which inspects heap
+    // objects, so we need to unpark the local heap.
+    UnparkedScopeIfNeeded scope(data->broker());
     LoopPeeler(data->graph(), data->common(), loop_tree, temp_zone,
                data->source_positions(), data->node_origins())
         .PeelInnerLoopsOfTree();

test/mjsunit/regress/regress-crbug-1137594.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+v = { symbol: Symbol() };
+function f() {
+  for (var i = 0; i < 1; ++i) {
+    try { v.symbol(); } catch (e) {}
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();