[compiler] Skip DescriptorArray search in IsReadOnlyLengthDescriptor

We can hardcode the result and to make sure we are using the correct
offset, we now have a static_assert.

Change-Id: Ic04ce9f8e46847504d3d0a5921f55cb750f7f3ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831473
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74044}

src/compiler/js-heap-broker.cc

@@ -1308,13 +1308,13 @@ InstanceType HeapObjectData::GetMapInstanceType() const {
 namespace {
 bool IsReadOnlyLengthDescriptor(Isolate* isolate, Handle<Map> jsarray_map) {
   DCHECK(!jsarray_map->is_dictionary_map());
-  Handle<Name> length_string = isolate->factory()->length_string();
   DescriptorArray descriptors =
       jsarray_map->instance_descriptors(isolate, kRelaxedLoad);
-  // TODO(jkummerow): We could skip the search and hardcode number == 0.
-  InternalIndex number = descriptors.Search(*length_string, *jsarray_map);
-  DCHECK(number.is_found());
-  return descriptors.GetDetails(number).IsReadOnly();
+  static_assert(
+      JSArray::kLengthOffset == JSObject::kHeaderSize,
+      "The length should be the first property on the descriptor array");
+  InternalIndex offset(0);
+  return descriptors.GetDetails(offset).IsReadOnly();
 }
 
 bool SupportsFastArrayIteration(Isolate* isolate, Handle<Map> map) {