[compiler] Replace HeapNumberData with direct reads

Bug: v8:7790
Change-Id: I0194178cd73715b2a7e229dd7ce52a67c2280881
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2382312
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69743}

src/compiler/heap-refs.h

@@ -56,7 +56,9 @@ enum class OddballType : uint8_t {
 // FLAG_turbo_direct_heap_access is on. Otherwise, they might get serialized.
 #define HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(V) \
   /* Subtypes of FixedArrayBase */                  \
-  V(FixedDoubleArray)
+  V(FixedDoubleArray)                               \
+  /* Subtypes of HeapObject */                      \
+  V(HeapNumber)
 
 // This list is sorted such that subtypes appear before their supertypes.
 // DO NOT VIOLATE THIS PROPERTY!
@@ -99,7 +101,6 @@ enum class OddballType : uint8_t {
   V(FeedbackVector)                           \
   V(FixedArrayBase)                           \
   V(FunctionTemplateInfo)                     \
-  V(HeapNumber)                               \
   V(JSReceiver)                               \
   V(Map)                                      \
   V(Name)                                     \

src/compiler/js-heap-broker.cc

@@ -696,7 +696,9 @@ class HeapNumberData : public HeapObjectData {
  public:
   HeapNumberData(JSHeapBroker* broker, ObjectData** storage,
                  Handle<HeapNumber> object)
-      : HeapObjectData(broker, storage, object), value_(object->value()) {}
+      : HeapObjectData(broker, storage, object), value_(object->value()) {
+    DCHECK(!FLAG_turbo_direct_heap_access);
+  }
 
   double value() const { return value_; }
 
@@ -3318,8 +3320,13 @@ Handle<Object> JSHeapBroker::GetRootHandle(Object object) {
   return Handle<Object>(isolate()->root_handle(root_index).location());
 }
 
+// We can special case kNeverSerializedHeapObject (which is included in
+// data_->should_access_heap()) to avoid the Allow scopes that we need for the
+// other kinds accepted in should_access_heap().
 #define IF_ACCESS_FROM_HEAP_C(name)                                      \
-  if (data_->should_access_heap()) {                                     \
+  if (data_->kind() == ObjectDataKind::kNeverSerializedHeapObject) {     \
+    return object()->name();                                             \
+  } else if (data_->should_access_heap()) {                              \
     AllowHandleAllocationIf handle_allocation(data_->kind(),             \
                                               broker()->mode());         \
     AllowHandleDereferenceIf allow_handle_dereference(data_->kind(),     \
@@ -3389,6 +3396,8 @@ BIMODAL_ACCESSOR_C(FeedbackVector, double, invocation_count)
 
 BIMODAL_ACCESSOR(HeapObject, Map, map)
 
+BIMODAL_ACCESSOR_C(HeapNumber, double, value)
+
 BIMODAL_ACCESSOR(JSArray, Object, length)
 
 BIMODAL_ACCESSOR(JSBoundFunction, JSReceiver, bound_target_function)
@@ -3929,11 +3938,6 @@ base::Optional<ObjectRef> JSArrayRef::GetOwnCowElement(
   return ObjectRef(broker(), element);
 }
 
-double HeapNumberRef::value() const {
-  IF_ACCESS_FROM_HEAP_C(value);
-  return data()->AsHeapNumber()->value();
-}
-
 uint64_t BigIntRef::AsUint64() const {
   IF_ACCESS_FROM_HEAP_C(AsUint64);
   return data()->AsBigInt()->AsUint64();