[turbofan] Remove remaining heap accesses from pipeline

Bug: v8:7790
Change-Id: Id213800587f08df544bea4f9fca7460d136baeb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1786280
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63590}

src/compiler/heap-refs.h

@@ -769,7 +769,8 @@ class ScopeInfoRef : public HeapObjectRef {
   V(bool, is_safe_to_skip_arguments_adaptor) \
   V(bool, IsInlineable)                      \
   V(int, StartPosition)                      \
-  V(bool, is_compiled)
+  V(bool, is_compiled)                       \
+  V(bool, IsUserJavaScript)
 
 class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
  public:

src/compiler/pipeline.cc

@@ -2218,12 +2218,13 @@ bool PipelineImpl::CreateGraph() {
 
   // Determine the Typer operation flags.
   {
-    if (is_sloppy(info()->shared_info()->language_mode()) &&
-        info()->shared_info()->IsUserJavaScript()) {
+    SharedFunctionInfoRef shared_info(data->broker(), info()->shared_info());
+    if (is_sloppy(shared_info.language_mode()) &&
+        shared_info.IsUserJavaScript()) {
       // Sloppy mode functions always have an Object for this.
       data->AddTyperFlag(Typer::kThisIsReceiver);
     }
-    if (IsClassConstructor(info()->shared_info()->kind())) {
+    if (IsClassConstructor(shared_info.kind())) {
       // Class constructors cannot be [[Call]]ed.
       data->AddTyperFlag(Typer::kNewTargetIsReceiver);
     }