[compiler] Read the FixedDoubleArray value from the Ref only once

When reading the FixedDoubleArray value and representation, we are
reading the same value but bitcasting it diffrently. In this vein, we
can read it only once and ask whether it is the hole or not.

Bug: v8:7790
Change-Id: I0d7b29ce037b9abb55c5a1332c7e6d06887905e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2428587
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70119}
diff --git a/src/compiler/heap-refs.h b/src/compiler/heap-refs.h
index 3716270..7443a9b 100644
--- a/src/compiler/heap-refs.h
+++ b/src/compiler/heap-refs.h
@@ -10,6 +10,7 @@
 #include "src/objects/elements-kind.h"
 #include "src/objects/feedback-vector.h"
 #include "src/objects/instance-type.h"
+#include "src/utils/boxed-float.h"
 
 namespace v8 {
 class CFunctionInfo;
@@ -719,8 +720,7 @@
 
   Handle<FixedDoubleArray> object() const;
 
-  double get_scalar(int i) const;
-  bool is_the_hole(int i) const;
+  Float64 get(int i) const;
 };
 
 class BytecodeArrayRef : public FixedArrayBaseRef {
diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index 9fe9688..8d79036 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -1770,10 +1770,11 @@
   if (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE) {
     FixedDoubleArrayRef elements = boilerplate_elements.AsFixedDoubleArray();
     for (int i = 0; i < elements_length; ++i) {
-      if (elements.is_the_hole(i)) {
+      Float64 value = elements.get(i);
+      if (value.is_hole_nan()) {
         elements_values[i] = jsgraph()->TheHoleConstant();
       } else {
-        elements_values[i] = jsgraph()->Constant(elements.get_scalar(i));
+        elements_values[i] = jsgraph()->Constant(value.get_scalar());
       }
     }
   } else {
diff --git a/src/compiler/js-heap-broker.cc b/src/compiler/js-heap-broker.cc
index 61499c2..8b33b7c 100644
--- a/src/compiler/js-heap-broker.cc
+++ b/src/compiler/js-heap-broker.cc
@@ -34,7 +34,6 @@
 #include "src/objects/objects-inl.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/objects/templates.h"
-#include "src/utils/boxed-float.h"
 #include "src/utils/utils.h"
 
 namespace v8 {
@@ -3198,24 +3197,13 @@
   return ObjectRef(broker(), data()->AsFixedArray()->Get(i));
 }
 
-bool FixedDoubleArrayRef::is_the_hole(int i) const {
+Float64 FixedDoubleArrayRef::get(int i) const {
   if (data_->should_access_heap()) {
     AllowHandleDereferenceIfNeeded allow_handle_dereference(data()->kind(),
                                                             broker()->mode());
-    return object()->is_the_hole(i);
+    return Float64::FromBits(object()->get_representation(i));
   } else {
-    return data()->AsFixedDoubleArray()->Get(i).is_hole_nan();
-  }
-}
-
-double FixedDoubleArrayRef::get_scalar(int i) const {
-  if (data_->should_access_heap()) {
-    AllowHandleDereferenceIfNeeded allow_handle_dereference(data()->kind(),
-                                                            broker()->mode());
-    return object()->get_scalar(i);
-  } else {
-    CHECK(!data()->AsFixedDoubleArray()->Get(i).is_hole_nan());
-    return data()->AsFixedDoubleArray()->Get(i).get_scalar();
+    return data()->AsFixedDoubleArray()->Get(i);
   }
 }