Always 64-bit align floating point values in heap numbers....

src/ia32/ic-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 441 matching lines @@
       // to a 64-bit int manually.
       __ push(Immediate(0));
       __ push(eax);
       __ fild_d(Operand(esp, 0));
       __ pop(eax);
       __ pop(eax);
     }
     // FP(0): value
     __ AllocateHeapNumber(eax, ebx, ecx, &failed_allocation);
     // Set the value.
-    __ fstp_d(FieldOperand(eax, HeapNumber::kValueOffset));
+    __ GenerateHeapNumberValueAddress(ebx, eax);
+    __ fstp_d(Operand(ebx, 0));
     __ ret(0);
   } else if (array_type == kExternalFloatArray) {
     // For the floating-point array type, we need to always allocate a
     // HeapNumber.
     __ AllocateHeapNumber(eax, ebx, ecx, &failed_allocation);
     // Set the value.
-    __ fstp_d(FieldOperand(eax, HeapNumber::kValueOffset));
+    __ GenerateHeapNumberValueAddress(ebx, eax);
+    __ fstp_d(Operand(ebx, 0));
     __ ret(0);
   } else {
     __ shl(eax, kSmiTagSize);
     __ ret(0);
   }
 
   // If we fail allocation of the HeapNumber, we still have a value on
   // top of the FPU stack. Remove it.
   __ bind(&failed_allocation);
   __ ffree();
@@ skipping 234 matching lines @@
   __ ret(0);
 
   __ bind(&check_heap_number);
   __ cmp(FieldOperand(eax, HeapObject::kMapOffset),
          Immediate(Factory::heap_number_map()));
   __ j(not_equal, &slow);
 
   // The WebGL specification leaves the behavior of storing NaN and
   // +/-Infinity into integer arrays basically undefined. For more
   // reproducible behavior, convert these to zero.
-  __ fld_d(FieldOperand(eax, HeapNumber::kValueOffset));
+  __ GenerateHeapNumberValueAddress(edx, eax);
+  __ fld_d(Operand(edx, 0));
   __ mov(edx, eax);  // Save the value.
   __ mov(ecx, FieldOperand(ecx, ExternalArray::kExternalPointerOffset));
   // ebx: untagged index
   // ecx: base pointer of external storage
   // top of FPU stack: value
   if (array_type == kExternalFloatArray) {
     __ fstp_s(Operand(ecx, ebx, times_4, 0));
     __ mov(eax, edx);  // Return the original value.
     __ ret(0);
   } else {
@@ skipping 30 matching lines @@
         break;
       case kExternalIntArray:
       case kExternalUnsignedIntArray: {
         // We also need to explicitly check for +/-Infinity. These are
         // converted to MIN_INT, but we need to be careful not to
         // confuse with legal uses of MIN_INT.
         Label not_infinity;
         // This test would apparently detect both NaN and Infinity,
         // but we've already checked for NaN using the FPU hardware
         // above.
-        __ mov_w(edi, FieldOperand(edx, HeapNumber::kValueOffset + 6));
+        __ GenerateHeapNumberValueAddress(edi, edx);
+        __ mov_w(edi, Operand(edi, 6));
         __ and_(edi, 0x7FF0);
         __ cmp(edi, 0x7FF0);
         __ j(not_equal, &not_infinity);
         __ mov(eax, 0);
         __ bind(&not_infinity);
         __ mov(Operand(ecx, ebx, times_4, 0), eax);
         break;
       }
       default:
         UNREACHABLE();
@@ skipping 576 matching lines @@
 
   // Do tail-call to runtime routine.
   __ TailCallRuntime(
       ExternalReference(IC_Utility(kSharedStoreIC_ExtendStorage)), 3, 1);
 }
 
 #undef __
 
 
 } }  // namespace v8::internal