Always 64-bit align floating point values in heap numbers....

src/objects-inl.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 686 matching lines @@
 
 
 Object* Object::GetProperty(String* key, PropertyAttributes* attributes) {
   return GetPropertyWithReceiver(this, key, attributes);
 }
 
 
 #define FIELD_ADDR(p, offset) \
   (reinterpret_cast<byte*>(p) + offset - kHeapObjectTag)
 
+#define FIELD_ADDR_ALIGNED_8(p, offset) \
+  (reinterpret_cast<byte*>((reinterpret_cast<intptr_t>(p) + offset - kHeapObjectTag + 4) & -8))
+
 #define READ_FIELD(p, offset) \
   (*reinterpret_cast<Object**>(FIELD_ADDR(p, offset)))
 
 #define WRITE_FIELD(p, offset, value) \
   (*reinterpret_cast<Object**>(FIELD_ADDR(p, offset)) = value)
 
-
 #define WRITE_BARRIER(object, offset) \
   Heap::RecordWrite(object->address(), offset);
 
 // CONDITIONAL_WRITE_BARRIER must be issued after the actual
 // write due to the assert validating the written value.
 #define CONDITIONAL_WRITE_BARRIER(object, offset, mode) \
   if (mode == UPDATE_WRITE_BARRIER) { \
     Heap::RecordWrite(object->address(), offset); \
   } else { \
     ASSERT(mode == SKIP_WRITE_BARRIER); \
     ASSERT(Heap::InNewSpace(object) || \
            !Heap::InNewSpace(READ_FIELD(object, offset))); \
   }
 
-#define READ_DOUBLE_FIELD(p, offset) \
-  (*reinterpret_cast<double*>(FIELD_ADDR(p, offset)))
+#define READ_HEAP_NUMBER_FIELD(p, offset) \
+  (*reinterpret_cast<double*>(FIELD_ADDR_ALIGNED_8(p, offset)))
 
-#define WRITE_DOUBLE_FIELD(p, offset, value) \
-  (*reinterpret_cast<double*>(FIELD_ADDR(p, offset)) = value)
+#define WRITE_HEAP_NUMBER_FIELD(p, offset, value) \
+  (*reinterpret_cast<double*>(FIELD_ADDR_ALIGNED_8(p, offset)) = value)
 
 #define READ_INT_FIELD(p, offset) \
   (*reinterpret_cast<int*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_INT_FIELD(p, offset, value) \
   (*reinterpret_cast<int*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_INTPTR_FIELD(p, offset) \
   (*reinterpret_cast<intptr_t*>(FIELD_ADDR(p, offset)))
 
@@ skipping 349 matching lines @@
 
 void HeapObject::ClearOverflow() {
   ASSERT(IsOverflowed());
   MapWord first_word = map_word();
   first_word.ClearOverflow();
   set_map_word(first_word);
 }
 
 
 double HeapNumber::value() {
-  return READ_DOUBLE_FIELD(this, kValueOffset);
+  return READ_HEAP_NUMBER_FIELD(this, kValueMinimumOffset);
 }
 
 
 void HeapNumber::set_value(double value) {
-  WRITE_DOUBLE_FIELD(this, kValueOffset, value);
+  WRITE_HEAP_NUMBER_FIELD(this, kValueMinimumOffset, value);
 }
 
 
 ACCESSORS(JSObject, properties, FixedArray, kPropertiesOffset)
 
 
 Array* JSObject::elements() {
   Object* array = READ_FIELD(this, kElementsOffset);
   // In the assert below Dictionary is covered under FixedArray.
   ASSERT(array->IsFixedArray() || array->IsPixelArray() ||
@@ skipping 1895 matching lines @@
 }
 
 
 #undef CAST_ACCESSOR
 #undef INT_ACCESSORS
 #undef SMI_ACCESSORS
 #undef ACCESSORS
 #undef FIELD_ADDR
 #undef READ_FIELD
 #undef WRITE_FIELD
+#undef FIELD_ADDR_ALIGNED_8
 #undef WRITE_BARRIER
 #undef CONDITIONAL_WRITE_BARRIER
 #undef READ_MEMADDR_FIELD
 #undef WRITE_MEMADDR_FIELD
-#undef READ_DOUBLE_FIELD
-#undef WRITE_DOUBLE_FIELD
+#undef READ_HEAP_NUMBER_FIELD
+#undef WRITE_HEAP_NUMBER_FIELD
 #undef READ_INT_FIELD
 #undef WRITE_INT_FIELD
 #undef READ_SHORT_FIELD
 #undef WRITE_SHORT_FIELD
 #undef READ_BYTE_FIELD
 #undef WRITE_BYTE_FIELD
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_INL_H_