Replace HeapNumber as doublebox with an explicit MutableHeapNumber.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1706 matching lines @@
         String::cast(symbol->name())->StringShortPrint(accumulator);
       }
       accumulator->Add(">");
       break;
     }
     case HEAP_NUMBER_TYPE:
       accumulator->Add("<Number: ");
       HeapNumber::cast(this)->HeapNumberPrint(accumulator);
       accumulator->Put('>');
       break;
+    case MUTABLE_HEAP_NUMBER_TYPE:
+      accumulator->Add("<MutableNumber: ");
+      HeapNumber::cast(this)->HeapNumberPrint(accumulator);
+      accumulator->Put('>');
+      break;
     case JS_PROXY_TYPE:
       accumulator->Add("<JSProxy>");
       break;
     case JS_FUNCTION_PROXY_TYPE:
       accumulator->Add("<JSFunctionProxy>");
       break;
     case FOREIGN_TYPE:
       accumulator->Add("<Foreign>");
       break;
     case CELL_TYPE:
@@ skipping 103 matching lines @@
       Cell::BodyDescriptor::IterateBody(this, v);
       break;
     case PROPERTY_CELL_TYPE:
       PropertyCell::BodyDescriptor::IterateBody(this, v);
       break;
     case SYMBOL_TYPE:
       Symbol::BodyDescriptor::IterateBody(this, v);
       break;
 
     case HEAP_NUMBER_TYPE:
+    case MUTABLE_HEAP_NUMBER_TYPE:
     case FILLER_TYPE:
     case BYTE_ARRAY_TYPE:
     case FREE_SPACE_TYPE:
       break;
 
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                        \
     case EXTERNAL_##TYPE##_ARRAY_TYPE:                                         \
     case FIXED_##TYPE##_ARRAY_TYPE:                                            \
       break;
 
@@ skipping 36 matching lines @@
   }
   if (u.bits.exp == 0) {
     // Detect +0, and -0 for IEEE double precision floating point.
     if ((u.bits.man_low | u.bits.man_high) == 0) return false;
   }
   return true;
 }
 
 
 void HeapNumber::HeapNumberPrint(FILE* out) {
-  PrintF(out, "%.16g", Number());
+  PrintF(out, "%.16g", value());
 }
 
 
 void HeapNumber::HeapNumberPrint(StringStream* accumulator) {
   // The Windows version of vsnprintf can allocate when printing a %g string
   // into a buffer that may not be big enough.  We don't want random memory
   // allocation when producing post-crash stack traces, so we print into a
   // buffer that is plenty big enough for any floating point number, then
   // print that using vsnprintf (which may truncate but never allocate if
   // there is no more space in the buffer).
   EmbeddedVector<char, 100> buffer;
-  OS::SNPrintF(buffer, "%.16g", Number());
+  OS::SNPrintF(buffer, "%.16g", value());
   accumulator->Add("%s", buffer.start());
 }
 
 
 String* JSReceiver::class_name() {
   if (IsJSFunction() && IsJSFunctionProxy()) {
     return GetHeap()->function_class_string();
   }
   if (map()->constructor()->IsJSFunction()) {
     JSFunction* constructor = JSFunction::cast(map()->constructor());
@@ skipping 99 matching lines @@
   Representation representation = value->OptimalRepresentation(value_type);
   Handle<Map> new_map = CopyAddFieldDescriptor(
       handle(object->map()), name, index, attributes, representation, flag);
 
   JSObject::MigrateToMap(object, new_map);
 
   if (representation.IsDouble()) {
     // Nothing more to be done.
     if (value->IsUninitialized()) return;
     HeapNumber* box = HeapNumber::cast(object->RawFastPropertyAt(index));
+    ASSERT(box->IsMutableHeapNumber());
     box->set_value(value->Number());
   } else {
     object->FastPropertyAtPut(index, *value);
   }
 }
 
 
 static MaybeObject* CopyAddConstantDescriptor(Map* map,
                                               Name* name,
                                               Object* value,
@@ skipping 272 matching lines @@
   if (target_number_of_fields != number_of_fields) return true;
 
   // If smi descriptors were replaced by double descriptors, rewrite.
   DescriptorArray* old_desc = instance_descriptors();
   DescriptorArray* new_desc = target->instance_descriptors();
   int limit = NumberOfOwnDescriptors();
   for (int i = 0; i < limit; i++) {
     if (new_desc->GetDetails(i).representation().IsDouble() &&
         !old_desc->GetDetails(i).representation().IsDouble()) {
       return true;
+    } else if (old_desc->GetDetails(i).representation().IsDouble() &&
+               !new_desc->GetDetails(i).representation().IsDouble()) {
+      return true;
     }
   }
 
   // If no fields were added, and no inobject properties were removed, setting
   // the map is sufficient.
   if (target_inobject == inobject_properties()) return false;
   // In-object slack tracking may have reduced the object size of the new map.
   // In that case, succeed if all existing fields were inobject, and they still
   // fit within the new inobject size.
   ASSERT(target_inobject < inobject_properties());
@@ skipping 62 matching lines @@
     Object* raw_value = old_details.type() == CONSTANT
         ? old_descriptors->GetValue(i)
         : object->RawFastPropertyAt(old_descriptors->GetFieldIndex(i));
     Handle<Object> value(raw_value, isolate);
     if (!old_details.representation().IsDouble() &&
         details.representation().IsDouble()) {
       if (old_details.representation().IsNone()) {
         value = handle(Smi::FromInt(0), isolate);
       }
       value = NewStorageFor(isolate, value, details.representation());
+    } else if (old_details.representation().IsDouble() &&
+               !details.representation().IsDouble()) {
+      Handle<HeapNumber> old_value = Handle<HeapNumber>::cast(value);
+      value = isolate->factory()->NewHeapNumber(old_value->value());
     }
     ASSERT(!(details.representation().IsDouble() && value->IsSmi()));
     int target_index = new_descriptors->GetFieldIndex(i) - inobject;
     if (target_index < 0) target_index += total_size;
     array->set(target_index, *value);
   }
 
   for (int i = old_nof; i < new_nof; i++) {
     PropertyDetails details = new_descriptors->GetDetails(i);
     if (details.type() != FIELD) continue;
     if (details.representation().IsDouble()) {
       int target_index = new_descriptors->GetFieldIndex(i) - inobject;
       if (target_index < 0) target_index += total_size;
-      Handle<Object> box = isolate->factory()->NewHeapNumber(0);
+      Handle<Object> box = isolate->factory()->NewMutableHeapNumber(0);
       array->set(target_index, *box);
     }
   }
 
   // From here on we cannot fail and we shouldn't GC anymore.
   DisallowHeapAllocation no_allocation;
 
   // Copy (real) inobject properties. If necessary, stop at number_of_fields to
   // avoid overwriting |one_pointer_filler_map|.
   int limit = Min(inobject, number_of_fields);
@@ skipping 1476 matching lines @@
   descriptors = transition_map->instance_descriptors();
   details = descriptors->GetDetails(descriptor);
 
   if (details.type() != FIELD) return value;
 
   int field_index = descriptors->GetFieldIndex(descriptor);
   if (details.representation().IsDouble()) {
     // Nothing more to be done.
     if (value->IsUninitialized()) return value;
     HeapNumber* box = HeapNumber::cast(object->RawFastPropertyAt(field_index));
+    ASSERT(box->IsMutableHeapNumber());
     box->set_value(value->Number());
   } else {
     object->FastPropertyAtPut(field_index, *value);
   }
 
   return value;
 }
 
 
 static void SetPropertyToField(LookupResult* lookup,
                                Handle<Name> name,
                                Handle<Object> value) {
   Representation representation = lookup->representation();
   if (!value->FitsRepresentation(representation) ||
       lookup->type() == CONSTANT) {
     JSObject::GeneralizeFieldRepresentation(handle(lookup->holder()),
                                             lookup->GetDescriptorIndex(),
                                             value->OptimalRepresentation(),
                                             FORCE_FIELD);
     DescriptorArray* desc = lookup->holder()->map()->instance_descriptors();
     int descriptor = lookup->GetDescriptorIndex();
     representation = desc->GetDetails(descriptor).representation();
   }
 
   if (representation.IsDouble()) {
     HeapNumber* storage = HeapNumber::cast(lookup->holder()->RawFastPropertyAt(
         lookup->GetFieldIndex().field_index()));
+    ASSERT(storage->IsMutableHeapNumber());
     storage->set_value(value->Number());
     return;
   }
 
   lookup->holder()->FastPropertyAtPut(
       lookup->GetFieldIndex().field_index(), *value);
 }
 
 
 static void ConvertAndSetLocalProperty(LookupResult* lookup,
@@ skipping 630 matching lines @@
         Handle<Object> value(descs->GetConstant(i), isolate);
         PropertyDetails d = PropertyDetails(
             details.attributes(), NORMAL, i + 1);
         dictionary = NameDictionaryAdd(dictionary, key, value, d);
         break;
       }
       case FIELD: {
         Handle<Name> key(descs->GetKey(i));
         Handle<Object> value(
             object->RawFastPropertyAt(descs->GetFieldIndex(i)), isolate);
+        if (details.representation().IsDouble()) {
+          ASSERT(value->IsMutableHeapNumber());
+          Handle<HeapNumber> old = Handle<HeapNumber>::cast(value);
+          value = isolate->factory()->NewHeapNumber(old->value());
+        }
         PropertyDetails d =
             PropertyDetails(details.attributes(), NORMAL, i + 1);
         dictionary = NameDictionaryAdd(dictionary, key, value, d);
         break;
       }
       case CALLBACKS: {
         Handle<Name> key(descs->GetKey(i));
         Handle<Object> value(descs->GetCallbacksObject(i), isolate);
         PropertyDetails d = PropertyDetails(
             details.attributes(), CALLBACKS, i + 1);
@@ skipping 2008 matching lines @@
 
 
 Object* JSObject::SlowReverseLookup(Object* value) {
   if (HasFastProperties()) {
     int number_of_own_descriptors = map()->NumberOfOwnDescriptors();
     DescriptorArray* descs = map()->instance_descriptors();
     for (int i = 0; i < number_of_own_descriptors; i++) {
       if (descs->GetType(i) == FIELD) {
         Object* property = RawFastPropertyAt(descs->GetFieldIndex(i));
         if (descs->GetDetails(i).representation().IsDouble()) {
-          ASSERT(property->IsHeapNumber());
+          ASSERT(property->IsMutableHeapNumber());
           if (value->IsNumber() && property->Number() == value->Number()) {
             return descs->GetKey(i);
           }
         } else if (property == value) {
           return descs->GetKey(i);
         }
       } else if (descs->GetType(i) == CONSTANT) {
         if (descs->GetConstant(i) == value) {
           return descs->GetKey(i);
         }
@@ skipping 9725 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal