Replace HeapNumber as doublebox with an explicit MutableHeapNumber.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 169 matching lines @@
   STORE_NO_TRANSITION_HANDLE_COW
 };
 
 
 enum ContextualMode {
   NOT_CONTEXTUAL,
   CONTEXTUAL
 };
 
 
+enum MutableMode {
+  MUTABLE,
+  IMMUTABLE
+};
+
+
 static const int kGrowICDelta = STORE_AND_GROW_NO_TRANSITION -
     STANDARD_STORE;
 STATIC_ASSERT(STANDARD_STORE == 0);
 STATIC_ASSERT(kGrowICDelta ==
               STORE_AND_GROW_TRANSITION_SMI_TO_OBJECT -
               STORE_TRANSITION_SMI_TO_OBJECT);
 STATIC_ASSERT(kGrowICDelta ==
               STORE_AND_GROW_TRANSITION_SMI_TO_DOUBLE -
               STORE_TRANSITION_SMI_TO_DOUBLE);
 STATIC_ASSERT(kGrowICDelta ==
@@ skipping 166 matching lines @@
                                                                                \
   V(SYMBOL_TYPE)                                                               \
                                                                                \
   V(MAP_TYPE)                                                                  \
   V(CODE_TYPE)                                                                 \
   V(ODDBALL_TYPE)                                                              \
   V(CELL_TYPE)                                                                 \
   V(PROPERTY_CELL_TYPE)                                                        \
                                                                                \
   V(HEAP_NUMBER_TYPE)                                                          \
+  V(MUTABLE_HEAP_NUMBER_TYPE)                                                  \
   V(FOREIGN_TYPE)                                                              \
   V(BYTE_ARRAY_TYPE)                                                           \
   V(FREE_SPACE_TYPE)                                                           \
   /* Note: the order of these external array */                                \
   /* types is relied upon in */                                                \
   /* Object::IsExternalArray(). */                                             \
   V(EXTERNAL_INT8_ARRAY_TYPE)                                                  \
   V(EXTERNAL_UINT8_ARRAY_TYPE)                                                 \
   V(EXTERNAL_INT16_ARRAY_TYPE)                                                 \
   V(EXTERNAL_UINT16_ARRAY_TYPE)                                                \
@@ skipping 328 matching lines @@
   // Objects allocated in their own spaces (never in new space).
   MAP_TYPE,
   CODE_TYPE,
   ODDBALL_TYPE,
   CELL_TYPE,
   PROPERTY_CELL_TYPE,
 
   // "Data", objects that cannot contain non-map-word pointers to heap
   // objects.
   HEAP_NUMBER_TYPE,
+  MUTABLE_HEAP_NUMBER_TYPE,
   FOREIGN_TYPE,
   BYTE_ARRAY_TYPE,
   FREE_SPACE_TYPE,
 
   EXTERNAL_INT8_ARRAY_TYPE,  // FIRST_EXTERNAL_ARRAY_TYPE
   EXTERNAL_UINT8_ARRAY_TYPE,
   EXTERNAL_INT16_ARRAY_TYPE,
   EXTERNAL_UINT16_ARRAY_TYPE,
   EXTERNAL_INT32_ARRAY_TYPE,
   EXTERNAL_UINT32_ARRAY_TYPE,
@@ skipping 251 matching lines @@
 };
 
 
 #define OBJECT_TYPE_LIST(V)                    \
   V(Smi)                                       \
   V(HeapObject)                                \
   V(Number)                                    \
 
 #define HEAP_OBJECT_TYPE_LIST(V)               \
   V(HeapNumber)                                \
+  V(MutableHeapNumber)                         \
   V(Name)                                      \
   V(UniqueName)                                \
   V(String)                                    \
   V(SeqString)                                 \
   V(ExternalString)                            \
   V(ConsString)                                \
   V(SlicedString)                              \
   V(ExternalTwoByteString)                     \
   V(ExternalAsciiString)                       \
   V(SeqTwoByteString)                          \
@@ skipping 498 matching lines @@
       return Representation::Tagged();
     }
   }
 
   inline bool FitsRepresentation(Representation representation) {
     if (FLAG_track_fields && representation.IsNone()) {
       return false;
     } else if (FLAG_track_fields && representation.IsSmi()) {
       return IsSmi();
     } else if (FLAG_track_double_fields && representation.IsDouble()) {
-      return IsNumber();
+      return IsMutableHeapNumber() || IsNumber();
     } else if (FLAG_track_heap_object_fields && representation.IsHeapObject()) {
       return IsHeapObject();
     }
     return true;
   }
 
   inline MaybeObject* AllocateNewStorageFor(Heap* heap,
                                             Representation representation);
+  inline MaybeObject* WrapForRead(Heap* heap, Representation representation);
 
   // Returns true if the object is of the correct type to be used as a
   // implementation of a JSObject's elements.
   inline bool HasValidElements();
 
   inline bool HasSpecificClassOf(String* name);
 
   MUST_USE_RESULT MaybeObject* ToObject(Isolate* isolate);  // ECMA-262 9.9.
   bool BooleanValue();                                      // ECMA-262 9.2.
 
@@ skipping 1077 matching lines @@
       Handle<JSObject> object);
 
   // Transform slow named properties to fast variants.
   static void TransformToFastProperties(Handle<JSObject> object,
                                         int unused_property_fields);
 
   // Access fast-case object properties at index.
   MUST_USE_RESULT inline MaybeObject* FastPropertyAt(
       Representation representation,
       int index);
+  static Handle<Object> FastPropertyAt(Handle<JSObject> object,
+                                       Representation representation,
+                                       int index);
   inline Object* RawFastPropertyAt(int index);
   inline void FastPropertyAtPut(int index, Object* value);
 
   // Access to in object properties.
   inline int GetInObjectPropertyOffset(int index);
   inline Object* InObjectPropertyAt(int index);
   inline Object* InObjectPropertyAtPut(int index,
                                        Object* value,
                                        WriteBarrierMode mode
                                        = UPDATE_WRITE_BARRIER);
@@ skipping 8191 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_