Replace HeapNumber as doublebox with an explicit MutableHeapNumber.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index ddd321ca28906d5b0873741e639508f8b7f80cea..88d1386667183bac21043168bceb65838f6fa2cf 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -177,6 +177,7 @@ bool Object::NonFailureIsHeapObject() {
 
 
 TYPE_CHECKER(HeapNumber, HEAP_NUMBER_TYPE)
+TYPE_CHECKER(MutableHeapNumber, MUTABLE_HEAP_NUMBER_TYPE)
 TYPE_CHECKER(Symbol, SYMBOL_TYPE)
 
 
@@ -282,10 +283,26 @@ MaybeObject* Object::AllocateNewStorageFor(Heap* heap,
     return Smi::FromInt(0);
   }
   if (!representation.IsDouble()) return this;
+  double value;
   if (IsUninitialized()) {
-    return heap->AllocateHeapNumber(0);
+    value = 0;
+  } else if (IsMutableHeapNumber()) {
+    value = HeapNumber::cast(this)->value();
+  } else {
+    value = Number();
   }
-  return heap->AllocateHeapNumber(Number());
+  return heap->AllocateHeapNumber(value, MUTABLE);
+}
+
+
+MaybeObject* Object::WrapForRead(Heap* heap,
+                                 Representation representation) {
+  ASSERT(!IsUninitialized());
+  if (!representation.IsDouble()) {
+    ASSERT(FitsRepresentation(representation));
+    return this;
+  }
+  return heap->AllocateHeapNumber(HeapNumber::cast(this)->value());
 }
 
 
@@ -1954,7 +1971,7 @@ void JSObject::SetInternalField(int index, Smi* value) {
 MaybeObject* JSObject::FastPropertyAt(Representation representation,
                                       int index) {
   Object* raw_value = RawFastPropertyAt(index);
-  return raw_value->AllocateNewStorageFor(GetHeap(), representation);
+  return raw_value->WrapForRead(GetHeap(), representation);
 }
 
 
@@ -2885,7 +2902,6 @@ CAST_ACCESSOR(JSReceiver)
 CAST_ACCESSOR(JSObject)
 CAST_ACCESSOR(Smi)
 CAST_ACCESSOR(HeapObject)
-CAST_ACCESSOR(HeapNumber)
 CAST_ACCESSOR(Oddball)
 CAST_ACCESSOR(Cell)
 CAST_ACCESSOR(PropertyCell)
@@ -5776,6 +5792,12 @@ JSValue* JSValue::cast(Object* obj) {
 }
 
 
+HeapNumber* HeapNumber::cast(Object* object) {
+  SLOW_ASSERT(object->IsHeapNumber() || object->IsMutableHeapNumber());
+  return reinterpret_cast<HeapNumber*>(object);
+}
+
+
 ACCESSORS(JSDate, value, Object, kValueOffset)
 ACCESSORS(JSDate, cache_stamp, Object, kCacheStampOffset)
 ACCESSORS(JSDate, year, Object, kYearOffset)