Enable double alignment for constructed arrays.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2104 matching lines @@
                                                      HValue* capacity,
                                                      HValue* length_field,
                                                      bool fill_with_hole) {
   // These HForceRepresentations are because we store these as fields in the
   // objects we construct, and an int32-to-smi HChange could deopt. Accept
   // the deopt possibility now, before allocation occurs.
   capacity = builder()->Add<HForceRepresentation>(capacity,
                                                   Representation::Smi());
   length_field = builder()->Add<HForceRepresentation>(length_field,
                                                       Representation::Smi());
+  InstanceType instance_type = IsFastDoubleElementsKind(kind_)
+      ? FIXED_DOUBLE_ARRAY_TYPE : JS_ARRAY_TYPE;
   // Allocate (dealing with failure appropriately)
   HAllocate* new_object = builder()->Add<HAllocate>(size_in_bytes,
-      HType::JSArray(), NOT_TENURED, JS_ARRAY_TYPE);
+      HType::JSArray(), NOT_TENURED, instance_type);

[Hannes Payer (out of office), 2013/10/23 09:49:34]

This is not correct. JS_ARRAY refers to the array object and FIXED_DOUBLE_ARRAY
to its elements. This change may result in a memory corruption since potential
mementos behind JS_ARRAY do not get cleared.
What about calling MakeDoubleAligned() instead?

[dusmil, 2013/10/23 13:27:35]

Yes, the problem there is that allocation of array object and its array of
elements is manually folded into one. I am sure it safe, but it is semantically
incorrect to change instance_type. Good point, it is better to call
MakeDoubleAligned. The new patch set will be uploaded soon, after testing is
done.

[dusmil, 2013/10/23 13:55:20]

Done.

 
   // Fill in the fields: map, properties, length
   HValue* map;
   if (allocation_site_payload_ == NULL) {
     map = EmitInternalMapCode();
   } else {
     map = EmitMapCode();
   }
   elements_location_ = builder()->BuildJSArrayHeader(new_object,
                                                      map,
@@ skipping 7676 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal