Enable double alignment for constructed arrays.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 9d990bf93cc857ba325f11163fac940f84cc5c46..ddf82a11ee11207e0706f5b479deb20a2d2f0c55 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -2122,9 +2122,11 @@ HValue* HGraphBuilder::JSArrayBuilder::AllocateArray(HValue* size_in_bytes,
                                                   Representation::Smi());
   length_field = builder()->Add<HForceRepresentation>(length_field,
                                                       Representation::Smi());
+  InstanceType instance_type = IsFastDoubleElementsKind(kind_)
+      ? FIXED_DOUBLE_ARRAY_TYPE : JS_ARRAY_TYPE;
   // Allocate (dealing with failure appropriately)
   HAllocate* new_object = builder()->Add<HAllocate>(size_in_bytes,
-      HType::JSArray(), NOT_TENURED, JS_ARRAY_TYPE);
+      HType::JSArray(), NOT_TENURED, instance_type);

[Hannes Payer (out of office), 2013/10/23 09:49:34]

This is not correct. JS_ARRAY refers to the array object and FIXED_DOUBLE_ARRAY
to its elements. This change may result in a memory corruption since potential
mementos behind JS_ARRAY do not get cleared.
What about calling MakeDoubleAligned() instead?

[dusmil, 2013/10/23 13:27:35]

Yes, the problem there is that allocation of array object and its array of
elements is manually folded into one. I am sure it safe, but it is semantically
incorrect to change instance_type. Good point, it is better to call
MakeDoubleAligned. The new patch set will be uploaded soon, after testing is
done.

[dusmil, 2013/10/23 13:55:20]

Done.

 
   // Fill in the fields: map, properties, length
   HValue* map;