Replace HeapNumber as doublebox with an explicit MutableHeapNumber.

src/heap-snapshot-generator.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/heap-snapshot-generator-inl.h"
 
 #include "src/allocation-tracker.h"
 #include "src/code-stubs.h"
@@ skipping 1623 matching lines @@
 }
 
 
 void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
   if (js_obj->HasFastProperties()) {
     DescriptorArray* descs = js_obj->map()->instance_descriptors();
     int real_size = js_obj->map()->NumberOfOwnDescriptors();
     for (int i = 0; i < real_size; i++) {
       switch (descs->GetType(i)) {
         case FIELD: {
+          Representation r = descs->GetDetails(i).representation();
+          if (r.IsSmi() || r.IsDouble()) break;
           int index = descs->GetFieldIndex(i);
 
           Name* k = descs->GetKey(i);
           if (index < js_obj->map()->inobject_properties()) {
             Object* value = js_obj->InObjectPropertyAt(index);
             if (k != heap_->hidden_string()) {
               SetPropertyReference(
                   js_obj, entry,
                   k, value,
                   NULL,
@@ skipping 1517 matching lines @@
   writer_->AddString("\"<dummy>\"");
   for (int i = 1; i < sorted_strings.length(); ++i) {
     writer_->AddCharacter(',');
     SerializeString(sorted_strings[i]);
     if (writer_->aborted()) return;
   }
 }
 
 
 } }  // namespace v8::internal