In-object double fields unboxing (for 64-bit only).

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 6051447bcdf5e4dce001a0947c79d48890abf592..a033f0aa48741c25cfd45368e5bd4676b02cd6ed 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -436,6 +436,8 @@ void Genesis::SetFunctionInstanceDescriptor(
                           prototype, attribs);
     map->AppendDescriptor(&d);
   }
+  // Must be called after map layout parameters are fully initialized.
+  Map::RebuildLayoutDescriptor(map);
 }
 
 
@@ -587,6 +589,8 @@ void Genesis::SetStrictFunctionInstanceDescriptor(
                           prototype, attribs);
     map->AppendDescriptor(&d);
   }
+  // Must be called after map layout parameters are fully initialized.
+  Map::RebuildLayoutDescriptor(map);
 }
 
 
@@ -926,8 +930,10 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
       CallbacksDescriptor d(
           Handle<Name>(Name::cast(array_length->name())),
           array_length, attribs);
-      array_function->initial_map()->AppendDescriptor(&d);
+      initial_map->AppendDescriptor(&d);
     }
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(initial_map);
 
     // array_function is used internally. JS code creating array object should
     // search for the 'Array' property on the global object and use that one
@@ -980,6 +986,8 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
       CallbacksDescriptor d(factory->length_string(), string_length, attribs);
       string_map->AppendDescriptor(&d);
     }
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(string_map);
   }
 
   {  // --- D a t e ---
@@ -1058,7 +1066,8 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
     initial_map->set_unused_property_fields(0);
     initial_map->set_instance_size(
         initial_map->instance_size() + 5 * kPointerSize);
-    initial_map->set_visitor_id(StaticVisitorBase::GetVisitorId(*initial_map));
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(initial_map);
 
     // RegExp prototype object is itself a RegExp.
     Handle<Map> proto_map = Map::Copy(initial_map);
@@ -1224,6 +1233,8 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
     map->set_prototype(native_context()->object_function()->prototype());
     map->set_pre_allocated_property_fields(1);
     map->set_inobject_properties(1);
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(map);
 
     // Copy constructor from the sloppy arguments boilerplate.
     map->set_constructor(
@@ -1646,8 +1657,10 @@ Handle<JSFunction> Genesis::InstallInternalArray(
   {  // Add length.
     CallbacksDescriptor d(
         Handle<Name>(Name::cast(array_length->name())), array_length, attribs);
-    array_function->initial_map()->AppendDescriptor(&d);
+    initial_map->AppendDescriptor(&d);
   }
+  // Must be called after map layout parameters are fully initialized.
+  Map::RebuildLayoutDescriptor(initial_map);
 
   return array_function;
 }
@@ -1843,6 +1856,8 @@ bool Genesis::InstallNatives() {
           script_source_mapping_url, attribs);
       script_map->AppendDescriptor(&d);
     }
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(script_map);
 
     // Allocate the empty script.
     Handle<Script> script = factory()->NewScript(factory()->empty_string());
@@ -1990,6 +2005,8 @@ bool Genesis::InstallNatives() {
     initial_map->set_inobject_properties(2);
     initial_map->set_pre_allocated_property_fields(2);
     initial_map->set_unused_property_fields(0);
+    // Must be called after map layout parameters are fully initialized.
+    Map::RebuildLayoutDescriptor(initial_map);
 
     native_context()->set_regexp_result_map(*initial_map);
   }