Add %LoadMutableDouble index check.

src/field-index-inl.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_FIELD_INDEX_INL_H_
 #define V8_FIELD_INDEX_INL_H_
 
 #include "src/field-index.h"
 
 namespace v8 {
@@ skipping 51 matching lines @@
     first_inobject_offset = map->GetInObjectPropertyOffset(0);
     field_index += JSObject::kHeaderSize / kPointerSize;
   }
   FieldIndex result(is_inobject, field_index, is_double,
                     map->inobject_properties(), first_inobject_offset);
   DCHECK(result.GetLoadByFieldIndex() == orig_index);
   return result;
 }
 
 
+inline bool FieldIndex::LoadByFieldIndexValid(int index) {
+  index >>= 1;
+  if (index < 0) {
+    index = -(index + 1);
+    index += FixedArray::kHeaderSize / kPointerSize;
+  } else {
+    index += JSObject::kHeaderSize / kPointerSize;
+  }
+  return IndexBits::is_valid(index);
+}
+
+
 // Returns the index format accepted by the HLoadFieldByIndex instruction.
 // (In-object: zero-based from (object start + JSObject::kHeaderSize),
 // out-of-object: zero-based from FixedArray::kHeaderSize.)
 inline int FieldIndex::GetLoadByFieldIndex() const {
   // For efficiency, the LoadByFieldIndex instruction takes an index that is
   // optimized for quick access. If the property is inline, the index is
   // positive. If it's out-of-line, the encoded index is -raw_index - 1 to
   // disambiguate the zero out-of-line index from the zero inobject case.
   // The index itself is shifted up by one bit, the lower-most bit
   // signifying if the field is a mutable double box (1) or not (0).
@@ skipping 38 matching lines @@
     return GetLoadByFieldIndex();
   } else {
     return property_index();
   }
 }
 
 
 } }  // namespace v8::internal
 
 #endif