[literals] Perform a deep boilerplate copy for MutableHeapNumber fields

Bug: chromium:734162, chromium:734051, v8:6211
Change-Id: I5c3e7578e9278b8f19ff16ad4d963f490dcc6c8c
Reviewed-on: https://chromium-review.googlesource.com/541415
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46033}

src/runtime/runtime-literals.cc

@@ -196,6 +196,11 @@ MaybeHandle<JSObject> CreateLiteral(Isolate* isolate,
   JSObject::DeepCopyHints copy_hints =
       (flags & ObjectLiteral::kShallowProperties) ? JSObject::kObjectIsShallow
                                                   : JSObject::kNoHints;
+  if (FLAG_track_double_fields && !FLAG_unbox_double_fields) {
+    // Make sure we properly clone mutable heap numbers on 32-bit platforms.
+    copy_hints = JSObject::kNoHints;
+  }
+
   Handle<AllocationSite> site;
   Handle<JSObject> boilerplate;
 

test/mjsunit/object-literal.js

@@ -34,6 +34,10 @@ function runTest(fn) {
   fn();
   // The third run might copy literals directly in the stub.
   fn();
+  // Several invocations more to trigger map deprecations.
+  fn();
+  fn();
+  fn();
   // Make sure literals keep on workin in optimized code.
   %OptimizeFunctionOnNextCall(fn);
   fn();
@@ -322,7 +326,6 @@ function TestLiteralElementsKind() {
 }
 runTest(TestLiteralElementsKind);
 
-
 function TestNonNumberElementValues() {
   var o = {
     1: true,

test/mjsunit/regress/regress-crbug-734051.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function TestMutableHeapNumberLiteral() {
+    var data = { a: 0, b: 0 };
+    data.a += 0.1;
+    assertEquals(0.1, data.a);
+    assertEquals(0, data.b);
+};
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();

test/mjsunit/regress/regress-crbug-734162.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+(function TestSmi() {
+  var v_0 = {};
+  function f_0(constructor, closure) {
+    var v_2 = { value: 0 };
+    v_4 = closure(constructor, 1073741823, v_0, v_2);
+    assertEquals(1, v_2.value);
+  }
+  function f_1(constructor, val, deopt, v_2) {
+    if (!new constructor(val, deopt, v_2)) {
+    }
+  }
+  function f_10(constructor) {
+    f_0(constructor, f_1);
+    f_0(constructor, f_1);
+    f_0(constructor, f_1);
+  }
+  function f_12(val, deopt, v_2) {
+    v_2.value++;
+  }
+  f_10(f_12);
+})();
+
+(function TestHeapNumber() {
+  var v_0 = {};
+  function f_0(constructor, closure) {
+    var v_2 = { value: 1.5 };
+    v_4 = closure(constructor, 1073741823, v_0, v_2);
+    assertEquals(2.5, v_2.value);
+  }
+  function f_1(constructor, val, deopt, v_2) {
+    if (!new constructor(val, deopt, v_2)) {
+    }
+  }
+  function f_10(constructor) {
+    f_0(constructor, f_1);
+    f_0(constructor, f_1);
+    f_0(constructor, f_1);
+  }
+  function f_12(val, deopt, v_2) {
+    v_2.value++;
+  }
+  f_10(f_12);
+})();