956250 - Change the memory layout for built-in value types

Status: UNCONFIRMED

(Core :: JavaScript Engine, defect)

Description

[haitao]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

Steps to reproduce:

var a = TypedObject.float32(1.0);


Actual results:

In the engine, we need double indirection to access the value 1.0.


Expected results:

The value 1.0 is stored inside the object and consecutive with the object header so that we could easily boxing a register or stack slots in Ion (representing the value) when bailout happens.