Remove Box<T> from JsValue for JsString

[HalidOdat]

Remove Box<T> wrapper of JsString in nan-boxed JsValue, this requires us to return a clone of a JsString (reference bump) for JsValue::as_string().

[github-actions]

Test262 conformance changes

Test result	main count	PR count	difference
Total	50,595	50,595	0
Passed	47,238	47,238	0
Ignored	1,964	1,964	0
Failed	1,393	1,393	0
Panics	0	0	0
Conformance	93.36%	93.36%	0.00%

[HalidOdat]

Benchmark

main

PROGRESS Richards
RESULT Richards 177
PROGRESS DeltaBlue
RESULT DeltaBlue 180
PROGRESS Encrypt
PROGRESS Decrypt
RESULT Crypto 145
PROGRESS RayTrace
RESULT RayTrace 391
PROGRESS Earley
PROGRESS Boyer
RESULT EarleyBoyer 465
PROGRESS RegExp
RESULT RegExp 73.2
PROGRESS Splay
RESULT Splay 706
PROGRESS NavierStokes
RESULT NavierStokes 345
SCORE 249

PR

PROGRESS Richards
RESULT Richards 180
PROGRESS DeltaBlue
RESULT DeltaBlue 182
PROGRESS Encrypt
PROGRESS Decrypt
RESULT Crypto 150
PROGRESS RayTrace
RESULT RayTrace 388
PROGRESS Earley
PROGRESS Boyer
RESULT EarleyBoyer 462
PROGRESS RegExp
RESULT RegExp 74.5
PROGRESS Splay
RESULT Splay 742
PROGRESS NavierStokes
RESULT NavierStokes 351
SCORE 254

[hansl]

Nice optimization! LGTM.

[raskad]

I have not looked into this in detail, but do we potentially run into issues here because JsString is a Tagged pointer?

[hansl]

do we potentially run into issues here because JsString is a Tagged pointer

@raskad NaN-boxed pointers are not tagged on the LSB (which is what JsString uses). We moved away from this early in the development of NaN-boxing values. Storing a LSB-tagged pointer is "safe".

We have enough tests around it that I'm confident if we ever break this assumption we'll assert quite quickly.

[HalidOdat]

Yes, as @hansl mentioned, it's not a issue, and we have more than enough space to store the tag. 😄