Infer HConstant::NotInNewSpace only if the supplied handle is null.

BUG=chromium:449291
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/898753003

Cr-Commit-Position: refs/heads/master@{#26413}

src/hydrogen-instructions.cc

@@ -2869,7 +2869,7 @@ void HConstant::Initialize(Representation r) {
     // could cause heap object checks not to get emitted.
     object_ = Unique<Object>(Handle<Object>::null());
   }
-  if (r.IsSmiOrInteger32()) {
+  if (r.IsSmiOrInteger32() && object_.handle().is_null()) {
     // If it's not a heap object, it can't be in new space.
     bit_field_ = IsNotInNewSpaceField::update(bit_field_, true);
   }

test/mjsunit/regress/regress-449291.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = {y:1.5};
+a.y = 1093445778;
+b = a.y;
+c = {y:{}};
+
+function f() {
+  return {y: b};
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f().y, 1093445778);