Always deoptimize on undefined if a double value implicitly gets converted.

R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16126002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -1718,9 +1718,7 @@ class HChange: public HUnaryOperation {
     ASSERT(!value->representation().Equals(to));
     set_representation(to);
     SetFlag(kUseGVN);
-    if (deoptimize_on_undefined || to.IsTagged()) {
-      SetFlag(kDeoptimizeOnUndefined);
-    }
+    if (deoptimize_on_undefined) SetFlag(kDeoptimizeOnUndefined);
     if (is_truncating) SetFlag(kTruncatingToInt32);
     if (value->representation().IsSmi() || value->type().IsSmi()) {
       set_type(HType::Smi());

src/hydrogen.cc

@@ -3247,7 +3247,11 @@ void HGraph::MarkDeoptimizeOnUndefined() {
     HPhi* phi = phi_list()->at(i);
     if (phi->representation().IsDouble()) {
       for (HUseIterator it(phi->uses()); !it.Done(); it.Advance()) {
-        if (it.value()->CheckFlag(HValue::kDeoptimizeOnUndefined)) {
+        int use_index = it.index();
+        HValue* use_value = it.value();
+        Representation req = use_value->RequiredInputRepresentation(use_index);
+        if (!req.IsDouble() ||
+            use_value->CheckFlag(HValue::kDeoptimizeOnUndefined)) {
           RecursivelyMarkPhiDeoptimizeOnUndefined(phi);
           break;
         }
@@ -3988,8 +3992,8 @@ bool HGraph::Optimize(SmartArrayPointer<char>* bailout_reason) {
   // This must happen after inferring representations.
   MergeRemovableSimulates();
 
-  InsertRepresentationChanges();
   MarkDeoptimizeOnUndefined();
+  InsertRepresentationChanges();
 
   InitializeInferredTypes();