Fix shortcutting bug in HInferRepresentation

* src/hydrogen.cc (HInferRepresentation::Analyze): Fix iterative loop
  over phis; the shortcutting behavior of || appears to be accidental
  here, causing O(n^2) convergence.  Not that it matters much, but hey!

While I'm at it, a minor comment fix:

* src/hydrogen-instructions.h (EnsureAndPropagateNotMinusZero): Fix a
  comment about the kinds of instructions that propagate to multiple
  inputs.

BUG=
TEST=passes tools/test.py

Review URL: http://codereview.chromium.org/7350019
Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -588,9 +588,9 @@ class HValue: public ZoneObject {
   // it would otherwise output what should be a minus zero as an int32 zero.
   // If the operation also exists in a form that takes int32 and outputs int32
   // then the operation should return its input value so that we can propagate
-  // back.  There are two operations that need to propagate back to more than
-  // one input.  They are phi and binary add.  They always return NULL and
-  // expect the caller to take care of things.
+  // back.  There are three operations that need to propagate back to more than
+  // one input.  They are phi and binary div and mul.  They always return NULL
+  // and expect the caller to take care of things.
   virtual HValue* EnsureAndPropagateNotMinusZero(BitVector* visited) {
     visited->Add(id());
     return NULL;

src/hydrogen.cc

@@ -1666,8 +1666,8 @@ void HInferRepresentation::Analyze() {
         HValue* use = it.value();
         if (use->IsPhi()) {
           int id = HPhi::cast(use)->phi_id();
-          change = change ||
-              connected_phis[i]->UnionIsChanged(*connected_phis[id]);
+          if (connected_phis[i]->UnionIsChanged(*connected_phis[id]))
+            change = true;
         }
       }
     }