Fix representation of Phis for mutable-heapnumber-in-object-literal properties

BUG=v8:3392
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/328343004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -11010,7 +11010,7 @@ void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
         // 1) it's a child object of another object with a valid allocation site
         // 2) we can just use the mode of the parent object for pretenuring
         HInstruction* double_box =
-            Add<HAllocate>(heap_number_constant, HType::HeapNumber(),
+            Add<HAllocate>(heap_number_constant, HType::HeapObject(),
                 pretenure_flag, HEAP_NUMBER_TYPE);
         AddStoreMapConstant(double_box,
             isolate()->factory()->heap_number_map());

test/mjsunit/regress/regress-3392.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = {b: -1.5};
+  for (var i = 0; i < 1; i++) {
+    a.b = 1;
+  }
+  assertTrue(0 <= a.b);
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();