[arm64] Fixed unnecessary environment assignment to LSmiTag instruction.

BUG=chromium:490021
LOG=N

Review URL: https://codereview.chromium.org/1235563002

Cr-Commit-Position: refs/heads/master@{#29567}

src/arm64/lithium-arm64.cc

@@ -1203,7 +1203,7 @@ LInstruction* LChunkBuilder::DoChange(HChange* instr) {
     } else if (to.IsSmi()) {
       LOperand* value = UseRegisterAtStart(val);
       LInstruction* result = DefineAsRegister(new(zone()) LSmiTag(value));
-      if (val->CheckFlag(HInstruction::kUint32)) {
+      if (instr->CheckFlag(HValue::kCanOverflow)) {
         result = AssignEnvironment(result);
       }
       return result;

test/mjsunit/regress/regress-crbug-490021.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var global = new Object(3);
+function f() {
+  global[0] = global[0] >>> 15.5;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();