[crankshaft] Always force number representation for increment.

BUG=chromium:664087

Review-Url: https://codereview.chromium.org/2491333002
Cr-Commit-Position: refs/heads/master@{#40900}

src/crankshaft/hydrogen.cc

@@ -10386,17 +10386,13 @@ static Representation RepresentationFor(AstType* type) {
   return Representation::Tagged();
 }
 
-
-HInstruction* HOptimizedGraphBuilder::BuildIncrement(
-    bool returns_original_input,
-    CountOperation* expr) {
+HInstruction* HOptimizedGraphBuilder::BuildIncrement(CountOperation* expr) {
   // The input to the count operation is on top of the expression stack.
   Representation rep = RepresentationFor(expr->type());
   if (rep.IsNone() || rep.IsTagged()) {
     rep = Representation::Smi();
   }
 
-  if (returns_original_input) {
   // We need an explicit HValue representing ToNumber(input).  The
   // actual HChange instruction we need is (sometimes) added in a later
   // phase, so it is not available now to be used as an input to HAdd and
@@ -10407,7 +10403,6 @@ HInstruction* HOptimizedGraphBuilder::BuildIncrement(
     number_input->SetFlag(HInstruction::kCannotBeTagged);
   }
   Push(number_input);
-  }
 
   // The addition has no side effects, so we do not need
   // to simulate the expression stack after this instruction.
@@ -10466,7 +10461,7 @@ void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
     DCHECK(prop == NULL);
     CHECK_ALIVE(VisitForValue(target));
 
-    after = BuildIncrement(returns_original_input, expr);
+    after = BuildIncrement(expr);
     input = returns_original_input ? Top() : Pop();
     Push(after);
 
@@ -10519,7 +10514,7 @@ void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
 
   CHECK_ALIVE(PushLoad(prop, object, key));
 
-  after = BuildIncrement(returns_original_input, expr);
+  after = BuildIncrement(expr);
 
   if (returns_original_input) {
     input = Pop();

src/crankshaft/hydrogen.h

@@ -2687,8 +2687,7 @@ class HOptimizedGraphBuilder : public HGraphBuilder,
       HValue* left,
       HValue* right,
       PushBeforeSimulateBehavior push_sim_result);
-  HInstruction* BuildIncrement(bool returns_original_input,
-                               CountOperation* expr);
+  HInstruction* BuildIncrement(CountOperation* expr);
   HInstruction* BuildKeyedGeneric(PropertyAccessType access_type,
                                   Expression* expr, FeedbackVectorSlot slot,
                                   HValue* object, HValue* key, HValue* value);

test/mjsunit/regress/regress-664087.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+  throw 1;
+}
+
+var v = { valueOf : g };
+
+function foo(v) {
+  v++;
+}
+
+%NeverOptimizeFunction(g);
+assertThrows(function () { foo(v); });
+assertThrows(function () { foo(v); });
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function () { foo(v); });