Fix potential deopt-loop introduced in r17143.

TBR=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/26805004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/code-stubs.cc

@@ -584,11 +584,18 @@ void BinaryOpStub::UpdateStatus(Handle<Object> left,
          op_ == Token::ADD);
 
   if (old_state == GetExtraICState()) {
-    // Since the fpu is to precise, we might bail out on numbers which
-    // actually would truncate with 64 bit precision.
-    ASSERT(!CpuFeatures::IsSupported(SSE2) &&
-           result_state_ <= INT32);
-    result_state_ = NUMBER;
+    // Tagged operations can lead to non-truncating HChanges
+    if (left->IsUndefined()) {
+      left_state_ = GENERIC;
+    } else if (right->IsUndefined()) {
+      right_state_ = GENERIC;
+    } else {
+      // Since the fpu is to precise, we might bail out on numbers which
+      // actually would truncate with 64 bit precision.
+      ASSERT(!CpuFeatures::IsSupported(SSE2) &&
+             result_state_ <= INT32);
+      result_state_ = NUMBER;
+    }
   }
 }