Fix representation inference for mutable double boxes.

R=jarin@chromium.org
BUG=v8:3307
TEST=mjsunit/regress/regress-3307
LOG=N

Review URL: https://codereview.chromium.org/298723014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -714,6 +714,7 @@ class HValue : public ZoneObject {
     if (r.IsTagged()) {
       HType t = type();
       if (t.IsSmi()) return Representation::Smi();
+      // TODO(mstarzinger): This is not correct for mutable HeapNumbers.
       if (t.IsHeapNumber()) return Representation::Double();
       if (t.IsHeapObject()) return r;
       return Representation::None();
@@ -5503,6 +5504,10 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
       return Representation::Integer32();
     }
   }
+  // TODO(mstarzinger): Workaround until we track mutable HeapNumber types.
+  virtual Representation KnownOptimalRepresentation() V8_OVERRIDE {
+    return representation();
+  }
 
   virtual Handle<Map> GetMonomorphicJSObjectMap() {
     return known_initial_map_;

test/mjsunit/regress/regress-3307.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function p(x) {
+  this.x = x;
+}
+
+function f() {
+  var a = new p(1), b = new p(2);
+  for (var i = 0; i < 1; i++) {
+    a.x += b.x;
+  }
+  return a.x;
+}
+
+new p(0.1);  // make 'x' mutable box double field in p.
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());