[crankshaft] Fix invalid number truncation assumption on HAdd inputs.

In Crankshaft we don't know reliably know that an HAdd might not turn
into a string addition later (via deoptimization), so we cannot set the
HValue::kAllowUndefinedAsNaN flag on the HAdd instruction in those
cases. It doesn't seem to affect performance if we just remove the flag
completely from the HAdd instruction, so let's stick to that approach
for now.

R=jarin@chromium.org
BUG=v8:5074

Review-Url: https://codereview.chromium.org/2048643002
Cr-Commit-Position: refs/heads/master@{#36805}

src/crankshaft/hydrogen-instructions.h

@@ -4370,6 +4370,11 @@ class HAdd final : public HArithmeticBinaryOperation {
       SetChangesFlag(kNewSpacePromotion);
       ClearFlag(kAllowUndefinedAsNaN);
     }
+    if (!right()->type().IsTaggedNumber() &&
+        !right()->representation().IsDouble() &&
+        !right()->representation().IsSmiOrInteger32()) {
+      ClearFlag(kAllowUndefinedAsNaN);
+    }
   }
 
   Representation RepresentationFromInputs() override;

test/mjsunit/compiler/regress-5074.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var s = [,0.1];
+
+function foo(a, b) {
+  var x = s[a];
+  s[1] = 0.1;
+  return x + b;
+}
+
+assertEquals(2.1, foo(1, 2));
+assertEquals(2.1, foo(1, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("undefined2", foo(0, "2"));