Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339).

test/mjsunit/regress/regress-2339.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 13 matching lines @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --expose-gc
 
 /**
  * The possible optimization states of a function. Must be in sync with the
  * return values of Runtime_GetOptimizationStatus() in runtime.cc!
  */
+
 var OptimizationState = {
     YES: 1,
     NO: 2,
     ALWAYS: 3,
     NEVER: 4
 };
 
-function mul (a, b) {
-  return a * b;
+function simple() {
+  return simple_two_args(0, undefined);
 }
 
-mul(-1, -1);
-mul(0x80000001|0, -1);
-mul(0x80000001|0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
+function simple_two_args(always_zero, always_undefined) {
+  var always_five = always_undefined || 5;
+  return always_zero * always_five * .5;
+}
 
-var raw_optimized = %GetOptimizationStatus(mul);
+for (var i = 0; i < 10000; i++) {
+  simple();
+}
+var raw_optimized = %GetOptimizationStatus(simple);
 assertFalse(raw_optimized == OptimizationState.NO);
 gc();