Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339).

test/mjsunit/regress/regress-1117.js

Index: test/mjsunit/regress/regress-1117.js
diff --git a/test/mjsunit/regress/regress-1117.js b/test/mjsunit/regress/regress-1117.js
index b013a223ece4e049504d0b4b1e298c7ad4c33b32..5d659cd6c43c2121843044e01059f4c5cfdbf489 100644
--- a/test/mjsunit/regress/regress-1117.js
+++ b/test/mjsunit/regress/regress-1117.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Test that we actually return the right value (-0) when we multiply
 // constant 0 with a negative integer.
 
@@ -33,3 +35,10 @@ for( var i = 0; i< 1000000; i++){
   foo(42);
 }
 assertEquals(1/foo(-42), -Infinity);
+
+function bar(x) { return x * 0; }
+assertEquals(Infinity, 1/bar(5));
+assertEquals(Infinity, 1/bar(5));
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(-Infinity, 1/bar(-5));
+