Only allow non-double if the observed representations are int32.

src/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2442 matching lines @@
 }
 
 
 void HCompareIDAndBranch::InferRepresentation(HInferRepresentation* h_infer) {
   Representation left_rep = left()->representation();
   Representation right_rep = right()->representation();
   Representation observed_left = observed_input_representation(0);
   Representation observed_right = observed_input_representation(1);
 
   Representation rep = Representation::Smi();
-  if (!left_rep.IsTagged()) rep = rep.generalize(left_rep);
-  if (!right_rep.IsTagged()) rep = rep.generalize(right_rep);
-  if (!observed_left.IsTagged()) rep = rep.generalize(observed_left);
-  if (!observed_right.IsTagged()) rep = rep.generalize(observed_right);
+  if (observed_left.IsInteger32() && observed_right.IsInteger32()) {
+    if (!left_rep.IsTagged()) rep = rep.generalize(left_rep);
+    if (!right_rep.IsTagged()) rep = rep.generalize(right_rep);
+  } else {
+    rep = Representation::Double();
+  }
 
   if (rep.IsDouble()) {
     // According to the ES5 spec (11.9.3, 11.8.5), Equality comparisons (==, ===
     // and !=) have special handling of undefined, e.g. undefined == undefined
     // is 'true'. Relational comparisons have a different semantic, first
     // calling ToPrimitive() on their arguments.  The standard Crankshaft
     // tagged-to-double conversion to ensure the HCompareIDAndBranch's inputs
     // are doubles caused 'undefined' to be converted to NaN. That's compatible
     // out-of-the box with ordered relational comparisons (<, >, <=,
     // >=). However, for equality comparisons (and for 'in' and 'instanceof'),
@@ skipping 1318 matching lines @@
     case kBackingStore:
       if (!name_.is_null()) stream->Add(*String::cast(*name_)->ToCString());
       stream->Add("[backing-store]");
       break;
   }
 
   stream->Add("@%d", offset());
 }
 
 } }  // namespace v8::internal