Always deoptimize on undefined if a double value implicitly gets converted.

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3229 matching lines @@
   // Compute DeoptimizeOnUndefined flag for phis.
   // Any phi that can reach a use with DeoptimizeOnUndefined set must
   // have DeoptimizeOnUndefined set.  Currently only HCompareIDAndBranch, with
   // double input representation, has this flag set.
   // The flag is used by HChange tagged->double, which must deoptimize
   // if one of its uses has this flag set.
   for (int i = 0; i < phi_list()->length(); i++) {
     HPhi* phi = phi_list()->at(i);
     if (phi->representation().IsDouble()) {
       for (HUseIterator it(phi->uses()); !it.Done(); it.Advance()) {
-        if (it.value()->CheckFlag(HValue::kDeoptimizeOnUndefined)) {
+        int use_index = it.index();
+        HValue* use_value = it.value();
+        Representation req = use_value->RequiredInputRepresentation(use_index);
+        if (!req.IsDouble() ||
+            use_value->CheckFlag(HValue::kDeoptimizeOnUndefined)) {
           RecursivelyMarkPhiDeoptimizeOnUndefined(phi);
           break;
         }
       }
     }
   }
 }
 
 
 // Discover instructions that can be marked with kUint32 flag allowing
@@ skipping 720 matching lines @@
   }
 
   HInferRepresentation rep(this);
   rep.Analyze();
 
   // Remove HSimulate instructions that have turned out not to be needed
   // after all by folding them into the following HSimulate.
   // This must happen after inferring representations.
   MergeRemovableSimulates();
 
+  MarkDeoptimizeOnUndefined();
   InsertRepresentationChanges();
-  MarkDeoptimizeOnUndefined();
 
   InitializeInferredTypes();
 
   // Must be performed before canonicalization to ensure that Canonicalize
   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
   // zero.
   if (FLAG_opt_safe_uint32_operations) ComputeSafeUint32Operations();
 
   if (FLAG_use_canonicalizing) Canonicalize();
 
@@ skipping 7464 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal