Pass the complete number type information into the GenericBinaryOpStub....

src/frame-element.h

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 35 matching lines @@
 //   * Register: an element that resides in a register.
 //   * Constant: an element whose value is known at compile time.
 
 class FrameElement BASE_EMBEDDED {
  public:
   enum SyncFlag {
     NOT_SYNCED,
     SYNCED
   };
 
-  NumberInfo::Type number_info();
-  void set_number_info(NumberInfo::Type info) {
+  inline NumberInfo::Type number_info() {
+    // Copied elements do not have number info. Instead
+    // we have to inspect their backing element in the frame.
+    ASSERT(!is_copy());
+    if (!is_constant()) return NumberInfoField::decode(value_);
+    Handle<Object> value = handle();
+    if (value->IsSmi()) return NumberInfo::kSmi;
+    if (value->IsHeapNumber()) return NumberInfo::kHeapNumber;
+    return NumberInfo::kUnknown;
+  }
+
+  inline void set_number_info(NumberInfo::Type info) {
     value_ = value_ & ~NumberInfoField::mask();
     value_ = value_ | NumberInfoField::encode(info);
   }
 
   // The default constructor creates an invalid frame element.
   FrameElement() {
     value_ = TypeField::encode(INVALID)
         | CopiedField::encode(false)
         | SyncedField::encode(false)
         | NumberInfoField::encode(NumberInfo::kUninitialized)
@@ skipping 173 matching lines @@
   class SyncedField: public BitField<bool, 4, 1> {};
   class NumberInfoField: public BitField<NumberInfo::Type, 5, 3> {};
   class DataField: public BitField<uint32_t, 8, 32 - 9> {};
 
   friend class VirtualFrame;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_FRAME_ELEMENT_H_