Fix re-initialization of existing double field.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4008 matching lines @@
   switch (lookup.type()) {
     case NORMAL: {
       PropertyDetails details = PropertyDetails(attributes, NORMAL, 0);
       result = self->SetNormalizedProperty(*name, *value, details);
       break;
     }
     case FIELD: {
       Representation representation = lookup.representation();
       Representation value_representation =
           value->OptimalRepresentation(value_type);
+      if (value_representation.IsNone()) break;
       if (!value_representation.fits_into(representation)) {
         MaybeObject* maybe_failure = self->GeneralizeFieldRepresentation(
             lookup.GetDescriptorIndex(), value_representation);
         if (maybe_failure->IsFailure()) return maybe_failure;
         DescriptorArray* desc = self->map()->instance_descriptors();
         int descriptor = lookup.GetDescriptorIndex();
         representation = desc->GetDetails(descriptor).representation();
       }
       if (FLAG_track_double_fields && representation.IsDouble()) {
         HeapNumber* storage =
@@ skipping 11748 matching lines @@
 
 
 void JSTypedArray::Neuter() {
   set_byte_offset(Smi::FromInt(0));
   set_byte_length(Smi::FromInt(0));
   set_length(Smi::FromInt(0));
   set_elements(GetHeap()->EmptyExternalArrayForMap(map()));
 }
 
 } }  // namespace v8::internal