[crankshaft] Fix invalid ToNumber optimization.

test/mjsunit/regress/regress-crbug-590989-2.js

Index: test/mjsunit/regress/regress-crbug-590989-2.js
diff --git a/test/mjsunit/compiler/regress-dead-throw-inlining.js b/test/mjsunit/regress/regress-crbug-590989-2.js
similarity index 56%
copy from test/mjsunit/compiler/regress-dead-throw-inlining.js
copy to test/mjsunit/regress/regress-crbug-590989-2.js
index 097a20bc41d34760931928c45e4117888295f20a..cae1d9db5bde93207a6c9bc4a5718e5ea052f656 100644
--- a/test/mjsunit/compiler/regress-dead-throw-inlining.js
+++ b/test/mjsunit/regress/regress-crbug-590989-2.js
@@ -4,10 +4,9 @@
 
 // Flags: --allow-natives-syntax
 
-function g() { if (false) throw 0; }
-function f() { g(); }
+function f(x) { return x === +x; }
 
-f();
-f();
+assertEquals(false, f(undefined));
+assertEquals(false, f(undefined));
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(false, f(undefined));  // Interestingly this fails right away.