[crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil.

src/crankshaft/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen-instructions.h"
 
 #include "src/base/bits.h"
 #include "src/base/safe_math.h"
 #include "src/crankshaft/hydrogen-infer-representation.h"
 #include "src/double.h"
@@ skipping 1466 matching lines @@
 HValue* HUnaryMathOperation::Canonicalize() {
   if (op() == kMathRound || op() == kMathFloor) {
     HValue* val = value();
     if (val->IsChange()) val = HChange::cast(val)->value();
     if (val->representation().IsSmiOrInteger32()) {
       if (val->representation().Equals(representation())) return val;
       return Prepend(new(block()->zone()) HChange(
           val, representation(), false, false));
     }
   }
-  if (op() == kMathFloor && value()->IsDiv() && value()->HasOneUse()) {
+  if (op() == kMathFloor && representation().IsSmiOrInteger32() &&
+      value()->IsDiv() && value()->HasOneUse()) {
     HDiv* hdiv = HDiv::cast(value());
 
     HValue* left = hdiv->left();
     if (left->representation().IsInteger32() && !left->CheckFlag(kUint32)) {
       // A value with an integer representation does not need to be transformed.
     } else if (left->IsChange() && HChange::cast(left)->from().IsInteger32() &&
                !HChange::cast(left)->value()->CheckFlag(kUint32)) {
       // A change from an integer32 can be replaced by the integer32 value.
       left = HChange::cast(left)->value();
     } else if (hdiv->observed_input_representation(1).IsSmiOrInteger32()) {
@@ skipping 2631 matching lines @@
     case HObjectAccess::kExternalMemory:
       os << "[external-memory]";
       break;
   }
 
   return os << "@" << access.offset();
 }
 
 }  // namespace internal
 }  // namespace v8