Fix representation generalization for doubles.

test/mjsunit/regress/regress-347909.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 

[Toon Verwaest, 2014/02/28 10:59:15]

Flags: --allow-natives-syntax

[Hannes Payer (out of office), 2014/02/28 11:06:52]

Done.

-// Flags: --expose-gc
-a = [];
-a[1000] = .1;
-a.length = 0;
-gc();
-gc();
-a[1000] = .1;
-assertEquals(.1, a[1000]);
+a = {y:1.5};

[Toon Verwaest, 2014/02/28 10:59:15]

var a =, var b =, var d =

[Hannes Payer (out of office), 2014/02/28 11:06:52]

Done.

+a.y = 0;
+b = a.y;
+a.y= {};

[Toon Verwaest, 2014/02/28 10:59:15]

add space after a.y

[Hannes Payer (out of office), 2014/02/28 11:06:52]

Done.

+d = 1;
+function f() {
+  d = 0;
+  return {y: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();