Fix representation generalization for doubles.

src/property-details.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 120 matching lines @@
     return Equals(other);
   }
 
   bool is_more_general_than(const Representation& other) const {
     if (kind_ == kExternal && other.kind_ == kNone) return true;
     if (kind_ == kExternal && other.kind_ == kExternal) return false;
     if (kind_ == kNone && other.kind_ == kExternal) return false;
 
     ASSERT(kind_ != kExternal);
     ASSERT(other.kind_ != kExternal);
-    if (IsHeapObject()) return other.IsDouble() || other.IsNone();
+    if (IsHeapObject()) return other.IsNone();
     if (kind_ == kUInteger8 && other.kind_ == kInteger8) return false;
     if (kind_ == kUInteger16 && other.kind_ == kInteger16) return false;
     return kind_ > other.kind_;
   }
 
   bool fits_into(const Representation& other) const {
     return other.is_more_general_than(*this) || other.Equals(*this);
   }
 
   Representation generalize(Representation other) {
@@ skipping 168 matching lines @@
   PropertyDetails(int value, PropertyAttributes attributes) {
     value_ = AttributesField::update(value, attributes);
   }
 
   uint32_t value_;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_PROPERTY_DETAILS_H_