Fix HConstants with Smi-ranged HeapNumber values

test/mjsunit/regress/regress-crbug-349878.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-a = {y:1.5};
-a.y = 0;
-b = a.y;
-c = {y:{}};
-
-function f() {
-  return 1;
+function f(a, b) {
+  a == b;
 }
 
+f({}, {});
+
+var a = { y: 1.5 };
+a.y = 777;
+var b = a.y;
+
+function h() {
+  var d = 1;
+  var e = 777;
+  while (d-- > 0) e++;
+  f(1, e);
+}
+
+var global;
 function g() {
-  var e = {y: b};
-  var d = {x:f()};
-  var d = {x:f()};
-  return [e, d];
+  global = b;
+  return h(b);
 }
 
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
-assertEquals(1, g()[1].x);
+g();