Fix missing representation for the result of HIsSmiAndBranch.

test/mjsunit/regress/regress-is-smi-repr.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-var a = {y:1.5};
-a.y = 0;
-var b = a.y;
-a.y = {};
-var d = 1;
-function f() {
-  d = 0;
-  return {y: b};
-}
-f();
-f();
+"use strict";
+
+var global;
+
+function g() { global = this; }
+Object.defineProperty(Number.prototype, "prop", { get: g });
+function f(s) { s.prop; }
+
+f(1);
+f(1);
 %OptimizeFunctionOnNextCall(f);
-f();
+f(1);