Make sure value is a heap number when reusing the double box in BinaryOpICStub.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 945 matching lines @@
       }
     }
     result = EnforceNumberType(result, result_type);
   }
 
   // Reuse the double box of one of the operands if we are allowed to (i.e.
   // chained binops).
   if (state.CanReuseDoubleBox()) {
     HValue* operand = (state.mode() == OVERWRITE_LEFT) ? left : right;
     IfBuilder if_heap_number(this);
-    if_heap_number.IfNot<HIsSmiAndBranch>(operand);
+    if_heap_number.If<HHasInstanceTypeAndBranch>(operand, HEAP_NUMBER_TYPE);
     if_heap_number.Then();
     Add<HStoreNamedField>(operand, HObjectAccess::ForHeapNumberValue(), result);
     Push(operand);
     if_heap_number.Else();
     Push(result);
     if_heap_number.End();
     result = Pop();
   }
 
   return result;
@@ skipping 453 matching lines @@
   return BuildRegExpConstructResult(length, index, input);
 }
 
 
 Handle<Code> RegExpConstructResultStub::GenerateCode(Isolate* isolate) {
   return DoGenerateCode(isolate, this);
 }
 
 
 } }  // namespace v8::internal