Make sure value is a heap number when reusing the double box in BinaryOpICStub.

test/mjsunit/regress/regress-359525.js

Index: test/mjsunit/regress/regress-359525.js
diff --git a/test/mjsunit/regress/comparison-in-effect-context-deopt.js b/test/mjsunit/regress/regress-359525.js
similarity index 84%
copy from test/mjsunit/regress/comparison-in-effect-context-deopt.js
copy to test/mjsunit/regress/regress-359525.js
index b28dff73a745dfc7445a6c093380c56f51b3fb76..6a82a38fd3d2d7b95e49115f1e35fbf803fff8cc 100644
--- a/test/mjsunit/regress/comparison-in-effect-context-deopt.js
+++ b/test/mjsunit/regress/regress-359525.js
@@ -25,23 +25,20 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-function lazyDeopt() {
-  %DeoptimizeFunction(test);
-  return "deopt";
+// Test BinaryOpICStub substract
+var a;
+for (var i = 0; i < 2; i++) {
+  var x = 42 + a - {};
+  print(x);
+  a = "";
 }
 
-var x = { toString : lazyDeopt };
-
-function g(x) {
-  return "result";
+// Test BinaryOpICStub add
+var b = 1.4;
+var val = 0;
+var o = {valueOf:function() { val++; return 10; }};
+for (var i = 0; i < 2; i++) {
+  var x = (b + i) + o;
+  b = "";
 }
-
-function test(x) {
-  return g(void(x == ""));
-}
-
-test(x);
-%OptimizeFunctionOnNextCall(test);
-assertEquals("result", test(x));
+assertEquals(val, 2);