Fix Math.round/floor that had bogus Smi representation

test/mjsunit/regress/regress-crbug-272564.js

Index: test/mjsunit/regress/regress-crbug-272564.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-crbug-272564.js
similarity index 83%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-crbug-272564.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..5475298a88cde102a1e9229acdf8ec7e73f67c99 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-crbug-272564.js
@@ -27,24 +27,23 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
-
-function f(a, b) {
-  return g("c", "d");
+function Bb(w) {
+  this.width = w;
 }
 
-function g(a, b) {
-  g.constructor.apply(this, arguments);
+function ce(a, b) {
+  "number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
+  return a
 }
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+function pe(a, b, c) {
+  if (b instanceof Bb) b = b.width;
+  a.width = ce(b, !0);
 }
 
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+var a = new Bb(1);
+var b = new Bb(5);
+pe(a, b, 0);
+pe(a, b, 0);
+%OptimizeFunctionOnNextCall(pe);
+pe(a, b, 0);