[builtins] Don't canonicalize results of Math double operations.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 505 matching lines @@
         var_result.Bind(zero);
         Goto(&return_result);
       }
     }
   }
   Bind(&if_overflow);
   {
     var_lhs_float64.Bind(SmiToFloat64(a));
     var_rhs_float64.Bind(SmiToFloat64(b));
     Node* value = Float64Mul(var_lhs_float64.value(), var_rhs_float64.value());
-    Node* result = ChangeFloat64ToTagged(value);
+    Node* result = AllocateHeapNumberWithValue(value);
     var_result.Bind(result);
     Goto(&return_result);
   }
 
   Bind(&return_result);
   return var_result.value();
 }
 
 Node* CodeStubAssembler::TaggedIsSmi(Node* a) {
   return WordEqual(WordAnd(BitcastTaggedToWord(a), IntPtrConstant(kSmiTagMask)),
@@ skipping 7854 matching lines @@
     // Load the HeapNumber value.
     var_finc_value.Bind(LoadHeapNumberValue(value));
     Goto(&do_finc);
   }
 
   Bind(&do_finc);
   {
     Node* finc_value = var_finc_value.value();
     Node* one = Float64Constant(1.0);
     Node* finc_result = Float64Add(finc_value, one);
-    var_result.Bind(ChangeFloat64ToTagged(finc_result));
+    var_result.Bind(AllocateHeapNumberWithValue(finc_result));
     Goto(&end);
   }
 
   Bind(&end);
   return var_result.value();
 }
 
 compiler::Node* CodeStubAssembler::CreateArrayIterator(
     compiler::Node* array, compiler::Node* array_map,
     compiler::Node* array_type, compiler::Node* context, IterationKind mode) {
@@ skipping 159 matching lines @@
   Node* buffer_bit_field = LoadObjectField(
       buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Uint32());
   Node* was_neutered_mask = Int32Constant(JSArrayBuffer::WasNeutered::kMask);
 
   return Word32NotEqual(Word32And(buffer_bit_field, was_neutered_mask),
                         Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8