Fix potential deopt-loop introduced in r17143.

src/code-stubs.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 566 matching lines @@
     left_state_ = GENERIC;
   } else if (!has_int_result() && op_ != Token::SHR &&
              max_input <= NUMBER && max_input > result_state_) {
     result_state_ = max_input;
   }
 
   ASSERT(result_state_ <= (has_int_result() ? INT32 : NUMBER) ||
          op_ == Token::ADD);
 
   if (old_state == GetExtraICState()) {
-    // Since the fpu is to precise, we might bail out on numbers which
-    // actually would truncate with 64 bit precision.
-    ASSERT(!CpuFeatures::IsSupported(SSE2) &&
-           result_state_ <= INT32);
-    result_state_ = NUMBER;
+    // Tagged operations can lead to non-truncating HChanges
+    if (left->IsUndefined()) {
+      left_state_ = GENERIC;
+    } else if (right->IsUndefined()) {
+      right_state_ = GENERIC;
+    } else {
+      // Since the fpu is to precise, we might bail out on numbers which
+      // actually would truncate with 64 bit precision.
+      ASSERT(!CpuFeatures::IsSupported(SSE2) &&
+             result_state_ <= INT32);
+      result_state_ = NUMBER;
+    }
   }
 }
 
 
 void BinaryOpStub::UpdateStatus(Handle<Object> object,
                                 State* state) {
   v8::internal::TypeInfo type = v8::internal::TypeInfo::FromValue(object);
   if (object->IsUndefined()) {
     // Undefined will be automatically truncated for us by HChange.
     type = (op_ == Token::BIT_AND || op_ == Token::BIT_OR ||
@@ skipping 550 matching lines @@
   InstallDescriptor(isolate, &stub3);
 }
 
 InternalArrayConstructorStub::InternalArrayConstructorStub(
     Isolate* isolate) {
   InternalArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
 }
 
 
 } }  // namespace v8::internal