Enforce correct number comparisons when inlining Array.indexOf.

test/mjsunit/regress/regress-crbug-407946.js

Index: test/mjsunit/regress/regress-crbug-407946.js
diff --git a/test/mjsunit/regress/regress-alloc-smi-check.js b/test/mjsunit/regress/regress-crbug-407946.js
similarity index 65%
copy from test/mjsunit/regress/regress-alloc-smi-check.js
copy to test/mjsunit/regress/regress-crbug-407946.js
index 295048a13ef862ceb21939de104e7968dd7772da..d5687cca342ca1ef4432f2fc7880588e9c3c53d9 100644
--- a/test/mjsunit/regress/regress-alloc-smi-check.js
+++ b/test/mjsunit/regress/regress-crbug-407946.js
@@ -1,16 +1,12 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
 
-var x = {};
+// Flags: --allow-natives-syntax
 
-function f(a) {
-  a[200000000] = x;
-}
+function f(n) { return [0].indexOf((n - n) + 0); }
 
-f(new Array(100000));
-f([]);
+assertEquals(0, f(.1));
+assertEquals(0, f(.1));
 %OptimizeFunctionOnNextCall(f);
-f([]);
+assertEquals(0, f(.1));