Fix Smi vs. HeapObject confusion in HConstants.

src/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/base/bits.h"
 #include "src/double.h"
 #include "src/factory.h"
 #include "src/hydrogen-infer-representation.h"
@@ skipping 2797 matching lines @@
       if (object->IsJSObject()) {
         // Try to eagerly migrate JSObjects that have deprecated maps.
         Handle<JSObject> js_object = Handle<JSObject>::cast(object);
         if (js_object->map()->is_deprecated()) {
           JSObject::TryMigrateInstance(js_object);
         }
       }
       r = Representation::Tagged();
     }
   }
+  if (r.IsSmi()) {
+    // If we have an existing handle, zap it, because it might be a heap
+    // number which we must not re-use when copying this HConstant to
+    // Tagged representation later, because having Smi representation now
+    // could cause heap object checks not to get emitted.
+    object_ = Unique<Object>(Handle<Object>::null());
+  }
   set_representation(r);
   SetFlag(kUseGVN);
 }
 
 
 bool HConstant::ImmortalImmovable() const {
   if (has_int32_value_) {
     return false;
   }
   if (has_double_value_) {
@@ skipping 1940 matching lines @@
       break;
     case HObjectAccess::kExternalMemory:
       os << "[external-memory]";
       break;
   }
 
   return os << "@" << access.offset();
 }
 
 } }  // namespace v8::internal