Reset overwrite mode for BinaryOpStub unless we can actually make use of it.

src/code-stubs.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 568 matching lines @@
   State max_input = Max(left_state_, right_state_);
 
   if (!has_int_result() && op_ != Token::SHR &&
       max_input <= NUMBER && max_input > result_state_) {
     result_state_ = max_input;
   }
 
   ASSERT(result_state_ <= (has_int_result() ? INT32 : NUMBER) ||
          op_ == Token::ADD);
 
+  // Reset overwrite mode unless we can actually make use of it, or may be able
+  // to make use of it at some point in the future.
+  if ((mode_ == OVERWRITE_LEFT && left_state_ > NUMBER) ||
+      (mode_ == OVERWRITE_RIGHT && right_state_ > NUMBER) ||
+      result_state_ > NUMBER) {
+    mode_ = NO_OVERWRITE;
+  }
+
   if (old_state == GetExtraICState()) {
     // Tagged operations can lead to non-truncating HChanges
     if (left->IsUndefined() || left->IsBoolean()) {
       left_state_ = GENERIC;
     } else if (right->IsUndefined() || right->IsBoolean()) {
       right_state_ = GENERIC;
     } else {
       // Since the fpu is to precise, we might bail out on numbers which
       // actually would truncate with 64 bit precision.
       ASSERT(!CpuFeatures::IsSupported(SSE2) &&
@@ skipping 601 matching lines @@
   InstallDescriptor(isolate, &stub3);
 }
 
 InternalArrayConstructorStub::InternalArrayConstructorStub(
     Isolate* isolate) {
   InternalArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
 }
 
 
 } }  // namespace v8::internal