Reset overwrite mode for BinaryOpStub unless we can actually make use of it.

src/code-stubs.cc

Index: src/code-stubs.cc
diff --git a/src/code-stubs.cc b/src/code-stubs.cc
index 166d46d911ef3a78fcf9e5d5f8c4205cc7d232d9..051dd45dd99273969a22591920b9484c539b13c3 100644
--- a/src/code-stubs.cc
+++ b/src/code-stubs.cc
@@ -586,6 +586,14 @@ void BinaryOpStub::UpdateStatus(Handle<Object> left,
   ASSERT(result_state_ <= (has_int_result() ? INT32 : NUMBER) ||
          op_ == Token::ADD);
 
+  // Reset overwrite mode unless we can actually make use of it, or may be able
+  // to make use of it at some point in the future.
+  if ((mode_ == OVERWRITE_LEFT && left_state_ > NUMBER) ||
+      (mode_ == OVERWRITE_RIGHT && right_state_ > NUMBER) ||
+      result_state_ > NUMBER) {
+    mode_ = NO_OVERWRITE;
+  }
+
   if (old_state == GetExtraICState()) {
     // Tagged operations can lead to non-truncating HChanges
     if (left->IsUndefined() || left->IsBoolean()) {