Convert to immutable heap number when materializing arguments object.

test/mjsunit/regress/regress-457935.js

Index: test/mjsunit/regress/regress-457935.js
diff --git a/test/mjsunit/regress/regress-457935.js b/test/mjsunit/regress/regress-457935.js
new file mode 100644
index 0000000000000000000000000000000000000000..db907b344125a16f76c3b45ceb971e7f2b6920e1
--- /dev/null
+++ b/test/mjsunit/regress/regress-457935.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertEquals(found) { };
+
+function __f_25() {

[Igor Sheludko, 2015/02/17 15:07:54]

I think it would be better to get rid of __X_ ugliness.

[Jarin, 2015/02/17 15:20:48]

Done (but we do keep the underscores in other tests and I use it as a clue that
I should not try too hard to understand the code.)

+  return __f_25.arguments;
+}
+
+function __f_30(limit) {
+  var __v_29 = 0;
+  var __v_30 = {};
+  for (; __v_29 < limit; __v_29++) {
+    __v_30.y = +__v_30.y;
+    __f_25();
+  }
+}
+
+ __f_30(1);
+ __f_30(1);
+%OptimizeFunctionOnNextCall(__f_30);
+assertEquals(__f_30(1));
+assertEquals(__f_30(2));