DFG might force a local to be double even if we store non-numeric val…

JSTests/stress/double-inlined-call-argument.js

@@ -0,0 +1,22 @@
+function foo(a, b, c, p) {
+    a = b + c;
+    if (p) {
+        a++;
+        return a;
+    }
+}
+
+function bar(a, b) {
+    return foo("hello", a, b, a <= b);
+}
+
+noInline(bar);
+
+for (var i = 0; i < 100000; ++i) {
+    var result = bar(2000000000, 2000000000.5);
+    if (result != 4000000001.5)
+        throw new Error(`Bad result: ${result}!`);
+}
+
+if (reoptimizationRetryCount(bar) != 0)
+    throw new Error(`Should not have reoptimized bar, but reoptimized ${reoptimizationRetryCount(bar)} times.`);

JSTests/stress/regress-116397731.js

@@ -0,0 +1,16 @@
+var out;
+
+function func0(value) {
+  if (value) {}
+  out = value;
+  value = value + 1 + 2;
+}
+
+function main() {
+  for (let i = 0; i < 0x100000; i++)
+    func0(undefined);
+  if (out !== undefined)
+    throw new Error(`Bad value: ${out}!`);
+}
+
+main();

Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp

@@ -131,7 +131,7 @@ bool VariableAccessData::tallyVotesForShouldUseDoubleFormat()
     if (!newValueOfShouldUseDoubleFormat) {
         // We monotonically convert to double. Hence, if the fixpoint leads us to conclude that we should
         // switch back to int, we instead ignore this and stick with double.
-        return false;
+        return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat);
     }
 
     if (m_doubleFormatState == UsingDoubleFormat)