diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 05b31162af..196f8f0b51 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -714,6 +714,7 @@ class HValue : public ZoneObject {
     if (r.IsTagged()) {
       HType t = type();
       if (t.IsSmi()) return Representation::Smi();
+      // TODO(mstarzinger): This is not correct for mutable HeapNumbers.
       if (t.IsHeapNumber()) return Representation::Double();
       if (t.IsHeapObject()) return r;
       return Representation::None();
@@ -5503,6 +5504,10 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
       return Representation::Integer32();
     }
   }
+  // TODO(mstarzinger): Workaround until we track mutable HeapNumber types.
+  virtual Representation KnownOptimalRepresentation() V8_OVERRIDE {
+    return representation();
+  }
 
   virtual Handle<Map> GetMonomorphicJSObjectMap() {
     return known_initial_map_;
diff --git a/test/mjsunit/regress/regress-3307.js b/test/mjsunit/regress/regress-3307.js
new file mode 100644
index 0000000000..1fc770d20c
--- /dev/null
+++ b/test/mjsunit/regress/regress-3307.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function p(x) {
+  this.x = x;
+}
+
+function f() {
+  var a = new p(1), b = new p(2);
+  for (var i = 0; i < 1; i++) {
+    a.x += b.x;
+  }
+  return a.x;
+}
+
+new p(0.1);  // make 'x' mutable box double field in p.
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());