LCodeGen::DoDeferredNumberTagI expects dst to contain overflowed smi.