Mere r4172 to trunk. The new version is 2.1.6.1.

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3745 matching lines @@
     // continue.
     if (has_valid_frame()) {
       // Record the source position of the statement as this code which
       // is after the code for the body actually belongs to the loop
       // statement and not the body.
       CodeForStatementPosition(node);
       Visit(node->next());
     }
   }
 
+  // The update expression resets the type of the loop variable. So we
+  // set it to smi before compiling the test expression.
+  if (node->is_fast_smi_loop()) {
+    // Set number type of the loop variable to smi.
+    Slot* slot = node->loop_variable()->slot();
+    ASSERT(slot->type() == Slot::LOCAL);
+    frame_->SetTypeForLocalAt(slot->index(), NumberInfo::Smi());
+    if (FLAG_debug_code) {
+      frame_->PushLocalAt(slot->index());
+      Result var = frame_->Pop();
+      var.ToRegister();
+      __ AbortIfNotSmi(var.reg(), "Loop variable not a smi.");
+    }
+  }
+
   // Based on the condition analysis, compile the backward jump as
   // necessary.
   switch (info) {
     case ALWAYS_TRUE:
       if (has_valid_frame()) {
         if (node->next() == NULL) {
           node->continue_target()->Jump();
         } else {
           loop.Jump();
         }
@@ skipping 3084 matching lines @@
 
     Result new_value = frame_->Pop();
     new_value.ToRegister();
 
     Result old_value;  // Only allocated in the postfix case.
     if (is_postfix) {
       // Allocate a temporary to preserve the old value.
       old_value = allocator_->Allocate();
       ASSERT(old_value.is_valid());
       __ mov(old_value.reg(), new_value.reg());
+
+      // The return value for postfix operations is the
+      // same as the input, and has the same number info.
+      old_value.set_number_info(new_value.number_info());
     }
+
     // Ensure the new value is writable.
     frame_->Spill(new_value.reg());
 
     Result tmp;
     if (new_value.is_smi()) {
       if (FLAG_debug_code) {
         __ AbortIfNotSmi(new_value.reg(), "Operand not a smi");
       }
     } else {
       // We don't know statically if the input is a smi.
@@ skipping 43 matching lines @@
         deferred->Branch(not_zero);
       } else {
         // Otherwise we test separately for overflow and smi tag.
         deferred->Branch(overflow);
         __ test(new_value.reg(), Immediate(kSmiTagMask));
         deferred->Branch(not_zero);
       }
     }
     deferred->BindExit();
 
+    // The result of ++ or -- is an Integer32 if the
+    // input is a smi. Otherwise it is a number.
+    if (new_value.is_smi()) {
+      new_value.set_number_info(NumberInfo::Integer32());
+    } else {
+      new_value.set_number_info(NumberInfo::Number());
+    }
 
     // Postfix: store the old value in the allocated slot under the
     // reference.
     if (is_postfix) frame_->SetElementAt(target.size(), &old_value);
 
     frame_->Push(&new_value);
     // Non-constant: update the reference.
     if (!is_const) target.SetValue(NOT_CONST_INIT);
   }
 
@@ skipping 5276 matching lines @@
 
   // Call the runtime; it returns -1 (less), 0 (equal), or 1 (greater)
   // tagged as a small integer.
   __ bind(&runtime);
   __ TailCallRuntime(Runtime::kStringCompare, 2, 1);
 }
 
 #undef __
 
 } }  // namespace v8::internal