Fix type propagation rules for count operation....

src/ia32/codegen-ia32.cc

Index: src/ia32/codegen-ia32.cc
===================================================================
--- src/ia32/codegen-ia32.cc	(revision 4169)
+++ src/ia32/codegen-ia32.cc	(working copy)
@@ -6867,7 +6867,12 @@
       old_value = allocator_->Allocate();
       ASSERT(old_value.is_valid());
       __ mov(old_value.reg(), new_value.reg());
+
+      // The old value that is return for postfix operations has the
+      // same type as the input value we got from the frame.
+      old_value.set_number_info(new_value.number_info());
     }
+
     // Ensure the new value is writable.
     frame_->Spill(new_value.reg());
 
@@ -6931,6 +6936,8 @@
     }
     deferred->BindExit();
 
+    // The result of ++ or -- is always a number.
+    new_value.set_number_info(NumberInfo::Number());
 
     // Postfix: store the old value in the allocated slot under the
     // reference.