[turbofan] Fix frame states for CountOperation (again).

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/linkage.h"
@@ skipping 2573 matching lines @@
 
 void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
   DCHECK(expr->expression()->IsValidReferenceExpressionOrThis());
 
   // Left-hand side can only be a property, a global or a variable slot.
   Property* property = expr->expression()->AsProperty();
   LhsKind assign_type = Property::GetAssignType(property);
 
   // Reserve space for result of postfix operation.
   bool is_postfix = expr->is_postfix() && !ast_context()->IsEffect();
-  if (is_postfix) environment()->Push(jsgraph()->UndefinedConstant());
+  if (is_postfix && assign_type != VARIABLE) {
+    environment()->Push(jsgraph()->ZeroConstant());
+  }
 
   // Evaluate LHS expression and get old value.
   Node* old_value = NULL;
   int stack_depth = -1;
   switch (assign_type) {
     case VARIABLE: {
       VariableProxy* proxy = expr->expression()->AsVariableProxy();
       VectorSlotPair pair = CreateVectorSlotPair(proxy->VariableFeedbackSlot());
       FrameStateBeforeAndAfter states(this, BeforeId(proxy));
       old_value =
@@ skipping 62 matching lines @@
     }
   }
 
   // Convert old value into a number.
   if (!is_strong(language_mode())) {
     old_value = NewNode(javascript()->ToNumber(), old_value);
     PrepareFrameState(old_value, expr->ToNumberId(),
                       OutputFrameStateCombine::Push());
   }
 
+  // Create a proper eager frame state for the stores.
+  environment()->Push(old_value);
+  FrameStateBeforeAndAfter store_states(this, expr->ToNumberId());
+  old_value = environment()->Pop();
+
   // Save result for postfix expressions at correct stack depth.
   if (is_postfix) {
-    environment()->Poke(stack_depth, old_value);
-  } else {
-    environment()->Push(old_value);
+    if (assign_type != VARIABLE) {
+      environment()->Poke(stack_depth, old_value);
+    } else {
+      environment()->Push(old_value);
+    }
   }
-  // TODO(bmeurer): This might not match the fullcodegen in case of non VARIABLE
-  // eager deoptimization; we will figure out when we get there.
-  FrameStateBeforeAndAfter store_states(this, expr->ToNumberId());
-  if (!is_postfix) old_value = environment()->Pop();
 
   // Create node to perform +1/-1 operation.
   Node* value;
   {
     FrameStateBeforeAndAfter states(this, BailoutId::None());
     value =
         BuildBinaryOp(old_value, jsgraph()->OneConstant(), expr->binary_op());
     // This should never deoptimize outside strong mode because otherwise we
     // have converted to number before.
     states.AddToNode(value, is_strong(language_mode()) ? expr->ToNumberId()
@@ skipping 1520 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8