Work in progress: don't optimize increment/decrements on frozen objects

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 7442 matching lines @@
       }
 
       case Variable::LOOKUP:
         return Bailout(kLookupVariableInCountOperation);
     }
 
   } else {
     // Argument of the count operation is a property.
     ASSERT(prop != NULL);
 
+    SmallMapList* types = prop->GetReceiverTypes();
+    for (int i = 0; i < types->length(); ++i) {
+      if (types->at(i)->is_frozen()) {
+        return Bailout(kFrozenObjectInCountOperation);

[Mark Miller, 2013/08/07 18:36:07]

Do you want to bail on the object being frozen, or on the property in question
being frozen?

+      }
+    }
+
     if (prop->key()->IsPropertyName()) {
       // Named property.
       if (returns_original_input) Push(graph()->GetConstantUndefined());
 
       CHECK_ALIVE(VisitForValue(prop->obj()));
       HValue* object = Top();
 
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       Handle<Map> map;
       HInstruction* load = NULL;
       bool monomorphic = prop->IsMonomorphic();
-      SmallMapList* types = prop->GetReceiverTypes();
       if (monomorphic) {
         map = types->first();
         if (map->is_dictionary_map()) monomorphic = false;
       }
       if (monomorphic) {
         Handle<JSFunction> getter;
         Handle<JSObject> holder;
         if (LookupGetter(map, name, &getter, &holder)) {
           load = BuildCallGetter(object, map, getter, holder);
         } else {
@@ skipping 2244 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal