Work in progress: don't optimize increment/decrements on frozen objects

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 6043caa0f47f84ed16c18535eed3f278204b17b3..bbaf1fb6e5cb00b43a9f369bef38fc85e8c69f51 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7460,6 +7460,13 @@ void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
     // Argument of the count operation is a property.
     ASSERT(prop != NULL);
 
+    SmallMapList* types = prop->GetReceiverTypes();
+    for (int i = 0; i < types->length(); ++i) {
+      if (types->at(i)->is_frozen()) {
+        return Bailout(kFrozenObjectInCountOperation);

[Mark Miller, 2013/08/07 18:36:07]

Do you want to bail on the object being frozen, or on the property in question
being frozen?

+      }
+    }
+
     if (prop->key()->IsPropertyName()) {
       // Named property.
       if (returns_original_input) Push(graph()->GetConstantUndefined());
@@ -7471,7 +7478,6 @@ void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
       Handle<Map> map;
       HInstruction* load = NULL;
       bool monomorphic = prop->IsMonomorphic();
-      SmallMapList* types = prop->GetReceiverTypes();
       if (monomorphic) {
         map = types->first();
         if (map->is_dictionary_map()) monomorphic = false;