Fix deoptimization of the count operation in Turbofan.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties.h"
@@ skipping 1402 matching lines @@
   Node* value =
       BuildBinaryOp(old_value, jsgraph()->OneConstant(), expr->binary_op());
   // TODO(jarin) Insert proper bailout id here (will need to change
   // full code generator).
   PrepareFrameState(value, BailoutId::None());
 
   // Store the value.
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->expression()->AsVariableProxy()->var();
+      environment()->Push(value);
       BuildVariableAssignment(variable, value, expr->op(),
                               expr->AssignmentId());
+      environment()->Pop();
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Unique<Name> name =
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       Node* store =
           NewNode(javascript()->StoreNamed(strict_mode(), name), object, value);
+      environment()->Push(value);

[Michael Starzinger, 2014/09/10 21:38:38]

This is approaching crankshaft-esque complexity levels. I cannot even judge
anymore whether this is correct or not. Need to breed over it a little longer
tomorrow.

       PrepareFrameState(store, expr->AssignmentId());
+      environment()->Pop();
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       Node* store = NewNode(javascript()->StoreProperty(strict_mode()), object,
                             key, value);
+      environment()->Push(value);
       PrepareFrameState(store, expr->AssignmentId());
+      environment()->Pop();
       break;
     }
   }
 
   // Restore old value for postfix expressions.
   if (is_postfix) value = environment()->Pop();
 
   ast_context()->ProduceValue(value);
 }
 
@@ skipping 560 matching lines @@
     DCHECK(node->InputAt(frame_state_index)->op()->opcode() == IrOpcode::kDead);
 
     Node* frame_state_node = environment()->Checkpoint(ast_id, combine);
     node->ReplaceInput(frame_state_index, frame_state_node);
   }
 }
 
 }
 }
 }  // namespace v8::internal::compiler