Fix deoptimization of the count operation in Turbofan.

src/compiler/ast-graph-builder.cc

Index: src/compiler/ast-graph-builder.cc
diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index 5ee9fa457d988447af2e40f55cc02fc09f27639d..584b2361e7a84c2b9b9ab12414bde414c3d4425a 100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1420,8 +1420,10 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->expression()->AsVariableProxy()->var();
+      environment()->Push(value);
       BuildVariableAssignment(variable, value, expr->op(),
                               expr->AssignmentId());
+      environment()->Pop();
       break;
     }
     case NAMED_PROPERTY: {
@@ -1430,7 +1432,9 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
           MakeUnique(property->key()->AsLiteral()->AsPropertyName());
       Node* store =
           NewNode(javascript()->StoreNamed(strict_mode(), name), object, value);
+      environment()->Push(value);

[Michael Starzinger, 2014/09/10 21:38:38]

This is approaching crankshaft-esque complexity levels. I cannot even judge
anymore whether this is correct or not. Need to breed over it a little longer
tomorrow.

       PrepareFrameState(store, expr->AssignmentId());
+      environment()->Pop();
       break;
     }
     case KEYED_PROPERTY: {
@@ -1438,7 +1442,9 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
       Node* object = environment()->Pop();
       Node* store = NewNode(javascript()->StoreProperty(strict_mode()), object,
                             key, value);
+      environment()->Push(value);
       PrepareFrameState(store, expr->AssignmentId());
+      environment()->Pop();
       break;
     }
   }