With this fix codegen looks like:

mov ecx,[eax+0xf]  ;;; <@52,#38> load-named-field
add ecx,0x2  ;;; <@54,#40> add-i
mov [eax+0xf],ecx  ;;; <@56,#41> store-named-field

without it there is an overflow check and jump to deopt.

x64 code looks similar, except there is an (annoying) smi-untag then int32-to-smi around the add operation.

R=bmeurer@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/104313003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00