Support setter inlining in CountOperation.

R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23757018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -5006,13 +5006,20 @@ void HOptimizedGraphBuilder::BuildStoreNamed(Expression* expr,
     Handle<JSObject> holder;
     if (LookupSetter(map, name, &setter, &holder)) {
       AddCheckConstantFunction(holder, object, map);
-      // Don't try to inline if the result_value is different from the
-      // store_value. That case isn't handled yet by the inlining.
-      if (result_value == store_value &&
-          FLAG_inline_accessors &&
-          TryInlineSetter(setter, id, assignment_id, store_value)) {
+      if (FLAG_inline_accessors) {
+        if (result_value != store_value) {
+          // The result_value and object are already pushed by CountOperation.
+          // Push(store_value) to complete the arguments to the setter.
+          Push(store_value);
+          bool check = TryInlineSetter(setter, id, assignment_id, store_value);
+          // Drop the result of the setter to return result_value that's on the
+          // stack already.
+          Drop(1);
+          if (check) return;
+        } else if (TryInlineSetter(setter, id, assignment_id, store_value)) {
           return;
         }
+      }
       Drop(2);
       Add<HPushArgument>(object);
       Add<HPushArgument>(store_value);
@@ -7572,6 +7579,9 @@ void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
 
       after = BuildIncrement(returns_original_input, expr);
       HValue* result = returns_original_input ? Pop() : after;
+      if (returns_original_input) {
+        environment()->SetExpressionStackAt(1, result);
+      }
 
       return BuildStoreNamed(expr, expr->id(), expr->position(),
                              expr->AssignmentId(), prop, object, after, result);