[Interpreter] Ensure ValueOf is only called once for post-increment operations.

BUG=chromium:662418

Review-Url: https://codereview.chromium.org/2473223004
Cr-Commit-Position: refs/heads/master@{#40846}

src/interpreter/bytecode-generator.cc

@@ -2724,7 +2724,9 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
   if (is_postfix) {
     // Convert old value into a number before saving it.
     old_value = register_allocator()->NewRegister();
-    builder()->ConvertAccumulatorToNumber(old_value);
+    builder()
+        ->ConvertAccumulatorToNumber(old_value)
+        .LoadAccumulatorWithRegister(old_value);
   }
 
   // Perform +1/-1 operation.

test/cctest/interpreter/bytecode_expectations/AssignmentsInBinaryExpression.golden

@@ -242,7 +242,7 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 41
+bytecode array length: 43
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), U8(17),
@@ -254,6 +254,7 @@ bytecodes: [
                 B(Star), R(1),
                 B(Ldar), R(0),
                 B(ToNumber), R(2),
+                B(Ldar), R(2),
                 B(Inc), U8(3),
                 B(Star), R(0),
                 B(Ldar), R(2),

test/cctest/interpreter/bytecode_expectations/CountOperators.golden

@@ -31,12 +31,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 14
+bytecode array length: 16
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), U8(1),
                 B(Star), R(0),
   /*   45 S> */ B(ToNumber), R(1),
+                B(Ldar), R(1),
                 B(Inc), U8(2),
                 B(Star), R(0),
                 B(Ldar), R(1),
@@ -73,12 +74,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 14
+bytecode array length: 16
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), U8(1),
                 B(Star), R(0),
   /*   45 S> */ B(ToNumber), R(1),
+                B(Ldar), R(1),
                 B(Dec), U8(2),
                 B(Star), R(0),
                 B(Ldar), R(1),
@@ -95,13 +97,14 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 24
+bytecode array length: 26
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(1), R(1),
                 B(Mov), R(1), R(0),
   /*   54 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
                 B(ToNumber), R(2),
+                B(Ldar), R(2),
                 B(Inc), U8(6),
   /*   66 E> */ B(StaNamedPropertySloppy), R(0), U8(1), U8(4),
                 B(Ldar), R(2),
@@ -143,7 +146,7 @@ snippet: "
 "
 frame size: 5
 parameter count: 1
-bytecode array length: 29
+bytecode array length: 31
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   45 S> */ B(LdaConstant), U8(0),
@@ -153,6 +156,7 @@ bytecodes: [
   /*   72 S> */ B(Ldar), R(0),
   /*   81 E> */ B(LdaKeyedProperty), R(1), U8(2),
                 B(ToNumber), R(4),
+                B(Ldar), R(4),
                 B(Dec), U8(6),
   /*   86 E> */ B(StaKeyedPropertySloppy), R(1), R(0), U8(4),
                 B(Ldar), R(4),
@@ -223,7 +227,7 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 25
+bytecode array length: 27
 bytecodes: [
                 B(CreateFunctionContext), U8(1),
                 B(PushContext), R(1),
@@ -234,6 +238,7 @@ bytecodes: [
                 B(Star), R(0),
   /*   78 S> */ B(LdaCurrentContextSlot), U8(4),
                 B(ToNumber), R(2),
+                B(Ldar), R(2),
                 B(Dec), U8(2),
   /*   86 E> */ B(StaCurrentContextSlot), U8(4),
                 B(Ldar), R(2),
@@ -251,7 +256,7 @@ snippet: "
 "
 frame size: 4
 parameter count: 1
-bytecode array length: 26
+bytecode array length: 28
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), U8(1),
@@ -260,6 +265,7 @@ bytecodes: [
                 B(Star), R(1),
   /*   63 S> */ B(Ldar), R(0),
                 B(ToNumber), R(3),
+                B(Ldar), R(3),
                 B(Inc), U8(2),
                 B(Star), R(0),
                 B(LdaSmi), U8(2),

test/cctest/interpreter/bytecode_expectations/GlobalCountOperators.golden

@@ -36,11 +36,12 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 13
+bytecode array length: 15
 bytecodes: [
   /*   26 E> */ B(StackCheck),
   /*   31 S> */ B(LdaGlobal), U8(2),
                 B(ToNumber), R(0),
+                B(Ldar), R(0),
                 B(Dec), U8(6),
   /*   44 E> */ B(StaGlobalSloppy), U8(0), U8(4),
                 B(Ldar), R(0),
@@ -82,11 +83,12 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 13
+bytecode array length: 15
 bytecodes: [
   /*   27 E> */ B(StackCheck),
   /*   32 S> */ B(LdaGlobal), U8(2),
                 B(ToNumber), R(0),
+                B(Ldar), R(0),
                 B(Inc), U8(6),
   /*   50 E> */ B(StaGlobalSloppy), U8(0), U8(4),
                 B(Ldar), R(0),

test/mjsunit/ignition/regress-662418.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var valueof_calls = 0;
+
+var v = {
+  toString: function() {
+    var z = w++;
+  }
+};
+var w = {
+  valueOf: function() {
+    valueof_calls++;
+  }
+};
+var x = { [v]: 'B' };
+assertTrue(valueof_calls == 1);