Fix overeager property cache fills, leading to wrong answers after certain JOF_INCDEC ops. Bug 614782, r=dmandelin.

js/src/jit-test/tests/basic/testIncDecReadOnly.js

@@ -0,0 +1,22 @@
+var r;
+Object.defineProperty(this, "x", {value: 0, writable: false});
+
+for (var a = 0; a < 10; ++a)
+    r = ++x;
+assertEq(x, 0);
+assertEq(r, 1);
+
+for (var a = 0; a < 10; ++a)
+    r = --x;
+assertEq(x, 0);
+assertEq(r, -1);
+
+for (var a = 0; a < 10; ++a)
+    r = x++;
+assertEq(x, 0);
+assertEq(r, 0);
+
+for (var a = 0; a < 10; ++a)
+    r = x--;
+assertEq(x, 0);
+assertEq(r, 0);

js/src/jspropertycache.cpp

@@ -202,7 +202,7 @@ PropertyCache::fill(JSContext *cx, JSObject *obj, uintN scopeIndex, uintN protoI
          * with stub getters and setters, we can cache the slot.
          */
         if (!(cs->format & (JOF_SET | JOF_FOR)) &&
-            (!(cs->format & JOF_INCDEC) || shape->hasDefaultSetter()) &&
+            (!(cs->format & JOF_INCDEC) || (shape->hasDefaultSetter() && shape->writable())) &&
             shape->hasDefaultGetter() &&
             pobj->containsSlot(shape->slot)) {
             /* Great, let's cache shape's slot and use it on cache hit. */