STEPS TO REPRODUCE: 1) Breakpoint in the JSOP_INCNAME/DECNAME/etc case in jsops.cpp 2) Load attached testcase. 3) Step down to right after the ASSERT_VALID_PROPERTY_CACHE_HIT when trying to increment |x|. 4) Observe that PCVAL_IS_SLOT(entry) is false. 5) See that we call js_FindPropertyHelper as a result. 6) Note that this happens every time we try to increment x. I can understand not being able to take the fast-increment path if the entry is not a slot (though not why it's not a slot in this case, honestly). But do we really have to call js_FindPropertyHelper?