Fix Object.freeze, Object.observe wrt CountOperation and CompoundAssignment.

test/mjsunit/harmony/object-observe.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 628 matching lines @@
 function recursiveObserver2(r) {
   recordCount += r.length;
   if (r[0].oldValue < 100) {
     ++obj1.a;
     ++obj2.a;
   }
 }
 Object.observe(obj1, recursiveObserver2);
 Object.observe(obj2, recursiveObserver2);
 ++obj1.a;
-// TODO(verwaest): Disabled because of bug 2774.
-// Object.deliverChangeRecords(recursiveObserver2);
-// assertEquals(199, recordCount);
+Object.deliverChangeRecords(recursiveObserver2);
+assertEquals(199, recordCount);
 
 
 // Observing named properties.
 reset();
 var obj = {a: 1}
 Object.observe(obj, observer.callback);
 obj.a = 2;
 obj["a"] = 3;
 delete obj.a;
 obj.a = 4;
@@ skipping 864 matching lines @@
     for (var n1 = 0; n1 < 3; ++n1)
       for (var n2 = 0; n2 < 3; ++n2)
         for (var i in mutation)
           TestFastElementsLength(mutation[i], b1 != 0, b2 != 0, 20*n1, 20*n2);
 
 for (var b1 = 0; b1 < 2; ++b1)
   for (var b2 = 0; b2 < 2; ++b2)
     for (var n = 0; n < 3; ++n)
       for (var i in mutationByIncr)
         TestFastElementsLength(mutationByIncr[i], b1 != 0, b2 != 0, 7*n, 7*n+1);