Fix bad regression in fix for 316885 (317714, r=shaver).

js/src/jsemit.c

@@ -4345,16 +4345,6 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
           case TOK_DOT:
             if (!EmitPropOp(cx, pn2, op, cg))
                 return JS_FALSE;
-            /*
-             * Allocate an extra stack slot for GC protection in case the
-             * initial value being post-incremented or -decremented is not
-             * a number, but converts to a jsdouble.  See jsinterp.c, the
-             * JSOP_PROPINC and JSOP_PROPDEC cases.
-             */
-            if ((js_CodeSpec[op].format & JOF_POST) &&
-                (uintN)cg->stackDepth == cg->maxStackDepth) {
-                ++cg->maxStackDepth;
-            }
             break;
           case TOK_LB:
             if (!EmitElemOp(cx, pn2, op, cg))
@@ -4386,6 +4376,19 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
           default:
             JS_ASSERT(0);
         }
+
+        /*
+         * Allocate another stack slot for GC protection in case the initial
+         * value being post-incremented or -decremented is not a number, but
+         * converts to a jsdouble.  In the TOK_NAME cases, op has 0 operand
+         * uses and 1 definition, so we don't need an extra stack slot -- we
+         * can use the one allocated for the def.
+         */
+        if (pn2->pn_type != TOK_NAME &&
+            (js_CodeSpec[op].format & JOF_POST) &&
+            (uintN)cg->stackDepth == cg->maxStackDepth) {
+            ++cg->maxStackDepth;
+        }
         break;
 
       case TOK_DELETE:

js/src/jsinterp.c

@@ -3437,7 +3437,7 @@ interrupt:
             goto out;                                                         \
     JS_END_MACRO
 
-                if ((cs->format & JOF_POST) && i != -2) {
+                if (cs->format & JOF_POST) {
                     /*
                      * We must push early to protect the postfix increment
                      * or decrement result, if converted to a jsdouble from
@@ -3450,6 +3450,7 @@ interrupt:
 #ifdef __GNUC__
                 else vp = NULL; /* suppress bogus gcc warnings */
 #endif
+
                 NONINT_INCREMENT_OP_MIDDLE();
             }