Index: kjs/nodes.cpp
===================================================================
--- kjs/nodes.cpp	(revision 33029)
+++ kjs/nodes.cpp	(working copy)
@@ -4344,7 +4344,8 @@ found:
 
 RegisterID* AssignDotNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_base.get());
     RegisterID* value = generator.emitNode(dst, m_right.get());
     return generator.emitPutById(base.get(), m_ident, value);
 }
@@ -4371,7 +4372,8 @@ JSValue* AssignDotNode::evaluate(OldInte
 
 RegisterID* ReadModifyDotNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_base.get());
 
     // FIXME: should not write temp value to dst if dst is a local!
     RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
@@ -4424,8 +4426,10 @@ JSValue* AssignErrorNode::evaluate(OldIn
 
 RegisterID* AssignBracketNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_base.get());
+    RefPtr<RegisterID> property = generator.newTemporary();
+    generator.emitNode(property.get(), m_subscript.get());
     RegisterID* value = generator.emitNode(dst, m_right.get());
     return generator.emitPutByVal(base.get(), property.get(), value);
 }
@@ -4465,8 +4469,10 @@ JSValue* AssignBracketNode::evaluate(Old
 
 RegisterID* ReadModifyBracketNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_base.get());
+    RefPtr<RegisterID> property = generator.newTemporary();
+    generator.emitNode(property.get(), m_subscript.get());
 
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
     RegisterID* change = generator.emitNode(m_right.get());