60568 cpst Index: kjs/nodes.cpp =================================================================== --- kjs/nodes.cpp (revision 33029) +++ kjs/nodes.cpp (working copy) @@ -4344,7 +4344,8 @@ found: RegisterID* AssignDotNode::emitCode(CodeGenerator& generator, RegisterID* dst) { - RefPtr<RegisterID> base = generator.emitNode(m_base.get()); + RefPtr<RegisterID> base = generator.newTemporary(); + generator.emitNode(base.get(), m_base.get()); RegisterID* value = generator.emitNode(dst, m_right.get()); return generator.emitPutById(base.get(), m_ident, value); } @@ -4371,7 +4372,8 @@ JSValue* AssignDotNode::evaluate(OldInte RegisterID* ReadModifyDotNode::emitCode(CodeGenerator& generator, RegisterID* dst) { - RefPtr<RegisterID> base = generator.emitNode(m_base.get()); + RefPtr<RegisterID> base = generator.newTemporary(); + generator.emitNode(base.get(), m_base.get()); // FIXME: should not write temp value to dst if dst is a local! RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident); @@ -4424,8 +4426,10 @@ JSValue* AssignErrorNode::evaluate(OldIn RegisterID* AssignBracketNode::emitCode(CodeGenerator& generator, RegisterID* dst) { - RefPtr<RegisterID> base = generator.emitNode(m_base.get()); - RefPtr<RegisterID> property = generator.emitNode(m_subscript.get()); + RefPtr<RegisterID> base = generator.newTemporary(); + generator.emitNode(base.get(), m_base.get()); + RefPtr<RegisterID> property = generator.newTemporary(); + generator.emitNode(property.get(), m_subscript.get()); RegisterID* value = generator.emitNode(dst, m_right.get()); return generator.emitPutByVal(base.get(), property.get(), value); } @@ -4465,8 +4469,10 @@ JSValue* AssignBracketNode::evaluate(Old RegisterID* ReadModifyBracketNode::emitCode(CodeGenerator& generator, RegisterID* dst) { - RefPtr<RegisterID> base = generator.emitNode(m_base.get()); - RefPtr<RegisterID> property = generator.emitNode(m_subscript.get()); + RefPtr<RegisterID> base = generator.newTemporary(); + generator.emitNode(base.get(), m_base.get()); + RefPtr<RegisterID> property = generator.newTemporary(); + generator.emitNode(property.get(), m_subscript.get()); RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get()); RegisterID* change = generator.emitNode(m_right.get()); 3419474250 #webkit TRUE