Revert change 1656 which was unsafe until it can be properly fixed....

src/codegen-ia32.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4781 matching lines @@
       }
       return;
     }
     target.TakeValue(NOT_INSIDE_TYPEOF);
 
     DeferredCountOperation* deferred =
         new DeferredCountOperation(this, is_postfix, is_increment,
                                    target.size() * kPointerSize);
 
     Result value = frame_->Pop();
+    value.ToRegister();
+    ASSERT(value.is_valid());
 
     // Postfix: Store the old value as the result.
     if (is_postfix) {
-      if (value.is_register()) {
-        Result old_value = allocator_->Allocate();
-        ASSERT(old_value.is_valid());
-        __ mov(old_value.reg(), value.reg());
-        frame_->SetElementAt(target.size(), &old_value);
-      } else {
-        ASSERT(value.is_constant());
-        Result old_value = value;
-        frame_->SetElementAt(target.size(), &old_value);
-      }
+      Result old_value = value;
+      frame_->SetElementAt(target.size(), &old_value);
     }
 
     // Perform optimistic increment/decrement.  Ensure the value is
     // writable.
-    value.ToRegister();
-    ASSERT(value.is_valid());
     frame_->Spill(value.reg());
     ASSERT(allocator_->count(value.reg()) == 1);
 
     // In order to combine the overflow and the smi check, we need to
     // be able to allocate a byte register.  We attempt to do so
     // without spilling.  If we fail, we will generate separate
     // overflow and smi checks.
     //
     // We need to allocate and clear the temporary byte register
     // before performing the count operation since clearing the
@@ skipping 2250 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal