Keep the result of postfix increment and decrement in a register.

Review URL: http://codereview.chromium.org/56106

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/codegen-ia32.cc

@@ -4799,17 +4799,25 @@ void CodeGenerator::VisitCountOperation(CountOperation* node) {
                                    target.size() * kPointerSize);
 
     Result value = frame_->Pop();
-    value.ToRegister();
-    ASSERT(value.is_valid());
 
     // Postfix: Store the old value as the result.
     if (is_postfix) {
-      Result old_value = value;
-      frame_->SetElementAt(target.size(), &old_value);
+      if (value.is_register()) {
+        Result old_value = allocator_->Allocate();
+        ASSERT(old_value.is_valid());
+        __ mov(old_value.reg(), value.reg());
+        frame_->SetElementAt(target.size(), &old_value);
+      } else {
+        ASSERT(value.is_constant());
+        Result old_value = value;
+        frame_->SetElementAt(target.size(), &old_value);
+      }
     }
 
     // Perform optimistic increment/decrement.  Ensure the value is
     // writable.
+    value.ToRegister();
+    ASSERT(value.is_valid());
     frame_->Spill(value.reg());
     ASSERT(allocator_->count(value.reg()) == 1);