new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug673767.js
@@ -0,0 +1,2 @@
+var stack = {};
+stack.length += 3;

--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -4669,26 +4669,24 @@ EmitAssignment(JSContext *cx, JSCodeGene
                                    ? JSOP_GETARG
                                    : JSOP_GETLOCAL,
                                    atomIndex);
             }
             break;
           case TOK_DOT:
             if (js_Emit1(cx, cg, JSOP_DUP) < 0)
                 return false;
-            if (lhs->pn_atom == cx->runtime->atomState.lengthAtom) {
-                if (js_Emit1(cx, cg, JSOP_LENGTH) < 0)
-                    return false;
-            } else if (lhs->pn_atom == cx->runtime->atomState.protoAtom) {
+            if (lhs->pn_atom == cx->runtime->atomState.protoAtom) {
                 if (!EmitIndexOp(cx, JSOP_QNAMEPART, atomIndex, cg))
                     return false;
                 if (!EmitElemOpBase(cx, cg, JSOP_GETELEM))
                     return false;
             } else {
-                EMIT_INDEX_OP(JSOP_GETPROP, atomIndex);
+                bool isLength = (lhs->pn_atom == cx->runtime->atomState.lengthAtom);
+                EMIT_INDEX_OP(isLength ? JSOP_LENGTH : JSOP_GETPROP, atomIndex);
             }
             break;
           case TOK_LB:
           case TOK_LP:
 #if JS_HAS_XML_SUPPORT
           case TOK_UNARYOP:
 #endif
             if (js_Emit1(cx, cg, JSOP_DUP2) < 0)