diff --git a/lib/exprengine.cpp b/lib/exprengine.cpp
index b1ed2d935..6866bea12 100644
--- a/lib/exprengine.cpp
+++ b/lib/exprengine.cpp
@@ -1978,6 +1978,9 @@ static ExprEngine::ValuePtr executeIncDec(const Token *tok, Data &data)
     ExprEngine::ValuePtr assignValue = simplifyValue(std::make_shared<ExprEngine::BinOpResult>(tok->str().substr(0,1), beforeValue, std::make_shared<ExprEngine::IntRange>("1", 1, 1)));
     assignExprValue(tok->astOperand1(), assignValue, data);
     auto retVal = (precedes(tok, tok->astOperand1())) ? assignValue : beforeValue;
+    auto binOp = std::dynamic_pointer_cast<ExprEngine::BinOpResult>(retVal);
+    if (binOp && !binOp->op1)
+        retVal.reset();
     call(data.callbacks, tok, retVal, &data);
     return retVal;
 }
diff --git a/test/testexprengine.cpp b/test/testexprengine.cpp
index f104021e3..d560f4fe4 100644
--- a/test/testexprengine.cpp
+++ b/test/testexprengine.cpp
@@ -58,6 +58,7 @@ private:
 
         TEST_CASE(inc1);
         TEST_CASE(inc2);
+        TEST_CASE(inc3);
 
         TEST_CASE(if1);
         TEST_CASE(if2);
@@ -409,6 +410,11 @@ private:
                       expr("void f() { unsigned char a[2]; a[0] = 1; a[0]++; a[0] == a[0]; }", "=="));
     }
 
+    void inc3() { // #10391 - don't crash
+        ASSERT_EQUALS("",
+                      expr("void f(T* p, T t) { *p++ = 1; *p++ = t; *p == 0; }", "=="));
+    }
+
     void if1() {
         ASSERT_EQUALS("(< $1 $2)\n"
                       "(and (>= $1 (- 2147483648)) (<= $1 2147483647))\n"