Fix a bug in stack overflow error handling. This fixes half of Bug

#115555.

The error from s_push() on stack overflow was -1, which was passed
through unchanged by push(), but not tested for by push()'s caller --
which only expected positive error codes.  Fixed by changing s_push()
to return E_NOMEM on stack overflow.  (Not quite the proper error code
either, but I can't be bothered adding a new E_STACKOVERFLOW error
code in all the right places.)