Fix for bug 433672, r=igor.
authorBrendan Eich <brendan@mozilla.org>
Fri, 23 May 2008 19:08:44 -0700
changeset 17166 6e4e82c5932f463b82bf5463b8e34de2a91b7e73
parent 15143 79924d3b5bbab9757992099105626781a6a2a3a0
child 17167 b3d09506eaae1fcb5cbddf76c6e4cd95c2b0ee2a
push idunknown
push userunknown
push dateunknown
reviewersigor
bugs433672
milestone1.9.1a1pre
Fix for bug 433672, r=igor.
js/src/jsinterp.cpp
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -3689,20 +3689,20 @@ interrupt:
                     regs.sp--;
                     STORE_NUMBER(cx, -1, d);
                 }
             }
           END_CASE(JSOP_ADD)
 
 #define BINARY_OP(OP)                                                         \
     JS_BEGIN_MACRO                                                            \
+        FETCH_NUMBER(cx, -2, d);                                              \
         FETCH_NUMBER(cx, -1, d2);                                             \
-        FETCH_NUMBER(cx, -2, d);                                              \
         d = d OP d2;                                                          \
-        regs.sp--;                                                                 \
+        regs.sp--;                                                            \
         STORE_NUMBER(cx, -1, d);                                              \
     JS_END_MACRO
 
           BEGIN_CASE(JSOP_SUB)
             BINARY_OP(-);
           END_CASE(JSOP_SUB)
 
           BEGIN_CASE(JSOP_MUL)