--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4225,16 +4225,18 @@ js_Interpret(JSContext *cx)
                 if (entry
                     ? !js_GetPropertyHelper(cx, obj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
             } while (0);
 
             STORE_STACK(-1, rval);
+            JS_ASSERT(JSOP_GETPROP_LENGTH + i == js_CodeSpec[op].length);
+            len = JSOP_GETPROP_LENGTH + i;
           END_VARLEN_CASE
 
           BEGIN_CASE(JSOP_LENGTH)
             FETCH_STACK(-1, lval);
             if (JSVAL_IS_STRING(lval)) {
                 str = JSVAL_TO_STRING(lval);
                 regs.sp[-1] = INT_TO_JSVAL(JSSTRING_LENGTH(str));
             } else if (!JSVAL_IS_PRIMITIVE(lval) &&
@@ -4249,18 +4251,16 @@ js_Interpret(JSContext *cx)
                 length = obj->fslots[JSSLOT_ARRAY_LENGTH];
                 if (length <= JSVAL_INT_MAX) {
                     regs.sp[-1] = INT_TO_JSVAL(length);
                 } else if (!js_NewDoubleInRootedValue(cx, (jsdouble) length,
                                                       &regs.sp[-1])) {
                     goto error;
                 }
             } else {
-            JS_ASSERT(JSOP_GETPROP_LENGTH + i == js_CodeSpec[op].length);
-            len = JSOP_GETPROP_LENGTH + i;
                 i = -2;
                 goto do_getprop_with_lval;
             }
           END_CASE(JSOP_LENGTH)
 
           BEGIN_CASE(JSOP_CALLPROP)
           {
             JSObject *aobj;