--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -1171,72 +1171,77 @@ DefaultValue(VMFrame &f, JSType hint, Va
 void JS_FASTCALL
 stubs::Add(VMFrame &f)
 {
     JSContext *cx = f.cx;
     JSFrameRegs &regs = f.regs;
     Value rval = regs.sp[-1];
     Value lval = regs.sp[-2];
 
-    if (lval.isInt32() && rval.isInt32()) {
-        int32_t l = lval.toInt32(), r = rval.toInt32();
-        int32_t sum = l + r;
-        regs.sp--;
-        if (JS_UNLIKELY(bool((l ^ sum) & (r ^ sum) & 0x80000000)))
-            regs.sp[-1].setDouble(double(l) + double(r));
-        else
-            regs.sp[-1].setInt32(sum);
+    /* The string + string case is easily the hottest;  try it first. */
+    bool lIsString = lval.isString();
+    bool rIsString = rval.isString();
+    JSString *lstr, *rstr;
+    if (lIsString && rIsString) {
+        lstr = lval.toString();
+        rstr = rval.toString();
+        goto string_concat;
+
     } else
 #if JS_HAS_XML_SUPPORT
     if (lval.isObject() && lval.toObject().isXML() &&
         rval.isObject() && rval.toObject().isXML()) {
         if (!js_ConcatenateXML(cx, &lval.toObject(), &rval.toObject(), &rval))
             THROW();
         regs.sp--;
         regs.sp[-1] = rval;
     } else
 #endif
     {
+        /* These can convert lval/rval to strings. */
         if (lval.isObject() && !DefaultValue(f, JSTYPE_VOID, lval, -2))
             THROW();
         if (rval.isObject() && !DefaultValue(f, JSTYPE_VOID, rval, -1))
             THROW();
-        bool lIsString, rIsString;
-        if ((lIsString = lval.isString()) | (rIsString = rval.isString())) {
-            JSString *lstr, *rstr;
+        if ((lIsString = lval.isString()) || (rIsString = rval.isString())) {
             if (lIsString) {
                 lstr = lval.toString();
             } else {
                 lstr = js_ValueToString(cx, lval);
                 if (!lstr)
                     THROW();
                 regs.sp[-2].setString(lstr);
             }
             if (rIsString) {
                 rstr = rval.toString();
             } else {
                 rstr = js_ValueToString(cx, rval);
                 if (!rstr)
                     THROW();
                 regs.sp[-1].setString(rstr);
             }
-            JSString *str = js_ConcatStrings(cx, lstr, rstr);
-            if (!str)
-                THROW();
-            regs.sp--;
-            regs.sp[-1].setString(str);
+            goto string_concat;
+
         } else {
             double l, r;
             if (!ValueToNumber(cx, lval, &l) || !ValueToNumber(cx, rval, &r))
                 THROW();
             l += r;
             regs.sp--;
             regs.sp[-1].setNumber(l);
         }
     }
+    return;
+
+  string_concat:
+    JSString *str = js_ConcatStrings(cx, lstr, rstr);
+    if (!str)
+        THROW();
+    regs.sp--;
+    regs.sp[-1].setString(str);
 }
 
 
 void JS_FASTCALL
 stubs::Sub(VMFrame &f)
 {
     JSContext *cx = f.cx;
     JSFrameRegs &regs = f.regs;