Fix typo that leads to assertion failure. No bug, r=me.

--HG--
extra : convert_revision : a52df753119f0b9c3b6b9a3e6b8efc664b164dec

js/src/nanojit/LIR.cpp

@@ -2775,7 +2775,7 @@ namespace nanojit
 
         case LIR_negi:
             if (lim > 0)
-                return sub(Interval(0, 0), of(ins->oprnd2(), lim-1));
+                return sub(Interval(0, 0), of(ins->oprnd1(), lim-1));
             goto overflow;
 
         case LIR_muli: