Fixed regression from recent constant folding patch (bug 465272, r=gal).

js/src/jstracer.cpp

@@ -695,7 +695,7 @@ public:
                 if (d0->isconst() && d1->isconst()) {
                     int i0 = d0->constval();
                     int i1 = d1->constval();
-                    if (v == LIR_fsub)
+                    if (v == LIR_sub)
                         i1 = -i1;
                     int ir = i0 + i1;
                     /* If these overflow safely, emit an integer constant. */

js/src/trace-test.js

@@ -1893,6 +1893,14 @@ function testBug465261() {
 testBug465261.expected = true;
 test(testBug465261);
 
+function testBug465272() {
+    var a = new Array(5);
+    for (j=0;j<5;++j) a[j] = "" + ((5) - 2);
+    return a.join(",");
+}
+testBug465272.expected = "3,3,3,3,3"
+test(testBug465272);
+
 // BEGIN MANDELBROT STUFF
 // XXXbz I would dearly like to wrap it up into a function to avoid polluting
 // the global scope, but the function ends up heavyweight, and then we lose on