Bug 458355 - ecma_3/Operators/11.4.1-002.js fail; r=brendan

js/src/jsinterp.cpp

@@ -5046,7 +5046,7 @@ js_Interpret(JSContext *cx)
           BEGIN_CASE(JSOP_RESUME)
             /* This case is not truly empty. The tracer is invoked transparently. */
           END_CASE(JSOP_RESUME)
-          
+
 #if JS_HAS_LVALUE_RETURN
           BEGIN_CASE(JSOP_SETCALL)
             argc = GET_ARGC(regs.pc);
@@ -5056,8 +5056,10 @@ js_Interpret(JSContext *cx)
             LOAD_INTERRUPT_HANDLER(cx);
             if (!ok)
                 goto error;
+            JS_ASSERT(regs.pc[JSOP_SETCALL_LENGTH] == JSOP_RESUME);
+            len = JSOP_SETCALL_LENGTH + JSOP_RESUME_LENGTH;
             if (!cx->rval2set) {
-                op2 = (JSOp) regs.pc[JSOP_SETCALL_LENGTH];
+                op2 = (JSOp) regs.pc[len];
                 if (op2 != JSOP_DELELEM) {
                     JS_ASSERT(!(js_CodeSpec[op2].format & JOF_DEL));
                     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
@@ -5071,7 +5073,7 @@ js_Interpret(JSContext *cx)
                  * it doesn't seem worth the code for this obscure case.
                  */
                 *vp = JSVAL_TRUE;
-                regs.pc += JSOP_SETCALL_LENGTH + JSOP_DELELEM_LENGTH;
+                regs.pc += len + JSOP_DELELEM_LENGTH;
                 op = (JSOp) *regs.pc;
                 DO_OP();
             }