Keep key register pinned longer when accessing elements of hoisted arguments objects, bug 683207. r=dvander

js/src/methodjit/FastOps.cpp

@@ -1816,9 +1816,6 @@ mjit::Compiler::jsop_getelem_args()
     RegisterID dataReg = frame.allocReg();
     RegisterID typeReg = frame.allocReg();
 
-    if (!key.isConstant())
-        frame.unpinReg(key.reg());
-
     // Guard on nactual.
     if (!hoistedLength) {
         Address nactualAddr(JSFrameReg, StackFrame::offsetOfArgs());
@@ -1840,6 +1837,9 @@ mjit::Compiler::jsop_getelem_args()
         masm.loadFrameActuals(outerScript->function(), actualsReg);
     }
 
+    if (!key.isConstant())
+        frame.unpinReg(key.reg());
+
     if (key.isConstant()) {
         Address arg(actualsReg, key.index() * sizeof(Value));
         masm.loadValueAsComponents(arg, typeReg, dataReg);