Bug 668936: Stringify String.prototype.replace's arguments in the right order (r=jwalden)

js/src/jsstr.cpp

@@ -2133,6 +2133,9 @@ js::str_replace(JSContext *cx, uintN argc, Value *vp)
         return false;
     static const uint32 optarg = 2;
 
+    if (!rdata.g.init(argc, vp))
+        return false;
+
     /* Extract replacement string/function. */
     if (argc >= optarg && js_IsCallable(vp[3])) {
         rdata.lambda = &vp[3].toObject();
@@ -2188,9 +2191,6 @@ js::str_replace(JSContext *cx, uintN argc, Value *vp)
         rdata.dollar = js_strchr_limit(fixed->chars(), '$', rdata.dollarEnd);
     }
 
-    if (!rdata.g.init(argc, vp))
-        return false;
-
     /*
      * Unlike its |String.prototype| brethren, |replace| doesn't convert
      * its input to a regular expression. (Even if it contains metachars.)