From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 27 Oct 2011 15:14:28 -0700
Subject: Bug 674776 - Fix trap problem in js_GetOpcode (r=jorendorff,
 a=legneato)

---
 js/src/jsopcode.cpp |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 29c9440..aa7fad5 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -153,11 +153,13 @@ js_GetIndexFromBytecode(JSContext *cx, JSScript *script, jsbytecode *pc,
     span = js_CodeSpec[op].length;
     base = 0;
     if (pc - script->code + span < script->length) {
-        if (pc[span] == JSOP_RESETBASE) {
+        JSOp next = js_GetOpcode(cx, script, pc + span);
+        if (next == JSOP_RESETBASE) {
             base = GET_INDEXBASE(pc - JSOP_INDEXBASE_LENGTH);
-        } else if (pc[span] == JSOP_RESETBASE0) {
-            JS_ASSERT(JSOP_INDEXBASE1 <= pc[-1] || pc[-1] <= JSOP_INDEXBASE3);
-            base = (pc[-1] - JSOP_INDEXBASE1 + 1) << 16;
+        } else if (next == JSOP_RESETBASE0) {
+            JSOp prev = js_GetOpcode(cx, script, pc - 1);
+            JS_ASSERT(JSOP_INDEXBASE1 <= prev && prev <= JSOP_INDEXBASE3);
+            base = (prev - JSOP_INDEXBASE1 + 1) << 16;
         }
     }
     return base + GET_UINT16(pc + pcoff);
