--- a/js/src/jsvector.h	2009-10-16 14:59:39.988229000 +0800
+++ b/js/src/jsvector.h	2009-10-16 15:00:12.259437000 +0800
@@ -662,7 +662,8 @@
     /* We are !usingInlineStorage(). Initialize new elements. */
     JS_ASSERT(heapLength() <= heapCapacity() && heapCapacity() - heapLength() >= needed);
     Impl::copyConstructN(heapEnd(), needed, t);
-    heapEnd() += needed;
+    T *& heapEndTmp = heapEnd();
+    heapEndTmp += needed;
     return true;
 }