LJ_GC64: Fix BC_CALLM snapshot handling.

diff --git a/src/lj_trace.c b/src/lj_trace.c
index 80a7f024af55ea39a7eeab547644c6a3deef96d0..d85b47f8013e1529c59944c402e4a37bc0640e87 100644 (file)
--- a/src/lj_trace.c
+++ b/src/lj_trace.c
@@ -894,7 +894,7 @@ int LJ_FASTCALL lj_trace_exit(jit_State *J, void *exptr)
   ERRNO_RESTORE
   switch (bc_op(*pc)) {
   case BC_CALLM: case BC_CALLMT:
-    return (int)((BCReg)(L->top - L->base) - bc_a(*pc) - bc_c(*pc) + LJ_FR2);
+    return (int)((BCReg)(L->top - L->base) - bc_a(*pc) - bc_c(*pc) - LJ_FR2);
   case BC_RETM:
     return (int)((BCReg)(L->top - L->base) + 1 - bc_a(*pc) - bc_d(*pc));
   case BC_TSETM: