unboxed closures with multiple captures behave strangely

[Tobba]

Seems like the captures are being read from a slightly offset location

#![feature(unboxed_closures)]

fn main() {
    let (a, b) = (1u32, 2u32);
    println!("{} {}", a, b)
    let mut closure = |&mut: c: u32| println!("{} {} {}", a, b, c);
    closure.call((3,));
}

Output:

1 2
2 32575 3

(the argument is necessary to bypass #16168 and not using overloaded calls to get past #16166)

[Tobba]

cc @pcwalton @hounw

[pcwalton]

Fixed now.