Assume that EA = (X)+ is the effective address equal to the contents of…

Concept — auto-indexed addressing. An auto-indexed mode adjusts the pointer by exactly one word length as a side effect of forming an effective address. In a post-adjusted mode the effective address is the value the pointer already holds and the adjustment happens afterwards; in a pre-adjusted mode the adjustment happens first and the effective address is the value the pointer then holds. The placement of the adjustment, not its size, decides which cell an operand is taken from.

Concept — one instruction reaching two stack cells. In (opcode, source, destination) with destination ← source op destination, the source effective address is formed first, so any pointer side effect the source carries is already in force when the destination effective address is formed. That carry-over is the only mechanism by which a single two-operand instruction can reach two different cells of a stack addressed through one pointer.

Concept — what pop, pop, add, push must look like. Consuming two words and producing one leaves the stack one word shorter, so the pointer must finish one cell nearer the base than it started and the cell it finishes on must hold the sum. Here X holds the address of the current top and the stack is filled toward higher addresses, so the element below the top lies one word lower and a pop reads the cell X addresses and then decrements X.

Application. Let X = 1000, so cell 1000 holds the top of the stack, call it a, and cell 999 holds the element below it, call it b. Trace ADD (X)−, (X).

1. Form the source effective address. (X)− is post-adjusted, so the effective address is the 1000 that X already holds and the source operand is a. X then becomes 999.

2. Form the destination effective address. (X) uses the value X holds at that moment, which is now 999, so the destination cell is 999 and the destination operand is b.

3. Execute destination ← source + destination. Cell 999 receives a + b.

4. Read off the final state. X = 999 and cell 999 holds a + b, so a and b have both been consumed and the single value X now addresses is their sum.

Two elements were taken off the stack, one value was left in their place, and the pointer finished one cell lower than it started — exactly pop, pop, add, push.

Cross-check. Tracing all four instructions from the same starting state X = 1000 gives:

Only ADD (X)−, (X) draws its two operands from two different cells. In the other three the same cell supplies both operands: ADD (X), (X)− doubles a and stores the result at cell 1000, which the pointer has already moved below; ADD −(X), (X)+ and ADD −(X), (X) never read a at all and store b + b at cell 999, differing only in where the pointer finishes.

Note on the direction of growth. These four instructions are consistent only with a stack filled toward higher addresses, where reading cell X and then decrementing X is a pop. If the stack were assumed to grow toward lower addresses, a pop would be the post-increment form (X)+, the instruction needed would be ADD (X)+, (X), and none of the four instructions offered would work. The post-decrement reading is therefore the one the question intends.