--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -1260,16 +1260,25 @@ mjit::Compiler::generateMethod()
             JSAtom *atom = script->getAtom(fullAtomIndex(PC));
             prepareStubCall();
             masm.move(ImmPtr(atom), Registers::ArgReg1);
             stubCall(stubs::InitMethod, Uses(1), Defs(0));
             frame.pop();
           }
           END_CASE(JSOP_INITMETHOD)
 
+          BEGIN_CASE(JSOP_UNBRAND)
+            jsop_unbrand();
+          END_CASE(JSOP_UNBRAND)
+
+          BEGIN_CASE(JSOP_UNBRANDTHIS)
+            jsop_this();
+            jsop_unbrand();
+          END_CASE(JSOP_UNBRANDTHIS)
+
           BEGIN_CASE(JSOP_OBJTOSTR)
             jsop_objtostr();
           END_CASE(JSOP_OBJTOSTR)
 
           BEGIN_CASE(JSOP_GETGLOBAL)
           BEGIN_CASE(JSOP_CALLGLOBAL)
             jsop_getglobal(GET_SLOTNO(PC));
             if (op == JSOP_CALLGLOBAL)
@@ -2159,8 +2168,15 @@ void
 mjit::Compiler::jsop_getelem_slow()
 {
     prepareStubCall();
     stubCall(stubs::GetElem, Uses(2), Defs(1));
     frame.popn(2);
     frame.pushSynced();
 }
 
+void
+mjit::Compiler::jsop_unbrand()
+{
+    prepareStubCall();
+    stubCall(stubs::Unbrand, Uses(0), Defs(0));
+}
+

--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -163,16 +163,17 @@ class Compiler
     void jsop_eleminc(JSOp op, VoidStub);
     void jsop_getgname(uint32 index);
     void jsop_getgname_slow(uint32 index);
     void jsop_setgname(uint32 index);
     void jsop_setgname_slow(uint32 index);
     void jsop_bindgname();
     void jsop_setelem_slow();
     void jsop_getelem_slow();
+    void jsop_unbrand();
 
     /* Fast opcodes. */
     void jsop_bitop(JSOp op);
     void jsop_globalinc(JSOp op, uint32 index);
     void jsop_relational(JSOp op, BoolStub stub, jsbytecode *target, JSOp fused);
     void jsop_neg();
     void jsop_bitnot();
     void jsop_objtostr();

--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -2463,8 +2463,15 @@ stubs::TableSwitch(VMFrame &f, jsbytecod
 
 finally:
     /* Provide the native address. */
     ptrdiff_t offset = (originalPC + jumpOffset) - script->code;
     JS_ASSERT(script->nmap[offset]);
     return script->nmap[offset];
 }
 
+void JS_FASTCALL
+stubs::Unbrand(VMFrame &f)
+{
+    if (!f.regs.sp[-1].asObject().unbrand(f.cx))
+        THROW();
+}
+

--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -148,16 +148,17 @@ void JS_FASTCALL IterNext(VMFrame &f);
 JSBool JS_FASTCALL IterMore(VMFrame &f);
 void JS_FASTCALL EndIter(VMFrame &f);
 void JS_FASTCALL ForName(VMFrame &f, JSAtom *atom);
 
 JSBool JS_FASTCALL ValueToBoolean(VMFrame &f);
 JSString * JS_FASTCALL TypeOf(VMFrame &f);
 JSBool JS_FASTCALL InstanceOf(VMFrame &f);
 void JS_FASTCALL ArgCnt(VMFrame &f);
+void JS_FASTCALL Unbrand(VMFrame &f);
 
 }}} /* namespace stubs,mjit,js */
 
 extern "C" void *
 js_InternalThrow(js::VMFrame &f);
 
 #endif /* jslogic_h__ */