new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/arguments/strict-args-flushstack.js
@@ -0,0 +1,27 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+var args;
+
+function test()
+{
+  "use strict";
+  eval("args = arguments;");
+  var a = [];
+  for (var i = 0; i < RUNLOOP; i++)
+    a.push(arguments);
+  return a;
+}
+
+var a = test();
+
+assertEq(Array.isArray(a), true);
+assertEq(a.length, RUNLOOP);
+
+var count = 0;
+a.forEach(function(v, i) { count++; assertEq(v, args); });
+assertEq(count, RUNLOOP);
+
+assertEq(Object.prototype.toString.call(args), "[object Arguments]");
+assertEq(args.length, 0);

--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -3058,17 +3058,20 @@ public:
         JS_ASSERT(JS_THREAD_DATA(mCx)->waiveGCQuota);
         debug_only_printf(LC_TMTracer, "%s%u=", stackSlotKind(), 0);
         JSObject *frameobj = *(JSObject **)mStack;
         JS_ASSERT((frameobj == NULL) == (*mTypeMap == JSVAL_TYPE_NULL));
         if (p == fp->addressOfArgs()) {
             if (frameobj) {
                 JS_ASSERT_IF(fp->hasArgsObj(), frameobj == &fp->argsObj());
                 fp->setArgsObj(*frameobj);
-                frameobj->setPrivate(fp);
+                if (frameobj->isNormalArguments())
+                    frameobj->setPrivate(fp);
+                else
+                    JS_ASSERT(frameobj->isStrictArguments());
                 debug_only_printf(LC_TMTracer,
                                   "argsobj<%p> ",
                                   (void *)frameobj);
             } else {
                 JS_ASSERT(!fp->hasArgsObj());
                 debug_only_print0(LC_TMTracer,
                                   "argsobj<null> ");
             }