new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testEvalInFrameEdgeCase.js
@@ -0,0 +1,11 @@
+// |jit-test| debug
+
+function g() {
+    var x = 100;
+    return evalInFrame(2, "x");
+}
+function f() {
+    var x = 42;
+    return evalInFrame.call(null, 0, "g()");
+}
+assertEq(f.call(), 42);

--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1368,17 +1368,19 @@ StackIter::settleOnNewState()
         bool containsCall = data_.seg_->contains(data_.calls_);
         while (!containsFrame && !containsCall) {
             /* Eval-in-frame can cross contexts, so use prevInMemory. */
             data_.seg_ = data_.seg_->prevInMemory();
             containsFrame = data_.seg_->contains(data_.fp_);
             containsCall = data_.seg_->contains(data_.calls_);
 
             /* Eval-in-frame allows jumping into the middle of a segment. */
-            if (containsFrame && data_.seg_->fp() != data_.fp_) {
+            if (containsFrame &&
+                (data_.seg_->fp() != data_.fp_ || data_.seg_->maybeCalls() != data_.calls_))
+            {
                 /* Avoid duplicating logic; seg_ contains fp_, so no iloop. */
                 StackIter tmp = *this;
                 tmp.startOnSegment(data_.seg_);
                 while (!tmp.isScript() || tmp.data_.fp_ != data_.fp_)
                     ++tmp;
                 JS_ASSERT(tmp.isScript() &&
                           tmp.data_.seg_ == data_.seg_ &&
                           tmp.data_.fp_ == data_.fp_);