--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -1370,18 +1370,21 @@ mjit::Compiler::finishThisUp()
     JS_ASSERT(outerScript == script);
 
     chunk->code = JSC::MacroAssemblerCodeRef(result, execPool, masm.size() + stubcc.size());
     chunk->pcLengths = pcLengths;
 
     if (chunkIndex == 0) {
         jit->invokeEntry = result;
         if (script->function()) {
+            jit->arityCheckEntry = stubCode.locationOf(arityLabel).executableAddress();
             jit->argsCheckEntry = stubCode.locationOf(argsCheckLabel).executableAddress();
             jit->fastEntry = fullCode.locationOf(invokeLabel).executableAddress();
+            void *&addr = isConstructing ? script->jitArityCheckCtor : script->jitArityCheckNormal;
+            addr = jit->arityCheckEntry;
         }
     }
 
     /*
      * WARNING: mics(), callICs() et al depend on the ordering of these
      * variable-length sections.  See JITChunk's declaration for details.
      */
 

--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1357,16 +1357,17 @@ JITScript::destroyChunk(JSContext *cx, u
     if (chunkIndex == 0) {
         if (argsCheckPool) {
             argsCheckPool->release();
             argsCheckPool = NULL;
         }
 
         invokeEntry = NULL;
         fastEntry = NULL;
+        arityCheckEntry = NULL;
         argsCheckEntry = NULL;
 
         if (script->jitNormal == this)
             script->jitArityCheckNormal = NULL;
         else
             script->jitArityCheckCtor = NULL;
 
         // Fixup any ICs still referring to this chunk.

--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -801,16 +801,17 @@ struct CrossChunkEdge
 };
 
 struct JITScript
 {
     JSScript        *script;
 
     void            *invokeEntry;       /* invoke address */
     void            *fastEntry;         /* cached entry, fastest */
+    void            *arityCheckEntry;   /* arity check address */
     void            *argsCheckEntry;    /* arguments check address */
 
     /* List of inline caches jumping to the fastEntry. */
     JSCList         callers;
 
     uint32_t        nchunks;
     uint32_t        nedges;