new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug648438.js
@@ -0,0 +1,7 @@
+for (var i = 0; i < 20; i++) {
+    (function () {
+        try {
+            JSON.parse();
+        } catch (e) {}
+    }).call();
+}

--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -933,25 +933,27 @@ StackIter::settleOnNewState()
              *
              * Function.prototype.call will however appear, hence the debugger
              * can, by inspecting 'args.thisv', give some useful information.
              */
             JSOp op = js_GetOpcode(cx_, fp_->script(), pc_);
             if (op == JSOP_CALL || op == JSOP_FUNCALL) {
                 uintN argc = GET_ARGC(pc_);
                 DebugOnly<uintN> spoff = sp_ - fp_->base();
-                JS_ASSERT(spoff == js_ReconstructStackDepth(cx_, fp_->script(), pc_));
+                JS_ASSERT_IF(!fp_->hasImacropc(),
+                             spoff == js_ReconstructStackDepth(cx_, fp_->script(), pc_));
                 Value *vp = sp_ - (2 + argc);
 
                 if (IsNativeFunction(*vp)) {
                     state_ = IMPLICIT_NATIVE;
                     args_ = CallArgsFromVp(argc, vp);
                     return;
                 }
             } else if (op == JSOP_FUNAPPLY) {
+                JS_ASSERT(!fp_->hasImacropc());
                 uintN argc = GET_ARGC(pc_);
                 uintN spoff = js_ReconstructStackDepth(cx_, fp_->script(), pc_);
                 Value *sp = fp_->base() + spoff;
                 Value *vp = sp - (2 + argc);
 
                 if (IsNativeFunction(*vp)) {
                     if (sp_ != sp) {
                         JS_ASSERT(argc == 2);