new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/for-of/array-jit.js
@@ -0,0 +1,6 @@
+var arr = [1, 2, 3];
+var y = 0;
+for (var i = 0; i < 10; i++)
+    for (var x of arr)
+        y += x;
+assertEq(y, 60);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/symbol/toNumber-2.js
@@ -0,0 +1,14 @@
+// |jit-test| error: ReferenceError
+function eq(e, a) {
+    passed = (a == e);
+}
+function f(e, a) {
+    fail();
+    eq(e, a);
+}
+try {
+    f();
+} catch (exc1) {}
+eq(.1, .1);
+var sym = Symbol("method");
+evaluate("f(test, sym, 0)", {compileAndGo: true});

--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -1254,16 +1254,25 @@ BaselineCompiler::emit_JSOP_DOUBLE()
 
 bool
 BaselineCompiler::emit_JSOP_STRING()
 {
     frame.push(StringValue(script->getAtom(pc)));
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_SYMBOL()
+{
+    unsigned which = GET_UINT8(pc);
+    JS::Symbol *sym = cx->runtime()->wellKnownSymbols->get(which);
+    frame.push(SymbolValue(sym));
+    return true;
+}
+
 typedef NativeObject *(*DeepCloneObjectLiteralFn)(JSContext *, HandleNativeObject, NewObjectKind);
 static const VMFunction DeepCloneObjectLiteralInfo =
     FunctionInfo<DeepCloneObjectLiteralFn>(DeepCloneObjectLiteral);
 
 bool
 BaselineCompiler::emit_JSOP_OBJECT()
 {
     if (JS::CompartmentOptionsRef(cx).cloneSingletons()) {

--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -56,16 +56,17 @@ namespace jit {
     _(JSOP_ZERO)               \
     _(JSOP_ONE)                \
     _(JSOP_INT8)               \
     _(JSOP_INT32)              \
     _(JSOP_UINT16)             \
     _(JSOP_UINT24)             \
     _(JSOP_DOUBLE)             \
     _(JSOP_STRING)             \
+    _(JSOP_SYMBOL)             \
     _(JSOP_OBJECT)             \
     _(JSOP_CALLSITEOBJ)        \
     _(JSOP_REGEXP)             \
     _(JSOP_LAMBDA)             \
     _(JSOP_LAMBDA_ARROW)       \
     _(JSOP_BITOR)              \
     _(JSOP_BITXOR)             \
     _(JSOP_BITAND)             \