--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -4016,17 +4016,21 @@ js_AttemptToExtendTree(JSContext* cx, VM
                guard (anchor) has the type information for everything below the current scope,
                and the actual guard we exited from has the types for everything in the current
                scope (and whatever it inlined). We have to merge those maps here. */
             VMSideExit* e1 = anchor;
             VMSideExit* e2 = exitedFrom;
             fullMap.add(getStackTypeMap(e1), e1->numStackSlotsBelowCurrentFrame);
             fullMap.add(getStackTypeMap(e2), e2->numStackSlots);
             stackSlots = fullMap.length();
-            fullMap.add(getGlobalTypeMap(e1), e1->numGlobalSlots);
+            fullMap.add(getGlobalTypeMap(e2), e2->numGlobalSlots);
+            if (e1->numGlobalSlots >= e2->numGlobalSlots) {
+                fullMap.add(getGlobalTypeMap(e1) + e2->numGlobalSlots,
+                            e1->numGlobalSlots - e2->numGlobalSlots);
+            }
             ngslots = e1->numGlobalSlots;
             typeMap = fullMap.data();
         }
         JS_ASSERT(ngslots >= anchor->numGlobalSlots);
         return js_StartRecorder(cx, anchor, c, (TreeInfo*)f->vmprivate, stackSlots,
                                 ngslots, typeMap, exitedFrom, outer, cx->fp->argc);
     }
     return false;