--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2301,18 +2301,21 @@ TraceRecorder::adjustCallerTypes(Fragmen
     unsigned ngslots = treeInfo->globalSlots->length();
     JS_ASSERT(ngslots == treeInfo->nGlobalTypes());
     TreeInfo* ti = (TreeInfo*)f->vmprivate;
     uint8* map = ti->globalTypeMap();
     uint8* m = map;
     FORALL_GLOBAL_SLOTS(cx, ngslots, gslots,
         LIns* i = get(vp);
         bool isPromote = isPromoteInt(i);
-        if (isPromote && *m == JSVAL_DOUBLE)
+        if (isPromote && *m == JSVAL_DOUBLE) {
             lir->insStorei(get(vp), lirbuf->state, nativeGlobalOffset(vp));
+            /* Aggressively undo speculation so the inner tree will compile if this fails. */
+            oracle.markGlobalSlotUndemotable(cx, gslots[n]);
+        }
         JS_ASSERT(!(!isPromote && *m == JSVAL_INT));
         ++m;
     );
     JS_ASSERT(unsigned(m - map) == ti->nGlobalTypes());
     map = ti->stackTypeMap();
     m = map;
     FORALL_SLOTS_IN_PENDING_FRAMES(cx, 0,
         LIns* i = get(vp);