--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1097,16 +1097,18 @@ StrictlyEqual(JSContext *cx, const Value
     Value lval = lref, rval = rref;
     if (SameType(lval, rval)) {
         if (lval.isString())
             return js_EqualStrings(lval.toString(), rval.toString());
         if (lval.isDouble())
             return JSDOUBLE_COMPARE(lval.toDouble(), ==, rval.toDouble(), JS_FALSE);
         if (lval.isObject())
             return EqualObjects(cx, &lval.toObject(), &rval.toObject());
+        if (lval.isUndefined())
+                return true;
         return lval.payloadAsRawUint32() == rval.payloadAsRawUint32();
     }
 
     if (lval.isDouble() && rval.isInt32()) {
         double ld = lval.toDouble();
         double rd = rval.toInt32();
         return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE);
     }

--- a/js/src/methodjit/NunboxAssembler.h
+++ b/js/src/methodjit/NunboxAssembler.h
@@ -155,17 +155,18 @@ class Assembler : public BaseAssembler
      * Stores type first, then payload.
      * Returns label after type store. Useful for offset verification.
      */
     void storeValue(const Value &v, Address address) {
         jsval_layout jv;
         jv.asBits = JSVAL_BITS(Jsvalify(v));
 
         store32(ImmTag(jv.s.tag), tagOf(address));
-        store32(Imm32(jv.s.payload.u32), payloadOf(address));
+        if (!v.isUndefined())
+            store32(Imm32(jv.s.payload.u32), payloadOf(address));
     }
 
     void storeValue(const Value &v, BaseIndex address) {
         jsval_layout jv;
         jv.asBits = JSVAL_BITS(Jsvalify(v));
 
         store32(ImmTag(jv.s.tag), tagOf(address));
         if (!v.isUndefined())

--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -1094,16 +1094,18 @@ StubEqualityOp(VMFrame &f)
             JSObject *l = &lval.toObject(), *r = &rval.toObject();
             if (EqualityOp eq = l->getClass()->ext.equality) {
                 if (!eq(cx, l, &rval, &cond))
                     return false;
                 cond = cond == EQ;
             } else {
                 cond = (l == r) == EQ;
             }
+        } else if (lval.isNullOrUndefined()) {
+            cond = EQ;
         } else {
             cond = (lval.payloadAsRawUint32() == rval.payloadAsRawUint32()) == EQ;
         }
     } else {
         if (lval.isNullOrUndefined()) {
             cond = rval.isNullOrUndefined() == EQ;
         } else if (rval.isNullOrUndefined()) {
             cond = !EQ;