--- a/js/src/methodjit/nunbox/Assembler.h
+++ b/js/src/methodjit/nunbox/Assembler.h
@@ -50,16 +50,20 @@ class Assembler : public BaseAssembler
     static const uint32 PAYLOAD_OFFSET = 0;
     static const uint32 TAG_OFFSET     = 4;
 
   public:
     Address payloadOf(Address address) {
         return address;
     }
 
+    Address tagOf(Address address) {
+        return Address(address.base, address.offset + TAG_OFFSET);
+    }
+
     void loadTypeTag(Address address, RegisterID reg) {
         load32(Address(address.base, address.offset + TAG_OFFSET), reg);
     }
 
     void storeTypeTag(Imm32 imm, Address address) {
         store32(imm, Address(address.base, address.offset + TAG_OFFSET));
     }
 
@@ -73,15 +77,24 @@ class Assembler : public BaseAssembler
 
     void storeData32(Imm32 imm, Address address) {
         store32(imm, Address(address.base, address.offset + PAYLOAD_OFFSET));
     }
 
     void storeData32(RegisterID reg, Address address) {
         store32(reg, Address(address.base, address.offset + PAYLOAD_OFFSET));
     }
+
+    void storeValue(const Value &v, Address address) {
+        jsval_layout jv;
+        jv.asBits = Jsvalify(v);
+
+        store32(Imm32(jv.s.mask32), tagOf(address));
+        if (!v.isUndefined())
+            store32(Imm32(jv.s.payload.u32), payloadOf(address));
+    }
 };
 
 } /* namespace js */
 } /* namespace mjit */
 
 #endif
 

--- a/js/src/methodjit/nunbox/FrameEntry.h
+++ b/js/src/methodjit/nunbox/FrameEntry.h
@@ -71,17 +71,17 @@ class FrameEntry
         return type.isConstant();
     }
 
     uint32 getTypeTag() {
         return v_.s.mask32;
     }
 
     uint32 getPayload32() {
-        JS_ASSERT(!Valueify(v_.asBits).isDouble());
+        JS_ASSERT(!Valueify(v_.asBits).isDouble() || type.synced());
         return v_.s.payload.u32;
     }
 
     uint32 copyOf() {
         JS_ASSERT(type.isCopy() || data.isCopy());
         return index_;
     }
 

--- a/js/src/methodjit/nunbox/FrameState.cpp
+++ b/js/src/methodjit/nunbox/FrameState.cpp
@@ -168,20 +168,26 @@ FrameState::syncData(FrameEntry *fe, Ass
         masm.storeData32(fe->data.reg(), addressOf(fe));
     fe->data.setSynced();
 }
 
 void
 FrameState::sync(Assembler &masm, RegSnapshot &snapshot) const
 {
     for (FrameEntry *fe = base; fe < sp; fe++) {
-        if (fe->type.needsSync())
-            syncType(fe, masm);
-        if (fe->data.needsSync())
-            syncData(fe, masm);
+        if (fe->isConstant()) {
+            JS_ASSERT(fe->type.synced() == fe->data.synced());
+            if (!fe->data.synced())
+                masm.storeValue(fe->getValue(), addressOf(fe));
+        } else {
+            if (fe->type.needsSync())
+                syncType(fe, masm);
+            if (fe->data.needsSync())
+                syncData(fe, masm);
+        }
     }
 
     JS_STATIC_ASSERT(sizeof(snapshot.regs) == sizeof(regstate));
     JS_STATIC_ASSERT(sizeof(RegState) == sizeof(uint32));
     memcpy(snapshot.regs, regstate, sizeof(regstate));
     snapshot.alloc = regalloc;
 }