diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index e68db169c02c..7559b018a8d4 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2441,6 +2441,7 @@ TraceRecorder::synthesize_frame(JSFunction* fun, JSStackFrame* down, uintN argc,
     JSInlineFrame* newifp;
 
     nframeslots = JS_HOWMANY(sizeof(JSInlineFrame), sizeof(jsval));
+    nbytes = (nframeslots + script->nslots) * sizeof(jsval);
 
     /* Allocate missing expected args adjacent to actuals. */
     if (fun->nargs <= argc) {