diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index 8e6ee511e22..50d3fb4d1ea 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -524,14 +524,14 @@ mjit::Compiler::jsop_bitop(JSOp op)
         RegisterID rr = frame.tempRegForData(rhs);
 #endif
 
-        frame.pinReg(rr);
         if (lhs->isConstant()) {
+            frame.pinReg(rr);
             reg = frame.allocReg();
             masm.move(Imm32(lhs->getValue().toInt32()), reg);
+            frame.unpinReg(rr);
         } else {
             reg = frame.copyDataIntoReg(lhs);
         }
-        frame.unpinReg(rr);
         
         if (op == JSOP_LSH) {
             masm.lshift32(rr, reg);
diff --git a/js/src/trace-test/tests/jaeger/bug600419.js b/js/src/trace-test/tests/jaeger/bug600419.js
new file mode 100644
index 00000000000..981a6a17c4c
--- /dev/null
+++ b/js/src/trace-test/tests/jaeger/bug600419.js
@@ -0,0 +1,5 @@
+/* Don't assert. */
+(function() {
+    var x;
+    [1].map(function(){}, x << x);
+})()