diff --git a/js/src/ion/BaselineCompiler.cpp b/js/src/ion/BaselineCompiler.cpp
index bfdc58b32a4..800b566286c 100644
--- a/js/src/ion/BaselineCompiler.cpp
+++ b/js/src/ion/BaselineCompiler.cpp
@@ -2399,6 +2399,17 @@ BaselineCompiler::emit_JSOP_SETRVAL()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_CALLEE()
+{
+    JS_ASSERT(function());
+    frame.syncStack(0);
+    masm.loadPtr(frame.addressOfCallee(), R0.scratchReg());
+    masm.tagValue(JSVAL_TYPE_OBJECT, R0.scratchReg(), R0);
+    frame.push(R0);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_POPV()
 {
diff --git a/js/src/ion/BaselineCompiler.h b/js/src/ion/BaselineCompiler.h
index 7e687d5c2a2..b79ecc61e7e 100644
--- a/js/src/ion/BaselineCompiler.h
+++ b/js/src/ion/BaselineCompiler.h
@@ -160,6 +160,7 @@ namespace ion {
     _(JSOP_MOREITER)           \
     _(JSOP_ITERNEXT)           \
     _(JSOP_ENDITER)            \
+    _(JSOP_CALLEE)             \
     _(JSOP_POPV)               \
     _(JSOP_SETRVAL)            \
     _(JSOP_RETURN)             \
diff --git a/js/src/jit-test/tests/baseline/callee.js b/js/src/jit-test/tests/baseline/callee.js
new file mode 100644
index 00000000000..328574dcc9d
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/callee.js
@@ -0,0 +1,5 @@
+ff = (function g() {
+    for (var i=0; i<15; i++) {}
+    return g;
+});
+assertEq(ff(), ff);
diff --git a/js/src/jit-test/tests/basic/bug522136.js b/js/src/jit-test/tests/basic/bug522136.js
index 8a86f7fc377..751396dbd54 100644
--- a/js/src/jit-test/tests/basic/bug522136.js
+++ b/js/src/jit-test/tests/basic/bug522136.js
@@ -7,4 +7,4 @@ try {
 }
 
 // Exact behavior of recursion check depends on which JIT we use.
-assertEq(thrown && Q > 8000, true);
+assertEq(thrown && Q > 3500, true);