diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/debug/Frame-onPop-10.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/debug/Frame-onPop-10.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,22 @@
+// Setting onPop handlers from an onStep handler works.
+var g = newGlobal();
+var dbg = new Debugger(g);
+var log;
+
+dbg.onDebuggerStatement = function handleDebugger(frame) {
+    log += 'd';
+    assertEq(frame.type, "eval");
+    frame.onStep = function handleStep() {
+        log += 's';
+        this.onStep = undefined;
+        this.onPop = function handlePop() {
+            log += ')';
+        };
+    };
+};
+
+log = "";
+g.flag = false;
+g.eval('debugger; flag = true');
+assertEq(log, 'ds)');
+assertEq(g.flag, true);