diff -r e731795f925c -r c52ca323063f src/BytecodeCompiler.cpp
--- a/src/BytecodeCompiler.cpp	Fri Sep 14 02:38:14 2012 -0700
+++ b/src/BytecodeCompiler.cpp	Sat Sep 15 13:15:51 2012 -0700
@@ -777,10 +777,8 @@
         __ note_position(node->pos());
         if (var->scope()->kind() == Scope::GLOBAL)
             __ newarray(map, Heap::Tenure_Old);
-        else if (var->needsHeapAllocation())
+        else
             __ newarray(map, Heap::Tenure_Default);
-        else
-            __ newarray(map, Heap::Tenure_Stack);
 
         if (node->initialization()) {
             node->initialization()->accept(this);
@@ -827,9 +825,8 @@
     // Sniff out natives, which have a specific opcode and are guaranteed to
     // be called via name proxy.
     NamedFunction *native = NULL;
-    if (funType->isNative()) {
+    if (funType->isNative())
         native = node->callee()->toNameProxy()->binding()->toNamedFunction();
-    }
 
     Local<Type> given(zone_);
     for (size_t i = node->arguments()->length() - 1; i < node->arguments()->length(); i--) {
@@ -920,7 +917,13 @@
                 // change in the future, we do the same thing and dupe the
                 // newly allocated array.
                 map = ArrayMap::cast(array->map());
-                __ newarray(map, Heap::Tenure_Stack);
+                
+                // Natives cannot escape array references, so we can allocate
+                // them on the LIFO stack.
+                if (funType->isNative())
+                    __ newarray(map, Heap::Tenure_Stack);
+                else
+                    __ newarray(map, Heap::Tenure_Default);
                 __ dup();
                 __ object(array);
                 __ copyarray();