Back out revision 2a1149f381ed (bug 873209) because apparently pushValue does not adjust the frame size and hence we got a CLOSED TREE