diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index c0a56844471a..8c72be215d11 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -697,6 +697,8 @@ struct GetPropertyHelper {
             return ic.error(cx);
         if (!prop)
             return ic.disable(cx, "lookup failed");
+        if (!obj->isNative())
+            return ic.disable(cx, "non-native");
         if (!IsCacheableProtoChain(obj, holder))
             return ic.disable(cx, "non-native holder");
         shape = (const Shape *)prop;