diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index fd04506820a9..1f6b5bbb2c98 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1752,20 +1752,20 @@ HeapTypeSetKey::constant(CompilerConstraintList *constraints, Value *valOut)
     if (nonData(constraints))
         return false;
 
-    if (!maybeTypes())
-        return false;
-
-    if (maybeTypes()->nonConstantProperty())
-        return false;
-
     // Only singleton object properties can be marked as constants.
-    JS_ASSERT(object()->singleton());
+    JSObject *obj = object()->singleton();
+    if (!obj || !obj->isNative())
+        return false;
+
+    if (maybeTypes() && maybeTypes()->nonConstantProperty())
+        return false;
 
     // Get the current value of the property.
-    Shape *shape = object()->singleton()->nativeLookupPure(id());
-    if (!shape)
+    Shape *shape = obj->nativeLookupPure(id());
+    if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot() || shape->hadOverwrite())
         return false;
-    Value val = object()->singleton()->nativeGetSlot(shape->slot());
+
+    Value val = obj->nativeGetSlot(shape->slot());
 
     // If the value is a pointer to an object in the nursery, don't optimize.
     if (val.isGCThing() && IsInsideNursery(val.toGCThing()))