diff --git a/js/src/jit-test/tests/ion/bug835496.js b/js/src/jit-test/tests/ion/bug835496.js
new file mode 100644
index 000000000000..0c40c0106c2d
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug835496.js
@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+(function([{x}]) {})({
+    t: 0,
+    "1": 0
+})
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 910d5c8a7c11..24b2eaa63115 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3248,7 +3248,7 @@ TypeCompartment::fixObjectType(JSContext *cx, HandleObject obj)
      */
     JS_ASSERT(obj->isObject());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode())
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
         return;
 
     ObjectTypeTable::AddPtr p = objectTypeTable->lookupForAdd(obj.get());