Bug 835496 - Don't try to fix the types for object initializers with dense elements, r=jandem.

js/src/jit-test/tests/ion/bug835496.js

@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+(function([{x}]) {})({
+    t: 0,
+    "1": 0
+})

js/src/jsinfer.cpp

@@ -3248,7 +3248,7 @@ TypeCompartment::fixObjectType(JSContext *cx, HandleObject obj)
      */
     JS_ASSERT(obj->isObject());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode())
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
         return;
 
     ObjectTypeTable::AddPtr p = objectTypeTable->lookupForAdd(obj.get());