diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index 444a3ba1d2f6..29fb942cf63e 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -5054,6 +5054,9 @@ IonBuilder::jsop_getelem_string()
     MStringLength *length = MStringLength::New(str);
     current->add(length);
 
+    // This will cause an invalidation of this script once the 'undefined' type
+    // is monitored by the interpreter.
+    JS_ASSERT(oracle->propertyRead(script_, pc)->getKnownTypeTag() == JSVAL_TYPE_STRING);
     id = addBoundsCheck(id, length);
 
     MCharCodeAt *charCode = MCharCodeAt::New(str, id);
diff --git a/js/src/ion/TypeOracle.cpp b/js/src/ion/TypeOracle.cpp
index 869759b55a9c..a598a4bdcde7 100644
--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -357,8 +357,11 @@ TypeInferenceOracle::elementReadIsString(JSScript *script, jsbytecode *pc)
     if (id->getKnownTypeTag() != JSVAL_TYPE_INT32)
         return false;
 
-    types::TypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
-    if (!pushed->hasType(types::Type::StringType()))
+    // This function is used for jsop_getelem_string which should return
+    // undefined if this is out-side the string bounds. Currently we just
+    // fallback to a CallGetElement.
+    StackTypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
+    if (pushed->getKnownTypeTag() != JSVAL_TYPE_STRING)
         return false;
 
     return true;