diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp index 52ef0c61eab..bd2f90353ad 100644 --- a/js/src/jstracer.cpp +++ b/js/src/jstracer.cpp @@ -7162,6 +7162,8 @@ TraceRecorder::record_JSOP_GETELEM() /* Property access using a string name or something we have to stringify. */ if (!JSVAL_IS_INT(idx)) { + if (!JSVAL_IS_PRIMITIVE(idx)) + ABORT_TRACE("non-primitive index"); // If index is not a string, turn it into a string. if (!js_InternNonIntElementId(cx, obj, idx, &id)) ABORT_TRACE("failed to intern non-int element id");