--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -6053,17 +6053,16 @@ IonBuilder::jsop_setelem_dense()
 
         current->add(ins);
         current->push(value);
 
         if (!resumeAfter(ins))
             return false;
     }
 
-    // Determine whether a write barrier is required.
     if (oracle->elementWriteNeedsBarrier(script(), pc))
         store->setNeedsBarrier();
 
     if (elementType != MIRType_None && packed)
         store->setElementType(elementType);
 
     return true;
 }

--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -996,16 +996,19 @@ IonBuilder::inlineUnsafeSetDenseArrayEle
     // there were setters on the prototype, they would not be invoked.
     // But this is actually the desired behavior.
 
     MStoreElement *store = MStoreElement::New(elements, id,
                                               callInfo.getArg(elemi),
                                               /* needsHoleCheck = */ false);
     store->setRacy();
 
+    if (oracle->elementWriteNeedsBarrier(getInlineArgTypeSet(callInfo, arri)))
+        store->setNeedsBarrier();
+
     current->add(store);
 
     if (!resumeAfter(store))
         return false;
 
     return true;
 }
 

--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -635,18 +635,23 @@ TypeInferenceOracle::propertyWriteNeedsB
     return types->propertyNeedsBarrier(cx, id);
 }
 
 bool
 TypeInferenceOracle::elementWriteNeedsBarrier(RawScript script, jsbytecode *pc)
 {
     // Return true if SETELEM-like instructions need a write barrier before modifying
     // a property. The object is the third value popped by SETELEM.
-    StackTypeSet *types = script->analysis()->poppedTypes(pc, 2);
-    return types->propertyNeedsBarrier(cx, JSID_VOID);
+    return elementWriteNeedsBarrier(script->analysis()->poppedTypes(pc, 2));
+}
+
+bool
+TypeInferenceOracle::elementWriteNeedsBarrier(StackTypeSet *obj)
+{
+    return obj->propertyNeedsBarrier(cx, JSID_VOID);
 }
 
 StackTypeSet *
 TypeInferenceOracle::getCallTarget(RawScript caller, uint32_t argc, jsbytecode *pc)
 {
     JS_ASSERT(caller == this->script());
     JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE);
 

--- a/js/src/ion/TypeOracle.h
+++ b/js/src/ion/TypeOracle.h
@@ -136,16 +136,19 @@ class TypeOracle
         return true;
     }
     virtual bool propertyWriteNeedsBarrier(RawScript script, jsbytecode *pc, RawId id) {
         return true;
     }
     virtual bool elementWriteNeedsBarrier(RawScript script, jsbytecode *pc) {
         return true;
     }
+    virtual bool elementWriteNeedsBarrier(types::StackTypeSet *obj) {
+        return true;
+    }
     virtual MIRType elementWrite(RawScript script, jsbytecode *pc) {
         return MIRType_None;
     }
 
     /* |pc| must be a |JSOP_CALL|. */
     virtual types::StackTypeSet *getCallTarget(RawScript caller, uint32_t argc, jsbytecode *pc) {
         // Same assertion as TypeInferenceOracle::getCallTarget.
         JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE && JSOp(*pc) != JSOP_EVAL);
@@ -283,16 +286,17 @@ class TypeInferenceOracle : public TypeO
     bool elementWriteNeedsDoubleConversion(RawScript script, jsbytecode *pc);
     bool elementWriteHasExtraIndexedProperty(RawScript script, jsbytecode *pc);
     bool elementWriteIsPacked(RawScript script, jsbytecode *pc);
     bool arrayResultShouldHaveDoubleConversion(RawScript script, jsbytecode *pc);
     bool setElementHasWrittenHoles(RawScript script, jsbytecode *pc);
     bool propertyWriteCanSpecialize(RawScript script, jsbytecode *pc);
     bool propertyWriteNeedsBarrier(RawScript script, jsbytecode *pc, RawId id);
     bool elementWriteNeedsBarrier(RawScript script, jsbytecode *pc);
+    bool elementWriteNeedsBarrier(types::StackTypeSet *obj);
     MIRType elementWrite(RawScript script, jsbytecode *pc);
     bool canInlineCall(HandleScript caller, jsbytecode *pc);
     types::TypeBarrier *callArgsBarrier(HandleScript caller, jsbytecode *pc);
     bool canEnterInlinedFunction(RawFunction callee);
     bool callReturnTypeSetMatches(RawScript callerScript, jsbytecode *callerPc, RawFunction callee);
     bool callArgsTypeSetIntersects(types::StackTypeSet *thisType, Vector<types::StackTypeSet *> &argvType, RawFunction callee);
     bool callArgsTypeSetMatches(types::StackTypeSet *thisType, Vector<types::StackTypeSet *> &argvType, RawFunction callee);
     types::StackTypeSet *aliasedVarBarrier(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier);
@@ -411,9 +415,8 @@ IsNullOrUndefined(MIRType type)
 {
     return type == MIRType_Null || type == MIRType_Undefined;
 }
 
 } /* ion */
 } /* js */
 
 #endif // js_ion_type_oracle_h__
-