--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -4625,17 +4625,16 @@ IonBuilder::jsop_not()
 
 
 inline bool
 IonBuilder::TestCommonPropFunc(JSContext *cx, types::TypeSet *types, HandleId id,
                    JSFunction **funcp, bool isGetter)
 {
     JSObject *found = NULL;
     JSObject *foundProto = NULL;
-    Shape *protoShape = NULL;
 
     *funcp = NULL;
 
     // No sense looking if we don't know what's going on.
     if (!types || types->unknownObject())
         return true;
 
     // Iterate down all the types to see if they all have the same getter or
@@ -4702,34 +4701,33 @@ IonBuilder::TestCommonPropFunc(JSContext
         if (!found)
             found = curFound;
         else if (found != curFound)
             return true;
 
         // We only support cases with a single prototype shared. This is
         // overwhelmingly more likely than having multiple different prototype
         // chains with the same custom property function.
-        if (!foundProto) {
+        if (!foundProto)
             foundProto = proto;
-            protoShape = shape;
-        } else if (foundProto != proto)
+        else if (foundProto != proto)
             return true;
     }
 
     // No need to add a freeze if we didn't find anything
     if (!found)
         return true;
 
-    JS_ASSERT(foundProto && protoShape);
+    JS_ASSERT(foundProto);
 
     types->addFreeze(cx);
 
     MInstruction *wrapper = MConstant::New(ObjectValue(*foundProto));
     current->add(wrapper);
-    MGuardShape *guard = MGuardShape::New(wrapper, protoShape);
+    MGuardShape *guard = MGuardShape::New(wrapper, foundProto->lastProperty());
     current->add(guard);
 
     // Now we have to freeze all the property typesets to ensure there isn't a
     // lower shadowing getter or setter installed in the future.
     types::TypeObject *curType;
     for (unsigned i = 0; i < types->getObjectCount(); i++) {
         curType = types->getTypeObject(i);