--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -6067,29 +6067,29 @@ class ICCall_ScriptedFunCall : public IC
 class ICCall_StringSplit : public ICMonitoredStub
 {
     friend class ICStubSpace;
 
   protected:
     uint32_t pcOffset_;
     HeapPtrString expectedThis_;
     HeapPtrString expectedArg_;
-    HeapPtrObject templateObject_;
+    HeapPtrNativeObject templateObject_;
 
     ICCall_StringSplit(JitCode *stubCode, ICStub *firstMonitorStub, uint32_t pcOffset, HandleString thisString,
-                       HandleString argString, HandleObject templateObject)
+                       HandleString argString, HandleNativeObject templateObject)
       : ICMonitoredStub(ICStub::Call_StringSplit, stubCode, firstMonitorStub),
         pcOffset_(pcOffset), expectedThis_(thisString), expectedArg_(argString),
         templateObject_(templateObject)
     { }
 
   public:
     static inline ICCall_StringSplit *New(ICStubSpace *space, JitCode *code,
                                           ICStub *firstMonitorStub, uint32_t pcOffset, HandleString thisString,
-                                          HandleString argString, HandleObject templateObject)
+                                          HandleString argString, HandleNativeObject templateObject)
     {
         if (!code)
             return nullptr;
         return space->allocate<ICCall_StringSplit>(code, firstMonitorStub, pcOffset, thisString,
                                                    argString, templateObject);
     }
 
     static size_t offsetOfExpectedThis() {
@@ -6107,43 +6107,43 @@ class ICCall_StringSplit : public ICMoni
     HeapPtrString &expectedThis() {
         return expectedThis_;
     }
 
     HeapPtrString &expectedArg() {
         return expectedArg_;
     }
 
-    HeapPtrObject &templateObject() {
+    HeapPtrNativeObject &templateObject() {
         return templateObject_;
     }
 
     class Compiler : public ICCallStubCompiler {
       protected:
         ICStub *firstMonitorStub_;
         uint32_t pcOffset_;
         RootedString expectedThis_;
         RootedString expectedArg_;
-        RootedObject templateObject_;
+        RootedNativeObject templateObject_;
 
         bool generateStubCode(MacroAssembler &masm);
 
         virtual int32_t getKey() const {
             return static_cast<int32_t>(kind);
         }
 
       public:
         Compiler(JSContext *cx, ICStub *firstMonitorStub, uint32_t pcOffset, HandleString thisString,
                  HandleString argString, HandleValue templateObject)
           : ICCallStubCompiler(cx, ICStub::Call_StringSplit),
             firstMonitorStub_(firstMonitorStub),
             pcOffset_(pcOffset),
             expectedThis_(cx, thisString),
             expectedArg_(cx, argString),
-            templateObject_(cx, &templateObject.toObject())
+            templateObject_(cx, &templateObject.toObject().as<NativeObject>())
         { }
 
         ICStub *getStub(ICStubSpace *space) {
             return ICCall_StringSplit::New(space, getStubCode(), firstMonitorStub_,
                                            pcOffset_, expectedThis_, expectedArg_,
                                            templateObject_);
         }
    };

--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -445,16 +445,18 @@ BaselineInspector::getTemplateObjectForN
 {
     if (!hasBaselineScript())
         return nullptr;
 
     const ICEntry &entry = icEntryFromPC(pc);
     for (ICStub *stub = entry.firstStub(); stub; stub = stub->next()) {
         if (stub->isCall_Native() && stub->toCall_Native()->callee()->native() == native)
             return stub->toCall_Native()->templateObject();
+        if (stub->isCall_StringSplit() && native == js::str_split)
+            return stub->toCall_StringSplit()->templateObject();
     }
 
     return nullptr;
 }
 
 DeclEnvObject *
 BaselineInspector::templateDeclEnvObject()
 {