new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/scalar-replacement-bug1138693.js
@@ -0,0 +1,19 @@
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+function check(v) {
+    return v.toSource();
+}
+function test() {
+    var fake = { toSource: ST.toSource };
+    try {
+        check(fake);
+    } catch (e) {}
+}
+test();
+var uint8 = TypedObject.uint8;
+function runTests() {
+  uint8.toSource();
+}
+runTests();
+test();
+

--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -486,16 +486,18 @@ ObjectMemoryView::visitStoreFixedSlot(MS
         return;
 
     // Clone the state and update the slot value.
     if (state_->hasFixedSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         state_->setFixedSlot(ins->slot(), ins->value());
         ins->block()->insertBefore(ins->toInstruction(), state_);
     } else {
+        // UnsafeSetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
@@ -505,16 +507,18 @@ ObjectMemoryView::visitLoadFixedSlot(MLo
     // Skip loads made on other objects.
     if (ins->object() != obj_)
         return;
 
     // Replace load by the slot value.
     if (state_->hasFixedSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getFixedSlot(ins->slot()));
     } else {
+        // UnsafeGetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
         ins->replaceAllUsesWith(undefinedVal_);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
@@ -542,16 +546,18 @@ ObjectMemoryView::visitStoreSlot(MStoreS
     }
 
     // Clone the state and update the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         state_->setDynamicSlot(ins->slot(), ins->value());
         ins->block()->insertBefore(ins->toInstruction(), state_);
     } else {
+        // UnsafeSetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
@@ -565,16 +571,18 @@ ObjectMemoryView::visitLoadSlot(MLoadSlo
         MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
         return;
     }
 
     // Replace load by the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getDynamicSlot(ins->slot()));
     } else {
+        // UnsafeGetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
         ins->replaceAllUsesWith(undefinedVal_);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }