--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -265,24 +265,28 @@ IsCacheableGetProp(JSObject *obj, JSObje
             IsCacheableProtoChain(obj, holder) &&
             shape->hasSlot() &&
             shape->hasDefaultGetter());
 }
 
 bool
 js::ion::GetPropertyCache(JSContext *cx, size_t cacheIndex, JSObject *obj, Value *vp)
 {
-    JSScript *script = GetTopIonJSScript(cx);
-    IonScript *ion = script->ionScript();
+    JSScript *topScript = GetTopIonJSScript(cx);
+    IonScript *ion = topScript->ionScript();
 
     IonCacheGetProperty &cache = ion->getCache(cacheIndex).toGetProperty();
     JSAtom *atom = cache.atom();
 
+    JSScript *script;
+    jsbytecode *pc;
+    cache.getScriptedLocation(&script, &pc);
+
     // Override the return value if we are invalidated (bug 728188).
-    AutoDetectInvalidation adi(cx, vp, script);
+    AutoDetectInvalidation adi(cx, vp, topScript);
 
     // For now, just stop generating new stubs once we hit the stub count
     // limit. Once we can make calls from within generated stubs, a new call
     // stub will be generated instead and the previous stubs unlinked.
     if (cache.stubCount() < MAX_STUBS && obj->isNative()) {
         cache.incrementStubCount();
 
         jsid id = ATOM_TO_JSID(atom);
@@ -295,25 +299,21 @@ js::ion::GetPropertyCache(JSContext *cx,
 
         const Shape *shape = (const Shape *)prop;
         if (IsCacheableGetProp(obj, holder, shape)) {
             if (!cache.attachNative(cx, obj, holder, shape))
                 return false;
         }
     }
 
-    if (!obj->getGeneric(cx, obj, ATOM_TO_JSID(atom), vp))
+    if (!GetPropertyOperation(cx, pc, ObjectValue(*obj), vp))
         return false;
 
-    {
-        JSScript *script;
-        jsbytecode *pc;
-        cache.getScriptedLocation(&script, &pc);
-        types::TypeScript::Monitor(cx, script, pc, *vp);
-    }
+    // Monitor changes to cache entry.
+    types::TypeScript::Monitor(cx, script, pc, *vp);
 
     return true;
 }
 
 void
 IonCache::updateBaseAddress(IonCode *code, MacroAssembler &masm)
 {
     initialJump_.repoint(code, &masm);