--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -1030,16 +1030,20 @@ TraceRecorder::checkType(jsval& v, uint8
     if (t == TYPEMAP_TYPE_ANY) /* ignore unused slots */
         return true;
     if (isNumber(v)) {
         /* Initially we start out all numbers as JSVAL_DOUBLE in the type map. If we still
            see a number in v, its a valid trace but we might want to ask to demote the
            slot if we know or suspect that its integer. */
         LIns* i = get(&v);
         if (TYPEMAP_GET_TYPE(t) == JSVAL_DOUBLE) {
+            /* BUG: We can't specialize once the primary trace has been compiled since
+               we would have to recompile it. */
+            if (fragment->root != fragment)
+                return true;
             /* Don't type specialize really long traces (we count the number of guards in them). */
             if (DEMOTE_THRESHOLD > 0 && guardCount > DEMOTE_THRESHOLD)
                 return true;
             if (isInt32(v) && !TYPEMAP_GET_FLAG(t, TYPEMAP_FLAG_DONT_DEMOTE)) {
                 /* If the value associated with v via the tracker comes from a i2f operation,
                    we can be sure it will always be an int. If we see INCVAR, we similarly
                    speculate that the result will be int, even though this is not
                    guaranteed and this might cause the entry map to mismatch and thus