diff --git a/js/src/jit-test/tests/basic/bug951346.js b/js/src/jit-test/tests/basic/bug951346.js
new file mode 100644
index 00000000000..2034d6ba0f8
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug951346.js
@@ -0,0 +1,3 @@
+
+setObjectMetadataCallback(function(obj) {});
+eval(uneval({'-1':true}));
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index da9d2bc1b6c..a3450af894d 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2603,7 +2603,12 @@ TypeCompartment::fixObjectType(ExclusiveContext *cx, JSObject *obj)
      */
     JS_ASSERT(obj->is<JSObject>());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
+    /*
+     * Exclude some objects we can't readily associate common types for based on their
+     * shape. Objects with metadata are excluded so that the metadata does not need to
+     * be included in the table lookup (the metadata object might be in the nursery).
+     */
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements() || obj->getMetadata())
         return;
 
     Vector<IdValuePair> properties(cx);