diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 5c15111eb47..fd04506820a 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1752,18 +1752,19 @@ HeapTypeSetKey::constant(CompilerConstraintList *constraints, Value *valOut)
     if (nonData(constraints))
         return false;
 
-    // Only singleton object properties can be marked as constants.
-    if (!object()->singleton())
+    if (!maybeTypes())
         return false;
 
-    if (maybeTypes() && maybeTypes()->nonConstantProperty())
+    if (maybeTypes()->nonConstantProperty())
         return false;
 
+    // Only singleton object properties can be marked as constants.
+    JS_ASSERT(object()->singleton());
+
     // Get the current value of the property.
     Shape *shape = object()->singleton()->nativeLookupPure(id());
-    if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot() || shape->hadOverwrite())
+    if (!shape)
         return false;
-
     Value val = object()->singleton()->nativeGetSlot(shape->slot());
 
     // If the value is a pointer to an object in the nursery, don't optimize.