diff --git a/js/src/jit-test/tests/basic/bug757199.js b/js/src/jit-test/tests/basic/bug757199.js
new file mode 100644
index 00000000000..c8c7e99d603
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug757199.js
@@ -0,0 +1,23 @@
+function ctor()
+{
+    this.a = 1;
+    this.b = 2;
+}
+function f2(o)
+{
+    o.c = 12;
+}
+function f()
+{
+    var x = new ctor();
+    verifybarriers();
+    f2(x);
+    verifybarriers();
+}
+f();
+f();
+var o = {};
+for (var i=0; i<1000; i++)
+    o['a'+i] = 3;
+f();
+f();
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index ff72f3b31a1..ed2004e562c 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -560,6 +560,15 @@ class SetPropCompiler : public PICStubCompiler
             if (obj->numDynamicSlots() != slots)
                 return disable("insufficient slot capacity");
 
+#ifdef JSGC_INCREMENTAL_MJ
+            /*
+             * Since we're changing the object's shape, we need a write
+             * barrier. Taking the slow path is the easiest way to get one.
+             */
+            if (cx->compartment->needsBarrier())
+                return disable("ADDPROP write barrier required");
+#endif
+
             if (pic.typeMonitored && !updateMonitoredTypes())
                 return Lookup_Uncacheable;