diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 6e86a976ed9..7978d1143f9 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -1747,10 +1747,15 @@ bool DoSpreadCallFallback(JSContext* cx, BaselineFrame* frame,
   // Transition stub state to megamorphic or generic if warranted.
   MaybeTransition(cx, frame, stub);
 
+  // The array is required to be packed, but may have indexed properties
+  // if its length exceeds MAX_DENSE_ELEMENTS_COUNT. Don't optimize in
+  // that case.
+  bool isIndexed = arr.toObject().as<NativeObject>().isIndexed();
+
   // Try attaching a call stub.
   bool handled = false;
   if (op != JSOp::SpreadEval && op != JSOp::StrictSpreadEval &&
-      stub->state().canAttachStub()) {
+      stub->state().canAttachStub() && !isIndexed) {
     // Try CacheIR first:
     Rooted<ArrayObject*> aobj(cx, &arr.toObject().as<ArrayObject>());
     MOZ_ASSERT(IsPackedArray(aobj));
diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
index 064f3d3a7b0..10a90ad6e9f 100644
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -6342,7 +6342,9 @@ ObjOperandId InlinableNativeIRGenerator::emitLoadArgsArray() {
   MOZ_ASSERT(!hasBoundArguments());
 
   if (flags_.getArgFormat() == CallFlags::Spread) {
-    return writer.loadSpreadArgs();
+    ObjOperandId result = writer.loadSpreadArgs();
+    writer.guardArrayIsPacked(result);
+    return result;
   }
 
   MOZ_ASSERT(flags_.getArgFormat() == CallFlags::FunApplyArray);
diff --git a/js/src/jit-test/tests/bug2068385.js b/js/src/jit-test/tests/bug2068385.js
new file mode 100644
index 00000000000..8b55edc1512
--- /dev/null
+++ b/js/src/jit-test/tests/bug2068385.js
@@ -0,0 +1,7 @@
+// |jit-test| slow
+
+try {
+  var ta = new Uint8Array(268435456 + 4096);
+  function g(x) { return Math.max(...x); }
+  print(g(ta));
+} catch {}

diff --git a/js/src/jit-test/tests/bug2068385.js b/js/src/jit-test/tests/bug2068385.js
new file mode 100644
index 00000000000..8b55edc1512
--- /dev/null
+++ b/js/src/jit-test/tests/bug2068385.js
@@ -0,0 +1,7 @@
+// |jit-test| slow
+
+try {
+  var ta = new Uint8Array(268435456 + 4096);
+  function g(x) { return Math.max(...x); }
+  print(g(ta));
+} catch {}