new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/xdr/tagged-template-literals-2.js
@@ -0,0 +1,4 @@
+var code = cacheEntry("(x => x.toSource())`bar`;");
+var g = newGlobal({ cloneSingletons: true });
+assertEq("[\"bar\"]", evaluate(code, { global: g, saveBytecode: true }));
+assertEq("[\"bar\"]", evaluate(code, { global: g, loadBytecode: true }));

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/xdr/tagged-template-literals.js
@@ -0,0 +1,4 @@
+var code = cacheEntry("assertEq('bar', String.raw`bar`);");
+var g = newGlobal({ cloneSingletons: true });
+evaluate(code, { global: g, saveBytecode: true });
+evaluate(code, { global: g, loadBytecode: true })

--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1144,48 +1144,25 @@ js::CloneObject(JSContext* cx, HandleObj
     return clone;
 }
 
 static bool
 GetScriptArrayObjectElements(JSContext* cx, HandleObject obj, MutableHandle<GCVector<Value>> values)
 {
     MOZ_ASSERT(!obj->isSingleton());
     MOZ_ASSERT(obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>());
+    MOZ_ASSERT(!obj->isIndexed());
 
     size_t length = GetAnyBoxedOrUnboxedArrayLength(obj);
     if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), length))
         return false;
 
-    if (obj->nonProxyIsExtensible()) {
-        MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().slotSpan() == 0);
-
-        size_t initlen = GetAnyBoxedOrUnboxedInitializedLength(obj);
-        for (size_t i = 0; i < initlen; i++)
-            values[i].set(GetAnyBoxedOrUnboxedDenseElement(obj, i));
-    } else {
-        // Call site objects are frozen before they escape to script, which
-        // converts their dense elements into data properties.
-        ArrayObject* aobj = &obj->as<ArrayObject>();
-        for (Shape::Range<NoGC> r(aobj->lastProperty()); !r.empty(); r.popFront()) {
-            Shape& shape = r.front();
-            if (shape.propid() == NameToId(cx->names().length))
-                continue;
-            MOZ_ASSERT(shape.isDataDescriptor());
-
-            // The 'raw' property is added before freezing call site objects.
-            // After an XDR or deep clone the script object will no longer be
-            // frozen, and the two objects will be connected again the first
-            // time the JSOP_CALLSITEOBJ executes.
-            if (shape.propid() == NameToId(cx->names().raw))
-                continue;
-
-            uint32_t index = JSID_TO_INT(shape.propid());
-            values[index].set(aobj->getSlot(shape.slot()));
-        }
-    }
+    size_t initlen = GetAnyBoxedOrUnboxedInitializedLength(obj);
+    for (size_t i = 0; i < initlen; i++)
+        values[i].set(GetAnyBoxedOrUnboxedDenseElement(obj, i));
 
     return true;
 }
 
 static bool
 GetScriptPlainObjectProperties(JSContext* cx, HandleObject obj,
                                MutableHandle<IdValueVector> properties)
 {