diff --git a/compiler/dex/quick/quick_compiler.cc b/compiler/dex/quick/quick_compiler.cc
index 2523a83..28c485a 100644
--- a/compiler/dex/quick/quick_compiler.cc
+++ b/compiler/dex/quick/quick_compiler.cc
@@ -33,6 +33,7 @@
 #include "dex/pass_driver_me_post_opt.h"
 #include "dex/pass_manager.h"
 #include "dex/quick/mir_to_lir.h"
+#include "dex/verified_method.h"
 #include "driver/compiler_driver.h"
 #include "driver/compiler_options.h"
 #include "elf_writer_quick.h"
@@ -661,6 +662,10 @@
     return nullptr;
   }
 
+  if (driver->GetVerifiedMethod(&dex_file, method_idx)->HasRuntimeThrow()) {
+    return nullptr;
+  }
+
   DCHECK(driver->GetCompilerOptions().IsCompilationEnabled());
 
   Runtime* const runtime = Runtime::Current();
diff --git a/compiler/dex/verified_method.cc b/compiler/dex/verified_method.cc
index 8a009cb..273b1628 100644
--- a/compiler/dex/verified_method.cc
+++ b/compiler/dex/verified_method.cc
@@ -41,6 +41,7 @@
                                              bool compile) {
   std::unique_ptr<VerifiedMethod> verified_method(new VerifiedMethod);
   verified_method->has_verification_failures_ = method_verifier->HasFailures();
+  verified_method->has_runtime_throw_ = method_verifier->HasInstructionThatWillThrow();
   if (compile) {
     /* Generate a register map. */
     if (!verified_method->GenerateGcMap(method_verifier)) {
diff --git a/compiler/dex/verified_method.h b/compiler/dex/verified_method.h
index 07f9a9b..bf11839 100644
--- a/compiler/dex/verified_method.h
+++ b/compiler/dex/verified_method.h
@@ -75,6 +75,10 @@
     return has_verification_failures_;
   }
 
+  bool HasRuntimeThrow() const {
+    return has_runtime_throw_;
+  }
+
   void SetStringInitPcRegMap(SafeMap<uint32_t, std::set<uint32_t>>& string_init_pc_reg_map) {
     string_init_pc_reg_map_ = string_init_pc_reg_map;
   }
@@ -121,6 +125,7 @@
   SafeCastSet safe_cast_set_;
 
   bool has_verification_failures_ = false;
+  bool has_runtime_throw_ = false;
 
   // Copy of mapping generated by verifier of dex PCs of string init invocations
   // to the set of other registers that the receiver has been copied into.
diff --git a/compiler/optimizing/optimizing_compiler.cc b/compiler/optimizing/optimizing_compiler.cc
index 1466366..1944ba6 100644
--- a/compiler/optimizing/optimizing_compiler.cc
+++ b/compiler/optimizing/optimizing_compiler.cc
@@ -677,7 +677,8 @@
                                             const DexFile& dex_file) const {
   CompilerDriver* compiler_driver = GetCompilerDriver();
   CompiledMethod* method = nullptr;
-  if (compiler_driver->IsMethodVerifiedWithoutFailures(method_idx, class_def_idx, dex_file)) {
+  if (compiler_driver->IsMethodVerifiedWithoutFailures(method_idx, class_def_idx, dex_file) &&
+      !compiler_driver->GetVerifiedMethod(&dex_file, method_idx)->HasRuntimeThrow()) {
      method = TryCompile(code_item, access_flags, invoke_type, class_def_idx,
                          method_idx, jclass_loader, dex_file);
   } else {
diff --git a/runtime/verifier/method_verifier.cc b/runtime/verifier/method_verifier.cc
index 5d685da..5ba0f4b 100644
--- a/runtime/verifier/method_verifier.cc
+++ b/runtime/verifier/method_verifier.cc
@@ -3778,6 +3778,7 @@
   } else {
     const RegType& array_type = work_line_->GetRegisterType(this, inst->VRegB_23x());
     if (array_type.IsZero()) {
+      have_pending_runtime_throw_failure_ = true;
       // Null array class; this code path will fail at runtime. Infer a merge-able type from the
       // instruction type. TODO: have a proper notion of bottom here.
       if (!is_primitive || insn_type.IsCategory1Types()) {
diff --git a/runtime/verifier/method_verifier.h b/runtime/verifier/method_verifier.h
index 994616f..d7ddd67 100644
--- a/runtime/verifier/method_verifier.h
+++ b/runtime/verifier/method_verifier.h
@@ -254,6 +254,10 @@
   bool HasCheckCasts() const;
   bool HasVirtualOrInterfaceInvokes() const;
   bool HasFailures() const;
+  bool HasInstructionThatWillThrow() const {
+    return have_pending_runtime_throw_failure_;
+  }
+
   const RegType& ResolveCheckedClass(uint32_t class_idx)
       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
   // Returns the method of a quick invoke or null if it cannot be found.
diff --git a/test/518-null-array-get/expected.txt b/test/518-null-array-get/expected.txt
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/test/518-null-array-get/expected.txt
diff --git a/test/518-null-array-get/info.txt b/test/518-null-array-get/info.txt
new file mode 100644
index 0000000..407f590
--- /dev/null
+++ b/test/518-null-array-get/info.txt
@@ -0,0 +1,3 @@
+Regression test for Quick and Optimizing that used
+to crash on an aget-object + int-to-byte sequence
+(accepted by the verifier in the case the array was null).
diff --git a/test/518-null-array-get/smali/NullArray.smali b/test/518-null-array-get/smali/NullArray.smali
new file mode 100644
index 0000000..52abc38
--- /dev/null
+++ b/test/518-null-array-get/smali/NullArray.smali
@@ -0,0 +1,26 @@
+# Copyright (C) 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+.class public LNullArray;
+
+.super Ljava/lang/Object;
+
+.method public static method()B
+   .registers 2
+   const/4 v0, 0
+   const/4 v1, 0
+   aget-object v0, v0, v1
+   int-to-byte v0, v0
+   return v0
+.end method
diff --git a/test/518-null-array-get/src/Main.java b/test/518-null-array-get/src/Main.java
new file mode 100644
index 0000000..66e50aa
--- /dev/null
+++ b/test/518-null-array-get/src/Main.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+
+public class Main {
+  // Workaround for b/18051191.
+  class InnerClass {}
+
+  public static void main(String[] args) throws Exception {
+    Class<?> c = Class.forName("NullArray");
+    Method m = c.getMethod("method");
+    Object[] arguments = { };
+    try {
+      m.invoke(null, arguments);
+      throw new Error("Expected an InvocationTargetException");
+    } catch (InvocationTargetException e) {
+      if (!(e.getCause() instanceof NullPointerException)) {
+        throw new Error("Expected a NullPointerException");
+      }
+    }
+  }
+}